Following breach, state delays collecting student Social Security numbers

By Lynda Clancy | Oct 04, 2010

Share

AUGUSTA — The effort to build a data system that includes Social Security numbers of public school students was derailed after a technology director in Gardiner's school district was able to view Social Security numbers of school staff elsewhere in the state.

Maine's Department of Education responded by dumping all Social Security numbers of public high school students collected to date, and announced Tuesday evening, Sept. 28, that it would delay collecting any more until an independent security review of the software is completed and a report is issued.

That could take several weeks, the DOE said.

The state education agency is now providing school districts a software script that allows them to upload student enrollment data without Social Security numbers.

"A software switch was turned on when it should have been off, or off when it should have been on," said David Connerty-Marin, spokesman for the Maine DOE, on Sept. 28.

The collection of Social Security numbers and other private data has met with resistance across the state from school boards, administrators, parents and the Maine Civil Liberties Union, who question the wisdom of posting information about students in a system where data could be stolen.

On Sept. 28, the DOE recognized that concern and said in a press release the delay in Social Security number collection and review of the entire Infinite Campus information system are steps taken "as privacy advocates have expressed concerns about the security of the information and because the department learned in the past few days of an error within a secondary data system not connected to the collection of student information."

The error was fixed immediately, the DOE said.

The data system is part of the education agency's decade-long project to build an information management system that links the DOE with schools around the state. Functions of the online data system include the Longitudinal Data System and the Infinite Campus system, all of which result in producing more aggregate data for federal and state reports.

Goals include assessing the effectiveness of state educational programs with the data and producing reports that comply with the No Child Left Behind Act, as well as other state and national expectations. Producing the data also keeps the state in compliance with the federal government, ensuring the flow of educational funding to Maine. Likewise, the compliance of local school districts with the state's requests for data keeps the money flowing to Maine schools.

Last year, the Legislature passed an "Act To Improve the Ability of the Department of Education To Conduct Longitudinal Data Studies" to help measure the success of students in state educational programs. The act included language allowing the DOE's commissioner to collect Social Security numbers only if federal money was flowing to expand the statewide longitudinal system. The law also required written consent from parents before entering the Social Security numbers into the system.

According to Connerty-Marin, the staff module of the Infinite Campus information system is separate from the student module, still in development, and will not be ready for full use until next fall.

"Only a handful of schools in the state have access to the staff module," he said, adding that after seeing the numbers, the Gardiner district "immediately brought it to our attention."

The student module is well established and has been in use for a couple of years, he said. "We're comfortable with the security of the student system," he said.

The independent review of the system is expected to take several weeks. Connerty-Marin said the contractor has not been hired and there a price tag has yet to be affixed to the review.

The DOE said it was immediately turning off the synchronization function in the Infinite Campus District Edition so no locally entered data can be shared with or viewed by the state or any other user.

"In addition, we will also delete any student Social Security numbers that have been entered or uploaded into the state system as a result of synchronization so far this year," the DOE said.

"We deeply appreciate that this technology director immediately recognized the issue and called the department to inform us of the error and it was resolved immediately," said DOE Commissioner Angela Faherty, in a prepared statement. "The department takes the security of private information seriously, and supports school boards, parents and school officials in their caution with respect to the collection of data."

Connerty-Marin said Sept. 28 that schools should continue to collect Social Security numbers and enter them into their individual data systems. The DOE's system is now set so that it will not accept any numbers until the security review is complete.

"After that time, the districts will be in control of when they decide to upload them," he said.

Districts across the state have been skeptical of the DOE's demands forf student Social Security numbers since last year. Earlier this month, School Administrative District 40 voted to encourage parents not to submit their children's Social Security numbers.

The collection of private data has been a bone of contention between districts and the DOE since 2007 when the state required schools to submit names of suspended students for its developing data system. The MCLU got involved and when the state began requesting submission of Social Security numbers, resistance got louder.

The DOE reasoned that collecting Social Security numbers would provide the state and school districts greater ability to track where students went to college and what work they entered following high school graduation.

In April 2009, the Five Town Community School District School Board, along with school boards from around the state, students from Hampden, educational administrators and the MCLU delivered hours of testimony before the Legislature's Joint Standing Committee on Education and Cultural Affairs concerning the collection of private data.

"Technology has now provided government agencies with unprecedented power to peer into our private lives, to collect information on our finances, employment, health and education," said Shenna Bellows, director of the MCLU, 18 months ago. "The [Maine] Department of Education's longitudinal data system is yet one example in a long list of new government database systems."

The DOE insisted then the system needed disclosure of personally identifiable information in case the U.S. Department of Education found reason to audit Maine's DOE. The DOE's migrant program was audited in 2003, and ran the risk of losing some federal funding.

