Let's Play Good Idea, Bad Idea

Recently, a Chemistry professor at OSU had their house broken into. Among the stolen items were two laptops. Typically, when someone has their laptop stolen, it sucks for them, but that's the end of the story.

But this is Ohio. They do things differently here.

You see, the laptops were ones on which said professor stored class rosters. And, among other things, these class rosters included the social security numbers of approximately 3,500 current and former students. Which is bad. And so the university has had to find and contact these 3,500 some odd individuals and let them know their identity security has been breached. Some of these students were from many many years ago, and as such, private investigators and the like had to be hired. Which costs money. Apparently this has cost the chemistry department and the university something like $80,000 so far.

That was in February. In early April, some other computers on campus were hacked into and something like 14,000 SSNs were "exposed." These SSNs are a subset of everyone who receives a paycheck from OSU ... including various faculty and staff, which (it seems like) was enough to make people go from saying "this is a problem that should be fixed" to actually trying to, you know, fix it.

There is much specialness abounding in this situation. The most obvious one to me is that there is no reason why a professor should ever have students' SSNs. So why do they? Well, it's because at this prestigious university, SSNs have long been used as student ID numbers. (Yes, I have complained about this before.) What this means is that they are routinely included on all class rosters, grade lists, etc etc. Which means that someone somewhere along the way had to think that was a good idea. Sure, it might have been back before the days of identity theft when everyone was all good and moral ... but a lot of software (e.g., for grade submission) has been written since then that didn't need to include that information. And once it became obvious that this practice could cause problems, someone somewhere had to make the decision to "phase" in a solution (apparently they've been saying this for years) instead of doing a rapid change manouver.

Which is what they're trying to do now, but with a great deal more... panic. No one likes a lawsuit, so another brilliant decision that someone somewhere made was to hold individuals liable. Not just the poor sap who has SSNs stored in his mail from over a decade ago, but also the individual responsible for that computer, aka, your friendly local tech support guy who is really not enthused at the idea of policing a department's worth of computers for nine digit strings, but is rather motivated at the idea of keeping their job.

Best part is, someone has realized that all of this goes against FERPA regulations ... pesky laws. We're assured that it'll all be fixed by the start of Autumn quarter in September, and the Astronomy department is definitely being all pro-active in purging computers of these data records. Besides, it's not every day you learn that Professor X has found Famous Astronomers Y and Z's social security numbers on their computer ...