Most have eliminated the Social Security number from the card, but what about the myriad of campus systems?

By Andy Williams, Contributing Editor

The ubiquitous nine-digit Social Security number is rapidly disappearing from the ID scene as colleges, governments and businesses attempt to stem a glaring ID theft risk. Colleges and universities long used the number to identify students and staff. Today, however, state legislation, student demands for greater security, and proactive campus administrators are changing all that.

The days when you could approach a bulletin board to see class grades listed by SSN are mostly gone. So too are days when student ID cards had the SSN plastered on the front in bold black print.

It was only few years ago, when the biggest issue with the SSN was that freshman had to memorize it. But today the epidemic of identity theft has raised the bar on SSN concerns.

Breaches have plagued higher education …

According to the Privacy Rights Clearinghouse, which lists a chart of all data breaches since 2005, about 230 cases have been reported at colleges and universities. Some of the same schools appear on this list multiple times. Last year set the record, with 72 breaches at four-year schools. So far this year, through Aug. 7, there have been 49 reported cases at universities.

But it’s not all about breaches. For example, in January of this year, a computer hard drive containing the names and Social Security numbers of current and former employees at New Mexico State University, Las Cruces, went missing.

Sometimes, it’s inadvertent mistakes by the university. At the University of Iowa, its engineering department exposed some of its former students’ information, including Social Security numbers, when it posted the data on the Web for several months.

Finally, there’s the stolen laptop issue and it illustrates the fact that even though socials no longer appear on student IDs, they’re still in the system. For example, at Penn State University, University Park, earlier this year, a laptop containing archived information and SSNs for 677 students attending the school between 1999 and 2004 was stolen from a faculty member.

A survey of campus card numbering schemes

CR80News was curious if schools were still using the SSN as the ID card number and, if not, how they replaced it. Of the schools we interviewed, none were using Social Security numbers as student identifiers. But most only quit doing so in the past few years, even though issues with Social Security numbers have been ongoing for more than a decade.

In many cases colleges have switched because state laws forced them to seek other numbering systems. That’s what many of the campuses responding to our survey mentioned as the major reason for banning SSNs on ID cards.

Purdue University in Indiana thought it was a good business practice, but that was “certainly tempered by the possibility of ID theft,” says Wayne Hilt, the university’s card services manager.

In fact, most of the universities responding to the survey named ID theft fears as one of the reasons that pushed them toward randomly generated ID numbers rather than Social Security numbers.

“We stopped printing the SSN on the face of the ID card in May of 2003, but we did not remove it from the magnetic stripe on the ID until May of 2006,” says Hilt.

Tompkins Cortland Community College, Dryden, N.Y., wanted to be “proactive instead of reactive,” says Tova Sturmer, the schools’ card manager, describing the transition from SSNs to a random generated numbering system.

The school, like many of the colleges that responded to the survey, still has the SSNs floating around in their databases. “But it is not used for anything on our campus except where it needs to be, such as financial aid,” says Sturmer.

Purdue uses a “10 digit University ID number generated by our IT department,” says Hilt. “The largest problem is making sure that you do not assign two numbers to the same individual. If that happens, we do have a process to consolidate the information onto one number.”

University of Vermont in Burlington replaced the SSN with a random number scheme last summer due to Vermont legislation, says Mark McKenna, program director, CATcard service center. “The only SSNs still in the system are for people who have not received their employee number from human resources. We have written an interface that replaces the SSN with the employee number when one is created in HR.”

Central Michigan University, Mount Pleasant, which dropped SSNs two years ago, has gone to a 10-digit number “generated by our student information system when a student applies,” says Anthony Smucler, campus ID office coordinator. While ID theft fears was one of the reasons for the change, the university also wanted “to consolidate several home grown systems into one large student information system and it made sense to drop the socials,” he adds.

The University of Southern California in Los Angeles also has its 10-digit student identification number generated randomly, says Brenda DeLong, USCard services director. “Occasionally an individual will end up with two records, that is two unique numbers … one number survives, the other is assigned but permanently merged with the surviving number,” she adds. In addition, there “has been a concentrated effort” to eliminate socials both as individual identifiers and in the school’s databases.

For the University of North Carolina at Chapel Hill, it’s a PID number that identifies its students. It stands for Person ID and was introduced a decade ago, says Jim Clinton, UNC’s director of operations. “Our PID is a nine-digit number that begins with the number 7” to distinguish it from a Social Security number, he adds.

At the University of New Mexico, Albuquerque, “students are assigned a system-generated, 9-digit unique identifier, their UNM ID number,” says ID card services manager Carolyn Hartley. They use the Banner Student Information System, she adds, noting that the system only issues the number after a search to make sure it’s not a duplicate.

But no system can completely eliminate human error as noted by another Banner user, Angelo State University, San Angelo, Texas. “We sometimes end up with duplicates if the person entering information into Banner is not careful or if we type in the wrong number and pull up the wrong record,” says Audrey Wilson, director of the school’s card program.

ISO numbering continues to be a popular alternative for campus cards

One of the more popular numbering systems appears to be those that are ISO-compliant. ISO stands for International Organization for Standardization. It is, as card provider CardSmith’s Taran Lent explains it, “the only global standard for card numbers and encoding on the planet.”

To be able to use the 16-digit ISO numbering system, one has to go through an application process to “become an issuer of an ISO number,” says Lent. Universities are then assigned a code range and “you can then issue numbers within that range. Those numbers belong to you and they’re guaranteed to be unique,” adds Lent.

Hundreds of campus card programs across the country have migrated to ISO numbering.

One school in the survey, Babson College, Wellesley, Mass., has never used a Social Security number to identify students. The number has always been ISO-based and is issued by the school’s IT department, says Babson’s card manager Steve Heaslip.

Protecting the identities of former students and staff

While universities may think thieves can’t obtain students Social Security numbers if they’re no longer used as student identifiers, what may not be considered are students who have graduated. There have been instances of lost laptops that contained the SSNs of students in old databases.

The University of New Mexico preempted that possibility by going back 25 years in its databases and assigning Banner ID numbers to other students in the system, “just like current and future students,” says Hartley.

Beyond the ID card, SSNs hide in every corner of the campus

But the Social Security number, because its ubiquitous nature even before it became an ID thief’s favorite tool, is everywhere. It’s like a tumor. You get rid of it in one area only to find it present in another.

Just because the SSN is no longer present on a student ID card or in the mag stripe, the number is likely present in dozens of other databases housed on campus servers, department-specific applications and even professor’s laptops.

Also, schools still must use Social Security numbers for federal financial aid registration, meaning the information is still possibly susceptible.