In April 2009, the education committee did not overturn the DOE's requirement that schools submit names of suspended students, and the longitudinal data system continued in its development. The "Act To Improve the Ability of the Department of Education To Conduct Longitudinal Data Studies" enacted last fall allowed the project to continue, but set parameters on the collection of Social Security numbers.

Last fall and this fall, school districts, including SADs 40 and 28, and the Five Town CSD, informed parents by letter that if they wanted to submit their children's Social Security numbers they could do so by opting in.

For more information, visit maine.gov/education.

Glitch delays collection of student Social Security numbers

Will delete numbers already submitted

By Matthew Stone mstone@centralmaine.com
Staff Writer

AUGUSTA -- The Maine Department of Education is telling school districts to hold off on submitting students' Social Security numbers to a state database while the department works out a system error that allowed a school technology director access to restricted information.

The state education department on Tuesday said it is deleting from its data systems student Social Security numbers that have already been submitted and ordering an outside review of the security of its data collection systems.

A technology director for a Maine school district on Friday reported being able to see the Social Security numbers of staff members employed by other Maine school districts.

State education officials say they immediately located the problem and addressed it, restricting access to the staff members' Social Security information. They still plan to hire an outside contractor to determine how the private information became available and how to prevent future data breaches, the department said.

"The department takes the security of private information seriously, and supports school boards, parents and school officials in their caution with respect to the collection of data," Education Commissioner Angela Faherty said in a statement.

The data flap comes as Maine school districts are for the first time collecting students' Social Security numbers to add to a statewide database intended to help policymakers track students' progress throughout school and college and into the workplace.

The Department of Education was to collect the Social Security numbers from districts along with a number of other informational items -- including enrollment and special education data -- that it collects on Oct. 1 of each year.

The Department of Education collects the information through its Infinite Campus information portal, the system through which the technology director was able to view the sensitive information.

"We're grateful that the Department of Education has recognized the seriousness of our data security concerns," said Shenna Bellows, executive director of the Maine Civil Liberties Union, which has been a vocal opponent of the Social Security number collection. "We continue to believe that there are more effective ways to evaluate student outcomes without violating student privacy."

Since the education department started rolling out information about the Social Security number collection, a number of school boards have passed resolutions opposing it. Under the 2009 law, school districts are required to ask for students' Social Security numbers, but parents can decline to share them.

The Department of Education said the technology director's ability to view staff members' Social Security numbers wasn't connected to the Infinite Campus function that would manage the collection of students' Social Security numbers.

"We want to just provide that added confidence with an independent review so people can remain comfortable that we have a secure system," said David Connerty-Marin, a Department of Education spokesman.

Connerty-Marin said state education officials are advising school districts to hang onto the student Social Security numbers they've already collected until the state is ready to accept them, which is expected to be in a few weeks.

The delay in Social Security number collection announced Tuesday is the second such delay since the law passed in June 2009. The Department of Education last September decided to hold off on the collection one more year to allow schools time to update privacy policies.

Matthew Stone -- 623-3811, ext. 435

mstone@centralmaine.com

LINK: http://www.kjonline.com/news/glitch-delays-collection-of-student-social-security-numbers_2010-09-28.html

Maine DOE Acknowledges Error in Infinite Campus

Maine DOE Takes Security Steps

September 28, 2010
Maine Department of Education

David Connerty-Marin | Director of Communications | 207-624-6880 (o) | David.Connerty-Marin@Maine.gov

AUGUSTA – The Maine Department of Education announced today that it is taking several immediate steps to strengthen public confidence in its student and staff data information systems. These include an independent review of the security of these systems, and a decision to delay submission of student Social Security numbers to the state until after they have had a chance to review the security report.

The steps are being taken as the voluntary collection of student Social Security numbers has become controversial in some Maine communities as privacy advocates have expressed concerns about the security of the information and because the Department learned in the past few days of an error within a secondary data system not connected to the collection of student information. The error, which was discovered and immediately fixed, affected information in the Staff Module of the State Edition of the Infinite Campus information system, and allowed authorized users of the system to see information there that should have been restricted. The Staff Module is separate from all other modules in the database and is in the final stages of development and not scheduled to be used for staff data collection until the Fall of 2011.

“The Department of Education will release the findings of the independent review, with specific recommendations for how to proceed in the most secure way,” said Education Commissioner Angela Faherty. It is anticipated the review will be completed in the next several weeks.

The error that was discovered on Friday was found by a technology director for a Maine school system, whose job duties include managing student and staff data in Infinite Campus. The technology director informed the Department that he was able to view Social Security numbers for some school staff in other school systems in the state. The Department was able to identify the problem that day and immediately restrict access to the information.

