UT Austin Hit By Massive Security Breach 557
mrpuffypants writes "Reported in the Austin-American Statesman: The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty. Official word from the school can be found here. Most troubling of all is that, like most schools, UT still uses SSNs for student ID numbers, and that was part of the information taken from them in the attack."
I used to go to UT Austin (Score:3, Informative)
Re:What is SSN? (Score:4, Informative)
Re:Illegal? (Score:3, Informative)
Probably just a student... (Score:1, Informative)
What's the big panic about SSNs? (Score:4, Informative)
Why are Americans so paranoid about who knows their SSN?
It's not the IT department.. it's the provost (Score:5, Informative)
Re:As a recent graduate... (Score:4, Informative)
You can't (not to say that you shouldn't make it more difficult, but just don't fool yourself into thinking that it's possible to do absoultely). It's like your house or car, you can take steps to make it more difficult to break in/steal, but there is absolutely nothing you can do to stop someone is wants to target YOU. So the best thing to do is to introduce a bit of paranoia in your life and assume therefore that it COULD happen and adjust accordingly. So for you're indentity, you do regular checks of your credit report, you keeps tabs on your bank accounts, you review your credit card statements, etc. The absolute worse thing that can happen is for someone to grab your identity and use it for a length of time without your knowledge. Getting your cc company to forgive unauthorized purchases is easy, as long as you do it within 30 days of your statement. Having someone apply for a cc with your info can bite you in the butt if you're trying to buy that car or get that mortgage, so you make sure you check well in advance and make sure that window of exposure is a small as possible.
Re:Are the stolen records ever used? (Score:3, Informative)
No offense.
Re:As a recent graduate... (Score:3, Informative)
- Experian [experian.com]
- Equifax [equifax.com]
- Trans Union [transunion.com]
Review who is looking at your credit report, and report suspicious activity to them. Having seen a few personal credit reports of people who were using their personal credit to establish a business line of credit, I've seen statements on them like: "Don't issue any credit to this person before contacting me at 111-222-3333".Isn't there a law?? (Score:2, Informative)
I know that many institutions and businesses use it (SSN) that way, but isn't it against the law? Or did I misinterpret the statement from the bank?
Re:Slightly OT - choice of credentials (Score:4, Informative)
Who would have thunk it?
Re:Penalties (Score:4, Informative)
UT students in the dark (Score:2, Informative)
Re:Slightly OT - choice of credentials (Score:5, Informative)
A bigger problem is that everyone assumes SSNs are unique. They aren't. At best they can only uniquely identify 1 billion people. "Easy," you say, "There aren't 1 billion people in the United States." There were 281 million in 2000. The birth rate is 14.5 per 1000, and the death rate is 8.7 per 1000. While the birth rate is declining, the life expectancy of a person is lengthening. Additionally, it can not be expected that the birth rate will continue to decline to 0. This means that, while it won't happen any time soon, eventually there will be more than 1 billing people in the US.
The next problem is that when you die, your SSN is NOT REUSED until your estate is closed, at a minimum. My mother's estate was not closed for nearly two YEARS after her death, and hers was a simple estate. Some accounting setups could cause you SSN to be used for many years after your death.
Re:Illegal? (Score:3, Informative)
Lets see. (pulls out wallet and get SSN card)
Nothing on the front but my name, SSN, my signature and the Social Security logo.
On the back I have this:
plus the SSA form number.
Nope, don't see anything telling me not to share this number....
Kent
Re:SS as ID is INSANE!!! (Score:3, Informative)
A common misconception. Federal agencies are now somewhat restricted in how they use it (5 U.S.C. Sec. 552A) and some states have laws about it in certain circumstances, but one the whole there's nothing illegal about it.
Some Googling:
http://www.cpsr.org/cpsr/privacy/ssn/ssn.faq.html# IsItIllegalToAsk
p loyalert0205.asp
http://www.lawcommerce.com/newsletters/art_OHS_em
http://www.usdoj.gov/foia/privstat.htm
I'm sure intrepid Googlers out there could find more.
Re:What's the big panic about SSNs? (Score:2, Informative)
Or get a driver's license.
Or sell it.
Or make your life a living hell until you can change it.
