Slashdot Mirror
Another School Exposes Private Information
DutchSter writes "In the wake of other schools announcing the theft of hardware containing sensitive student information, Miami University, of Oxford, Ohio, has announced that a file containing the name, Social Security number, the grade point average for the Fall 2002 semester, cumulative grade point average, and other related academic information, such as credit hours attempted that semester, for all 21,000 students who attended the Fall 2002 term has been available on a web server for the last three years. The discovery was made this week and the university is taking steps to deal with the fall-out sure to come."
Who are these ppl hiring as web admins??? Why are these files even on servers connected the net?? and hopefully first post
they figured this out after it showed up on Google? What ever happened to auditing what you have on the web.
-nick
I know this is a major breach of privacy/security, but I'm curious about what kinds of malicious things one could do with this information.
It seems to me that the only useful thing is the names/SSN combination.
Unless you could blackmail some poorly-achieving students by threatening to tell their parents their real marks?
"A week in the lab saves an hour in the library"
...a concept so simple even Congress gets it. Too bad tech doesn't.
Data breach law
Mongrel News all the news that fits and froths
Miami University... must be in Florida.
Oh, it's in Oxford... must be in England.
Bzzzzzt. BUT NO! It's in Ohio!
It must have taken a long time to come up with that combination of naming and placement.
My photolog
Three cheers for Business School's retarded cousin.
Miami University...in Oxford...Ohio.
Met a girl from Miami that went to Oxford, and didn't like the song "Ohio." Seems a little less obscure, too. Yet, this school has 21,000 students? I mean...that's more than the real Oxford...the one that's not in Ohio, but has students from Miami...
the university will refund their tuition for the year.
that's what i would expect at a minimum. on top of other punishment for letting it happen in the first place.
this only reinforces the notion i have that there is absolutely no privacy. once your data is in someone elses hands (and all your data does in fact belong to them) you can kiss your privacy goodbye.
there is no recourse whatsoever. you cannot even sue them or ask for damages.
your personal data is obviously worth something to sell to third party "warehouses" but when they expose your data to the whole world, at that point it ceases to be worth anything...
Science : Proprietary , Knowledge : Open Source
Binghamton University in NY, just announced this week that 404 student names and ss numbers, as long as other sensative data was unsecured for months, it was only after a relative of a student pointed it out was the problem fixed...just in case you guys didn't know
This got me thinking. Email spammers and other naughty types run web bots to scour web sites for email addresses and similar personal information. How hard could it be to write software to search one's own web server for lists of SSNs or whatever, and alert a webmaster so it can be quickly taken down? Doesn't sound like it would be particularly difficult at all. A quick search untility to parse publicly-accessable pages could save a lot of bad publicity later, as happened in this case.
Andrew Lenahan http://www.starblind.com/
No school needs an SSN. For that matter just say no to giving it to anybody but the IRS and your financial institutions. Your doctor doesn't need it. The gas company doesn't need it. Cingular and Earthlink don't need it.
The city in Florida sprung up at the end of the 1800s, and adopted the name because they thought it meant something vaguely pleasant regarding water.
So if anybody's ignorant, it's actually the clowns in Florida.
Anything computer-related done by either government or schools tends to be incompetently executed and annoying, probably because when you need to deal with them, you need to deal with them - you're not a customer and if you don't like the way they do things, you can go fuck yourself. There's no reason for them to care about you, and it would be irrational for them to spend much money on giving you a better experience (well, up until the point that they get in trouble for leaking your private info on the web, that is). At least that's my theory to explain my experiences.
Don't drop the soap, Tommy!
Whoever setup the web server should be held responsible and embarassed in front of his parents. The parents of the students should also vote on whatever method they think is most appropriate.
...and how was it being used? Was the file being used by admissions? Did anyone with access to the file have write permission? And does this mean that anyone in that class of students could have easily changed their records? Yes, this is a breach of privacy, but it might have also been an oportunity for some unethical clod.
It's the Future of Rock & Roll!
