Spring Break
Web site prompts change
System could lead to ID theft
PETER STEINBAUER
Issue date: 1/29/07 Section: News
The University Athletic Association's Web site highlights a University-wide need for information security updates.
Yet, the Athletic Association will continue using faculty Social Security numbers as account numbers on its ticketing Web site until a more viable option becomes available, ticket officials said.
"We do have Social Security numbers as account numbers in a system linked … for verification purposes," Director of Ticket Operations Tim Cearley said.
Cearley said the Social Security numbers are the only option to verify that staff and faculty are indeed University employees.
It's also necessary, he said, because University faculty and staff receive a 50 percent discount for tickets to campus sporting events, which must be reported to payroll as added income for tax purposes.
Any discount over 20 percent must be reported to payroll as added income.
Cearley said one option to improve security would include scaling back the staff discount from 50 percent to 20 percent.
"From a feasibility standpoint and a concern with security, it makes sense that that's the way to go," he said.
After a faculty complaint last week, ticket officials removed a confirmation number e-mailed to customers that contained their Social Security numbers.
The Athletic Association's issue underscores the larger University problem of using Social Security numbers as personal identifiers for both staff and students.
Cearley said departments across campus are having similar problems identifying staff and students.
Jeff Daniel, the Athletic Association's director of information technology, emphasized the site is completely secure and only a few people have access to the data. Daniel said the site has met Payment Card Industry standards.
PCI Security Standards Council is an independent body formed to develop, distribute and assist with security standards for payment account security, according to its Web site.
Law professor Robert Brussack, who focuses on cyber law, said "There are not enough decided cases to know how receptive the courts will be to situations including security breaches."
"The bottom line is that the prospect of liability is real enough to prompt anybody who handles this sort of information to pay close attention to security," he said.
The University is in the process of updating all of its administrative systems - a process that ultimately will take several years, University Registrar Rebecca Macon said.
Macon has co-chaired the ID management task force, which was developed in 2005 by Enterprise Information Technology Services Associate Provost Barbara White.
A separate exploratory committee was formed after it was determined there were more problems than just the use of social security numbers as personal identifiers.
"The student system, the financial aid system, the human resources system and the financial system are all very outdated - to different extents they've been updated," Macon said.
She also said members of the exploratory committee submitted a plan to University vice presidents for fully updating and integrating each of the systems. That plan included information on ending the use of Social Security numbers as personal identifiers.
Macon said University vice presidents asked for more specific budget information, including where money for the updates would come from.
"We hope this spring we'll find out where President (Adams) stands on this issue," Macon said. "And of course the dollars are the big issue."
Yet, the Athletic Association will continue using faculty Social Security numbers as account numbers on its ticketing Web site until a more viable option becomes available, ticket officials said.
"We do have Social Security numbers as account numbers in a system linked … for verification purposes," Director of Ticket Operations Tim Cearley said.
Cearley said the Social Security numbers are the only option to verify that staff and faculty are indeed University employees.
It's also necessary, he said, because University faculty and staff receive a 50 percent discount for tickets to campus sporting events, which must be reported to payroll as added income for tax purposes.
Any discount over 20 percent must be reported to payroll as added income.
Cearley said one option to improve security would include scaling back the staff discount from 50 percent to 20 percent.
"From a feasibility standpoint and a concern with security, it makes sense that that's the way to go," he said.
After a faculty complaint last week, ticket officials removed a confirmation number e-mailed to customers that contained their Social Security numbers.
The Athletic Association's issue underscores the larger University problem of using Social Security numbers as personal identifiers for both staff and students.
Cearley said departments across campus are having similar problems identifying staff and students.
Jeff Daniel, the Athletic Association's director of information technology, emphasized the site is completely secure and only a few people have access to the data. Daniel said the site has met Payment Card Industry standards.
PCI Security Standards Council is an independent body formed to develop, distribute and assist with security standards for payment account security, according to its Web site.
Law professor Robert Brussack, who focuses on cyber law, said "There are not enough decided cases to know how receptive the courts will be to situations including security breaches."
"The bottom line is that the prospect of liability is real enough to prompt anybody who handles this sort of information to pay close attention to security," he said.
Updating info an ongoing process
The University is in the process of updating all of its administrative systems - a process that ultimately will take several years, University Registrar Rebecca Macon said.
Macon has co-chaired the ID management task force, which was developed in 2005 by Enterprise Information Technology Services Associate Provost Barbara White.
A separate exploratory committee was formed after it was determined there were more problems than just the use of social security numbers as personal identifiers.
"The student system, the financial aid system, the human resources system and the financial system are all very outdated - to different extents they've been updated," Macon said.
She also said members of the exploratory committee submitted a plan to University vice presidents for fully updating and integrating each of the systems. That plan included information on ending the use of Social Security numbers as personal identifiers.
Macon said University vice presidents asked for more specific budget information, including where money for the updates would come from.
"We hope this spring we'll find out where President (Adams) stands on this issue," Macon said. "And of course the dollars are the big issue."
Be the first to comment on this story