Slashdot Mirror
UT Austin Hit By Massive Security Breach
mrpuffypants writes "Reported in the Austin-American Statesman: The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty. Official word from the school can be found here. Most troubling of all is that, like most schools, UT still uses SSNs for student ID numbers, and that was part of the information taken from them in the attack."
Seriously. In the UK the closest equivalent is a National Insurance number, which you give out to quite a few people. Banks often want this (because it's unique to you, which makes record-keeping easier). Your employer will want it, so their accountants can calculate your tax. Your doctor will probably want it, again, because it's a unique identifier.
Why are Americans so paranoid about who knows their SSN?
I used to admin at a University. One of the most frustrating things I encountered was the incessant desire for there to be no restrictions on any of the computing systems that the students used. This includes the servers. The firewall was just an expensive router. We were not allowed to run blocks from the internet to inside IPs, as that defeated the spirit of free access. I tried to explain why it was a 'Bad Thing(tm)' repeatedly, but alway met with resistance from the shared governance committee. One cannot blame the administrators in this thing. I assure you they feel just as powerless as I did. This kind of thing will become more and more rampant as clueless faculty (or upper-management in the business world) are allowed to influence major IT decision-making.
What steps can one take to protect one's identity?
You can't (not to say that you shouldn't make it more difficult, but just don't fool yourself into thinking that it's possible to do absoultely). It's like your house or car, you can take steps to make it more difficult to break in/steal, but there is absolutely nothing you can do to stop someone is wants to target YOU. So the best thing to do is to introduce a bit of paranoia in your life and assume therefore that it COULD happen and adjust accordingly. So for you're indentity, you do regular checks of your credit report, you keeps tabs on your bank accounts, you review your credit card statements, etc. The absolute worse thing that can happen is for someone to grab your identity and use it for a length of time without your knowledge. Getting your cc company to forgive unauthorized purchases is easy, as long as you do it within 30 days of your statement. Having someone apply for a cc with your info can bite you in the butt if you're trying to buy that car or get that mortgage, so you make sure you check well in advance and make sure that window of exposure is a small as possible.
No offense.
"Eve of Destruction", it's not just for old hippies anymore...
- Experian
- Equifax
- Trans Union
Review who is looking at your credit report, and report suspicious activity to them. Having seen a few personal credit reports of people who were using their personal credit to establish a business line of credit, I've seen statements on them like: "Don't issue any credit to this person before contacting me at 111-222-3333".Google can answer most of your questions with nifty links like this, or this.
Who would have thunk it?
"I work in health care, and with HIPAA coming into effect, we've been moving a substantial part of our network off the internet -- if there's no physical connection, we can't get hacked. " Oh really? Something like 60% of breaches are internal. What are you going to do now? Put everyone on their own separate network? We are going to see a lot of medical data stolen since Bush took the teeth out of the HIPAA requirements.
Stop Continental Drift! Reunite Gondwanaland!
There's a problem with your statement "They're unique and everyone already has one." First, not everyone has one. You were not legaly required to have an SSN until 20 or so years ago. Of course, without one you can't get social security benefits.
A bigger problem is that everyone assumes SSNs are unique. They aren't. At best they can only uniquely identify 1 billion people. "Easy," you say, "There aren't 1 billion people in the United States." There were 281 million in 2000. The birth rate is 14.5 per 1000, and the death rate is 8.7 per 1000. While the birth rate is declining, the life expectancy of a person is lengthening. Additionally, it can not be expected that the birth rate will continue to decline to 0. This means that, while it won't happen any time soon, eventually there will be more than 1 billing people in the US.
The next problem is that when you die, your SSN is NOT REUSED until your estate is closed, at a minimum. My mother's estate was not closed for nearly two YEARS after her death, and hers was a simple estate. Some accounting setups could cause you SSN to be used for many years after your death.
Private businesses can request your SSN if they want... you don't have to give it though. But if you don't, they don't have to give you whatever you're looking for either :)
However, UT is a public school and is subject to the restrictions on government agencies... here's a page with some info on the use of SSNs in public schools.
Anyways, as a former UT Austin student, I'd be annoyed if my SSN was one of the ones that got out... and if so, I wonder how UT plans on contacting me--as far as I know, they don't have my current address, phone number, or any other type of contact info. As a side note, the first year I was there (1988), a lot of professors posted exam grades outside the classroom indexed by SSN... I guess someone put a stop to that :)
I have both attended at work at UT in IT, so I can give you my observations.
For many years, UT had a non-centralized IT infrastructure. That is, the Colleges did one thing, the Administrative Computing Group did another thing, the Academic Computing Group did yet another thing, and the Libraries something else entirely. This was recently changed with the introduction of a new Office of Information Technology head by a new Vice Provost (Dan Updegrove, originally at Yale). One of the very first things I heard him address was the Social Security number problem in which every student, faculty, and staff member used their SSN as their ID. That practice had to change in order to meet both legal and privacy standards (see FERPA) , and UT has been trying for the past couple of years to make that happen. The trouble is, it was so integrated into all of the different services and departments that it is a slow process to remove it. They started to phase it out, but now UT is seeing the effects of this particular practice. I'm likely one of the ones who will be affected, so I'm waiting for them to announce where people can find that out. (It may be at the UT site, http://www.utexas.edu/datatheft/.
The Daily Texan (student newspaper) has an article about the theft, as does the Houston Chronicle.)
By the way, your Social Security Number isn't public information. It is required for use by some agencies of the government, but you are not required to provide your SSN to private groups unless they need to interact with certain government agencies (this includes your employers, who deal with the IRS). That being said, SSNs are so commonly used a search may pull up that information- but that doesn't mean it is legally public info.
Just to let everybody know, this was the last semester that UT was using SSN's as id's. We are in the process of switching over to what they call the EID. The EID is just a text string (similar to a user login). This is what we have to use to access online services for several years. Within months it was going to be our official identifier in all of the university's systems.
Actually, it is illegal for anyone to ask for you social security number except for:
1) The purposes of reporting individual tax information (such as wages and salaries).
2) The payment and qualification for social security benefits.
Alot of people do not believe the above, because they have gotten used to it and have accepted that people will use their SSN for means of unique identification number. It's great for database developers to just use your social security number as your customer ID. Because we know that SSN's are unique. Example, if you go to a hospital, what do you think your ID is? Now, you have the absolute, 100% right to refuse to give ANYONE your social security number. (Aside for the above reasons) In the above example, the hostipals will probably insist. But they most definately treat non-americans (either visiting the US or here on a Visa). These people do not have SSN's. The SSN's have become a defacto National ID card only because people have let it become so. That being said, your social security number is NOT a national ID card system, although it is being used like one whether we like it or not.
Is your SSN in the following ranges?
* 449-31-98xx - 450-91-24xx
* 451-12-32xx - 451-20-35xx
* 451-20-64xx - 452-20-40xx
If so, within these ranges, 55,200 people of the following types, including but not limited to:
* Current students, faculty and staff
* Former students, faculty and staff
* Job applicants
* Retirees
may be affected.
I'm a student at UT-Arlington, the next largest school in the UT System. Last October our Student Congress passed a resolution I wrote asking them to basically make it easier for students to be able to request to no longer use their Social Security Numbers as their ID # - UTA currently has a system in place where you can request to use a randomly generated ID# instead of your SSN, but no one knows about it and they don't advertise it or make it easy.
The administration's response was "Come Summer 2005, when we have our new Student Information System, we won't use anyone's SSN" but that in the meantime, we're screwed because they weren't going to change anything.
A month ago I discovered the 'secure' portion of the Housing department's website had been indexed by Google, including the ID # (Social Security Number) of all 1200+ residents living in the on-campus dorms. This highlighted the need for the immediate cessation of collecting and storing SSN's, so I've introduced a follow-up resolution our Student Congress is looking to pass soon basically demanding each department document every way they use SSN's and the security measures in place to protect them, after which we want a committee of students and faculty to go through the documentation and approve or deny their use and storage of the SSN's.
Our school paper, The Shorthorn (www.theshorthorn.com) is supposed to do a story in tomorrow's (Friday's) issue concerning the leak at UT-Austin and the fact that administrators so far at UT-Arlington are ignoring the need to provide secyrity for SSN's NOW, and not just in 2005.
It should be interesting to see if the administration has finally 'seen the light' and will listen to us, this time.