Students, faculty and staff across the country are at risk for identity theft due to the policies and procedures followed by their college or university, including those at Stony Brook University. The use of social security as the primary form of identification for students has created many problems associated with fraud.
On Apr. 24, 2007, the names and Social Security numbers of almost 90,000 people in the Stony Brook database were visible through the Health Sciences Library web site and available through Google Cache. This information was kept there for nearly two weeks until university officials discovered the mistake.
In late March, a University of California at San Francisco server that stored the names, contact information, and Social Security numbers of about 3,000 cancer study subjects were stolen from a locked office.
Last Friday at Montana State University, an unknown individual breached a university server containing the names, credit card and Social Security numbers of 1,400 students.
Dozens of other institutions, including NYU, Northwestern University and Ohio University, have reported security breaches involving thousands of Social Security numbers at a time.
With the rising rates of security breaches reported by educational institutions, universities across the country are making the final effort to convert their reliance on Social Security to a system of randomly assigned numbers.
According to a study released in 2002 by the American Association of Collegiate Registrars and Admission Officers, 50 percent of the 1,036 responding institutions used Social Security numbers as the primary form of identification, while 41 percent reported that they assigned random identification numbers to students that are independent to Social Security although they still relied on Social Security numbers as a secondary form of identification. Since then, a large number of universities have eliminated the use of Social Security numbers when possible.
SBU currently uses randomly assigned ID numbers as the primary form of identification, said Eileen Ippolito, a staff assistant at the University Counsel. ‘Stony Brook changed over to the ID system because people had concerns’hellip;Stony Brook took the initiative to change,’ Ippolito said. The social security identification system took a total of 5 years to phase out because ‘there were so many systems based on social security.’
Part of the reason why so many educational institutions are converting to randomly assigned numbers is because many laws have been enacted to limit the use of Social Security.
In New York State, this legislation was enacted in August 2000. The law prohibits the public display of a student’s Social Security number but allows it to be used for the institution’s own internal use. In other words, a student’s Social Security number is not allowed to be posted or publicly listed in student directories, class rosters, student ID cards and grade lists.
Some exceptions include the use of Social Security numbers in connection with student employment to document and report wages. The Internal Revenue Service depends on social security as the primary form of identification so many financial and tax services also keep this record. All colleges must issue a 1098-T, or the education tax credit, for each student in all college credit classes. Thus, colleges are still required to collect these Social Security numbers.
‘[Social Security numbers] is in our records due to the IRS and the student’s records could be accessed through Social Security numbers,’ Ippolito said.
To identify students who have forgotten their IDs, many staff members can still access computer screens that link the students’ names to their Social Security numbers. This ability has also raised much concern.
‘It’s your whole life out there, your credit score’hellip;everything. All your information is open’hellip;It’s your whole identity, it’s you,’ said May Castro, a senior at SBU.
Many other institutions also rely on Social Security as a primary form of identification. Any communication the university makes with other organizations such as the Department of Education needs to be communicated through the student’s Social Security number.
Some have pointed out that from a records perspective, a student’s Social Security number is necessary in case of complications that can arise from students having the same name or even birth date. Other complications occur when a student changes their name without notifying the school.
Alumni who ask for records of their transcripts years after they graduate may forget their student ID number but will remember their Social Security number.
‘Ten years down the road, [the student’s transcript] would be tracked through their Social Security number,’ Ippolito said.
Universities in other states that do not require educational institutions to limit the use of social security have also begun revising their identification systems. In the beginning of last summer at the University of Georgia, a multi-year plan was established to eliminate the use of Social Security numbers by converting to a randomly assigned nine-digit number system.
‘ ‘
SBU has maintained their stance on this issue.
‘We are striving to be social security free,’ Ippolito said.