Berkeley Grads' Identity Data Stolen 289
yali writes "Did you get a graduate degree from Berkeley? Or maybe you just applied but didn't go there? If so, your identity may have been stolen. A laptop was stolen containing names, social security numbers, birthdates, and addresses of grad students, alumni, and applicants. University police suspect that the thief just wanted the laptop, but the irony of California's mandatory notification law is that the thief may now know they have something even more valuable. Berkeley has set up a website with information on the breach."
Re:Why do they need the SSNs? (Score:5, Interesting)
The real problem: unchangeable passwords (Score:5, Interesting)
It seems like this could be solved with a public database of SSNs and birthdays. Once you list yourself, you can tell credit bureaus and banks that this information has been widely published, and therefore anybody who acts like it's a secret is negligent. Civil disobedience for the information age.
I am too chicken to go first, though.
Biometrics (Score:5, Interesting)
These leaks aren't gonna go away, so we'd better start finding ways to make them irrelevant. Sure, it'd be inconvenient and raise privacy concerns, but I'd rather have my prints on file than have my bank accounts cleaned out and credit ruined with little, if any recourse, solely due to someone else's blunder.
Great (Score:2, Interesting)
Re:Why do they need the SSNs? (Score:2, Interesting)
To answer my own question... they could, and quite easily. The difficulty lies in transitioning all your data systems from one ID number to the other.
Can you say "Irony" (Score:5, Interesting)
Why does the notifcation have to be public? (Score:4, Interesting)
As I read the law personal notifcation is not only allowed it is prefered. The complants about "now the theves know they have something valuable" seems like it is more a result of the choice to hold a press conferance and save the cost of a lot of stamps.
Re:The real problem: unchangeable passwords (Score:3, Interesting)
The real problem is that banks, credit bureaus, and schools are allowed to continue to pretend that knowing someone's SSN and birthdate is proof of anything.
Schools maybe, but what bank or credit bureau does such a thing?
It seems like this could be solved with a public database of SSNs and birthdays. Once you list yourself, you can tell credit bureaus and banks that this information has been widely published, and therefore anybody who acts like it's a secret is negligent.
I am too chicken to go first, though.
The problem is, you'd probably be negligent for listing yourself in such a database.
If you really want to make harder to get a loan, just call up the three credit bureaus and tell them that your identity was stolen. They'll put a note on your credit report and you basically won't be able to do anything by phone any more.
I fail to see how this is a good thing, though.
At Least It's Not Arrogance (Score:5, Interesting)
Anyway, my role was to prepare reports for various people around campus. For example, if a student organization required a given GPA for membership, their faculty advisor could request a report of all students meeting the criteria.
The thing that most amazed me when I started working there was the complete lack of respect for people's social security numbers and birthdays. Any professor on campus could get pretty much any information he or she wanted.
Even more brazen than this activity was the infrastructure on campus. Every user ran their applications over a telnet session. Yes....telnet. I demonstrated to my boss how easy it was to run a packet sniffer and catch social security numbers as they went across the wire..but all my concerns fell on deaf ears. I also showed them how SSH could be used as a direct replacement for telnet but again...no one seemed care.
I then wrote a letter to the editor of the University's only newspaper describing the lack of respect for peoples' personal information, but the letter was never published. When I e-mailed the student editor and asked why my letter wasn't published, she said she was asked by the administration not to run it.
I graduated in 99 so I'm not sure if any changes have been made. I would love to know.
Too much (Score:2, Interesting)
Re:The real problem: unchangeable passwords (Score:3, Interesting)
Re:Why does the notifcation have to be public? (Score:2, Interesting)
Re:At Least It's Not Arrogance (Score:2, Interesting)
Anyways, who should I go talk to? I also know a CS gradstudent here.
I could give my liberal hippy friends soemthing to protest about on campus.
idiots (Score:5, Interesting)
Something tells me the whole thing was on Excel.
There is absolutely no reason to have anything like this on a laptop. If there is some reason one would need the information from a laptop, you can access it from a server using a client that won't make a local copy. Ridiculous.
Re:The real problem: unchangeable passwords (Score:3, Interesting)
But.... I've happily gone around not giving out my SSN.... Given Blood, etc, etc... just say "sorry, I don't have one".
Re:The real problem: unchangeable passwords (Score:1, Interesting)
Have a system where US citizens (Gotta HAVE a SSN) fill out a bunch of such data, and then it's hidden.
Gone, invisible. Noone else can see it.
Untill, lets say, a million people sign up.
See? Noone has to be the chicken.
And you better encrypt that system
California Universities (Score:4, Interesting)
As an aside, my girlfriend lives in California, and someone opened a credit card in her name soon after she had sent in applications to several California universities applying for grad school.