I am a sophomore at Miami (and yes we were a university before Florida was a state). Frankly it doesn't come as a surprise, IT around here is nothing to brag about. Although making /. that's what really got me...
A campus wide email was sent out...looking a bit like this:
"Dear Miami student,
Miami University is notifying all members of the University community today that a report containing the names, grades, and social security numbers of all students who were enrolled at Miami in Fall 2002 was inadvertently placed in a file accessible through the Internet. At this point we have no evidence of illegal use of this information, but we are concerned and deeply regret that because of this action private and confidential student information was exposed.
You will find below the press release we are sending out that will give you more information about this incident.
I want to repeat that this affects only students attending Miami in Fall 2002. There is no threat to current students who were not on campus in Fall 2002. If you were on campus in Fall 2002, you will receive by early next week from Reid Christenberry, vice president for information technology, an email message providing you with a toll-free phone number, which will be staffed by trained investigators who are experienced in dealing with privacy issues. Later you will receive similar, written notification from Miami with the toll-free phone number and additional information about actions you can take if you are concerned about possible identity theft.
Again, we deeply regret that this information was made accessible. We will keep you informed of the actions we are taking to protect current students and alumni.
Richard Nault
Vice President for Student Affairs"
Ba dum dum:-).
Sue the hell out of the person who discovered the security hole. That will show em.
Hacker Media
Last year, UConn, my college, had a privacy breach where lots of SSN's were leaked. This year, they've made a committee to figure out ways in which they can remove SSN's from as many internal processes as possible.
Last year, a student's ID was their SSN. Now, it's an ID assigned by our peoplesoft system. If i forget my ID at, oh say, the campus book store *shudder*, they can't look it up w/ my social. Like I said, good things can sometimes come out of these events.
Color me sudo...
Just because it was on a webserver doesn't mean it was easy to find. Unless your a concerned student who searches for your name and the first group or two of your SSN.
Restrict what's in your webspace!
What I'd be concerned about is did the "now retired faculty member" know the directory where they put the file was on a public server or was the file put there and then someone did a chmod 755 on the dir, possibly after they retired by the replacement who didn't know any better. The school I'm at has school.edu/dept/whatevertheywant I know some departments use it for public and private storage, yes bad idea, with password protected files&dirs. If the same happened there it's possible someone made a location public without checking the contents of all the sub dirs. I've heard of this happening too many times, schools need to have clearly labeled dedicated internal network storage and separate webspace. Once they start getting mixed up there's the chance a file will accidentally get copied or moved to the wrong place for all to see. The problem is "public" and "private" are too close when listed alphabetically. If those labels are used it's too easy for someone using a windows interface to accidentally drag&drop something to the wrong location when it looks like:
~admissions_office
lunch_menus
office_supplies
private
public
schedules
warez(maybe not)
F7 doesn't work, ignore spelling and grammar
Over the Summer, my school's district replaced their old SIS (Student Information System) with "SchoolMAX", designed by Maximus. After talking to a guidance counselor regarding schedule modifications, I noticed her log in to the new system - I noticed it required 4 credentials, one which the counselor left blank, and I made a mental note to Google the name of the system for more info on it for curiosity sake. The counselor printed me my new schedule, right from the web page. Sweet, thanks for doing the work for me - the URL was on the bottom of the sheet. I got home, hopped on the web, and keyed in the URL. The credentials required were school district, operator ID, password, and screen ID. Screen ID was what the counselor had left blank, so I was down to 3. I figured school district would be available online - a quick Google search confirmed this, and I was down to 2 fields remaining. There doesn't seem to be any real security on the site, and I predict a simple brute force or something more practical such as social engineering would enable anyone to an entire district worth of information.
Oxford, OH.
Strangely enough, I grew up not far from Oxford, OH. Funny to see this place mentioned on Slashdot. Even more hilarious to see it on Slashdot due to the actions of some irresponsible people!