- OrbNobz
"Mind if I drive?" "Not if you don't mind me clawing at the dash and screaming like a cheerleader." - Sam n' Max (vice versa anyway)
Re:Isn't there a law?? (Score:5, Informative)
Private businesses can request your SSN if they want... you don't have to give it though. But if you don't, they don't have to give you whatever you're looking for either :)
However, UT is a public school and is subject to the restrictions on government agencies... here's [uncg.edu] a page with some info on the use of SSNs in public schools.
Anyways, as a former UT Austin student, I'd be annoyed if my SSN was one of the ones that got out... and if so, I wonder how UT plans on contacting me--as far as I know, they don't have my current address, phone number, or any other type of contact info. As a side note, the first year I was there (1988), a lot of professors posted exam grades outside the classroom indexed by SSN... I guess someone put a stop to that :)
Re:Slightly OT - choice of credentials (Score:2, Informative)
Re:Action (Score:3, Informative)
Re:I used to go to UT Austin (Score:3, Informative)
As for student notification, go to the bottom of the UT article; The last section is headed "How will affected individuals be notified?" and gives an e-mail address.
SSN at UT (Score:5, Informative)
For many years, UT had a non-centralized IT infrastructure. That is, the Colleges did one thing, the Administrative Computing Group did another thing, the Academic Computing Group did yet another thing, and the Libraries something else entirely. This was recently changed with the introduction of a new Office of Information Technology head by a new Vice Provost (Dan Updegrove, originally at Yale). One of the very first things I heard him address was the Social Security number problem in which every student, faculty, and staff member used their SSN as their ID. That practice had to change in order to meet both legal and privacy standards (see FERPA [cpsr.org]) , and UT has been trying for the past couple of years to make that happen. The trouble is, it was so integrated into all of the different services and departments that it is a slow process to remove it. They started to phase it out, but now UT is seeing the effects of this particular practice. I'm likely one of the ones who will be affected, so I'm waiting for them to announce where people can find that out. (It may be at the UT site, http://www.utexas.edu/datatheft/ [utexas.edu].
The Daily Texan (student newspaper) has an article about the theft [dailytexanonline.com], as does the Houston Chronicle [chron.com].)
By the way, your Social Security Number isn't public information. It is required for use by some agencies of the government, but you are not required to provide your SSN to private groups unless they need to interact with certain government agencies (this includes your employers, who deal with the IRS). That being said, SSNs are so commonly used a search may pull up that information- but that doesn't mean it is legally public info.
Re:Clarification? (Score:2, Informative)
Such a transition will be entirely difficult and time-consuming. The university is interested in making the transition, but the issues which arise from a multitude of departmental management techniques are wide-ranging and difficult to tackle. The recent changes to the UT EID system (a unified login scheme to manage campus life and services) are just the beginning og a long uphill IT battle that is being tackled (...we hope
Re:Penalties (Score:2, Informative)
Re:Action (Score:2, Informative)
Social security numbers are not guaranteed to be unique! In the early days it was allowed for an individual to share their number with a non-working spouse. The spouse recieves reduced benefits after the primary has died.
I've contracted at several major health insurance companies. That's where I first encountered records of two individuals with the same number. This is no longer allowed.
I believe the numbers could be re-used after death, but I haven't seen this my self. Maybe someone out there in /.-land has better info on that.
last semester for SSN identification (Score:3, Informative)
Re:Action (Score:3, Informative)
Re:I used to go to UT Austin (Score:4, Informative)
Am I Affected?
Is your SSN in the following ranges?
449-31-98xx - 450-91-24xx
451-12-32xx - 451-20-35xx
451-20-64xx - 452-20-40xx
If so, within these ranges, 55,200 people of the following types, including but not limited to:
Current students, faculty and staff
Former students, faculty and staff
Job applicants
Retirees
may be affected.
another reason they aren't unique (Score:2, Informative)
Re:As a recent graduate... (Score:3, Informative)
Re:What's the big panic about SSNs? (Score:2, Informative)
Again, it might surprise some of you ;-), but this is exactly the reason you can only apply for a credit card (loan, mortgage, etc) IN PERSON.
Sounds inconvenient ? Well, it depends on how secure you need to be. Typing in passwords is inconvenient as well...
