What Can I Do About Poorly Handled Data Theft? 53
Embarrassed UTA Alumnus writes "My former college, the University of Texas at Arlington, just made the now-all-to-common announcement that student data — including Social Security numbers, e-mail addresses, grades, and other information — were on several recently stolen personal computers. The computers were from the home of a Computer Science lecturer, and perhaps more worrisome was the fact that they were the only stolen items in the incident. I had the displeasure of taking one of the lecturer's courses a few years ago, and anyone from his courses since the year 2000 is affected. In response, UTA is providing free 90-day 'fraud monitoring' (not full credit reports), and no disciplinary action has been taken against the lecturer who lost the data."
In situations like this, what can a student do when a large institution loses critical private information, makes only a token effort to fix the problem, and lets the people involved continue in practices that may make a similar, or more serious breach occur in the future?
"The data was not encrypted. The lecturer in question is one of the CS faculty at UTA who all conveniently guarded one another, so I guess I shouldn't expect more from him in that area. More importantly though, no one should have had this data on their personal computers, and Social Security numbers should not have been included at all. Furthermore, even without the concern of theft, I seriously question the need for years-old private student data. It is suspicious at the very least.
The UTA PR department is already trying to bury the issue with vague claims of new efforts to hire a system-wide CIO who would be responsible for all 15 UT system campuses. The lecturer in question responded to the student newspaper with 'no comment' each time they attempt to interview him.
I feel like the university should do more, including seeking disciplinary action against all involved. What can I do, short of keeping an eye on my credit and letting the school get away with yet another blunder?"
The UTA PR department is already trying to bury the issue with vague claims of new efforts to hire a system-wide CIO who would be responsible for all 15 UT system campuses. The lecturer in question responded to the student newspaper with 'no comment' each time they attempt to interview him.
I feel like the university should do more, including seeking disciplinary action against all involved. What can I do, short of keeping an eye on my credit and letting the school get away with yet another blunder?"
Obviously (Score:5, Funny)
Only downside is eventually having to explain the diploma in the name of "Nospamplease Fuckoff" proudly displayed on your wall.
Re: (Score:2)
If you can afford a lawyer, I'd file a civil negligence suit against the lecturer and the school. Don't ask for "eleventy billion dollars" or anything that would make you out as somebody looking to score an easy buck; rather, ask for an amount that would cover your legal costs and time (as well as any real damage caused by the theft) and ask for real assurances that it won't happen again. If you know several people involved, share the lawyer expe
Why do professors need SSN? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
But you are exactly right, they should never use SSNs as student ID's, and there should be an IT policy to keep that stuff encrypted for all the other professors in other departments who are unlikely to be as clued in to computer security as this CS professor SHOULD have been.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
It's worse than that. I'm currently a UTA grad student. Until this year, UTA student IDs were the same as your SSN, unless you specifically requested a different number. Starting in the summer session of 2006, all new student IDs are now a 10-digit number unrelated to your SSN. So until this year, UTA professors had to have access to SSNs because there was no other way to do it. Don't
Re: (Score:2)
Re: (Score:1)
Anyways, to address your concerns...
The school had until very very recently (ie, '06 I think) had the standard practice of using SSNs as student IDs and made it a rather difficult prolonged process to get an alternative ID (I know, I tried, I gave up). This would be why SSNs are included in the stolen records. Blame the school in this case, not the prof.
Additionally, from my understanding, professors are supposed to be keeping grades for at least 5 years follo
Re: (Score:1)
Re: (Score:1)
That's all? (Score:1)
Short of screaming and crying at the top of your voice, there is nothing you can do.
Re: (Score:2)
Whether it will be worth the time and money involved, well, that is another question.
IANAL but... (Score:3, Insightful)
Re: (Score:3, Informative)
I agree, see if you can get a case. See if you can get it class action. Breach of privacy, lack of due diligence, there has got to be more than a few regulations that were broken. When I worked as a student aid at my college I had to sign paperwork and read some laws about how to handle student data to prevent all this kind of stuff. He should be liable under those laws (as should the school).
I'm not a lawyer, but I bet you can find one that will take your case.
School respond to two things: lawyers and mo
Re: (Score:2)
Re: (Score:2)
If, a year or two from now, a mortgage default suddenly appears on your credit report you need to be sure that you can take that back to the college, not have them wiggle out of liability because you did something wrong in the interim.
Write a letter to the Student Newspaper (Score:2)
Re: (Score:2)
Didn't read the summary (Score:2, Funny)
possible actions (Score:4, Informative)
Seeing as most of the administration sees information loss as nothing more than a potential liability to them, you need to make it clear to the University top administration that this gaffe is totally unacceptable. They need to understand how bad this is -- and that it will affect their alumni fund drives.
I'm assuming that you're fully aware of the potential problems, and how serious they are (why else would you be asking the question). You need to inform the administration, by letter (make sure you cc: your local newspapers and television station(s), and follow up with them to try to get somre more negative publicity for the U), just how serious it is.
One other thing you can do (from an OU mishap [merit.edu]):
publich the presidents & regents SS numbers (Score:4, Interesting)
If they are that sloppy, then these numbers should be easy to get. And it "cant be wrong" because the administration let your number get out.
Common sense (Score:2, Insightful)
Figure out what you want and then ask for it (Score:2, Insightful)
The professor can't retroactively encrypt the data, nor can anybody unsteal the computers that contained it.