It seems to me that there is an opening in the market here for a reliable intermediate service that attracts clients (universities, hospitals, firms) by outsourcing the privacy issue and attracts users (students, patients, et cetera) by putting a high premium on security. Coupled with lobbying for legislation on this issue, and there is a possible business opportunity. Certainly as a user I would prefer ONE widely respected (and carefully monitored) service to have my information, and allow other vendors only to know the id number of my account with the respected service (and validate that authorization by letting the service know to whom I had granted this information). Or, is there something like this?
Before you start blaming every CS student maybe you should read the full explanation on their site, which among other things says:
"On Monday, September 12, 2005, Miami University became aware that a grade report from the Fall 2002 semester had been unwittingly placed by a now-retired faculty member into a file that was accessible via the Internet.
Note the 'retired faculty member'. Not a student or a hacker.
This seems like a common problem, how does one protect again appending sensitive information from a protected document into an ordinary text or non-sensitive file? Is there a technology out there that can mark the data so it can not be copied into another file even though it is accessible to some. Apparently the 'now retired faculty member' had access to the file. Probably used cut and paste to imbed it into a file he/she could access from home/laptop etc. We had lots of problems like this at government locations I worked at
I understand your anger but this does not seem to be a malicious act, it appears to be an honest screw up and is not like the stupidity of Citibank sending their files via un-encrypted tapes by UPS.
The school seems to be handling this OK.
I understand that it is the easy thing to do but with all the compromises of data recently it seems that the inconveinience of unique numbers for different institutions would be a valid approach. Data theft is like gambling. In Vegas you can't lose what you don't bet. On the web you can't have data compromised if you don't put it on the network.
In constrast to most /. types, I have pretty much given up on "privacy" in this sense. We live in a world that is becoming more and more connected and wired every day. Within that context, it becomes more and more possible for people to obtain information about one another. Perhaps we should be thinking more about how to embrace this reality rather than fruitlessly attempting to resist it. Just a thought...
It's named after the Miami tribe of Native Americans who used to live in the area. I go there, and yeah it's a joke. I'm just there because it's somewhere close while I decide where I want to really go. Wasn't always like that though, and to all the Miami Flordia people, Miami U was a school before Flordia was a state.
Peace
P.S.
yay, my first post!!
I don't care what youre doing so much as the idiotic way you're doing it.
How many schools have info like this (or worse) posted on some forgotten webpage?
Maybe the IT departments of schools should look into hiring quality people for their systems instead of leaving it up to educators with no real-life experience or student staff that rotate every semester.
I am not bitter at all. I am sorry your personal info was given way by an ex-chair of your university. You are the one who should be bitter...
You know their motto ... it is the "Show Me" state!
I agree, perhaps public humiliation would be best in this case. While it won't physically harm the individual(s) responsible for this lapse, it will discipline them and it will provide an example for others. Perhaps the best form of humiliation would be genital exposure. Make these people walk around the campus for a day, penis hanging out.
Cyric Zndovzny at your service.
A lot of universities have not-well-advertised public ftp servers that are used for transferring large files, generally with scripts that scrub things that have been around for more than a day to avoid turning into warez servers. I know of one multi-campus institution where an employee at one campus and their counterpart at another campus agreed to use this method to transfer a list of all currently enrolled students at one of the campuses. This included phone numbers, addresses, and student ID numbers, which were mostly SSNs, because that was the default and most students didn't know to ask for a different ID number. Once the transfer was complete and they discovered they could not delete files from this server, they called support, and it was gone in under 5 minutes. They'd already had it drilled into their heads how bad it would be if such a list got out, but no procedure for securely transferring very large files had been established, and they did not have the technical expertise to establish one themselves.
I imagine this happens a lot, especially at research institutions whose scientists need to be able to receive large amounts of data from collaborators without having to set up accounts for them.
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
For free identity theft monitoring, please send your name, social security number, birth date, credit card numbers with expiration dates, and address to protectmyidentity@gmail.com. We will take care of your credit record for you and guarantee that you will never have to worry about your good credit record ever again.
You must give your SSN to Federal, State, and Local governments only when there is a law that requires it. The act also says the government agency MUST inform you at the time of collection whether giving your SSN is required or optional, cite the law that requires it, and explain what happens if you don't give it.
If you do not see a privacy act notice on government paperwork, then don't give your SSN. It's hard to say no, and many govt workers are completely ignorant of the law, but you've got to take a stand.
Non-government entities can ask you for your SSN for any reason or no reason, but you don't have to give it to them. If a company says they have to have it, be prepared to take your business elsewhere.
So, is Miami of Ohio a government entity? Many universities are because they are state funded or created by an act of state law or consitution. If so, demand that privacy act notice. If not, take your money somewhere else.
I doubt any school would deny you admission because you refuse to give your ssn. What do they do for the foreign students?
You'll never know what you can do without giving out (your SSN) until you stop giving in.
Things I've done without giving out my SSN: got real phone service, got satelite TV, been to the doctor/hospital, got medical insurance, got internet service, got married. Yeah sure, I wasn't able to get that extra 10% off at Pier One by signing up for a credit card. So what!
Yes, you just have to love J Crew U, home of some of the most obnoxious college students that I have ever met.
Everything I need to know I learned by killing smart people and eating their brains.
Business school? HAHAHAHAHAHAHAHAHAHAHAHAH *wipes a tear from my eye* Arguing about which business school is better is like arguing which tastes better, dog shit, or cat shit.
Dear Miami student,
Miami University is notifying all members of the University community today that a report containing the names, grades, and social security numbers of all students who were enrolled at Miami in Fall 2002 was inadvertently placed in a file accessible through the Internet. At this point we have no evidence of illegal use of this information, but we are concerned and deeply regret that because of this action private and confidential student information was exposed.
You will find below the press release we are sending out that will give you more information about this incident.
I want to repeat that this affects only students attending Miami in Fall 2002. There is no threat to current students who were not on campus in Fall 2002. If you were on campus in Fall 2002, you will receive by early next week from Reid Christenberry, vice president for information technology, an email message providing you with a toll-free phone number, which will be staffed by trained investigators who are experienced in dealing with privacy issues. Later you will receive similar, written notification from Miami with the toll-free phone number and additional information about actions you can take if you are concerned about possible identity theft.
If you were on campus in Fall 2002 and do not receive an email early next week, please let us know by emailing us at <<removed>>
Again, we deeply regret that this information was made accessible. We will keep you informed of the actions we are taking to protect current students and alumni.
Richard Nault
Vice President for Student Affairs
Yeah, that makes me feel better.
I blame the MIS students!!! Biz-kids think they can run a computer...
And yeah, the docs included my ssn...
I'm glad Bush passed that Bankruptcy reform
What happens when everyones id is stolen. Really fuck the econ, aye, you know, if you can't trust anyone id...
Dude, you're an alumnus from here at Miami who was in the CSA department?
I knew I should have been a Waste Management major instead of SAN.
Anyway, from TFA, it wasn't "Biz Kidzzzzz" who exposed the data, but a now-retired professor in the Business Department. The incompetence resides in Miami's IT for letting people who shouldn't be expected to be overly technical have that much ability to expose critical information.
http://www.kiplinger.com/personalfinance/tools/col leges/pubcollege.php?sortby=INRANK03&orderby=flip& states%5B%5D=OH&myschool%5B%5D=Miami+University&ou tputby=table
Is that retired as in the way that former FEMA director Michael Brown is now retired? I don't think he retired. I think he was fired. And, if I had to guess, when the person at Miami was holding all those SSN's, I hope he was on the pay roll. Retired today? What about yesterday?
RTFA. He has been retired for a while.
No, actually he's right. I know that I don't even realize how beautiful the women are here until I leave MU for a while (e.g., the summers) and come back. We're pretty spoiled, but I'm okay with it.
For being French, you speak wonderful English.
Yes, Miami was a name of a local tribe and Oxford, well, I hope you know where they got that one...
The funny thing about this is that it wouldn't have *mattered* 20 years ago. We live in a different world now, and it's going to take a while for people to understand it.
Think about the stereotypical absent-minded professor. Someone gives him a file of students' academic info, and like everything else, he misplaces it.
Okay -- 20 years ago, worst case scenario: the file is left out in plain view on his desk in an unlocked office, and a student nicks it. The student shows his friends, word gets out, and the student gets in trouble. Some students are upset about the privacy violation.
Now fast-forward to today, and the same innocuous, absent-minded professor can misplace a file and cause a DISASTER. Surprise, the whole world can see it! Nobody needed to break into his office, nobody needed to even enter the school, and they can get the file, just because he mixed up the X: drive (teacher fileserv) with the W: drive (public webserver), or something like that.
I'm no Luddite -- heck, I'm a web developer, and I'm the first to say that the benefits of the internet are incredible -- but it's a dangerous and powerful tool that doesn't get the respect it deserves... most users out there are kinda like teenagers learning to drive tractor trailors. Or it's like everyone's using these new ballpoint pens that also shoot out a lethal dart if you twist the handle.
To SW ohio's defense:
Carmen elektra and Sarah jessica parker are from there i think.
and Miami girls are just an example of what happens when 3 or 4 generations of rich people marry the most beutiful women they can afford. Standard upper class breeding.
They Are Night Zombies!! They Are Neighbors!! They Have Come Back from the Dead!! Ahhhh!
I have a sneaking suspicion we know each other. Did you attend Miami? Did I ram you with a stick scooter jousting? If so, look me up. I still got the old IM. I'm now at Iowa too if you want to find my email there. Interestingly enough, if this is you, I tried to look you up but your real name is so damn common there's no way I could find you.
Why does the school have the SSN's of all the students? They can't all be getting financial aid, or be employed by the school.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Yeah, there are plenty of dr. gonzo's out there, you can thank the late H.S. Thomson that ...
Yes, I found the expression 'recently retired' very funny. I immediately assumed that whomever it was was fired. Maybe this was not the first time but that this incident was revealed as a result of past indescretions? Who knows. It is spin speak.
I think that with schools placing so much in adjunct faculty, cut backs and general lack of financial support from our governments, we can expect many non-professionals doing tasks that they did not have to do in the past.
I think this is a systemic breakdown within our Universities and schools in general. So I agree with you that students should not be hired to do technical work. I just don't think the blame for this should be on their heads.
Anyone got the torrent?
Telltale Games: Bone, Sam and Max
Back then we carried around sheets of paper with our information. Some used a redundancy method known as "carbon copy" - in which the user would write once and the data would be recorded in many places.
Though I had to physically walk miles to track down professors without watches, the data was always securely stored in the back pocket of my jeans or stuffed into my backpack.
Best of all, we relied upon social engineering security and things like locked wooden file cabinets. The security team was staffed by should-have-already-retired women who hated all people and wore too-tight pastel colored polyester blouses and shirts. But nothing got past them.
The Luddites were ahead of their time.
I understand your anger but this does not seem to be a malicious act, it appears to be an honest screw up
I have no problem with harsh punishments for honest screwups, if the consequences of the screwups are great. If the consequences are really great (like massive loss of life and/or extraordinary dollar loss) then I support throwing people in jail or even capital punishment even when the people intended no wrong (of course, if they did intend harm then the punishment should be much more extreme). In the case of potential losses, it gets a little gray- but I still want to create very strong incentives for others not to repeat those mistakes.
Maybe rather than trying to conceal this sort of information, we should be working to make it useless.
Score:1, Troll
Someone didn't get the 'excuse my french' joke.
What a coincidence, that is exactly what I am doing. Just send me your name, SSN, address, date of birth, mother's maiden name and I can make it all pretty useless for you ;)
Which is to whom I was refering!
It's in the Great Miami River valley, and named after the Miami indian tribe. The sports mascot used to be called the 'Redskins', but they changed to the 'Redhawks' because they were scared of a lawsuit, even though they had the full endorsement of the Miami indian tribe to use 'Redskins'
They call themselves the Harvard of Ohio (hahaha) and try to put off a stuffy private school image, even though they are a public school. My younger brother is studying Zoology there, but thankfully he makes fun of the J Crew pink polo with a popped collar type.
