Confidential information mishandled

University improperly disposes of student, faculty data

By Mark Dent, Sasha Roe

Thursday, September 20, 2007

University officials are investigating the unauthorized release of personal information and records of students, faculty and employees to local media, including the University Daily Kansan. The University Daily Kansan received two manila envelopes containing the personal information on Tuesday.

The envelopes contained fax reports, student tests, Social Security numbers, seating charts and credit applications. A cover letter from an anonymous source was attached to the documents. The letter said the information was from the mathematics department and was retrieved from recycling bins and a dumpster behind Snow Hall. The letter implicated Gloria Prothe, an employee of the department of mathematics, for not properly disposing of personal information.

Lynn Bretz, Director of University Communications, said she didn’t know how the information was leaked, but that the University’s primary concern was protecting students and preventing their information from further exposure. Bretz said the University was asking for the return of the documents to protect the students and to begin its investigation of the incident.

“This is an issue in society,” Bretz said. “We’ve all been dealing with this for the last five, six, seven years — there’s been web-hacking. People all over the country are saying ‘Better not use Social Security numbers as numbers for students at universities.’ This is a long wake-up call for everybody.”

The Kansas City Star and The Lawrence Journal-World received envelopes containing similar information.

Bretz said the investigation would be led by a team made up of officials from the Provost’s office, the dean’s office, the College of Liberal Arts and Sciences, human relations, and Jane Rosenthal, the University Privacy Coordinator and Custodian of Records. Bretz didn’t give a timeline for the investigation.

Bretz said different departments took care of personal information in different ways. Prothe said the mathematics department typically shreds personal information.

“If I considered it confidential and I didn’t shred it, I would have disposed of it in a secure manner,” Prothe said.

Prothe declined to comment further.

Bretz said University employees needed to be trained better to create a more unified system for handling confidential information. The University’s “information management initiative” is the solution for unifying the system, Bretz said. In July, a Kansan reporter recovered private information from Wescoe Hall. The materials were taken from a portion of Wescoe Hall that was under construction. The documents found included KUID numbers, course evaluations and grades.

“People have forgotten about paper,” Bretz said. “It’s not just digital; it’s paper and how they’re connected. This is a wake-up call.”

Todd Davis, CEO of Life Lock, an identity theft prevention agency, said a Social Security number could allow an identity thief to find out more information about a person such as a phone number or address. With that information in addition to a Social Security number, Davis said, a thief could pose as someone else and apply for loans or credit cards.

One of the forms in the envelope received Tuesday included one person’s credit card number, Social Security number, phone number and address on the same page. Davis said that was particularly dangerous.

“You could do something immediately,” Davis said. “You could turn that into money within minutes.”

Todd Cohen, director of University Relations, said there was no indication that this latest development was a widespread issue. He said it should not be connected to the issue in July.

“They’re totally different by nature,” Cohen said.

The two envelopes received by the Kansan contained identical information and identical cover letters. The return address listed on the envelopes delivered to the Kansan was 645 New Hampshire St., the mailing address for the Lawrence Journal-World. The envelopes delivered to the Journal-World had the return address for the Kansan. The Kansas City Star was unable to comment on its envelopes’ return addresses.

The Kansan made copies of all of the documents for use in this story. The original contents were returned to Bretz and Cohen Wednesday afternoon. All of the documents remained secured from the time they were received until they were returned. The copies also remain secured and none of the information will be shared. The copies will be returned to the University as the story is completed.

— Edited by Rachel Bock

Comments

ecorunning (anonymous) says...

Why did the Kansan choose to return the paperwork back to KU officials when the other media outlets cited in the story are refusing to do so because of concerns about protecting whistleblowers? Was the Kansan obligated to do so or was this not a concern for Kansan editors?

September 20, 2007 at 10:52 a.m. ( | suggest removal )

Advertisement