Student Financial Aid Database Being Misused 182
pin_gween writes "The Washington Post reports on the probable abuse of the National Student Loan Data System. The database was created in 1993 to help determine which students are eligible for financial aid. Students' Social Security numbers, e-mail addresses, phone numbers, birth dates, and loan balances are in the database. It contains 60 million student records and is covered by federal privacy laws. Advocates worry that businesses are trolling for marketing data they can use to bombard students with mass mailings or other solicitations. The department has spent over $650,000 in the past four years protecting the data. However, some senior education officials are advocating a temporary shutdown of access to the database until tighter security measures can be put in place."
All databases eventually get hacked (Score:4, Interesting)
Re: (Score:3, Informative)
Re: (Score:2, Interesting)
Re: (Score:2)
Great, if you like brick.
He's probably talking about all the renovations and new buildings that have gone up on campus.
Re: (Score:2)
This data isn't hacked, it's being misused, they are completely different situations. This database is giving access to the wrong people who will likely use the data for data mining finiacial information. These people are given complete access like a normal university.
The real problem though is that it sounds like anyone who logs onto this system has 100 percent access to every entry even without any proof of a business relationship w
Re:All databases eventually get hacked (Score:5, Insightful)
Solution to telemarketers: just hang up!
Solution to junk mail: just throw it away!
Solution to spam: just delete it!
Are you serious?? Are you mad??
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
My phone is on one of those do-not-call lists, so if a tele-racketeer calls me, I have a little script (http://www.junkbusters.com/script.html) that, if they are persistent, might get them sued.
Solution to junk mail:
Scrap the address in the addressing box, send it back. It will add to their confusion and paperwork, maybe the USPS wants to do something about it if everybody would do it.
Solution to SPAM:
SpamAssassin, Postfix, RBL etc
Re: (Score:2, Insightful)
Not that simple (Score:5, Interesting)
It's not that simple. If the database contained only email addresses and telephone numbers, ok, noone would give too much of a shit.
Unfortunately, by the sound of it, it contains enough data for identity theft. Especially since in America a bunch of idiots decided that the SSN is usable as unique ID and/or password for everything, so anyone who knows yours already won half the battle to impersonate you. Plus the always useful (especially to a crook) information of how elligible for a loan everyone there is.
So here's a simple scenario: a crook looks through that database, finds a list of kids with upper middle class parents (you don't want to go for billionaire sons, because that might raise suspicions), also finds all the information needed to impersonate any of them to a bank, and takes a hefty "student loan" in the name of each. Just hefty enough to be worth the heist, but not quite close to the limit to raise too much suspicion and verifications. Crook buggers off with the money, and the parents are left to prove that it wasn't their offspring who took the loan. (After a round of inquisition to determine if it really was the son who blew the money on hookers, booze and dope.)
Re: (Score:2)
Re: (Score:2)
it's big in the UK too.
Re:Not that simple (Score:4, Insightful)
Re:Hacked? (Score:5, Interesting)
Re: (Score:2)
Why does the database system fulfill illegal search requests?
Because it's not a lawyer and doesn't have the information to know who's breaking the law by what request. (Note, those are separate reasons.)
Do those who have been searching illegally still have access? If so, why?
Yes, because no one knows yet they did an illegal search and even if they did, the university would have too much to gain by keeping their business.
What punishment exists for violating the re
Duh... (Score:5, Funny)
O rly?
I would never have guessed that these guys had anything to do with the 2-3 student loan consolidation offers I get per day...
I'm sure my future, not just this article, is
Re:Duh... (Score:4, Interesting)
I swear, every week I get some sort of consolidation spam vaguely disguised as a threatening pink or yellow bill.
Re: (Score:2)
Re: (Score:2)
Even worse than your ineligibility? Mine is now paid off, and I -still- get them. (Not as many, though.)
Re: (Score:2, Insightful)
Re: (Score:2)
You can't tell me that they are just sending these out to EVERYONE. They are obviously targeting those with student loans. And they had to get that information from SOMEWHERE.
Or we could stop fixing the wrong problem (Score:2, Insightful)
1. We need to reign in junk mail; and
2. Financial institutions need to stop treating a social security number as some sort of password.
Re: (Score:2)
Why so? PKI is a pretty simple concept at the high level, and most folks would just need to mentally replace their SSN/PIN/Whatever with their private key. Are people really that stupid in mass?
