Slashdot Mirror

← Back to Stories (view on slashdot.org)

Another School Exposes Private Information

Posted by CowboyNeal on from the open-door-admissions dept.

DutchSter writes "In the wake of other schools announcing the theft of hardware containing sensitive student information, Miami University, of Oxford, Ohio, has announced that a file containing the name, Social Security number, the grade point average for the Fall 2002 semester, cumulative grade point average, and other related academic information, such as credit hours attempted that semester, for all 21,000 students who attended the Fall 2002 term has been available on a web server for the last three years. The discovery was made this week and the university is taking steps to deal with the fall-out sure to come."

5 of 298 comments (clear)

  1. How much you wanna bet... by NickCatal · · Score: 3, Interesting

    they figured this out after it showed up on Google? What ever happened to auditing what you have on the web.

    --
    -nick
  2. now that they've had their data exposed... by KillShill · · Score: 4, Interesting

    the university will refund their tuition for the year.

    that's what i would expect at a minimum. on top of other punishment for letting it happen in the first place.

    this only reinforces the notion i have that there is absolutely no privacy. once your data is in someone elses hands (and all your data does in fact belong to them) you can kiss your privacy goodbye.

    there is no recourse whatsoever. you cannot even sue them or ask for damages.

    your personal data is obviously worth something to sell to third party "warehouses" but when they expose your data to the whole world, at that point it ceases to be worth anything...

    --
    Science : Proprietary , Knowledge : Open Source
    1. Re:now that they've had their data exposed... by bobbuck · · Score: 3, Interesting
      "there is no recourse whatsoever. you cannot even sue them or ask for damages."

      Why couldn't you sue them if you can prove damages? There's no liability exemption for universities. I know the courts get some well deserved bad press but we're not in Cuba.

  3. probably happens all the time by Chris+Snook · · Score: 4, Interesting

    A lot of universities have not-well-advertised public ftp servers that are used for transferring large files, generally with scripts that scrub things that have been around for more than a day to avoid turning into warez servers. I know of one multi-campus institution where an employee at one campus and their counterpart at another campus agreed to use this method to transfer a list of all currently enrolled students at one of the campuses. This included phone numbers, addresses, and student ID numbers, which were mostly SSNs, because that was the default and most students didn't know to ask for a different ID number. Once the transfer was complete and they discovered they could not delete files from this server, they called support, and it was gone in under 5 minutes. They'd already had it drilled into their heads how bad it would be if such a list got out, but no procedure for securely transferring very large files had been established, and they did not have the technical expertise to establish one themselves.

    I imagine this happens a lot, especially at research institutions whose scientists need to be able to receive large amounts of data from collaborators without having to set up accounts for them.

    --
    There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
  4. Re:Who are they hiring? by awkScooby · · Score: 4, Interesting
    The problem is not web admins. The problem is with clueless end users who are careless with sensitive data. As an admin, you're faced with hundreds of gigs to terabytes of stuff on your servers. It is impossible to police it. How would you begin to go about searching for social security numbers? Think of all the ways it could be encoded, and all of the false positives you would find in conducting such a search.

    I could be wrong here. If someone knows a way to scan an entire enterprise, when you don't have admin access to a number of the systems, and you don't have a list of all of the programs which are in use (so you don't know all the proprietary data formats), I would love to hear about your solution. Oh, you probably also need to be able to search documents and databases for encrypted versions, even though you don't have the keys... Management at the university I work for asked how we could scan the enterprise to find all sensitve data after we had a similar incident.

    The person who posted the data on the website is clearly the one who is responsible for that data. That would be the retired faculty member. An admin is responsible for keeping the web server running. Was the information available on the Internet? If so, the admin was doing a their job well.

    There are some fundamental questions universities need to be asking themselves:

    • Why do faculty members have access to Social Security numbers?
    • What are you doing with Social Security numbers to begin with? Sure, you need them for employees, but why for students?
    • Why do faculty members have access to other sensitive pieces of data? If they don't need it, they shouldn't have access (principal of least privilege)

    Why doesn't the government step in in these situations? Clearly this is a FERPA violation on a huge scale. The individual who put the information on the website ultimately should be held accountable. If nothing else, action should be taken against the university. If the university gets more than a slap on the wrist, you can bet that the next person to do something dumb like this will be held accountable by the university.

    I probably shouldn't ask for that, as they'll probably decide it's the sys admin's fault...