Students Gain Access to Files on Admission to Stanford | Hacker News Reader

Students Gain Access to Files on Admission to Stanford

nytimes.com

128 pointsjhull94 comments

> At least one student has received the records, and said he was surprised by what he got back: several hundred pages, including a log of every time his electronic identification card had been used to unlock a door,[...]

It seems totally unnecessary to indefinitely store every door swipe. Sure, store the swipes used to access the rare book room or the chemistry lab for 6 months or a year, but there’s no reason for every swipe into a dorm or dining hall to be permanently recorded. Some amount of time between a few days and a few weeks should be entirely sufficient for every reasonable purpose.

I imagine if the systems that store all the ID swipe data got hacked, it would be possible to learn all kinds of things about students, including embarrassing secrets or enough info about movement patterns to ambush someone.

[I guess this seems like a minor thing compared to records of people’s cell phone movements, internet traffic history, etc., but I think those should be deleted within a few days to a few weeks too.]

This is one of the reasons that Richard Stallman refused to use his RFID card at MIT. If a door was locked, he would just tailgate someone in. Eventually CSAIL just gave him a key to a back door.

My university offers "Shabat" keys, as some students religiously object to using the RFIDs on Shabat (Friday night through Saturday), due to it being electronic.

Look at it from this way, its probably more work to go back and delete entries that really don't take up much disk. Heck, collecting is easy, setting up periodic purges, archives, and such, usually gets pushed to another phase.... which may never come.

another side is, its both good and bad. You can see patterns and alert to changes. You could also use it to prove someone wasn't where others claim and so on. If your really creative you can mine it and try to figure out why so many students are making trips that take time and minimize it to put more time to learning than traveling. Like we route packages in shipping companies, load the truck properly for the route, get students into a route that minimizes travel from class to class

It's definitely easier to just never delete data (assuming storage capacity is not really a constraint).

setting up periodic purges, archives, and such, usually gets pushed to another phase.... which may never come.

True, but like collecting, it's easy.

>setting up periodic purges, archives, and such, usually gets pushed to another phase.... which may never come.

Isn't that where security compliance programs come into play? I think someone doing their due diligence in asking, "What is the business justification for storing building access logs indefinitely" would have been able to create a procedure for addressing the storage of these types of things.

When I was at college a friend of mine was being accused of a heinous crime. In the end, he used key card time slots to prove he was innocent. But even with the key card it was a matter of the incident happening like a single minute after he was there. Luckily, all of the key swipes were stored and it showed that shortly after he had already swiped his card etc. Anyways, long story short, it doesn't hurt to keep that kind of data especially on a college campus.

It didn't hurt in that particular instance, and that does not mean it couldn't have been turned on him if one of the readers had failed to record (or for any other reason gave ambiguity to his motions) and placed him incorrectly where the crime took place, nor that the practice is inherently good because it exonerated one person. Any more than potentially proving that you weren't at another crime scene makes storing all of your cell phone metadata inherently OK.

Yes, they have this potential benefit, but no, they should not be reviewed solely in that context.

Who says he didn't give his card to somebody else to create an alibi?

Your friend would have been saved with even an aggressive retention policy, from the sound of it. Heinous crimes usually don't take years to pop up.

Jimmy Saville. Harold Shipman. Etc etc.

I'll agree that the crimes committed by these individuals took a long time to come to light, but I don't see that either had any relevance to the discussion about retention of data that could be used to track their movements. Saville didn't escape discovery because there was no proof of his movements. He escaped because those who were harmed by him were cowed into silence, or ignored by those whose job it was to help.

As for Shipman, wasn't it precisely because of anomalies in data collected about him that he was caught? And do you agree that collecting clinical data about doctor's use of drugs, and their outcomes vs. statistical norms might be reasonably exempted from the kind of personal data logging that many people find objectionable [me!]

If I tracked 100% of people's activity, professional, sexual, recreational, intellectual, physical, I'm sure an anecdote would arise where someone didn't go to jail because we all had this information to prove he was innocent.

I hope you're seeing how this isn't very relevant however to the question whether we want this kind of monitoring.

I also don't see how your anecdote in any way is a long story for 'it doesn't hurt to keep that kind of data'. It's a story for how 'it can be helpful to keep that data as shown by one particular anecdote'. That's not really the point, I think we all agree we could find a useful application with data, the point is that we may not want these things to be monitored for opposite reasons.

