Purpose of Our Session:
- present examples of breaches in the
educational area
- identify the impact of privacy breaches
- use the breach data base as a teaching tool
for in-service
Breach Database
Education Focused - Privacy Breach Database:
- Consists of some 32 examples of education related
privacy breaches categorized into 7 areas
- Internet links for each breach allow for a review of the
specific breach and required action on the part of the
institution
- Additional resources and external links conclude the
database
- Individual breaches can be examined to highlight the
specific nature of a privacy breach
The Database
Malicious Computer Data Breaches:
Hackers Compromise 160,000 Student Healthcare Records at Berkeley,
Mills College
http://www.securitymanagement.com/news/hackers-compromise-160000student-healthcare-records-berkeley-mills-college-005621
Hackers Steal Information for Over 70,000 Students/Alumni from Brock
University
http://www.cbc.ca/technology/story/2006/10/12/tech-brock.html
Southern Connecticut State University Servers Compromised by Spam
Operation Potentially Exposing the Data of 11,000 Students
http://www.pcworld.com/businesscenter/article/145087/after_web_deface
ment_university_warns_of_data_breach.html
The Database
Malicious Computer Data Breaches:
Austin University Student Hacks in his School’s Computer System,
Accessing Over 50,000 Social Security Numbers & Other Data
http://www.msnbc.msn.com/id/9239576/
Potentially 400,000 Student Records Breached When San Diego University
Server Is Infiltrated
http://attrition.org/dataloss/2004/03/sdsu01.html
The Database
Accidental Computer Data Breaches:
Faculty Member at an Ohio University Accidentally Places Social Security
& Grade Report Online – Data is Public for Over 3 Years before Being
Noticed
http://www.miami.muohio.edu/documents_and_policies/privacyhelp.cfm
A City College in Edmonton Accidentally Makes Student Data Available
Online – Data Included Credit Cards, SIN Numbers, Signatures, Etc.
http://attrition.org/dataloss/2007/10/macewan01.html
Student Aid Records for 90 Individuals in Newfoundland were Publicly
Exposed Due to a Security Hole in an Online Database
http://www.cbc.ca/consumer/story/2008/09/08/student-breach-data.html
Hundreds of McGill Student Academic Records Accidentally Made Public
on School Website
http://www.cbc.ca/canada/montreal/story/2007/04/27/mcgill-privacy.html
The Database
Accidental Computer Data Breaches:
Teacher in Manchester, England Accidentally E-Mails Attachment with
Student & Employee Data to Hundreds of Other Students & Employees
http://www.vbsnet.com/news/2009/04/30/ico-acts-on-student-privacybreach.html
Four University of Texas Professors Accidentally Posted the Private Data
of Thousands of Student Online
http://www.woai.com/content/news/newslinks/story/U-T-StudentsPersonal-Information-Accidentally/VQQrtNfAc0WcWgWzVtMU1g.cspx
Ryerson University Software Glitch Accidentally Posts Student Data
Online – Issue Not Correct for Weeks after the School was Informed of the
Breach
http://www.itworldcanada.com/news/ryerson-privacy-breach-highlightsimmature-it-analyst-says/109118
Western University Exposes the Data of Over 1,000 Graduate Students Data was Posted on an Unsecured Portion of Western’s Website
http://communications.uwo.ca/com/western_news/stories/western_apolog
izes_for_privacy_breach_20051027434109/
The Database
Malicious Physical Document & Data Breaches:
Laptop with the Data of Over 98,000 Students Stolen from the Graduate
Admissions Office of Berkeley University
http://www.channelregister.co.uk/2005/09/16/berkeley_laptop_theft_arrest/
Newfoundland School Board Found in Violation of Privacy Laws After
Stolen Laptop Exposed the Records of 28,000 Students
http://www.cbc.ca/canada/newfoundland-labrador/story/2008/07/25/schooltheft-privacy.html
Entire Student Roll at College in Nassau New York Stolen from
Administrative Office – Over 21,000 Students Affected
http://attrition.org/dataloss/2006/12/nassau01.html
Two University of Alberta Hospital Laptops Stolen – Over 300,000 Affected
http://www.cbc.ca/canada/edmonton/story/2009/06/24/edmonton-laptoptheft.html
The Database
Accidental Physical Document & Data Breaches:
Sensitive Student Information Found Along Road from Nashville, TN High
School (Video Report Included)
http://www.wsmv.com/news/18966430/detail.html
Keller, TX High School Mails Incorrectly Addressed Private Data to
Hundreds of Students
http://datalossdb.org/archives/1099/2121/index.txt
New York City School Accidentally Leaves 12 Boxes of Student Records
on Curb
http://query.nytimes.com/gst/fullpage.html?res=9F0DE4DD143EF937A1575
2C1A9629C8B63
Tennessee State University Employee Misplaces Flash Drive with Social
Security Data Of Over 9,000 Students