Re:At Least It's Not Arrogance (Score:2, Interesting)
The only reason I could see for us having SS# was that without them we were relying on names to be unique within a given class of 30 people - a problem I didn't run into in 2 years of being a TA. But a simple unique student ID would serve that purpose as well - and the last few digits of that could be read aloud without any risk to distinguish the two students on the first day of class.
For basic stats classes (STAT 200, later 2000), we also had them fill out their SS#s on the scantron forms.
Colleges by and large don't respect privacy (Score:3, Interesting)
If you lost your ID, it was a simple matter to go down to Student Accounts and get a new one for $10. But since the SSN is used as an ID, the old ID card couldn't be deactivated and the missing one could be used by whoever found it.
Thankfully, last year they switched from using SSN to a 12 digit ID number generated by the college. However, "lost" cards are still usable
Re: Not all school are alike (Score:1, Interesting)
Everyone now must use there eID to access email, the central unix servers, use K-State Online, and a host of other services.
The general idea is that a person is assigned an eID and a dirkey. The eID may change in the future, but a single person is guaranteed to have only one dirkey over their lifetime. The dirkey is a CHAR(12) primary key in Oracle.
Lawsuits? (Score:5, Interesting)
If you just slip and fall on the grounds of a business, you can expect to make a couple 100 Gs for "mental suffering". Why not do the same here? People should get together and file class-action lawsuits left-and-right. Then watch the companies scramble to protect the data.
Don't get me wrong: I am dead against frivolous lawsuits. But the language of financial pain is the only language these businesses understand. "Morality" is a word that is not there in their lexicon.
Re:Why do they need the SSNs? (Score:2, Interesting)
Re:Why does the notifcation have to be public? (Score:3, Interesting)
You also have the people factor (Score:1, Interesting)
I soon began to receive more mail from them, including invitations to reunions, which I accepted. It was awkward at first, but as I researched other Alumni's lives, it became easier to pass myself off as an Alumnus myself: "Hey Thom Davis! Do you remember the time when you accidently got your foot caught in the broken-open drainage ditch? Oh, that was a hoot! And I'll never forget the look on your face! Har har!" Soon, with subtle suggestion, most Alumni even began to "remember" me and several of my antics. Amongst these Alumni was someone who had strong connections to the original Administration... I thought my charade was up - but much to my surprise, when he didn't find my name in the original records, he offered to help me "correct" them! "After all," he said, "Everyone here remembers you; the administration is at fault. What was your degree again?"
Okay, it wasn't quite as simple as that, but in the end, I got my Harvard degree without ever attending. I nudged someone else off the list and took his place. I stole someone's identity and made it my own. In short, identity theft is also an administration issue.
Malus Dei
SSNs - problems, reasons (Score:3, Interesting)
I am not from the US, but I was sent there for a few months to work. My wife came too for the holiday.
Some random notes about life without an SSN...
-
I decided to open a US bank account. Got a check book ok. Got a debit card. Then the fun starts - the bank calls back after two weeks to cancel the debit card. No SSN. The checks are 'starters' even though they start at 1000 (to fool those pesky shop clerks on the look out for checks that start at 1). Everyone refuses to honour them. So banking was a bust.
- Couldn't use checks at walmart - no SSN.
- Couldn't use VISA at Best Buy because it wasn't a US based VISA, and (you guessed it) no SSN. I did point out that I have used that VISA all over the world, except this very store.
Strangely, I have purchased from there many times since so perhaps I just hit a loser that day.
- A bank clerk called my passport a forgery when I tried to withdraw my money (since I couldn't use checks or cards) because it had a date "15/3/1967" - to quote ("there's no 15th month").
I eventually found a website [cpsr.net] that provides fake SSNs you can use with minimal chance of dups. Suddenly everything went smoothly at the supermarketThe reason I think that SSNs are dangerous is that because it is a simple ID, America has become tied to it in a dangerous way. Its become a widely respected and accepted ID. But there is no security associated with it. SSNs leak easily but encapsulate too much power - your SSN gives me trivial access to stuff thats yours.
Picture ID cards, money, drivers licences carry numerous security precautions - holograms, encoded data, special paper, the physical look of them. They are harder to duplicate (although it still does happen).
What is missing is that the SSN should be a first step to identification - perhaps as a replacement for your name + birthdate (yeah, I know.... "I am not a number"). Then follow it up with other identifiers - license, other data only you would know.
And people who dont need it *specifically* should not be permitted to force it from you. Sure, you can take your business elsewhere, but usually its a pain, and sometimes you just can't.Personally I think it should be restricted to government departments only.