The newsletter from The Fountain Hopper (who appears to have discovered this) has some more interesting details:

When you apply to Stanford, your application gets assigned at least two admissions 'readers.'

FoHo knows you get a third (specialized) reader if you're a legacy or a 'minority' (though we're not too sure how that's defined). We also think you get an additional reader if you're an athlete or development kid (i.e. you donated $$$).

These readers (a mix of full-time admissions officers and seasonal hires) are tasked with reading thousands of applications in just a few weeks and distilling each of them into an concise, 300-ish word summary.

http://us9.campaign-archive2.com/?u=c9d7a555374df02a66219b57...

> FoHo knows you get a third (specialized) reader if you're a legacy or a 'minority' (though we're not too sure how that's defined). We also think you get an additional reader if you're an athlete or development kid (i.e. you donated $$$).

This is how pretty much every major university does admissions, so not especially interesting. The one thing to note though is that athletes usually only get a boost if the coach actually goes to bat for them as part of the recruiting process, you're not going to get extra attention just because you played a sport.

Unless of course it's Caltech, which breaks both rules.

development kid (i.e. you donated $$$)

Anyone got any numbers on that? What does it take to become a development kid...

if they get another reviewer for that category, i can guarantee you that all that person will do is open an excel sheet, order by donation amount per family, and write the position your family is at. So i doubt donating the minimum will do you any good.

There are cases of parent givers (<$100k mind you) whose kids are rejected even with good stats.

Actually I've heard from sources I consider reliable, that there is a specific number, that people know, that you have to donate to guarantee entry of you child. It's really the logical conclusion of considering these factors in admission.

How are people not angered to the point of spittle launching fury by "development kids"? Its outrageously contra to a functioning meritocracy.

I may be extremely naive but what does Stanford need the donations for? Aren't they rolling in dough.

They are rolling in dough because of their donations.

I thought that affirmative action was a well established part of almost all university admissions. Seems disingenuous of them to put minority in scare quotes, when affirmative action is not something that universities are coy about talking about.

Minority is in scare quotes because they have to be the right minorities. East Asians and South Asians don't count.

I understand that, and agree to some extent, and yet universities don't claim to give preference to East Asians or South Asians (actually they discriminate against these groups, but that is another matter). Usually universities would call Blacks and Hispanics "historically underrepresented groups" or something similar.

A good term to use is "margarine group", it's more accurate than minority. In apartheid south Africa black people were a margalized group despite being the majority of the people.

Likewise, one could say that a minority of the USA is Asian, but are Asians a margalized group when it comes to university?

This is pretty much standard practice in Europe.

If you're storing/producing an information about an individual as an organization you have to operate on the assumption that the individual has a right to read it as in most cases they do.

The British implementation is called the Data Protection Act, which implements the EU Data Protection Directive.

http://en.wikipedia.org/wiki/Data_Protection_Act_1998

http://en.wikipedia.org/wiki/Data_Protection_Directive

Could Stanford just destroy these records after they've completed the admission process? Could a European university do that?

Assuming the European university no longer has a need for the records, they are really supposed to destroy the personal data present, no?

I currently attend a university in the UK and would like to request this information. But I'm not sure what the best way to do so is, who should I contact at my university (I presume the admissions department) and how should I request this information? Should I quote the Data Protection Act? Does anybody have experience doing this?

You can make a request through the site WhatDoTheyKnow: https://www.whatdotheyknow.com/search/university/all

Search your university website for "data protection". You migt need to include "policy". They should have a page with instructions.

EG: http://www.uwe.ac.uk/finance/sec/dp/

They have to check your ID. They're allowed to make a small charge. They'll want to know what information you want. You can try saying "everything you hold about me" and they will give you as much as they can, but that will miss some information. For example, that wouldn't include all the occurances of your face on CCTV. You can request that but I think you need to be specific abot the date / time and there might be a higher charge.

MIT had the same problem in late 2003, and in the case of the college applications, solved the problem by simply destroying parts of the records when they were done with them.

(http://tech.mit.edu/V123/N53/53studrec.53n.html and http://tech.mit.edu/V124/N47/47e3.47n.html)

Which is how it should be. I can understand keeping a summary of the data to track the performance of your admissions process, but you shouldn't be keeping highly personal information about students for any longer than it takes to make the admissions decision.