Re:What's the big panic about SSNs? (Score:4, Informative)
From that I can only assume that you live in the US ? Which, I guess, just proves my point that it is a system just waiting to be abused.
Never mind what those spams may say, in Europe you cannot get a bankaccount without applying in person. I guess there may be CC companies that are so eager to close that they trust me without proof. But I reckon that even those will send letters to your address that you have to return to them, signed. Which does prove at least two things to them: (A) you have physical access to the mailbox/streetaddress you supplied, and (B) they have your signature on paper, which can be useful to prove you signed it (and if need be, all the way though handwriting recognition experts).
In any case, that is better than nothing.
Learn about fraud alerts (Score:3, Informative)
http://www.fightidentitytheft.com/flag.html
and if the drawbacks don't sound too bad (think carefully!) make the calls. It takes about a half hour. Much less than the time you'll spend untangling the mess of an identity theft. You may also consider calling your bank and creditors to ask them to put similar holds on your contact info so that some clever scammer doesn't have your statements forwarded to Timbuktu, thus gaining them extra time to run amok and causing you even more grief. This isn't paranoia talking, it's experience.
Here are the numbers.
Credit Bureau Fraud Departments
TransUnion
Fraud Victim Assistance Department
Phone: 800-680-7289
Equifax
Consumer Fraud Division
Phone: 800-525-6285 or: 404-885-8000
Experian
Experian's National Consumer Assistance
Phone: 888-397-3742
Re:Action (Score:3, Informative)
1) The purposes of reporting individual tax information (such as wages and salaries).
2) The payment and qualification for social security benefits.
Alot of people do not believe the above, because they have gotten used to it and have accepted that people will use their SSN for means of unique identification number. It's great for database developers to just use your social security number as your customer ID. Because we know that SSN's are unique. Example, if you go to a hospital, what do you think your ID is? Now, you have the absolute, 100% right to refuse to give ANYONE your social security number. (Aside for the above reasons) In the above example, the hostipals will probably insist. But they most definately treat non-americans (either visiting the US or here on a Visa). These people do not have SSN's. The SSN's have become a defacto National ID card only because people have let it become so. That being said, your social security number is NOT a national ID card system, although it is being used like one whether we like it or not.
Re:What's the big panic about SSNs? (Score:4, Informative)
In Germany, the post offers a service called postident [deutschepost.de] - the mail carrier will only give you the letter if you show him your passport, and he'll send the passport number back to the sender of the letter.
The system is in place for years, afaik it's the only way to open accounts at internet only banks. No need for a magic SSN.
University of Florida (Score:1, Informative)
Furthermore I think the FERPA (Family Educational Rights Protection Act) makes it illegal to use even partial identification numbers to post grades. You can read more about the University of Florida's system at http://ufid.ufl.edu [ufl.edu]
Re:What's the big panic about SSNs? (Score:2, Informative)
You are exactly right, the system is pretty much screaming "abuse the hell out of me".
Here, you can pretty much get credit card applications with no effort. When I buy a book from my campus bookstore, it comes with a damn credit card application stuffed in it. The credit card companies decided, I guess, that it is profitable enough to make credit incredibly easy to obtain that they don't mind eating the cost of occasional fraud. Unfortunately, this hurts those whose identities have been stolen, as they have to take the time and effort to clear their credit rating.
It is a bit of a necessary evil (Score:2, Informative)
Re:Action (Score:3, Informative)
Anyone born in the last 15 years has often had an SSN assigned shortly after birth. Previously, it was typically issued when you opened your first bank account, or when you took your first job.
So that, combined with a person's age (or reasonable approximation) has a strong correlation for checking validity.
If you see a 45-year-old male with a brooklyn accent showing up with an SSN that was issued five years ago in Oregon, it would raise an eyebrow or two.
Back to this breakin.. It's time to treat data repositories like banks: Regulate them, and refer anyone who even tries to break into one to www.bop.gov for a nice long visit.
Am I Affected? (Score:3, Informative)
* 449-31-98xx - 450-91-24xx
* 451-12-32xx - 451-20-35xx
* 451-20-64xx - 452-20-40xx
If so, within these ranges, 55,200 people of the following types, including but not limited to:
* Current students, faculty and staff
* Former students, faculty and staff
* Job applicants
* Retirees
may be affected.