Actualy, they probably are, and I guess Spam Co X would just ask for their Private Key to "verify their identity" or somesuch anyway. And also consider that the folks making these kinds of decisions are generally not as IT or security savvy as the IT professionals o
Re: (Score:2)
The only way around this that I can think o
Re: (Score:2)
The remaining problem would be to convince a sufficiently large number of people that they should accept having to carry and use a smartcard when needing to identify them
Re: (Score:2)
Re: (Score:2)
The convenience of SSNs is that A) every citizen gets one (usually at birth or naturalization) and B) they are centrally managed by a disinterested party (the government). I think to go with PKI you'd need something similar to that.
If I may wax science-finctional (which is apparently really popular this morning) maybe some kind of fob you carry around that you need to know a passphrase to use.
Re: (Score:2)
it's about time, but we should do more (Score:5, Informative)
Well color me surprised. Or not. Anyone in the financial services industry is well aware that students are prime targets for all sorts of jacked-up offers. That data needs protecting, but the whole credit system in this country needs a major overhaul. [pbs.org]
What's the solution? (Score:4, Interesting)
A good example of how a good idea can go wrong is Digg. It addresses one of the sore spots about Slashdot: the ability for anyone to submit news, and immediately have it viewable by others. It also opens up the comment moderation system to everyone. It's the Digg comment moderation I'd like to consider for the moment.
What we often find is that people in the know get their posts voted down, especially if they say something unpopular (even if completely factual). An example of this is noted Slashdot poster John Randolph, who goes by the handle jcr. He often speaks his mind, and that gets some people at Digg all riled up. So they moderate down his comments. This is especially true in his posts dealing with Apple, where John says it as it is. After all, John worked at Apple for a long time. He knows how things are done there. But that's not good enough for many of the morons at Digg. They bury what are perhaps the most informative, insightful and interesting comments. It's a perfect example of how a system that tries to fix Slashdot ends up being far worse in most cases.
I could see the same thing happening with proposed solutions to these data protection problems. If it's a legislation-based approach, the law will end up making database server administration far more difficult and time-consuming. A market-based approach will no doubt have even more problems.
Slashdot's system in not really better than Diggs (Score:2)
Legislation to change the laws to make all lenders EQUAL is what is needed. Also, get the government out of the loan business and just into guaranteeing it. Let the market assign the risks. If the government thinks
Re: (Score:2)
link (.pdf) to privacy policy (Score:4, Informative)
link:http://www.ed.gov/notices/pia/nslds.pdf [ed.gov]
they sell to 'servicers' of educational institutions and i am guessing y'all signed off on it. if you are pissed about this issue a good question might be how someone is classified as a servicer.
regards.
Re: (Score:2)
Possibly, but even a simple move like eliminating the practice of Universal Default [wikipedia.org] would be a huge leap forward.
The number of credit card offers... (Score:2, Informative)
The goal is simple: hook them early, let them blow a wad of bills they don't have, and then get their parents to pay for it. For a true horror story on this, take a look at this example [sfgate.com] of a student who had no business getting a credit card getting one, and what happened. (Before you say it, this sort of thing doesn't just happen in S
Re:The number of credit card offers... (Score:5, Interesting)
The particularly obnoxious thing is not getting credit card offers... no... your student i.d. IS a credit card! It's a mastercard. You have to go online to activate it and when you do, you have the option (if you check the box every time it pops up) to NOT have a credit account attached to it.
In my mind this is even more insidious than the 5 credit card booths between the registrar's office and financial aid, and the pile of credit card apps in your bookstore bag.
There's no way to avoid getting the card and you have to work to not make it a credit card.
Re: (Score:2)
She didn't get 'a credit card'. She got more than one, as well as borrowing money from 'money lenders'. She obviously had a real problem and managed to hide it from her family and friends. Her mother DID question the new clothes and such, but that only led to hiding them better.
After the first credit ca
Re: (Score:2)
The average college student can't handle a credit card.
They do not have the resources, or experience and they are in desperate want of money.
It is entirely irresponsible to give the average college student a credit card, and yet they are marketed to en-mass.
Re: (Score:2)
Seriously, there are some shady things that the CC companies that should, no doubt, be changed, however if a college student, an adult for god's sake, applies for a credit card they should be able to get one.
Personally I'd prefer that none of the credit cards marketed to anyone en mass, but if I can throw away 10 offers a week, I see no reason why a college kid can't too.
Re: (Score:2)
Re: (Score:2)
Indeed. Same here.
My favorite solution was to tear them to shreds, put the scraps in the pre-paid return envelope and mail it. I also had a 2-sided form letter FULL of fine-print telling them why I didn't want their card, what the weather was doing in my part of the country, and describing my super-hero-like powers.
Re: (Score:2)
I had the same problem a few years ago...Called 5 times and asked to be taken off their lists over a period of 3 months, but the crap kept coming.
It took me sending their customer service an email saying any further mail would be shredded, burned, and have the ashes tossed in a nearby lake before it stopped
Only $650k? (Score:3, Insightful)
Doesn't surprise me. (Score:5, Informative)
But you can surprise them (Score:5, Funny)
Hi, you called <me/>, first class provider of premium customer service coaching for dodgey loan consolidation services providers. Before we begin, I'm obliged to tell you that this call is being recorded for customer service and validation reasons and that by continuing to use this coaching service, you are agreeing on behalf of your dodgey loan consolidation service provider to be bound by the terms and conditions available online at <free_host_where_I_posted_an_outrageous_contract>. Also you are reminded that if this is a second call by a respresentative of the dodgey loan consolidation service provider you represent, you are agreeing their behalf to the conditions of our $250000 per minute premium service as described in section 3.6a subsection z of the contract found at <free_host_where_I_posted_an_outrageous_contract>, do you understand?
.....
If things get any further.....
.....
Thank you, but I have already consolidated my loans and I'm really not interested.
Now I would advise, in order to provide the best possible customer service, you hang up. If this doesn't work for you, please call back for a premium consultation. Have a nice day. *click*
Re:But you can surprise them (Score:4, Interesting)
First, Ask them who they represent. Once they answer with the company they are working for tell them to take you off their list and any other lists they have associated with it and to make sure you don't end back up on the list again. Then tell them your not interested in the of offer and repeat the take me off the list thing again.
It is important to tell the to take you off the list first because sometimes they will hang up before you can say it after you told them you weren't interested.
I have heard that if they keep calling you after you told them to take you off the list, you can get something like $500 a pop for each time they call you after. I'm not sure about that specifically but I think the key that really makes this work is that they know you won't buy what they are selling and since you have shown that it angers you to be bothered by them, they move onto someone that will give them a commission or a sale. And trust me, This works quite well in stopping the phone calls. But you have to be specific and keep a record of who is calling. And when you tell them to take you off the list, Don't yell or scream, just speak like you are the principle at a grade school telling a third grader something they did was really bad.
Re: (Score:2)
Just to clarify -- it's not good enough to ask them to take you off their list; they'll just take you off the list of the firm that has contracted the telemarketing out to their firm.
The key is to identify both the firm they are representing (e.g., First Hassle Bank or what-ha
Re: (Score:2)
I'm not on the national "Do not call list" and I went from about four to five calls per night to less then 1 call per month. I even had one telemarketer (from some time share vacation/travel agency that i inadvertently signed up for while entering the door prize drawing at a computer show) Claim I asked to be on their list and they had a right to call me.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re:Doesn't surprise me. (Score:4, Informative)
Mail has various rates. If I grab a letter, first thing I look at is the top right hand corner. PRESRT STD. Throw way. No seriously, burn. No need to read or consider $this_offer. If anyone sends you or me anything of even the mildest importance, it's FIRST CLASS. Don't let any of the lies printed across the envelope fool you. Standard mail is always junk. However, many bills are presort first class, so be careful you notice the STANDARD or STD.
Sometimes the firm may even have the wallet to mail a first class solicitation (although rare). In this case, they probably spent a bit more money to have you throw it away.
I spam first class (Score:2)
I know some folks in my business who even go so far as to pay senior citizens in nursing homes to hand address their direct mail for them. Just trying to eek out
Re: (Score:2)
This obviously doesn't stop loan consolidation mail, but it works for credit card and other junk mail that can potentially be used to steal your identity if mishandled (aka not shredded and just tossed). I know what you are saying about the scare tactics. Credit cards are sneakier and they don't even label the envelope anymore, and you only know what it is after you open it.
Re: (Score:2)
Re: (Score:2)
Those profits, which they aren't calling profit
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What I do is this: 1) Stack up the credit card offers and stack up the junk mail separately 2) Open all the credit card offers and pull out the contents and add to junk pile 3) Collect all of the prepaid envelopes 4) Start stuffing the prepaids with all the junk 5) If the envelope is full,
Re: (Score:2)
Credit card companies don't make (much) money if you pay your balance in full every month, so they're likely to double their offers if you tell them you're in financial trouble.
The SSN is just a number (Score:3, Funny)
Re: (Score:2)
It's not the abuse, it's the incompetence (Score:4, Funny)
This past week I (a college student, with financial aid) got a letter stating I was pre-approved for a loan of $3,500 on condition of proving I own a home.
I live in a dorm. At a school in another state.
Apparently their "prescreening" folks can't even figure things out when they have a large chunk of my personal information staring them in the face.
Re: (Score:2)
This is their method of seeing if the information they have of you is up-to-date.
After all, if their information shows that you live in a dorm, that doesn't mean you still do.
it almost doesn't matter (Score:4, Interesting)
My stragegy for stopping the junk mail... (Score:5, Interesting)
1) Open junk mail
2) Remove return envelope
3) Fold up the rest of the contents as they arrived and stuff them in the envelope
4) Send it back to them
I figure if enough people do this, it can begin to make a dent by doubling how much they pay for each mailing(how many people actually sign up with junkmail anyhow) or at least maybe they will take me off their list(doubtful) but in the worst case... I am giving them they exact pain the inflict on me by having to open worthless mail.
Re: (Score:2, Funny)
Re:My stragegy for stopping the junk mail... (Score:4, Informative)
Re: (Score:2)
What you should have typed. (Score:4, Funny)
Re: (Score:3, Funny)
Re: (Score:2, Interesting)
Email on the other hand...
Re:My stragegy for stopping the junk mail... (Score:4, Insightful)
Now these scum bags are sending offers in envelopes that say things like "final notice," and "government notice." Shouldn't this be illegal? Now I actually have to examine some of the more deceiving items to make sure they're not real.
Re:My stragegy for stopping the junk mail... (Score:4, Funny)
Best. Quote. Ever. :)
Re: (Score:2)
1. Rip up their marketing material and put it to one side. Don't fold it up as they can then use it again. Also try not to send the same company their own stuff back.
2. Cram the envelope with bits of ripped up mail. If the company is a persistent offender then make get a big envlope, fill it full of crap and sellotape the envelope to it (if they want it delivering they'll have to pay extra to receive it)
3. Alternatively use the envelope
Re: (Score:3, Interesting)
I'm interested if anyone here has tried this and if it works.
Alternatively does anyone know how to stop the weekly circulars that I get every Thursday? I've had my mail shut off because I was out of town for a few weeks and my (apartment) mailbox became stuffed with these circulars and they thought I moved. I'm tired of throwing these away every week. I asked
Re: (Score:2)
Re: (Score:2)
2) Remove return envelope
3) Fold up the rest of the contents as they arrived and stuff them in the envelope
4) Send it back to them
You are not going far enough.
A prepaid envelop can be used as a shipping label to ship up to 72 lbs.
So, barring anything dangerous or restricted, add items (heavy preferably, like rocks) in a box, make sure it does not move too much in the box, close the lid securely, tabe the return envelop on it and send through the usps.
The worst they can do is ban use from us
Re: (Score:2)
I don't remember details, because I haven't been annoyed by credit card offers for 2 years.
Re: (Score:2)
Re: (Score:2)
Besides, the environment can be fixed. The amount of damage done by the extra weight in terms of fuel is minuscule compared to the satisfaction of doing something. Really, Everyone in the dorm could do this and not archive the amount of "weight" the truck could save if they had half a tank of fuel compared to the full tank. It will be more like the amount of weight that could be saved if the drive took a dump before his shift and didn't eat anything until his shift was ov
Re: (Score:2)
My god man, you're in college. When I was your age (by which I mean 2 years younger) living a little involved something a bit crazier than mailing back some empty applications to companies. Although I'll admit graduating has made me more mature (and hence more boring), I think your rebellious side is also coming off as a bit tame.