It would be interesting if a group of students applied for their applications en mass (say, the entire 2012 admitted class to a University in the US) and performed statistical analysis on the resulting data. I wonder if any great numbers of students would be willing to breach their privacy to allow such a study to be run.

Would like to see this too. I'm sure they could do this without breaching their privacy, maybe have one person validate the data, then redact name, social, and other identifiable information.

For grad school, working at the dept in which one would wish to enter is a popular, lower risk approach. The admissions for grad school tends to be either multi-tiered (uni & dept) or defers entirely to the department's admission folks. This tends to be one or two people for smaller programs. If they know you and you work in the same dept, you're probaly already friends by this time, so you'll at least have more intel on what's expected, if not some bias in your favor.

(Former Stanford affliate here. Ask me anything.)

I tried the "rejection rejection letter" joke with Stanford after applying and being rejected (2009). I ended up working on a project with a Stanford prof for six months after that. It was fairly fun, and it let me decide that I didn't want to do grad school, so win-win there.

History is made by those who show up. If you're told to not bother showing up, SHOW UP ANYWAY!

I never had to escort a security person out of a building, either (although that happened at a Best Buy in 2006, but that's out of the scope of this article).

By any chance, was the Best Buy story related to http://improveverywhere.com/2006/04/23/best-buy/ ?

this is interesting - snopes calls it "legend". The text for the letter is great http://www.snopes.com/college/admin/rejection.asp

Sometimes the best way to prevent a physical fight is to carry the would-be fighters outside over your shoulders, and then offer to referee it. Securistas calm down very quickly when they realize they're not the only people in the room willing to use their hands.

Is there a legal conflict here - do writers of letters not have any protections under the law to prevent the letter being made public, or passed on to third parties. Do you lose all legal rights and controls over letters once you mail them?

The teachers maker recommendations clearly had an assumption of privacy in their communication?

If the Uni chose to precis the letter - eg provide a score in its place - would the right to view its content disappear. Is it just by virtue of it being attached directly to your internal academic record that one gets the ability to view it?

Interesting.

"On the Common App used by most top colleges, applicants are asked to check a box waiving their right to ever see the recommendation letters written by their high school teachers and counselors. But students who did not check the box can get copies of those, too."

although if I recall correctly, it seemed obligatory to check that box in order to get our recommendation letters sent through Common App.

Sounds like a dark pattern.

Yeah, my college counselors basically said "if you don't click this box the college will disregard your letters of rec."

You are allowed to keep your FERPA recommendation rights but, as misingnoglic, most universities will not pay much attention to your recommendations if you choose to do so.

https://appsupport.commonapp.org/link/portal/33011/33013/Art...

How do you have an assumption of privacy when you are the one mailing out the letter to some third party?

It's _to_ the third party, not to the public. Particularly if it's to a named person and for a specific reason. That's just my instinctive take on this.

I haven't researched this issue at all before - though I did read this, http://www.cornellpress.cornell.edu/html/WYSIWYGfiles/file/G..., recently which suggests not publishing any private letters without consent and that letters from "government officials" (which teachers would be here it seems?) need permission from the relevant department. However that's a particular publishers guidelines and doesn't go in to the legal requirements that, inter alia, lead to those guidelines.

Are undergraduate recommendation letters really sent to a specific person? And only that person reads it? I doubt it.

I briefly browsed the organization's website, but I didn't find any verbatim copies of the documents they describe obtaining, so I can't confirm/deny this suspicion.

I think it's known that the letters can be read by anyone at the University and Federal Law has stated for the last 40 years that students have a right to view these communications. Not only has this right been codified for at least a generation, every student does have the right to know what a school is recording and communicating about them.

There's no (valid) assumption of privacy anywhere to be found here.

> “The things they write, it’s clear that they never expect them to be read,” said the Fountain Hopper staff member. “They’re very frank.”

I guess that'll now change. It'll become like what employers do when asked about a former employee's job performance - name, rank and serial number only.

The admissions committee may also become closed door meetings, with nobody allowed to take written notes or minutes. Verbal only.

> I guess that'll now change.

Why? So long as they don't do anything illegal in the selection process they shouldn't have to worry about anything. This is only for people who get accepted, not rejects.

It's not about doing illegal things but more to protect against perceived wrongs. Or someone or people just not being 'pc'. It's cone to the point where being frank can be a liability. That is it would remove possible hooks for people to hang perceived grievances

If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.

