July 24, 2007

Social Security Numbers putting Faculty and Students at Risk?

Posted in Misc at 11:47 AM by Joe From Boston

Here’s an interesting article from Inside Higher Ed that discusses how Social Security Numbers collected by colleges and universities – often required by law – are putting their own faculty and students at risk.

Moving Away From Social Security Numbers

All across the country, colleges and universities are putting their students, faculty and staff at risk for identity theft, just by collecting Social Security numbers, even when necessary by law.

In late March, a University of California at San Francisco server that stored the names, contact information and Social Security numbers of about 3,000 cancer study subjects and potential subjects was stolen from a locked office. In May, the names and Social Security numbers of almost 90,000 people associated with the State University of New York at Stony Brook were accidentally posted on a publicly accessible Web site.In the last few years, dozens of institutions, including New York University, Northwestern University, Ohio University, the University of California at Los Angeles and Utah Valley State College, have reported security breaches involving thousands of Social Security numbers each.

As the fall term approaches, some institutions across the country are making the final push to convert campus identification systems from Social Security numbers to randomly assigned numbers in time for the start of classes.

The American Association of Collegiate Registrars and Admissions Officers last released a study on the use of Social Security numbers in 2002.

As of 2001, 50 percent of the 1,036 responding institutions reported using Social Security numbers as the primary identification number, while 41 percent said they assigned identification numbers to students that were independent of their social security numbers, while still using social security numbers as a secondary form of identification.

Since then, scores of institutions have eliminated the use of Social Security numbers where at all possible, said Barmak Nassirian, the association’s associate executive director. Though institutions must collect Social Security numbers for tax purposes, general practice is not to “force students to disclose the number involuntarily” for basic identification, he said. “It’s fairly mainstream now that schools use a random student ID number … There are very few institutions left that use [the Social Security number] as a primary identifier.”

But the change, Nassirian said, “is a major information technology project that is very time consuming and expensive.”

The University of Georgia has begun a multi-year effort to eliminate Social Security numbers this summer, planning for the conversion to randomly-assigned nine-digit numbers for student identification on class and grade lists in the fall. “This measure is just a Band-Aid,” said Rodney L. Parks, associate registrar for operations — the first step in the process of disconnecting identification from Social Security numbers.

The nine-digit identification number comes from the 16-digit number that the university has printed on all identification cards for at least a decade, Parks said, making it easy for students to remember since it’s used everywhere from the campus gym to the health center to local restaurants. “In making the first change away from SSNs,” he said, “it made sense to go with a number that students are familiar with, that they’ll be able to remember when taking an exam and filling out a ScanTron.”

But because the identification numbers are printed on easy-to-misplace red, black and white plastic cards, Georgia has not adopted the numbers for all purposes. Students will still need to type in their Social Security numbers and a PIN number to login to the university’s Online Access to Student Information Systems (OASIS), where they register for classes, update address information and access other sensitive material.

Nonetheless, Parks said he hopes the university can eliminate the use of Social Security numbers for OASIS logins in 2008. “For us, it’s a three step change, from Socials to [the last nine digits of the 16-digit] numbers to a third alternative, maybe by next year.”

Auburn University is also in the process of a conversion, requiring all students, faculty and staff to renew their identification cards by Aug. 29 in time for a campus-wide switch from Social Security numbers to assigned nine-digit numbers scheduled to coincide with the university’s first football game of the season on Sept. 1.

Most campuses in Texas A&M University system have transitioned to randomized identification numbers in the last few years and the Corpus Christi branch began the changeover early this year, Marshall Collins, the assistant vice president for marketing and communications, said. “We were naturally in the process of introducing this new system, just as many other universities are.”

But in a case of “what would be considered bad timing,” Collins said, the university has had two incidents of lost student Social Security numbers since June when a professor traveling in Madagascar lost a flash drive that may have contained the Social Security numbers of 8,000 current and former students. Earlier this month, a student accidentally took a class roster including Social Security numbers off a professor’s desk, returning it two days later, once students had been told to search for it. The randomized identification system will be launched next month.

“It’s just one of those odd circumstances,” he said. “Something goes wrong just as you’re going about changing it.”

Jennifer Epstein



  1. Wow, I wasn’t aware of that one! My goodness, that’s horrible. Good luck, and make sure you call the credit bureaus and notify them that your SSN may have been stolen. It will save you a lot of headaches in the long term!

  2. egyptchick7 said,


    Suny Stony Brook just released 90000 SS numbers on the web and it took one month for a random student to find it and notify them before they took it down. It was an accident and now 90000 students identities ( Including mine) are compromised and Stony Brook isn’t doing a thing about it!

  3. […] Original post by moniqueleonard […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: