Posts Tagged privacy

IU must be held responsible

The recent discovery that someone downloaded 3,230 names and Social Security numbers, including mine, from the Bursar’s computerized records has shaken my confidence in IU. What upsets me most about the situation is the amount of time that passed between discovery and notification. In my case a total of 18 days passed between the time my information was compromised and the time I received the letter telling me that an unknown user had downloaded my name and Social Security number.

What is additionally upsetting is that the Bursar’s office kept this information within its office until Feb. 20 — a full 14 days after they discovered this information. Only then did the staff tell the University administration — 14 days during which mass publicity could have put the University on alert and helped us protect and safeguard ourselves.

Without a doubt, the Bursar’s office let down the 3,230 students whose names were compromised.

The initial letter I got from the Bursar offered no apologies, no details and no real assistance, other than two Web addresses. It was the news stories that came out after the letters that started to provide additional information — the dates of break-in, the number of students involved and the assurance the problem has been fixed.

Let me say right now I am glad the problem has been fixed, but I am still dismayed at the response of the Bursar’s office and of IU administration in general. As such, I believe IU must take tangible actions to assure students this will not happen again and that there is genuine concern on the part of the administration, as opposed to platitudes that came out in the first few days. It was not until Wednesday at the meeting organized by the Graduate Student Organization that I heard anyone from the administration apologize.

This type of incident has happened before at IU and other universities, including the University of Utah. The major difference between IU’s response and that of the University of Utah to a similar situation seems to be the level of caring. At the University of Utah, exposure happened two and a half years ago, and involved more than 23,300 students, faculty and staff. The university contacted local media even before sending out letters, to give people a heads up.

Here’s my proposed deal with affected students — it is a plan that will help assuage the fears of those students whose information was compromised and a plan that will help send strong signals to University staff members.

  • IU should provide free credit reports to affected students twice a year for the next seven years, if not longer. This step will help assure affected students IU is being responsible for its gross error — and minimize student costs associated with a mistake beyond their control. It will also bring peace of mind to many affected students.
  • Additionally, IU should compensate students for the time they have spent working on protecting their names. I would estimate that each student spent about four hours on the phone calling credit card companies and checking their credit reports, and at an average rate of roughly $10 an hour, or $40 each. This is real time people have lost from other productive uses of time.
  • IU should eliminate student Social Security numbers from the University’s computer systems. There is no need to have these numbers as identifiers on Bursar accounts. There is certainly no need to put them on rosters and to use them in computer systems. I realize students at the forum were told new identification numbers were going to be issued in two years, but this could actually be implemented by the end of the semester, if the University wanted. The only place IU needs to use Social Security numbers is on federal financial documents.
  • IU must reprimand the Bursar. I realize Susan E. Cote is not directly responsible (University Information Technology Services has taken blame for the actual breach), but she is ultimately responsible for everything that happens through her office. This step will help send a strong and significant message to all University staff and faculty who have access to Social Security numbers that they will be held accountable for their mistakes.

IU can learn a lot of lessons from this mistake, and I do believe it was just a mistake. Let’s hope it doesn’t happen again.

– – – – –

Correction: During the editing process an error was introduced to this column, and the following correction was printed on March 6, 2001:

“An opinion column, `IU must be held responsible,’ (March 2) contained misinformation.  The bursar took responsibility for the breach of its database.  The IDS regrets this error.”

, , ,

No Comments

Get that camera out of my face!

Recent use of security cameras are preventing citizens from moving about the country without being recorded. This is a problem.

By Adam Lederer | Indiana University
Original Version for IDS

Here in America, land of the free, without much notice, our privacy has slowly been eroding. It has come to my attention over the past two weeks with one national story regarding security at the Super Bowl, and one supposed major criminal break right in my home town: the arrest of a man accused of being a member of the Earth Liberation Front (ELF). Both of these incidents have upset me enough to encourage me to do my best to look suspicious to anyone watching me.

Let’s just say I do not always trust my government to do the right thing and I have become immensely annoyed with the number of cameras that are out and about photographing me as I go about my personal daily business.

The most recent visible security incident was at the Super Bowl in Tampa, where every person entering the stadium had their photograph taken and the pictures run through a police database to look for terrorists and criminals in attendance. The recent acknowledgement of this security measure concerns me because you as a citizen in this country should be free to move about without your whereabouts being continually recorded

However, it was gratifying, despite the happy face that was put on the system by officials, that it was a total failure. Out of the 71,000 people in attendance, there was only one person identified: a ticket scalper, who managed to flee into the crowds and avoid capture. You cannot tell me that out of the 71,000 people in the stadium that there were actually only two criminals – the aforementioned ticket scalper and the Raven’s Ray Lewis. They had to miss a number of other convicted crooks who, having served their time, are otherwise decent citizens who have a right to move about the country in an unfettered fashion.

There is no way, however, that I can make myself look suspicious at a Super Bowl. I have no interest in attending the Super Bowl, so I have had to make myself look suspicious at home in Monroe County, Indiana, home of Indiana University. I achieved my suspect status within the community by going to Lowe’s Home Improvement Warehouse and purchasing 10-inch Grip-Rite spiral shank nails. I used my credit card and did it within full sight of the video cameras that track every purchase and every purchaser. Should the FBI need to determine who’s been buying the nails, they have me on record.

Why does this make me a suspect?

It makes me a suspect because our state and national governments have taken to watching purchases at Lowe’s and photographing license plates to determine who might have been out spiking trees in an area of the Morgan-Monroe State Forest where timber sales are conducted. The circumstantial evidence these efforts turned up was good enough to arrest Frank Ambrose, a local environmental activist and accuse him of being a member of ELF.

Out of immense curiosity, I went to the Monroe County Justice Center and sat in on Ambrose’s arraignment. There was no discussion of the evidence at this juncture, so all I saw was a nervous 26-year-old man sitting behind the defendant’s table. He was there because of a security camera at Lowe’s, a photograph of his car parked near a timber sale and investigators with active imaginations. If convicted of this Class D Felony under Indiana state law, he could end up with three years in prison and a $10,000 fine.

So my purchase of the 10-inch Grip Rite spiral shank nails is not enough to make me the total suspect. To achieve that goal, in future weekends, homework permitting, I might start hanging out in the state forests, allowing forest rangers to photograph my license plate, documenting that my car was seen in the forest — a car owned by the same person who once, on a shopping trip to Lowe’s, bought 10-inch Grip-Rite spiral shank nails.

I have never spiked a tree, nor do I have any immediate or long-term plans to do so. I have no idea whether Ambrose actually spiked the trees — but I doubt it. ELF members do not leave their cars parked near the sites of environmental actions. If they did, the 1998 ELF action at the Vail Resorts in Colorado would have been solved long ago.

What upsets me about this case is the invasion of privacy. Cameras are everywhere, and your movements and purchases are being recorded. Ultimately too much information is being collected about people and it is not always being used in ethical ways.

It’s like when you register with an e-mail list for information you are interested in, and then your e-mail address gets sold. You start receiving e-mails inviting you to view “teenage sex stars,” or worse. You can at least ignore the spam with effective filters, but when people start taking photographs and using them against you, the photographs do not exist in a context — it is only a still image of a moment in time, devoid of meaning. Were you buying the package of condoms for yourself or for somebody too nervous to buy them? Were you visiting the adult bookstore at 3 AM because you wanted to buy some pornographic videos or because you got a flat tire a block away and wanted to use their telephone? And what if you were buying condoms or porn for yourself? Whose business is it anyway?

Still images only record the fact that you bought condoms and that you were in an adult bookstore, not your reason for being there. Some might argue you should be willing to explain why you were in a particular place if you have nothing to hide.

I disagree: The presumption should be innocence, and I shouldn’t have to explain to anybody why I have 10-inch Grip-Rite spiral shank nails. I bought them, and why I bought them is none of your business.

Adam Lederer is a graduate student in Public Affairs at Indiana University. He recently learned that 10-inch Grip Rite nails come in five pound boxes, each containing 25 nails.

, , , , , ,

1 Comment

Get that camera out of my face

See an extended
Get that camera out of my face,
prepared for Student Discourse

There are times to trust our government and times not to trust our government. To be honest, I’m upset with the number of photos being taken by our government and used for investigative purposes. I’m so upset I have decided to do my best to look suspicious to anyone watching me.

To that end, yesterday I purchased 10-inch Grip-Rite spiral shank nails at Lowe’s hardware store. I used my credit card and did it within full sight of the video cameras that track every purchase and every purchaser. Should the FBI need to determine who’s been buying the nails, they have me on record.

In future weekends, homework permitting, I might start hanging out in the state forests, allowing forest rangers to photograph my license plate, documenting that my car was seen in the forest — a car owned by the same person who once, on a shopping trip to Lowe’s, bought 10-inch Grip-Rite spiral shank nails.

It seems our state and national governments have taken to watching purchases at Lowe’s and tracking license plates to determine who might have been out spiking trees in the Morgan-Monroe State Forest. The circumstantial evidence these efforts have turned up has been good enough to arrest Frank Ambrose, a local environmental activist. If convicted, he could end up with three years in prison and a $10,000 fine.

Out of immense curiosity, I went to the Monroe County Justice Center and sat in on Ambrose’s arraignment hearing Friday. There was no discussion of the evidence at this juncture, so all I saw was a nervous 26-year-old man sitting behind the defendant’s table. He was there because of a security camera at Lowe’s, a photograph of his car near a timber sale and investigators with active imaginations.

I have never spiked a tree, nor do I have any immediate or long-term plans to do so. I have no idea whether Ambrose actually spiked the trees — but I doubt it. Members of the Earth Liberation Front don’t leave their cars parked near the sites of ecoterrorist attacks. If they did, the ELF attack at the Vail Resorts in Colorado would have been solved long ago.

What upsets me about this case is the invasion of privacy. Cameras are everywhere, and it is not possible to buy things without being recorded. I think too much information is being collected about people and it is not always being used in ethical ways.

It’s like when you register with an e-mail list for information you are interested in, and then your e-mail address gets sold. You start receiving e-mails inviting you to view “teenage sex stars,” or worse. You can at least ignore the spam with effective filters, but when people start taking photographs and using them against you, the photographs do not exist in a context — it is only a still image of a moment in time, devoid of meaning. Were you buying the package of condoms for yourself or for somebody too nervous to buy them? Were you visiting College Books because you wanted to buy some pornographic videos or because you got a flat tire a block away and wanted to use their telephone?

Still images only record the fact that you bought condoms and that you were in College Books, not your reason for being there. Some might argue you should be willing to explain why you were in a particular place if you have nothing to hide.

I disagree: The presumption should be innocence, and I shouldn’t have to explain to anybody why I have 10-inch Grip-Rite spiral shank nails. I bought them, and why I bought them is none of your business.

, , , , , ,

1 Comment