- Cardinal Richilieu

Things that seemed perfectly innocent at the time can very easily come back to bite you on the ass later. Donating to the wrong political campaign (Brendan Eich), being a part of the wrong political party (the Hollywood Six), overestimating how fast public attitudes to sex will change (the 60's supporters of NAMBLA who found it expedient to renounce them later).

If everything is anodyne consensus bullshit you can't blame anyone without blaming everyone. So all the real decisions get made somewhere there are no written/recorded notes.

What is the purpose of keeping records in the first place? Is it to see if admissions criteria is a good indicator of student success? Otherwise could schools, which may already destroy records after a certain number of years [1], shorten that period, say, to the autumn following admissions season?

[1] Quick Google search shows USC keeping records for admitted students 5 years after last class taken: http://registrar.sc.edu/pdf/RecordsRetention2005.pdf

I'm a little confused--the article mentions that letters of recommendation must be turned over, but I believe that's only the case if the writer explicitly waived confidentiality (see http://www.naceweb.org/public/ferpa0808.htm).

Looks like we've got something similar in Canada,

http://en.wikipedia.org/wiki/Personal_Information_Protection...

I'm excited to try it out at my university!

If/once these become public record, does that create any legal issues for the university? Given how easy it is to twist informal speech like an e-mail out of context it does make ya wonder. A boderline-defamatory remark made public seems quite different something kept private.

FERPA doesn't make them public records, it just allows a student to access their own educational records.

I think a student could release their own records but that wouldn't fall under defamation from what I know.

Why does the article focus so heavily on Stanford? I understand that the students who have done this so far are there, but if this is based on a federal law that applies to all universities, shouldn't it work at all universities?

> I understand that the students who have done this so far are there,

That's it exactly. They've done the groundwork, laid out a template, recruited some students to request their records, and discussed a bit what they found or might found. So it's going to be Stanford-specific until similar meat is thrown out about other places.

Why not ask students to only submit a 300 word-ish summary in the first place?

This sounds interesting. I just composed 3 based on the Fountain template and mailed them off (snailmail, since I don't still have access to any university help systems). Wonder what I'll get back?

Where is a link to actually read files? Reading NYTimes summary about said files is fine but I'd love to actually read them. It sounded like at least one student had made their files public? Maybe not.

Has anyone successfully gained access to their records? And has anyone posted them publicly? I'm interested in insights from this.

Any source about which federal law is? or if it does apply to other universities such as MIT or Harvrad?

The Family Educational Rights and Privacy Act, available at (http://www.law.cornell.edu/uscode/text/20/1232g)

You can read about the law here: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html

Wait, so will this work for other schools, too? Like a UC perhaps?

Current UCLA student. I just sent a request. Waiting to see what happens.

Keep me updated please!

Current Stanford student here willing to answer any questions.

How did you approach the admissions process?

Uhhh... go here: http://talk.collegeconfidential.com/stanford-university/

Have you requested your records yet?

Yup. It takes up to 45 days to come though.

Just so you know, it looks like your account is shadow banned - all of your article submissions since 248 days ago show as [dead] (I have showdead on).

What does that mean?

How do I get un shadow-banned?

Okay so how do I get my file?!

http://us9.campaign-archive1.com/?u=c9d7a555374df02a66219b57...

Apparently you mail a letter to the Office of Undergraduate Admissions with strong language referring to FERPA.

Even easier, you just submit a help ticket online (and they included copy-paste text templates)

If you're a Stanford student. I wouldn't want to try that for other schools.

Why not?

Because you have no idea if it'll work when you go through that system or be escalated to the right people, and you may not have access to such a system in the first place.

This has the potential to be really devastating, and not because of a few stray lawsuits (if that) that won't go anywhere. It threatens to put the most powerful brands in this society on trial. People understand that there's some socioeconomic corruption in the process, but still have the idea that admissions are 85-90 percent academic. If contrary information gets out there, it could have a major effect.

What will be proven beyond a reasonable doubt in a very short amount of time is that the non-academic "character" component of admissions isn't "partly" socioeconomic but almost 100% socioeconomic. And that's a huge brand risk.

Seems a bit conspiratorial sensationalist. There's probably some subtle bias (humans are fallible, impossible to be purely objective) common to reviewers that could be brought to light with large-scale stastical analysis. Admissions have a tough job because they are inundated with candidates that appear good but the signals of quality, if known, would tend to be easily simulated... Defeating their use.

