Hacker News Reader

Comment by jaydub | Hacker News Reader

As an alum of UMD I'm really annoyed by this whole situation.

While I was an undergrad there, there was an incident with social security numbers being revealed on parking mailers that were sent out (http://marylandrha.blogspot.com/2008/07/social-security-numb...)

At the time I was wondering why the heck do people sending out parking mailers have access to my SSN?

After seeing this article I'm again wondering why the heck does the university retain SSN for alumni?

edit: the reason I mention this is because I think having reasonable data policies in place can help mitigate the severity of such events

View on HN

Who makes the decision about data retention in these cases? Do they plan with breaches in mind? Can anyone who works in that position shed some light on this?

Last spring I received a notice in the mail from a university I had been accepted to four years ago, but did not attend, that my personal information was exposed in a data breach just like this one. The free year of credit monitoring isn't comforting. Why on earth is sensitive information like that kept? The likelihood of people being affected just goes up.

Oh that's nothing. At Penn State, Social Security Numbers were your student ID numbers. I think this has been changed. I hope, anyway.

Same goes for my alma mater. They changed it in 2007 or so and it was a GIGANTIC pain in the ass. Of course it's worth it to not have your photo, full name, and SSN on your student ID card.

Massachusetts driver's license numbers used to be SSNs, they changed that about 7 or 8 years ago.

Indeed. This is one of the big problems with today's "save-all-the-data" mentality.

The general consensus is that there's no point removing data - since disk space is basically free ($0.05/GB) [1] and hey, we might need it later on.

[1] http://www.statisticbrain.com/average-cost-of-hard-drive-sto...

Why would a university ask for an SSN? What use would a university make of the ssn?

Information Security Operations for a tier-1 university here. If the university is public, which most are, they require SSN documentation to report to the state as technically your taxes helped pay for that school. This is all tied up in politics and documentation for everything really, but that's just how the politics seem to work. They are also required to file their assessment of your fees and tuition to the IRS via a 1098-T form.

Also you are awarded various small hidden grants on your tuition payments if you've a valid SSN as your taxes (or your future taxes) went towards that school's funding.

Reply on news.ycombinator.com