The Department immediately put in place the following changes:

1. The Department has turned off the synchronization function in the Infinite Campus District Edition so that no locally-entered data can be shared with or viewed by the state or any other user. In addition, we will also delete any student Social Security numbers that have been entered or uploaded into the State system as a result of synchronization so far this year.
2. At the Department’s request, the State’s Office of Information Technology will immediately engage an outside contractor to conduct an independent security review to verify the integrity of the state’s Staff Module where the error occurred, and to further verify that the student data system is secure.
3. The Department will delay collection of student Social Security numbers at this time as part of the October 1 data collection. Districts will be provided a software script that allows them to upload student enrollment data without Social Security numbers. Districts should continue to securely hold the Social Security number data they have already collected for later submission.

“We deeply appreciate that this technology director immediately recognized the issue and called the Department to inform us of the error and it was resolved immediately,” Faherty said. “The Department takes the security of private information seriously, and supports school boards, parents and school officials in their caution with respect to the collection of data.”

Only people with authorized access to Infinite Campus had access to the system, and the Staff Module of the Infinite Campus State Edition is separate from all other modules in the database. The staff module is in the final stages of development and not scheduled to be used by the state for staff data collection until the Fall of 2011.

LINK: http://mobile.maine.gov/e/news/?sid=133822

Maine investigates data security breach

Posted: September 29
Updated: Today at 11:30 PM 

The Department of Education asks schools to withhold student Social Security numbers after a glitch is found.

By Matthew Stone mstone@centralmaine.com
Staff Writer

AUGUSTA — The Maine Department of Education is telling school districts not to submit students' Social Security numbers to a state database until it works out a system error that gave a school technology director access to restricted information.

The department said Tuesday that it is deleting from its systems students' Social Security numbers that have been submitted and ordering an outside review of the security of its data collection systems.

On Friday, a technology director for a Maine school district reported being able to see the Social Security numbers of staff members in other districts.

State officials say they immediately found the problem and addressed it, restricting access to the staff members' Social Security information. They still plan to hire a contractor to determine how the private information became available and how to prevent future data breaches, the department said.

"The department takes the security of private information seriously, and supports school boards, parents and school officials in their caution with respect to the collection of data," Education Commissioner Angela Faherty said in a prepared statement.

For the first time, Maine school districts are collecting students' Social Security numbers for a statewide database intended to help policy makers track students' progress throughout school and college and into the workplace.

The Department of Education was to collect the Social Security numbers from districts along with other informational items – including enrollment and special education data – that it collects on Oct. 1 of each year.

The department collects the information through its Infinite Campus information portal, the system through which the technology director was able to view the sensitive information.

"We're grateful that the Department of Education has recognized the seriousness of our data security concerns," said Shenna Bellows, executive director of the Maine Civil Liberties Union, which has been a vocal opponent of the Social Security number collection. "We continue to believe that there are more effective ways to evaluate student outcomes without violating student privacy."

Since the Department of Education started rolling out information about the Social Security number collection, a number of school boards have passed resolutions opposing it. Under the 2009 law, school districts are required to ask for students' Social Security numbers, but parents can decline to provide them.

The Department of Education said the technology director's ability to view staff members' Social Security numbers wasn't connected to the Infinite Campus function that would manage the collection of students' Social Security numbers.

David Connerty-Marin, a Department of Education spokesman, said state officials are advising school districts to hang on to the students' Social Security numbers they have already collected until the state is ready to accept them, which is expected to be in a few weeks.

The delay announced Tuesday is the second such delay since the law was passed in June 2009. In September of 2009, the Department of Education decided to hold off on the collection one more year to give schools time to update privacy policies.

LINK: http://www.pressherald.com/news/state-investigates-data-security-breach_2010-09-29.html

Infinite Campus and the ACLU

MCLU Issues Back-to-School Privacy Alert

August 20, 2009

The Maine Civil Liberties Union Foundation says students and parents do not have to provide social security numbers to public schools when asked.

A Maine law passed this spring, An Act To Improve the Ability of the Department of Education To Conduct Longitudinal Data Studies, allows the Maine Department of Education to collect and use students’ social security numbers for tracking performance before and after graduation. The database is intended to link student information between the Maine Department of Education and Maine Department of Labor.

An important provision of the law establishes an opt-in program. Under the opt-in program, parents are not required to provide social security numbers to schools, but rather they may choose to participate. In 1974, Congress passed the Privacy Act (Public Law 93-579), finding that the right to privacy is a personal and fundamental right protected by the US Constitution and when government agencies collect, use, and disseminate private information, privacy is put at risk. In accordance with these findings, LD 1356 specifies that school administrations must notify parents that providing private information, such as students’ social security numbers, is optional.