The only thing you mention is that you want to see the professor disciplined. Will this bring your data back? Will you benefit from the discipline of a professor whose class you took years ago?
What more do you want the school to do for you? You mentioned that you felt 90 days of credit monitoring was
Re: (Score:2)
One answer to that would be "to make sure it doesn't happen again in the future." The best way to ensure that is to make sure all the other professors know that they'll be fired (regardless of tenure) if they do such a thing in the future, and the only way to demonstrate that is by firing this professor now.
Re: (Score:1)
You really don't know how it works, do you? It is NEARLY impossible to fire a tenured professor. In fact, in order to fire this one, he would have to be actively using or selling the SSNs.
Even wors
Re: (Score:2)
No, I don't care how it works. I care about how it should work, and how it should work is that no amount of tenure or anything else should excuse someone from committing gross negligence such as this!
It is a violation of FERPA (Score:5, Informative)
Sera
Re: (Score:2)
Possible responses (Score:2)
If that doesn't work, you have other options. Organizations respond to three things:
1) Threats to their existence
2) Threats to their finances
3) Threats to their reputation
As for item 1 - I'm not referring to nu
Why give them your SSN? (Score:3, Insightful)
Seriously. Nobody but your bank and employer need your SSN, and it's not supposed to be used for non-Social Security identification purposes anyway. Why people insist on using it as such, and why people still freely give it away just boggles my mind.
Re: (Score:1)
Re: (Score:1)
The instructor still didn't need the information to conduct his daily business.
Re: (Score:2)
Do this anywhere on forms you know don't need an SSN - typically anything not being used
UTA Knew About Data Security Problems, Did Nothing (Score:4, Informative)
Perhaps the most frustrating was when my name, phone number, dorm room number and Social Security Number were PUBLISHED ON THE INTERNET. This was in Feb 2003. The university was notified, they eventually took down the webpages that had been indexed by Google (searching for someone's name who lived anywhere on campus at UTA resulted in their social security number popping up in a result on Google. How handy!) and they engaged in massive spin-control.
After it happened, it became fairly public knowledge that UTA used your social security number as your student id, and that your student id was actually encoded in plaintext on your student id card. Lose your student id card, lose your social security number.
The University of Texas System made some system-wide rules after another data security incident occurred shortly thereafter at the University of Texas at Austin. Schools were no longer to release social security numbers to professors, since they had no need for it, and all schools in the UT System were to stop using social security numbers as identifiers within a year or two. This deadline was continually extended, until they finally set it at September 2007.
UTA knew that too many people had access to students social security numbers; indeed, the school newspaper has over 92 articles concerning the school's use of social security numbers, the questionable legality of such use and the dangers (ref.: http://search.yahoo.com/search?p=social+security+
My social was also one of the ID #'s that were stolen in this theft. I too, was appalled at how UTA handled this. Originally, the notification on UTA's website said that the Office of Information Technology would have a form you could fill out giving them your email address and asking them to check if you were affected; the notification was later edited to say that you must call the University's registrar's office and update your address, email address and phone number if you wanted them to contact you - clearly an effort to update the records of the Office of Development so that they could get your current address to begin spamming you about their new fundraising campaigns. And the "discounted" identity monitoring service...from a company I've never even heard of? Nice, UTA. Makes me so proud to call UTA my alma matter.
I honestly think there's enough here for a lawsuit, and would love to participate in it. Anyone heard anything about a suit, or considering one?
credit agencies are at fault here (Score:3, Insightful)
The contents of the average credit report amount to unsubstantiated slander. It's tremendously easy for smudges to accumulate, with little effective recourse. In any other life circumstance, the same poor, fragmentary, and unsubstantiated quality of information about a person's status and character would be open to action as libelous.
I think the credit reporting agencies should be made libel for reporting negative information about any person as a result of criminal credential fraud. Even our terminology is wrong: we are talking about the theft of credentials not personal identity. An identity can't be stolen. Only the credentials are subject to third party manipulation. The institutions who choose to accept credentials as evidence of an identity should be prepared to bear the cost of their own mistakes.
And the worst of it is that our existing credentials are designed by baboons. It's not humanly possible to protect credentials you hand to every teenage till monkey five times a day.
We all know the truism that when you hear one person criticize another, it says as much about the person making the criticism as it does about the person being criticized. Yet the credit reporting agencies are somehow given a free pass which I've never understood. Might it be that a bad credit report reflects bad credit reporting practice? I guess we're so overwhelmed by our powerlessness in that relationship (my god, even more powerful than Miss Wormwood) that you rarely hear it suggested that perhaps the credit agencies themselves are no better than ICANN or VeriSign.
I would love to see this case (Score:2)
If "Credit Agency X" reports you as being unreliable due to actions "Y" and "Z", and you did not commit said actions, could that not be construed as libel or defamation?
It falls pretty damn close to the definition in Webster's dictionary of law:
Communication to third parties of false statements about a person that injure the reputation of or deter others from associating with that person
When I can't take out a mortgage because credit reporting company X has infor
Push your Senator for DP laws (Score:2)
IMHO until this gets fixed you're with luck on any redress.
What you should really do... (Score:2)
Worrisome? (Score:2)
So somehow you would feel better if the TV and Microwave were also stolen?