If bad puns were like deli meat, this would be the wurst
In Sweden, both grades and the closest equivalent of SSN is public. Just call the school that gave out the grade and they'll tell you, just contact the right place and they'll tell you the personal number. I'd have assumed that is the case everywhere else too?
I don't see the problem with that, really. It's not like that will give you any useful information, at best you can check if a person lied about his grade. Is the problem that it's avaible on the internet?
The information released also included demographics. I've obtained the information and masked off the personally identifying information so I could show the sort of demographic information made available:
... Gender Dress ...
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Male, Khaki shorts, white T-shirt, ball cap
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
(if you've been there, you'll understand)
What are the odds that these schools are running SCT Banner and using IIS?
Pretty damned good. Banner in itself is an ungainly beast, an overlay on top of an Oracle database. But they host the web components on IIS which is a guaranteed point of failure.
I've loathed IIS and MS-SQL ever since I was exposed to LAMP. But universities decided their I.T. shops couldn't produce a good product so they got snowed by the SCT folks. Disgusting I tell you.
. . . unfortunate incidents are blown out of proportion or even engineered by the IT establishment at these colleges as a ploy for more authority and better funding. Whether or not that's the case, it'll certainly be the result.
I too have felt the cold finger of injustice.
To start out, i work in a security division of a credit card company. under the patriot act if a credit card company asks for your ssn you must give it to them to validate yourself as a citizan. If you dont give it to us, we can close your account. even if you dont give it to me, i can pull it up using FastData web or Accurent using just your address or phone number, along with anyone else that has ever lived there or had that phone number. so next time you call a credit card company at least, just give it to us, we have it anyways. stop being such a pain in my ass. and if you dont and we close your account its your own damn fault.
I wonder if it's still there in the Google cache? What about all the other search engines? What about the Wayback Machine?
That's nothing though - there's a California University of Pennsylvaia located in the wonderful town of California, Pennsylvania. It is a legitimate college, however the name is very misleading. They're neither California University nor the University of Pennsylvania.
I think the biggest joke has to be the University of Maryland University College. It's not named after a city in another state, but is it a University or a College? Is it affiliated with the University of Maryland? Why does 'University' appear twice in it's name?
"Where did you go to school?"
"I went to the Stanford College University of Arizona University College of Texas University College, in Montana"
They did produce Big Ben Roethlisberger, the current Steelers quarterback.
Yes, this technology exists.
When they use it to secure the newest 50-cent song, that DRM is horrible stuff.
When they use it to protect your SSN, it is the greatest thing in years.
But since we all use Linux here on slashdot, getting efficient DRM in place to force this type of security is rediculously difficult.
That's okay. You can transfer from California University (of Pennsylvania) to Indiana University (of Pennsylvania) and never leave the state of Pennsylvania. You can also go to Notre Dame and never visit Indiana -- Notre Dame College of Ohio that is. Pennsylvania and Ohio love to give their Colleges and Universities confusing names.
Beware of Sleestak
Go to myspace.com and look for people who attended that school during the affected year. If you come up with any firstname+lastname combos (firstname in profile, lastname in comments or something - passive social engineering by observation, my favorite kind), give the ol' search skills a whirl.
I found a few, but I think I'll leave you guys to do the detective work yourselves. >:D
[an error occured while processing this directive]
I think it's interesting that Miami doesn't know if this data was accessed by unauthorized people.
All they'd have to do was grep through their web server access logs and look at ips. There's a small, but important, possibility that no one ever accessed this file other than the professor. Or at least, they'd know ips for those who had accessed the file.
Presumably, they're not keeping logs this long.
You can transfer from California University (of Pennsylvania) to Indiana University (of Pennsylvania) and never leave the state of Pennsylvania.
That's because us Pennsylvanian's rule! I'd say 1/4 to half of my graduating high school class went to IUP(not me though, thank God). But then again, what does my town know? They worship a groundhog every February 2nd.