“The right to privacy is a fundamental right protected by the Constitution,” said Shenna Bellows, Executive Director of the Maine Civil Liberties Union Foundation. “In the interest of student privacy and to remain compliant with the law, schools must inform parents that this is an opt-in system. Parents do not have to provide private sensitive information about their children.”

The debate over LD 1356 was heated. Proponent Commissioner Susan Gendron said in her testimony that tracking data using social security numbers is “essential for evaluating the effectiveness of education programs and curriculum in impacting postsecondary and labor market outcomes.”

Opponents, including teachers, superintendents, parents and advocacy groups, highlighted the privacy risks with tracking student and worker data using social security numbers. Government agencies are not immune to security breaches. In 2006, the Veteran’s Affairs Administration was blamed for the theft of 26.5 million social security numbers when a disc containing sensitive information was stolen. Breach of information like the social security number would leave students vulnerable to identity theft or worse. Parents and students noted how tracking student data, including incidents of prohibited behavior, with a social security number could have a negative effect, as Congress noted, on students’ ability to obtain housing, employment, or credit. Noting these concerns, schools must ask parents to think long and hard before handing over children’s social security numbers.

“I work with students every day and support their right to succeed,” said Scott McFarland, principal at Mt. Desert Elementary School. “Attaching a 7-year-old’s achievement and discipline information to his social security number is an unfair and unjust violation of her privacy. We need to be advocates for children in a way that will protect their right to privacy and the unnecessary sharing of privileged information. I would encourage all administrators in Maine to let parents know they don’t have to put their children’s privacy at risk like this.”

“Every parent must know this is an opt-in program,” said Brianna Twofoot, Field Organizer for the Maine Civil Liberties Union Foundation. “The onus lies with the schools to disseminate accurate information about the program and ensure Maine students’ privacy is protected.”

LINK: http://www.aclu.org/technology-and-liberty/mclu-issues-back-school-privacy-alert

Student Privacy at Risk?

Student privacy bill spurs debate in Augusta

By Mal Leary
Capitol News Service

AUGUSTA, Maine — Students, parents and school administrators all told lawmakers the Department of Education should stop collecting the names of students disciplined by schools and keeping them in a database, but Commissioner Susan Gendron warned that could jeopardize all federal funds for education that come to the state.

“If we don’t comply with reporting requirements as the federal government specifies, we can in fact be required to return all and any federal dollars,” she told lawmakers. “IDEA [Individuals with Educational Disabilities Act] alone is $50 million a year.”

Gendron said that while the state is collecting the disciplinary information, it reports the information only as aggregate data without the students’ identification numbers. She said individual data are confidential by law and protected from release.

“The DOE has no compelling need to know this information that would override the rights of our students and their families,” said Patricia Hopkins, superintendent of Camden area schools. “The DOE has a data collection concern that it has chosen to solve at the expense of student privacy instead of protecting that privacy.”

She and other speakers argued there is no assurance that the department can keep the information confidential once it is collected. She said there have been frequent and well-publicized reports of data breaches at major corporations and at the federal government.

“They are trying to put a lot of security measures on this but even with the top security on this information it can still be accessed, it can still be breached,” said Jason Hamilton, a senior at Hampden Academy. “I just don’t think this is right.”

He said it does not seem fair that if he committed a crime as a juvenile, that record is not kept after he turns 18, but a record of a suspension for a playground fight in elementary school would be in a Department of Education database. He was one of several students testifying in support of banning the collection of names as part of the Department of Education database.

“The simplest terms I can put this in is when I had to set down and make a decision about putting students’ names in, it just felt dirty to me,” said Scott McFarland, principal of Mount Desert Elementary School in Northeast Harbor. “This just stinks, it is not right and it is not acceptable to me.”

The Maine School Management Association and the Maine School Boards Association also supported the measure.

Commissioner Gendron, the only opponent to the bill, defended the collection of the information as required by several federal laws, but her assertion was challenged by Jon Paterson, a Portland attorney representing the Maine Civil Liberties Union at the hearing.

“In my personal review of the federal laws that were cited by the department, there is no requirement in any of these federal laws that requires the Department of Education to collect that information,” he said.

In fact, Paterson said, some of the federal laws cited by department, such as the No Child Left Behind Act, specifically prohibit collection of information that names an individual.

“It says that reporting schools shall not identify victims of crimes or persons accused of crimes,” he said. “In the Individuals with Educational Disabilities Act, the state is prohibited from collecting information that would disclose personally identifiable information about individual children.”

The measure is sponsored by Sen. Justin Alfond, D-Portland, co-chair of the committee. The bill now will be considered at a workshop of the committee, scheduled for Wednesday afternoon. The bill then will go before the full Legislature with the recommendation of the panel whether it should be passed or needs to be amended.

Link: http://www.bangordailynews.com/detail/103236.html