I don't care that much what admissions offices do, to be frank about it. If they want to put bigoted "holistic"/nonacademic bullshit into their admissions processes, then that's about #43,207 on my concerns list. I don't have kids so I'm at least 18 years from this being my issue and the whole fucked-up mix will be different by then (better? worse? who knows?) I don't think the fault is mostly with the admissions offices themselves. The academic signals they get are not always reliable; high-school grades are hard to standardize, and the SAT is pretty preppable and doesn't go high enough on the math. (The SAT-M should have harder problems that extend it out to ~1000-1100. Or AMC/AIME scores can be given weight in admissions.) But right now, the SAT is too preppable and the relative lightness of academic merit in the admissions process isn't the officers' fault. They are, as you've noted, working with crummy data. In order to believe they're doing better than they would at a dartboard, they have to convince themselves to "see things" in a bunch of 17-year-old strangers.

What would be of value is to reduce the importance of these brands in the world at-large. It's not that I give a damn either way about Stanford or what it does. I do think the pedigree whoring that has crept into "tech" has been to its detriment. Twenty years ago, Silicon Valley was much less pedigree-obsessed. You didn't need a Stanford degree to raise capital. These days, we see pedigree being the most important factor in the Valley determining who gets to be a founder and who is merely "Engineer #2" on 0.1% of a $5M company, and we see absolute shit founders like Spiegel and Duplan tapping into that private welfare system. A bit of reversion-to-truth in the power given to brands might be a good thing... not only for the world, but also for elite universities, which would be pushed in the direction of using academic merit again, because the mystique they get in admitting rich idiots and making admissions appear "holistic" would be blown. That would be good for them, because it would force them to admit better students.

Thiel and others would probably agree with the value of brand point. http://www.paulgraham.com/credentials.html

Get more than one (1) IITian on a ski/gambling trip, and it's rank and test war stories the whole way. :) (I aced (800) the SAT I math section without studying a single minute, no prep classes... Not a lie.)

One thing I noticed is how anything that disess Ivy/Pac 10 always gets down-voted. Doubting the value of pedigree is tantamount to Siné out of Charlie Hebdo for poking at a certain religion I guess. People might be down-voting because they hate the circumstances and then do that the same as down-voting a video containing something newsworthy but horrible on (video platform).

Perhaps I'll try an evidenced-based comment sometime with generous, neutral language and let the audience make up their mind.

On the plus side of (undergraduate) academia, it signals completion of a large task.. Which has some value.

(Bias: I've worked at a big brand uni on both the research and business sides.)

>"This has the potential to be really devastating"

First - Devastating for who? If the most powerful brands in the USA are incorrectly perceived as being uncorrupted, would it benefit society if the truth reveals their corruption?

Consider an example: Pennsylvania State University's reputation is likely tarnished beyond repair for the current generation. This is a good thing - because the University's representatives endorsed and covered up years of child molestation. Society benefits as a whole when corruption is revealed. People are able to make better decisions when they have sufficient information.

Second: I think your estimate about the lack of perceived corruption is far high. University admissions is perceived as highly as the NSA is today. People understand that while academics and test scores might get you in the door, the system is broken by unofficial (and official) favoritism and quotas. Unfortunately, the political dividing lines in the USA are such that half the voters endorse (directly or indirectly) such 'broken' non-academic admissions policies. As such, there won't be any breaking news about revelations that university admissions are broken.

I think you're overestimating the effect of the exposure of corruption. Take for example, your example, Penn State. I'm not sure how much hard data there is one these things, but I'd bet that applications are as high in quantity as ever [0], job opportunities after graduation are as good as ever, and Penn State revenue has been barely affected [1].

Or perhaps people are just willing to isolate their judgement and only mentally penalize those actually involved with the scandal instead of all the professors and students.

[0]: http://onwardstate.com/2014/04/30/penn-state-application-num...

[1]: http://www.statecollege.com/news/local-news/penn-state-footb... Note on source 1: this only shows that Penn State's football revenue, most likely the hardest hit area hasn't declined much.

Edit: I see you only said Penn State's reputation was tarnished beyond repair. Question then is if there are no practical consequences of that, is the reputation really tarnished?

Maybe they even stack rank.

Reply on news.ycombinator.com