"Marking data so it can not be copied into another file" is the wrong way to think about this issue. That's a microsoft approach.
The problem was that the format was a text file and that the only way the faculty member had access to the data was by being emailed to him/her from the dean.
A data modeling/analysis program or custom web interface that allows authorized people (where the correct people are authorized) is the solution to this problem. This professor didn't want a text file of every student's information. S/he probably wanted something like a comparison of GPA's between different campus organized by majors, or something like that.
The problem wasn't that there wasn't enough meta-data and a required file reader restricting a user to what they can do with their data, but rather that a Dean wanted a person to have access to certain data and the only way to give it was to send a text file over.
The need for true-to-life authorization & useful data analysis tools are what caused this problem.
It was removed and Google was informed by an automatic process to re-archive; there was no cache, but the data was searchable for the day it was found. The evening it was found it was no longer searchable. Internet Archive and the like don't archive this particular type of content.
I haven't posted in so long, my sig is out of date.
I hope they did due dilligence and removed all access through google cache and the wayback machine. I realise that the SSNs are already out in the wild, but it would do no one any good to have their SSN permanently available in a history cache somewhere.
Time passed, and a few years ago Quicken bought them up, and rolled their system into Quicken's bill payment system. My stuff continued to work just fine, I was happy with the service. Time passed, and I was trying to find a way to do my bills online while maintaining an electronic transaction register without requiring double entry (bad, bad thing - can cause massive problems if you screw up) - and I wanted to use this system under Linux. I looked into various products, the closest "best" product being GNUCash - but they still don't have the EFT section done (and likely never will - banks, for some reason, are loathe to help them set this up, but have no problem with large companies doing it). So, I stuck with Quicken, and it was the one reason I still had a Windows system running.
Time passed, and recently I had to get a new checking account for reasons I won't go into here - suffice to say, it was a necessary thing I had to do. I got the new account, but then when I went to set it up in Quicken, the whole process fell over. Some of my bills didn't get paid (Quicken initially covered them), I went through a long process with them. After about two weeks, here is what I found out:
They were assumming that the ID they had on file for me was my SSN. It wasn't. They queried the bank for the account number I gave them, sent the ID number as my SSN to the bank to verify, and of course, it didn't match, so the whole thing was denied. After a few rounds of this, with them scratching their heads, I finally heard from someone who was very suspicious of what was happenning - they were required by some section of the PATRIOT Act for me to give them my SSN. Mind you, this was during the same time period that many companies (like the school in the article) were have credit card accounts stolen and other ID information stolen. I told them I wasn't going to give it to them, and I had never given it to them - because oh-so-long ago I had foreseen this very situation happenning, and I was going to do everything I could to prevent it from happenning to me (for this reason, my health insurance company doesn't have my real SSN, either - and I use different IDs between my dentist and my doctor).
Furthermore, I couldn't understand why they all of a sudden didn't trust my info when I could clearly show my old account was something I had with them for so long, working just fine. I guess customer loyalty means nothing anymore - what a sad situation that is. They pleaded and wheedled with me to just give them the ID, that was all they needed...
I told them to go to hell and closed my account - I value my privacy on my ID too much. Of course, with your revelation, they probably had the means to get it anyhow (I, of course, had to give my SSN out to get my mortgage at my current address) - so how in the hell is it supposed to be secure, I don't know, if anyone with access to those systems can get it with an address. I hate this world, this world without privacy for only some (but if you have enough money and power, no one can bother you) - but couple that with the ability for nearly anyone with the time and patience to do it, and they can assume your identity and fuck your life up for years - how is this supposed to be a good thing? Grrr...
Anyhow, I am no longer with Quicken, no longer with Checkfree - I do things the old fashioned way with a checkbook and stamps. I still use my Quicken software as a check/transaction register - but one day that will be phased out and I can drop kick Windows to the curb (well, maybe I will keep it around for some game playing or something). You know something, though? It is actually better this way...