Princeton's security breach ... (Score:3, Informative)
http://www.ispep.cx/files/tucson.princeton.edu.tx
Mod this up as Informative...
There's a lot of that going around lately (Score:2, Informative)
Not Unique (Score:2, Informative)
Kansas University was hit hard in late January. SEVIS was pilfered, Student Exchange Visitor Information System; part of the Patriot Act)
Info here [ku.edu].
Re:Why there hasn't been any reform on SSNs (Score:2, Informative)
It's a little-known and often-ignored-anyways fact that businesses and schools, etc. are NOT supposed to use your SSN for identity purposes. You have the legal right to DECLINE giving your SSN for any reason other than tax purposes (i.e. employer records, etc.)
When it started becoming more and more common to ask for SSN as an identifier, people just forgot that they could say "No", and presto! instant "standard".
FYI, if you are ever the victim of "identity theft" - credit cards issued in your name, bank accounts opened with your SSN, etc. - be aware that you are NOT allowed to change your SSN for any reason other than your life is in danger, i.e witness protection program. Harrassing bills for stuff you never bought? Hundreds of dollars spent faxing, duplicating, and mailing off documents to all the credit agencies explaining that your identity has been stolen? Tough cookies.
Another FYI, I have never had a fraud investigation department have anything more than a passing interest in WHO might have perpetrated the crime. The only thing you can do is re-new the flag on your credit report so that people HAVE to at least contact you by voice to allow a credit app.
My advice to anyone who has had their identity stolen - don't procrastinate in notifying the police and the major credit agencies, in writing, about your situation. Cancel any credit/store cards you don't use - make ESPECIALLY sure the account is permanently closed and not simply dormant to be reopened at a later date. I know for a fact, SEARS is guilty of that.
Finally, periodically request copies of your credit records to check for any unusual activity.
It'll be a looong time before the problem goes away.
blue
Re:What's the big panic about SSNs? (Score:3, Informative)
This surprises me as well, and I am from Canada. I have actually never applied for a credit card in person. I've done it by internet and by mail. Sometimes you have to pick it up at the bank branch, other times it comes in the mail to your home.
I actually work in the Credit Card division (VISA or Mastercard, but I won't tell you which ;-) of one of North America's 10 largest banks and I can tell you that this 'not in person' system DOES have its problems. Fraud is the curent biggest monetary loss for the bank. I won't post some of the methods the crooks use to take advantage of this mail and internet system (because I don't want to help budding fraudsters,) but it is truly nefarious. Fraud of credit cards is actually incredibly easy in Canada and the US, and it's going to get worse before it gets better. One big problem is that you don't need a PIN for the cc's and it is very rare that a merchant actually looks at the signature on the card. You could sign any old name and get away with it.
Now in Canada the system with SIN (social insurance numbers) is better than the US because by law, they can only be used for purposes related to paying taxes to the government. My SIN number is only used when starting a new job, opening a bank account that earns taxable interest, applying to university, paying taxes, and that's about it.
Biometrics are bad m'kay? (Score:3, Informative)
Then there was the amusing experiment where a bunch of Germans managed to fool retina scanners using printed images of eyes that could be taken at a reasonable distance with a camera.
Xix.
Perspectives from one of UT's sister universities (Score:3, Informative)
The administration's response was "Come Summer 2005, when we have our new Student Information System, we won't use anyone's SSN" but that in the meantime, we're screwed because they weren't going to change anything.
A month ago I discovered the 'secure' portion of the Housing department's website had been indexed by Google, including the ID # (Social Security Number) of all 1200+ residents living in the on-campus dorms. This highlighted the need for the immediate cessation of collecting and storing SSN's, so I've introduced a follow-up resolution our Student Congress is looking to pass soon basically demanding each department document every way they use SSN's and the security measures in place to protect them, after which we want a committee of students and faculty to go through the documentation and approve or deny their use and storage of the SSN's.
Our school paper, The Shorthorn (www.theshorthorn.com [theshorthorn.com]) is supposed to do a story in tomorrow's (Friday's) issue concerning the leak at UT-Austin and the fact that administrators so far at UT-Arlington are ignoring the need to provide secyrity for SSN's NOW, and not just in 2005.
It should be interesting to see if the administration has finally 'seen the light' and will listen to us, this time.