If you want to get into a technical argument, even an ounce of gas wasted makes your adventure a negative sum game. There's a reason why the p
Re: (Score:3, Insightful)
If you want to get into a technical argument, even an ounce of gas wasted makes your adventure a negative sum game. There's a reason why the post office has to charge 40 cents an envelope (and still loses money). in addition, the added cost to the company goes directly back to the consumer in higher costs.
Suppose you recycle or throw out the letter as opposed to mailing it back. Isn't fuel going to be used in those endeavors as well? If the long term result is less junk mail, then that is a positive sum game.
For the love of God don't shut it down (Score:2)
I wouldn't be at all surprised to find (Score:2)
Re: (Score:2)
It's been this way since 1980, when the Soviet Union invaded Afghanistan. As part of the high school class of 1980, I was rather pissed about it, since the draft had been eliminated a few years previously.
I'd buy that for a dollar (Score:3, Funny)
Based on the skills of some of our engineering new hires from expensive schools, I'd say the student aid itself is being misused.
more than $650,000 (Score:2, Insightful)
Wow, a whopping $650k? What's that, two salaries plus expenses?
I think that more accurately spun "the agency has spent less than $700,000 since 2003...."
It's not just colleges (Score:2, Informative)
How do I know it's the school that's been doing it? They've always spelled my name Zajary instead of Zakary on all their mailings, and that's wh
It's time (Score:3, Insightful)
This would give individuals rights around information that government and third parties collect on them, the most important being informed consent. It should be a crime to divulge or acquire electronic records without informed consent of the subject, excepting national intelligence and criminal investigation. Furthermore the right of informed consent by manadatory opt-in should be inalienable. Right now the status of privacy rights in the US can be summed up, to a first approximation, as this: if you can get your hands on a piece of information about somebody without breaking a law, it's yours to do with as you please for whatever you please.
If the government collects information about you, and it is divulged in a way that is not clearly illegal, then it becomes fair game. If you sue or are sued, the records of that suit, win, lose, or settled, can be harvested and put into commercial intelligence databases on you. If you sue your employer, you may find it hard to get a job afterwards. The records are made public to ensure the fair operation of the courts, but the same process exposes you to unfair judgment in an invisible (to you) commercial database.
Civilization will not come to an end if people are participants in how their information is used and divulged. Such rights are guaranteed in Europe via the European Convention on Human Rights. Harmonizing our laws with Europe will be good in the long term for our industry. Right now we are operating under an exception that allows EU data to be processed by American companies that promise to follow EU guidelines. But information privacy is not valued at all by companies here and therefore they aren't any good at it. It's only a matter of time before some horrible mishandling of data puts this on the trade agenda again.
Bringing ourselves up to scratch with the best international standards would be better for our citizens than digging in our heels. It would hurt some individual companies, but in the long run will allow American companies to compete better in a global services economy.
Sounds about right. (Score:2)
This happened to me today (Score:2, Interesting)
Re: (Score:2, Informative)
You were born before January 1, 1983.
You're married.
You're enrolled in a master's or doctorate program during the school year.
You have children or other dependents who receive more than half their support from you.
You're an orphan or ward of the court (or were a ward of the court until age 18).
You're a veteran of the U.S. Armed Forces. "Veteran" includes a student who attended a U.S.
Re: (Score:2, Informative)
Those restrictions are only to be declared independent on the FAFSA form automatically, you can still be declared independent by your school's financial aid office, but they are going to ask for some documentation you're paying your own lease, utilities, etc to start with. Evidence of past abuse by parents can also get you absolved of the requirements. It really is more up to the school's financial aid office more than the government if you're declared depen
Re: (Score:2)
If the answer is because he/she is still living in their home rent free then the argument about not getting help with school is bogus. Try paying for school and an apartment at the same time and you will see the help.
Re: (Score:2)
I'm all for kids being independent by college age, but to fuck him by continuing to claim him on thier taxes? fuck 'em.
Re: (Score:3, Insightful)
Because his future salary will repay them in taxes. There's a reason that countries that introduce free education go on to become wealthier a few years later.
Re: (Score:2, Interesting)
The best thing is, you really don't get junk mail from credit card companies or anything like that. If you do, just stick a note on your mail box stating "No advertisements" and the postal office will stop de