http://www.wsmv.com/education/17464384/detail.html
The Database
Accidental Physical Document & Data Breaches:
College Student Data Intended to be Shredded is Discovered Off-Campus
http://attrition.org/dataloss/2005/08/and01.html
Hard Drive at Colorado University Goes Missing – Potentially Exposing
15,790 Students
http://www.jrrobertssecurity.com/security-news/security-crimenews0028.htm
The Database
Visual Privacy:
Story about Teacher in Quebec Negatively Affected by Cell Phone Video of
Her Posted on YouTube by Students
http://www.cbc.ca/canada/ottawa/story/2006/11/24/you-tube.html
Stanford University Fights for Privacy Rights of Student
Pictures Posted Online
http://www.sfgate.com/cgiin/article.cgi?f=/c/a/1999/09/23/MN55114.DTL&type=printable
Article on Benefits and Perils of Video Cameras on School Buses
http://www.westmountexaminer.com/article-cp80346034-School-busesmay-be-wired-for-surveillance-privacy-experts-warn-of-perils.html
The Database
Visual Privacy:
English Newspaper is Censured for Posting Student Photos Online
Without Permission
http://www.timesonline.co.uk/tol/news/uk/article2260869.ece
Article on the Quebec Student Known as the “Light-Sabre Kid”
http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20090318/online_pri
vacy_090318/20090318?hub=SciTech
The Database
Anonymous Information:
City of Regina Accidentally Gives Out Extraneous Data to Outside
Researchers Exposing Thousands
http://www.cbc.ca/canada/saskatchewan/story/2009/02/11/reginainformation.html
YouTube and Viacom Agree to Mask Viewer Data
http://www.usatoday.com/tech/products/2008-07-15-2584242500_x.htm
The Database
Data Storage Locations:
An Article on Google, Lakehead University and Their Connection to the
U.S. Patriot Act
http://www.theglobeandmail.com/news/technology/article675014.ece
CBC Article on Health Records Vs. The Patriot Act
http://www.cbc.ca/health/story/2008/05/05/fhealth-digitalrecords.html
The Database
Additional Resources:
“Data Loss Database”
Searchable Database of over
2,500 privacy breaches from
across the world, affecting
almost 5 million records.
http://datalossdb.org
The Database
Additional Resources:
Privacy Rights Clearinghouse
Chronological Database of Hundreds of Privacy Breaches
http://www.privacyrights.org/ar/ChronDataBreaches.htm
IPC
Information and Privacy
Commissioner of Ontario
http://www.ipc.on.ca
The Database
Hamilton Spectator - Jan.28, 2010
excerpt:
January 28th is Data Privacy Day around the world, a day
dedicated to raising awareness about protecting personal
information, especially online.
The article contains a list of the major data privacy issues
today, according to the privacy commissioner's office. This
is a short sample:
- New technologies emerge daily, but often personal
information is required to use them. Consider how much
information you have handed over to play online games,
join social networks or even shop online. And what
happens if the information ends up in the wrong hands?
http://www.thespec.com/
article/713274
- Watch out for fraudulent e-mails, be on guard against
phishing -- lying about the real reasons someone is data
mining -- and much more.
Media Reports
Hamilton Spectator - Jan.28, 2010
“Privacy czar launches investigation over
personal-settings tool”
Privacy commissioner Jennifer Stoddart said yesterday the
complaint focuses on a personal-settings tool introduced
by Facebook last month.
The complainant alleges new default settings would have
exposed his information to a greater degree than settings
he had previously put in place.
Elizabeth Denham, the assistant privacy commissioner,
said in a news release the grievance echoes other
concerns expressed in recent months.
http://www.thespec.com/
article/713275
"Some Facebook users are disappointed by certain
changes being made to the site -- changes that were
supposed to strengthen their privacy and the protection of
their personal information."
Media Reports
“Identity Theft is much more than credit & debit
card skimming. It is the unauthorized collection
and fraudulent use of someone else’s personal
information.”
Hamilton Police Department Definition
Identity Theft
Types of Identity Theft:
- Thief obtains a credit card in victim’s name using personal information.
- Thief calls victim’s credit card company and pretending to be the victim.
- Thief changes the address on victim’s credit card account. In this
instance victim may not know of theft for quit some time.
- Thief obtains a cell phone account in victim’s name using stolen
identification.
- Thief opens a bank account in victim’s name using stolen identification.
- Thief steals credit or debit card information from victim’s card. The thief
then manufactures a forged card and attacks victim’s account.
