Maine Department of Education halts collection of Social Security Numbers after breach
|
Date Reported:
9/28/10
Organization:
State of Maine
Contractor/Consultant/Branch:
Department of Education
Infinite Campus, Inc.
Location:
Online/Various
Victims:
Students and/or staff members
Number Affected:
Undisclosed/Undetermined*
*There are more than 200,000 K-12 students in public and private schools across the state of Maine.
Types of Data:
Personal information, including Social Security numbers
Breach Description:
"AUGUSTA — The Maine Department of Education is telling school districts not to submit students' Social Security numbers to a state database until it works out a system error that gave a school technology director access to restricted information."
Reference URL:
Maine Department of Education Informational Letter
The Portland Press Herald
Republican Journal
Report Credit:
Angela R. Faherty, Ph.D., Commissioner, Maine Department of Education
Response:
From the online sources cited above:
AUGUSTA — The Maine Department of Education is telling school districts not to submit students' Social Security numbers to a state database until it works out a system error that gave a school technology director access to restricted information.
The department said Tuesday that it is deleting from its systems students' Social Security numbers that have been submitted and ordering an outside review of the security of its data collection systems.
[Evan] Was an outside review of security conducted prior to the discovery of a "system error"? Probably would have been a good idea.
On Friday, a technology director for a Maine school district reported being able to see the Social Security numbers of staff members in other districts.
State officials say they immediately found the problem and addressed it, restricting access to the staff members' Social Security information.
[Evan] Can we assume that since they "immediately found the problem", that the problem was somewhat obvious? Continuing down this line of thought, can we assume that the problem was an oversight that should have been addressed prior to implementation?
They still plan to hire a contractor to determine how the private information became available and how to prevent future data breaches, the department said.
[Evan] Good idea. FRSecure helps organizations prevent future data breaches every day!
"The department takes the security of private information seriously, and supports school boards, parents and school officials in their caution with respect to the collection of data," Education Commissioner Angela Faherty said in a prepared statement.
[Evan] Really? Then why does the school system deem it necessary to collect Social Security numbers? What value does this information provide to the Department of Education, and does the value outweigh the risks posed to students and/or staff?
For the first time, Maine school districts are collecting students' Social Security numbers for a statewide database intended to help policy makers track students' progress throughout school and college and into the workplace.
[Evan] YOU DON'T NEED SOCIAL SECURITY NUMBERS to "track students' progress throughout school and college"! You don't need much sense to understand that.
The Department of Education was to collect the Social Security numbers from districts along with other informational items – including enrollment and special education data – that it collects on Oct. 1 of each year.
The department collects the information through its Infinite Campus information portal, the system through which the technology director was able to view the sensitive information.
The data system is part of the education agency's decade-long project to build an information management system that links the DOE with schools around the state. Functions of the online data system include the Longitudinal Data System and the Infinite Campus system, all of which result in producing more aggregate data for federal and state reports.
[Evan] I am still baffled as to why the Department of Education needs to collect Social Security numbers. How does a Social Security number (an individual global identifier) play into "producing more aggregate data"?! This is nonsense.
"We're grateful that the Department of Education has recognized the seriousness of our data security concerns," said Shenna Bellows, executive director of the Maine Civil Liberties Union, which has been a vocal opponent of the Social Security number collection. "We continue to believe that there are more effective ways to evaluate student outcomes without violating student privacy."
Since the Department of Education started rolling out information about the Social Security number collection, a number of school boards have passed resolutions opposing it.
Under the 2009 law, school districts are required to ask for students' Social Security numbers, but parents can decline to provide them.
[Evan] Who the *&^$ sponsored and voted for such a ridiculous law? If you are a parent, DECLINE TO PROVIDE SOCIAL SECURITY NUMBERS belonging to your children. In Minnesota, where I live, our schools asked for the Social Security numbers of our children. We respectfully declined to provide this information. The school pushed back a little (which was unfortunate), then backed down on their request. We find that most public schools are very lax in their information security practices, and many of the personnel are not well educated on information security issues (best practices, laws, etc.).
The Department of Education said the technology director's ability to view staff members' Social Security numbers wasn't connected to the Infinite Campus function that would manage the collection of students' Social Security numbers.
"A software switch was turned on when it should have been off, or off when it should have been on," said David Connerty-Marin, spokesman for the Maine DOE, on Sept. 28.
[Evan] This is why we conduct information security reviews and testing at specific phases of implementation, prior to deployment.
David Connerty-Marin, a Department of Education spokesman, said state officials are advising school districts to hang on to the students' Social Security numbers they have already collected until the state is ready to accept them, which is expected to be in a few weeks.
The state education agency is now providing school districts a software script that allows them to upload student enrollment data without Social Security numbers.
[Evan] The problem with this is that the schools are still actively collecting this information and holding on to it themselves. How well does the school protect sensitive information? Have schools been subjected to independent information security reviews? Unlikely.
The delay announced Tuesday is the second such delay since the law was passed in June 2009.
In September of 2009, the Department of Education decided to hold off on the collection one more year to give schools time to update privacy policies.
Commentary:
This is crazy to me. I will leave my comments to those mentioned above. I don't know where further comments would lead. ;)
Past Breaches:
Unknown
This post was written by Evan Francen, CISSP CISM
President at FRSecure LLC
Posted by Evan Francen at 10/6/2010 10:06 AM 
Categories: Poor Business Practice, Infinite Campus, Employee Mistake, Maine Department of Education, State of Maine
Tags: chief security officer security breach network security data breach
Categories: Poor Business Practice, Infinite Campus, Employee Mistake, Maine Department of Education, State of Maine
Tags: chief security officer security breach network security data breach
Posts Atom 1.0
Comments