Reason is the Path to God - Anon
It was 755, and the file hadn't been noticed for three years; grades and records are stored in a database on secured servers somewhere. These records were a report run from that database to enable the department chair to make decisions, probably on things like class force-adds.
I haven't posted in so long, my sig is out of date.
... MU is a Linux shop. In fact, we have more UNIX servers of differet flavours than we have Windows servers.
I haven't posted in so long, my sig is out of date.
I'm a senior, thanks. My GPA is such that I can guarantee that it is at least as high as yours was, if we want to compare sticks. And you kind of just proved my point by describing how easy it is to post private information. So, what was your point?
You miss my point. When used as an insult, you don't have to use Windows to be an "MCSE". :)
Which is more painful? Going to work or gouging your eye out with a spoon? Find out!
http://www.workorspoon.com
It's been said before, but I'll say it again.
"Miami was a college before Florida was a state."
The college's name wasn't confusing when the name was given.
Miami, Florida is named after the Miami river valley in Ohio, which is also Miami University of Ohio's namesake.
___
It's the end of my comment as I know it and I feel fine.
There is no evidence that anybody ever used this information for unauthorized purposes. Some professor left the grade report in an exposed directory on a web server. Instead of taking the server down and forgeting about the incident (like 9 out of 10 IT departments would have) the University sent letters to all of the potentially affected parties. I don't even believe that OH has a CA style law requiring such disclosure. I commend them for their honesty.
The suggestion that the University should have refunded $20K to all of its 2002 students because its theoretically possible that somebody might have gotten their information is positively bizzare.
Ok, as a Miami student, I have to say that the business school is everything that's wrong with this place.
The CS department actually isn't too bad, faculty-wise; the student body is much less informed than at, say, Case Western, but the professors are knowledgeable and the classes are offered. I have no problems with the CS department - but it is annoying when other, completely worthless departments like business take all the funding and impose dumbed-down classes on us when they send their students into our department.
Ohio is very much in the Midwest. This terminology dates from back when the Mississippi was the western border of the nation. Past the Mississippi is just the West.
The Midwest, for future reference, consists of Ohio, Indiana, Illinois, Michigan, and Wisconsin.
I believe that most of the Miami girls are beautiful with or without make-up. I left Miami for summer break and realized that I sorely missed flirting with cute women.
Miami is a quaint little city. Some retirees prefer to retire somewhere quiet and that's what Miami is. Just because some are rich does not imply beautiful people. The rich CAN develop a nurturing environment for kids. Just don't retire near the frats. We can be very noisy.
I'm on the faculty of another small liberal arts school. I don't know why SSNs were passed around in this case, but other sensitive information is routinely shared among "officers of the college" (faculty, administrators, academic staff) for some purposes. For example, when our school evaluates candidates for Phi Beta Kappa--which, incidentally, would be my guess for how this professor had the information at Miami--quite a lot of people need to see transcript information. We also produce an anonymized version of the information for student members of the chapter. We try to secure the information carefully--keeping electronic versions protected, shredding the paper. The Miami violation is clearly egregious. I mention our circumstances to explain why professors sometimes have access to this kind of information about students.
Miami University in Oxford, Ohio (Amusing ...)
We all love to pour scorn (or other suitable liquid) on Floridians, but I just have to point out that
Oxford was a university *before the colonies rebelled*
"Europe. Yeah, Europe. Where the history comes from."
Miami is also famous for somehow stumbling across a genius and actually hiring him: William Holmes McGuffey author of the McGuffey Readers.
It was nice to receive an email today telling me that I'm one of the lucky ones to possibly be affected by this. They tell me that I can be advised as to what to do and how I can check to see if I've been damaged. My thought is this: It's been 3 years. If someone copied my information then they have my information for good and nothing short of changing my name, SSN, address, and family relationships will do much to change that.
But it's nice to know the campus who charges you $50 for misinterpreting their parking pass zones can make large mistakes and hope you'll forgive them.
Or at least the person who is pretending to be you is willing to let bygones be bygones.
*waves to Kundor*