Identity Theft
Some Facts about Identity Theft:
- Identity theft, skimming and other crimes related to criminals getting your
personal information is the fastest growing and costliest consumer crime in
North America
- Identity theft crimes have grown 100% every year since 1997, the year that
this type of crime began to be taken seriously
- In 2003 (the most recent year stats were available), identity theft cost the
Canadian Economy 2.5 billion dollars, and has only risen from there
- Canadians have a 1 in 10 to 1 in 20 chance of being victimized by Identity
Theft in their lifetime. By comparison, your chance of being physically
victimized (via assault, robbery, etc.) in your lifetime is much
less than 1 in 100.
Source: Hamilton Police Dept.
Identity Theft
Law Enforcement Suggestions on How To Avoid
Identity Theft:
- Place passwords on your credit and debit cards and change these often.
Avoid using easily available information, ie: birthdate and phone numbers as
your password.
- Secure personal information in your home.
- Don’t give personal information out over the phone, through the mail or over
the internet, unless you initiate the contact.
- Guard your mail and your trash from theft. Deposit outgoing mail at the post
office or secure box instead of an unsecured mailbox. Remove mail from your
mailbox promptly. Put your mail on hold if you are going
to be away.
Source: Hamilton Police Dept.
Identity Theft
Law Enforcement Suggestions on How To Avoid
Identity Theft:
- Shred all mail and paperwork that contains personal information.
-Do not carry your SIN card on your person; keep it in a safe place. This should
also be so for any identification not needed on a daily basis.
- When using you debit or credit card always keep it in your view, watch the
clerk as they process your card and always protect you PIN.
Source: Hamilton Police Dept.
Identity Theft
Breakdown
Breakdown
Breakdown
Teacher In-service Using the Breach Database
- Select a data base item from the one of the 7 areas
- Connect to the internet through the link
- Printed examples will be used in the workshop
- Review with staff the event, nature of the breach and type of information
compromised by this breach
- Pose the following questions for discussion:
a) Was the information of a nature that could compromise the
identity of the individual?
b) Could the information be used for malicious purposes?
c) Are there legal implications for our organization due to the loss
of this data?
d) Have we followed the necessary steps to inform the parties of
the loss of this information?
e) Have we done or can we do anything to re-secure this
information
Using The Database
Now It’s Your Turn:
Create a group for discussion purposes:
Your board team, or a group of 5 or 6
1) Select a breach from the database.
2) Review the breach on the internet or use one of the printed
examples.
3) Pose the questions.
4) Be prepared to report your discussion (20 minutes).
5) Each teams reports will be posted.
Using The Database
Best Practices to Prevent Breaches:
Resources available for use in teacher in-service:
- Privacy videos found on the London region MISA website
www.misalondon.ca
- Teacher videos
- Administration and Central Staff videos (Principals)
- I.T. Videos
- MISA Breach database found in pdf. format on the MISA
website resources
- PIM Guidelines
Using The Database
Physical Document & Data Protection for
Teachers
Click image to stream video in Media Player. Or visit the link below:
http://misalondon.ca/teacher_videos06.html
PIM Videos
Digital Data Protection for Admin/Staff
Click image to stream video in Media Player. Or visit the link below:
http://misalondon.ca/teacher_videos02.html
PIM Videos
Discussion Questions for Teachers Physical
Document & Data Video:
1. Is there a clear purpose for each type of personal information
that I collect, use, retain, or disclose?
2. Do I know when it is appropriate to destroy personal,
confidential, or sensitive information? When destroying such
information, do I place it in the appropriate shredding bins?
3. Are Ontario Student Records (OSR) and Office Index Cards
securely stored in the main office of the school and are only
accessible by authorized personnel in the main office of the school.
4. Do I ensure that information about a student(s) is shared only
with other staff in the school who are assigned to work with the
student(s), and only as needed to improve the education of the
student(s).
PIM Videos
Discussion Questions for Admin/Staff Digital
Data Protection Video:
1. Have I safeguarded all electronic personal information records
maintained in password-protected databases?
2. Do I refrain from storing personal, confidential, or sensitive
information on a Shared Network Drive?
3. Do I immediately pick up any personal, confidential, or sensitive
records sent to printer or photocopier or received by fax?
4. Before sending personal, confidential, or sensitive information
via email, have I considered taking precautions such as removing
personal information?
continued...
PIM Videos
Discussion Questions for Admin/Staff Digital
Data Protection Video:
5. Are computer access rights reviewed and updated regularly to
ensure that I do not have access to personal information that I do
not need to perform my duties and responsibilities?
6. Am I following the procedures in place for safeguarding personal
information on laptops, memory sticks, personal digital assistants
(PDAs, e.g., BlackBerry devices), etc.?
7. Do I sometimes share passwords with others? If so, do I
immediately change my password afterwards?
PIM Videos