Valerie Kurkas isn't a privacy expert, but she knows what can happen if Social Security numbers fall into the wrong hands--more so in the digital age.
The computer science major used to work at a collection agency where the numbers unlocked a wealth of financial information. In addition, her husband's Social Security number (SSN) was stolen and misused to apply for a credit card. So when Kurkas learned her Edinboro University of Pennsylvania email address would contain the last six digits of her SSN, she opted for a Hotmail account instead.
"I know that even though I don't use my email account at school, most of my Social Security number is only a click away from being public information," she said. "The university should not use our Social Security numbers to identify us anyway. They don't need to use a national identifier; they can come up with their own unique numbers for us."
Although Edinboro omits the first three numbers of SSNs, most of its 7,100 students are local. It wouldn't take long for a diligent shyster to match the partial numbers with their geographical number assignments.
The university also has an online search engine that puts a name with an email address if a student's name is known or a person takes a wild guess using a common surname. Students can opt out of being listed in the directory. But with a full nine-digit-number, a scam artist could commit credit fraud or retrieve a person's current addresses, tax information, employment history, and a slew of other personal details.
Edinboro is the latest example, but it's not the only college to make part or all of students' numbers available on the Net. The practice angers privacy advocates who say the schools are breaking the law and should change their ways. (See related story)
In July, Kurkas sent a letter to the president of her university, who replied last week stating he will look into the matter.
"This is being discussed now, but I don't know where it will go. We are in the process of rewiring the campus; we're behind the power curve on that. So I think this all goes into the mix to bring us up to speed," said Bill Reed, assistant vice president of public relations at Edinboro.
"We've always used Social Security numbers to identify students," he added. "Now a student could request a new email ID, which would make them anonymous."
Still, Reed acknowledged that students may not know the danger of giving out their SSN or using part of it as email address, which can easily be strewn across the Net. Like many other colleges, Edinboro also uses the numbers for other nonintended purposes, such as requiring students to sign in with their names and SSNs before gaining access to a computer lab.
Some colleges are trying to move away from using the SSN as a student identification number. Their efforts are being stepped up due to the proliferation of the Net.
For example, the University of Michigan adopted a policy in 1993 that it would wean its information technology systems away from using the SSN as a student ID. The plan will be completed in about 2002, but after that point the university will not display SSNs on badges, ID cards, paper forms, or as the digital ID for students in computer databases, according to the policy committee report. Instead, other data elements will be used to identify students.
"Edinboro should not be using the number for email--that is poor policy," said Virginia Rezmierski, director of policy development and education for the University of Michigan. She also chaired Cause's national task force on privacy and the handling of student information in electronic networks, which released a white paper on the issue in April.
"They should come up with unique names for email. We have names for a reason," she added. "We need to stop this movement toward the use of the Social Security numbers in these ways."
Cause's white paper says that an SSN should not be collected by a school, unless the student is employed by the university or receives financial aid, for example. "These uses should not be reason for requiring SSNs for all students," it states.