UD Moves to New ID Process

Identity theft was the most-reported complaint to the Federal Trade Commission in 2004, up 15% from 2003 to 247,000 complaints. The problem has intensified because of the speed, convenience and spread of the internet, and because people, especially students, are not aware they are targets for identity theft. Usually, victims are unaware that their identity has been stolen until it is too late and the damage has been done to their reputations. The use of SSNs for identification and authentication has become a major issue because of the increasing concern across the nation about identity theft.

According to the Social Security Administration, SSN is confidential and a key piece of information for perpetrators of identity theft. Because of the seriousness of this crime and the difficulty victims encounter cleaning up their reputations (by one estimate, averaging 180 hours of personal time, if it can be cleaned up at all), the University is moving to eliminate it from non-required use as soon as possible.

As reported in UDaily, the University is moving to a new identification process for all its centralized secure web services that uses UDelNet ID and password instead of SSN and PIN. Within University departments, all faculty and staff must identify processes where they are using SSN for identification purposes and immediately stop using them wherever possible, or begin transitioning to a replacement identifier.

The University's Information Security Policy defines employee responsibilities for the security of University information and it "allow(s) the use, access and disclosure of such information only in accordance with University interests..." Unless required by law, or needed to perform core departmental activities which cannot be immediately facilitated by other means, SSNs must not be collected, stored or used to identify University community members. This includes student SSNs on paper forms, stored in electronic spreadsheets or databases, or transmitted via e-mail for inter-departmental University business. The Department of Education has even ruled that using the last four digits of SSN for grade postings violates FERPA, so no portion of the SSN can be used as an identifier.

Information Technologies is gathering information about where and why University departments are using SSNs, and is providing guidance where needed, to facilitate the transition to a replacement identifier. If your department is using SSN as an identifier or in any other way not consistent with the Social Security Act, and you are not sure how to stop using it, call the Help Center at x6000 to arrange for a consultation.

Everyone in our community, especially students, should take a few minutes to understand identity theft and how to protect themselves; learn how to avoid becoming a victim by being vigilant about safeguarding your personal information, particularly SSN. You should be conscious of who you give your personal information to, because every time you divulge personal information to others, there is the possibility that it could be misused. The University, as an educational institution subject to the Family Education Rights and Privacy Act (FERPA), will never give out your personally identifiable information to unauthorized parties and has programs in place to ensure that your personal information is safe from prying eyes.

When someone does ask for your SSN, you are encouraged to ask why it is needed and how it will be used. Although some businesses won’t do business with you unless you provide your SSN, getting answers to these questions will help you determine whether to give them your SSN, and will raise their awareness of the sensitive, confidential nature of SSNs.

For more information about ID theft, check out our ID Theft Resources page.

Questions / comments?
Copyright © 2004, University of Delaware.