Students at risk for identity theft

Despite a University policy that prohibits professors from requesting students' Social Security numbers on exams, professor Virgil Percec's organic chemistry midterm included a line for the students to write the number.

Percec initially insisted that he would never ask students for their federal identification.

"I don't need it," he said. "I have them sign their name on the test."

When he took a second look at the exam, however, he was surprised to see that he had requested the number.

"I just took the front page from another professor" who had taught that class in the past, he said. "I didn't even pay attention."

Besides, the department has no need for Social Security numbers. They have "no value whatsoever," he said.

The number has little or no value to most faculty and administrators on campus, but Percec's class is not the only place where the numbers have carelessly circulated.

In fact, students are frequently asked to provide their Social Security number, and more often than not, this information is unnecessary.

The essential identifier

The Social Security number is issued by the federal government as a means of tracking an individual throughout his or her lifetime.

The numbers are unique identifiers, and a host of public and private organizations -- including banks, credit card companies, loan institutions, universities and potential employers -- use them frequently.

"The primary need for the Social Security numbers [at universities] is for financial aid purposes and interactions with the federal government and state lending agencies," said Peter DeBlois, spokesman for Educause, the association for information technology professionals in higher education.

"The potential for damage is enormous" if students' personal information falls into the wrong hands, said Barmak Nassirian, an official with the American Association of Collegiate Registrars and Admissions Officers.

Since the 1990s, an increase in the use of Social Security numbers has resulted in a sharp spike in the number of identity thefts nationwide.

The threat of identity theft

"Identity theft is when some aspect of your personal identity is acquired by a person who would use it for illegal purposes," DeBlois said.

The thieves frequently establish credit card and bank accounts, fraudulently take out loans to pay for expensive items and purchase cell phones in their victims' names.

The potential for identity theft increases each time an individual divulges his or her Social Security number. The federal government has passed legislation limiting the legal use of these numbers around the country. However, at many colleges and universities, students continue to be identified primarily by their Social Security number, even when another identifier would suffice.

Lack of awareness

The University has not had any reported incidents of identity theft since the Task Force on the Privacy of Personal Information issued its report in 2001, but the potential still exists.

For example, in order to be admitted to a limited-enrollment English class, students are instructed to fill out a form that requires their Social Security number.

And though the permit form was created prior to the task force report, according to Loretta Williams, coordinator of the undergraduate English program and departmental administrator, the information is unnecessary -- providing only the last four digits to the office is sufficient for identification.

"I thought all the students knew that they are not supposed to provide the entire" number, Williams said.

But most students are not aware of the fact that they can get a permit, declare a major and have a grade changed in a course without providing their Social Security number.

Though the permits and major applications in the Communication, History and Political Science departments -- among others -- request students' entire Social Security numbers, the forms in the Biology and Philosophy departments require only the last four digits.

Additionally, the common minor applications for the College of Arts and Sciences and the Wharton School include a line for students to write their Social Security numbers.

The last four digits combined with a complete name "can go a long way in uniquely identifying someone," said Lauren Steinfeld, the University's chief privacy officer. "It is usually as effective" as using the entire Social Security number.

However, this process requires more time and effort on the part of administrators.

"It's possible" to use only the last four digits of a Social Security number to declare a major or to issue a permit, said one administrator in the History Department. "It's just not efficient. ... Why have an identifying number if you can't use it?"

Despite the fact that the Philosophy Department requests only the last four digits for their records, "some students put their whole number down," said Sandy Natson, administrative assistant in the Philosophy Department.

There is a lack of awareness at all levels of the University regarding appropriate uses for the Social Security number.

Access to information

When a temporary staff member was charged with illegally accessing and using students' personal information in 2001, significant questions were raised regarding who should have access to sensitive databases -- questions that still may not have been answered.

Currently, in addition to permanent employees, both temporary employees and work-study students in various offices can access the personal information in the University databases through academic department offices, the Office of Undergraduate Admissions, the Student Employment Office and others.

"Temporary employees shouldn't have access to" sensitive information, said Gerald Porter, chairman of the privacy task force and Mathematics professor.

But Steinfeld said she believes many supervisors are currently restricting temporary workers' and work-study students' access to student information.

It's a "work in progress to turn into a policy the issues of temporary workers' access to personal information," she said.

The danger of carelessness

One sensitive database of information is maintained by the University Registrar's Office.

The registrar needs Social Security numbers to perform its administrative duties at the present time. Penn is currently researching the lengthy and costly conversion to a system that can operate without them, University Registrar Ron Sanders said.

In the meantime, administrators at the office's front desk are instructed not to ask students to say their Social Security numbers out loud.

But Sanders admitted that they "may forget from time to time."

Students have reported reciting their number out loud in the office.

While faculty and administrators should be more aware of when it is appropriate to ask for Social Security numbers, students should also be more protective of the information. Many students are more than willing to provide their nine-digit number on request

"If I ... ask my students to write down their identification number, they would write down their Social Security number without batting an eyelash," Porter said. "There has to be greater education on the fact that they're subject to great risk," he continued.

Students and faculty should also know that the Internet prone to security violations exacerbates that risk.

Members of the University community rely increasingly on e-mail. And though the medium's convenience can be taken for granted, its security cannot.

"It is difficult, if not impossible, to assure the privacy of e-mail," says Penn's 2000 policy on privacy in the electronic environment. "E-mail is not a good medium to use for sensitive matters that you would not want disclosed."

The tip of the iceberg

The problem of protecting Social Security numbers is difficult to address, and the University has spent significant time and effort to do so.

However, almost every student can cite instances when they were asked to provide their Social Security number for identification.

Carelessness and lack of awareness are the most pressing issues surrounding the privacy of personal information that the University must address in order to limit students' vulnerability to identity theft.

Steinfeld said that the decentralized nature of the Penn community contributes to the difficulties in addressing the biggest problem areas around campus. She emphasized that impressing on students and faculty the importance of protecting Social Security numbers is an effort that the University must continue to make.

Please note All comments are eligible for publication in The Daily Pennsylvanian.