Sensitive NYC school records discovered in public dumpster
|
Date Reported:
9/6/10
Organization:
New York City Department of Education
Contractor/Consultant/Branch:
School for the Physical City High School
Location:
Manhattan, New York
Victims:
Current and former students
Number Affected:
Undisclosed "hundreds"
Types of Data:
Personal information including "psychological exams, copies of birth certificates and Social Security cards, and medical records"
Breach Description:
"Hundreds of students’ confidential records — including psychiatric exams and Social Security numbers — were dumped on the sidewalk in front of their former Manhattan high school yesterday."
Reference URL:
New York Post
Office of Inadequate Security
New York Post (2)
Report Credit:
Beth Stebner and Kate Sheehy, New York Post
Response:
From the online sources cited above:
Hundreds of students’ confidential records — including psychiatric exams and Social Security numbers — were dumped on the sidewalk in front of their former Manhattan high school yesterday.
Infuriated parents and kids from the School for the Physical City rushed to the East 25th Street site after learning of the horrific privacy bungle, saying they were terrified about the compromised personal information.
“We got an anonymous call about 6:30 [p.m.], so we flew here with a shopping cart,” said worried mom Connie Click, whose daughter, Skylar, graduated from the architecture-oriented high school a year ago.
“I have no idea who did this. People are always looking through the garbage, especially down here.”
A “disgusted” Skylar added, “One of my friends has information here — I found his file on the street.
“We don’t even know what information they have in the [nearby] Dumpster,” she said. “We’re taking my files and my friend’s files. I don’t want that kind of information out there.”
About 15 brown cardboard boxes and clear plastic bins crammed with the students’ records were piled high on the sidewalk in front of the former site of the school, along with a locker and several computers.
[Evan] How do you explain the behavior that led to this breach without using the word negligent? The person responsible for dumping this information is dangerous.
The records included psychological exams, copies of birth certificates and Social Security cards, and medical records, including many for children with learning disabilities. The records date back to at least 1990.
[Evan] It is important to note that some of this extremely sensitive information dates back 20 years!
A nearby Dumpster was also overflowing with records.
The school — which has about 100 students in ninth to 12th grades — moved from its old East 25th Street location to West 14th Street over the summer, city Department of Education spokeswoman Margie Feinberg said last night.
Feinberg said the department first learned about the dumped records from a Post reporter.
“We are taking this very seriously,” she said. “This would be an improper disposal of student records, and it is not acceptable and is going to be investigated.
[Evan] In my opinion, the person responsible for this breach is more than simply ignorant or careless. Anyone with an ounce of common sense should know better than to discard these records in a dumpster. If we can assume that the person/people knew better, then we can probably draw the line towards willful negligence.
“Right now, we’re going to the school building and look and see what has been left and investigate, and then take appropriate action.”
Feinberg said that when the high school transferred across town, “Baruch College moved into the location.”
Calls to the college and the high school’s principal were not immediately returned.
Connie Click said she has already spoken to a lawyer.
[Evan] According to a subsequent story posted at the New York Post, she has filed suit against the NYC Department of Education. According to the public records; the case is real (Ref. 111862-2010). We don't know all of the facts. Based solely on what I've read and my own experience, I think she has a very good case.
“This is a crime. They’re letting everyone’s life out on the street,” she said.
[Evan] I don't know if this is a crime in NY (I'm no lawyer).
Commentary:
What do we say? Is it not obvious? Sensitive documents and records must be secured at all times, throughout their life-cycle; from creation through destruction.
Past Breaches:
Unknown
Posted by Evan Francen at 9/23/2010 9:22 AM 
Categories: Physical City High School, NYC Department of Education, Insecure Discard
Categories: Physical City High School, NYC Department of Education, Insecure Discard
Posts Atom 1.0
I can pose a scenario. It does nothing to excuse the situation and it's just a theory.
The new folks in the building find the records, perhaps either inadvertently left behind or left behind with the intent to retrieve them on a tomorrow that, for whatever reason, never happened. The new folks stack them somewhere to get them out of the way until the owner picks them up.
Along comes the minimum wage night cleaning crew who may not even speak or read English (or any language for that matter.) The see all those boxes of papers stacked where they don't look like they belong and hauls them off to the dumpster.
Obviously someone is culpable and needs to be dealt with, but this would take it out of the willful negligence category.
Reply to this
Good point Tom. This is a feasible scenario. I'm glad to see you commenting!
Reply to this