By Derek Hawkins
In light of a recent identity theft scare at Yale University – in which thieves stole two university computers that contained the Social Security numbers of more than 10,000 current and former students, faculty and staff members- Northeastern officials said private information is well guarded.
Since February, Information Services officials at Northeastern have introduced two major initiatives to limit and protect the use of Social Security numbers at the university.
Such measures, they said, will greatly reduce the risk of exposing Social Security numbers and personal records of Northeastern students and employees.
In the first initiative, the NUID Project, Information Services officials replaced Social Security numbers with randomly-generated, nine-digit numbers to be used as student identifications.
Until then, Social Security numbers had been the university’s primary means of student identification and had appeared on class rosters and other unprotected documents.
The change affected about 200 university systems and more than 1 million records, said Information Services Director Bob Weir, who led the project.
“We take information technology security incredibly seriously,” Weir said. “We have not had any significant security breach in the last 10 years. [But] you never say never. It’s a topic that’s always evolving and always challenging.”
To complement the NUID Project, Northeastern adopted the Social Security Number Collection, Handling and Use Policy. Enacted June 1, the policy limits university’s use of Social Security numbers to “purposes required or permitted by law or regulation, and in matters of inquiry conducted by authorized university officials.”
Glenn Hill, director of Information Security and Identity Services, drafted the policy, which he said set new standards for handling sensitive information.
“The only place we store Social Security numbers now is where it’s required or university policy – which tends to mirror regulation – like payroll or financial aid records,” he said. “If somebody is asking you for an SSN now you should be surprised.”
The new policy and the NUID Project, combined with monthly security training seminars for faculty and staff, have bolstered protection of private information and reduce the risk that Northeastern will experience a crisis similar to Yale’s, Hill said.
Information breaches, however, are not uncommon among universities. Privacy Rights Clearinghouse, a nonprofit consumer advocacy organization, has tracked nearly 250 instances of private information breaches this year. Of them, more than 60 have occurred at educational institutions. Northeastern was not on the list.
Students said they felt Social Security numbers were safe in university systems and viewed the possibility of identity theft as remote.
“Those things don’t really preoccupy me,” said Peter Boller, a middler history major. “I’m not totally aware of what dangers of foul play exist, but I generally trust the university.”
Middler music industry major Arielle Cwerm said she thought the NUID Project added a necessary degree of protection.
“When the change took place it occurred to me that there was a degree of risk,” she said. “It’s better that they don’t use our Social Security numbers for IDs anymore.”
