Risk of using Social Security number for ID

DALLAS -- As long as universities continue to use Social Security numbers to identify students, there will be crimes like the recent computer hacking at the University of Texas, experts say.

"I am 100 percent opposed to any college using Social Security numbers that way," said Jay Foley, director of consumer and victim services at the Identity Theft Resource Center, a San Diego-based nonprofit group. "All it can do is damage."

Between Feb. 26 and March 2, someone hacked repeatedly into a UT computer network, breaching security systems and stealing the Social Security numbers of more than 55,000 students, faculty and alumni.

Law enforcement officials said there is no evidence that the stolen data have been used inappropriately. No arrests have been made.

The hacker or hackers apparently used a computer program to query a UT database with 3 million possible Social Security numbers. If one of the numbers matched an individual in the database, the hacker was able to access other personal data.

Officials at the University of North Texas in Denton and the Collin County Community College District said their institutions use Social Security numbers as student ID numbers. But they said that students could request that their Social Security numbers not be used.

UT officials said they did not announce the data exposure immediately because they thought doing so might make capturing the hackers more difficult.

"We believed because the origin of this attack was limited and appeared to be local, we might be able to recapture the data without it being disseminated or lost," said Dan Updegrove, UT's vice president for information technology. Much of the personal data the hackers obtained -- names, phone numbers, addresses -- can be found legally through other sources. But when combined with Social Security numbers, the information can make identity theft possible.

"It looks like they found a soft point in the system," Foley said. "From the way it was done, it appears there was planning and preparation involved. But this wouldn't be that difficult to do."

Universities' use of Social Security numbers gained national notice last summer, when officials at Yale University accused Princeton officials of improperly accessing student admissions data on a Yale server. Princeton officials were able to use the Social Security numbers of high school seniors to find out if Yale had offered them admission.

Because it is a unique identifier, many colleges and universities use a Social Security number as a student's college ID number. A 2002 study by the American Association of Collegiate Registrars and Admissions Officers found that 50 percent of universities surveyed use students' Social Security numbers as their primary student IDs. Many universities, including UT, are trying to phase out the use of Social Security numbers of most student documents.

"The Social Security number was never intended for this," said Nede Mansour, a spokeswoman for the Social Security Administration. "We try to discourage this sort of use, but we can't do anything about it."

In any event, abandoning Social Security numbers entirely will probably be impossible, experts say. Even if a university adopts an internal ID system for students, it will always need to provide some way of identifying individuals to other institutions -- for example, if it has to send a transcript to another university.

"It's not the best way to handle it," said Barmak Nassirian, associate executive director of the American Association of Collegiate Registrars and Admissions Officers. "If your name is Barmak Nassirian, there probably won't be many of you. But if your name is James Wilson, you need something unique to identify you."

He said universities are also required to gather Social Security numbers by federal programs such as the Hope Scholarship, which provides tax credits for college tuition.