U. makes progress in privacy protection

Occurrences of identity theft have been increasing over the last two decades and in response, Penn has intensified its efforts to protect students' personal information.

Identity thieves have left hundreds of individuals across the nation -- including students -- heavily in debt and with destroyed credit. Social Security numbers, formerly the primary identifier of students at Penn, are the gateway to accessing the personal information needed to perpetrate these crimes.

After the U.S. government passed federal legislation in the early 1990s, institutions have been "moving their student information systems away from reliance on the Social Security number," said Peter DeBlois, spokesman for Educause, the association for information technology professionals in higher education.

Penn followed suit, taking a major step in 1997 by removing Social Security numbers from PennCards -- the University-issued identification card. Another major step was the August 2002 move from Social Security numbers to the use of the PennKey for online academic resources, including Blackboard and Penn InTouch.

Since 2000, the University has spent significant time and money addressing privacy concerns and evaluating Penn's effectiveness at securing students' personal information.

The Task Force on the Privacy of Personal Information issued 17 recommendations for improvement in a report in 2001.

These recommendations led to the hiring of Chief Privacy Officer Lauren Steinfeld -- the first in the Ivy League -- and the establishment of an infrastructure designed to deal solely with privacy issues.

"Some of the University's biggest gains lie in the creation of the privacy infrastructure and the focus on awareness," Steinfeld said.

Currently, Penn has a Privacy Senior Executive Committee comprised of senior administrators and faculty, and has designated a privacy liaison to each of the University's 12 schools.

Recently, the University made a move toward using only the last four digits of Social Security numbers to protect students in cases where the number is still necessary.

"It's a significant improvement," Steinfeld said. "It's hard to do anything in terms of committing identity theft using the last four digits."

To further combat identity theft, Steinfeld has been working to raise awareness of the issue in the Penn community, including efforts such as the Penn Privacy Web site and presentations at New Student Orientation.

However, the University recognizes that there is room for improvement regarding privacy security, and in general, administrators are responsive to issues as they become aware of them.

For example, until yesterday the credentials file registration form posted on the Career Services Web site included a space for students to write their entire Social Security number. Career Services Director Patricia Rose said she was unaware that the registration form was still on the Web site. Now, the form requests only the last four digits.

Overall, officials said they are committed to remaining at least one step ahead of identity thieves.

"We've made great progress," said Gerald Porter, chairman of the task force and Mathematics professor. "But we have to always be careful because those people who want to hurt us by stealing identities are always going to find new ways of doing it."

Please note All comments are eligible for publication in The Daily Pennsylvanian.