Housing SSN security breach - Revision history

Absentminded at 20:47, 10 January 2014

2014-01-10T20:47:45Z

Admin at 23:11, 8 December 2013

2013-12-08T23:11:35Z

Admin at 21:58, 26 May 2013

2013-05-26T21:58:10Z

Jiabao: Reverted edits by 24.184.156.208 (Talk); changed back to last version by Wsehb2.125

2008-06-14T01:21:06Z

Reverted edits by 24.184.156.208 (Talk); changed back to last version by Wsehb2.125

24.184.156.208 at 00:44, 14 June 2008

2008-06-14T00:44:57Z

Wsehb2.125: /* External links */

2008-06-13T15:06:23Z

‎External links

Wsehb2.125 at 15:05, 13 June 2008

2008-06-13T15:05:04Z

Jiabao: Added some content and headers, removed personal names

2008-06-13T14:28:50Z

Added some content and headers, removed personal names

Wsehb2.125 at 13:37, 13 June 2008

2008-06-13T13:37:38Z

66.108.7.16 at 12:14, 13 June 2008

2008-06-13T12:14:14Z

← Older revision		Revision as of 20:47, 10 January 2014
Line 1:		Line 1:
−	The '''Housing SSN security breach''' was an accidental public posting of 5,000 [[w:Social Security Numbers\|Social Security Numbers]] by a [[Columbia Housing\|Housing]] employee. It was discovered in June [[2008]].	+	The '''Housing SSN security breach''' was an accidental public posting of 5,000 [[w:Social Security Numbers\|Social Security Numbers]] by a [[Columbia Housing\|Housing]] employee. It was discovered in June [[2008]]. It is one of many Columbia [[SSN security breaches]].

	==Summary==		==Summary==

← Older revision		Revision as of 23:11, 8 December 2013
Line 122:		Line 122:
	* [http://www.columbiaspectator.com/node/55185 Spectator: 5000 Students Informed of Online Security Breach]		* [http://www.columbiaspectator.com/node/55185 Spectator: 5000 Students Informed of Online Security Breach]

−	[[Category:~~Scandals~~]]	+	[[Category:Housing scandals]]
		+	[[Category:IT scandals]]

← Older revision		Revision as of 21:58, 26 May 2013
Line 1:		Line 1:
−	The '''Housing SSN security breach''' was an accidental public posting of 5,000 [[w:Social Security Numbers\|Social Security Numbers]] by a [[Housing]] employee. It was discovered in June [[2008]].	+	The '''Housing SSN security breach''' was an accidental public posting of 5,000 [[w:Social Security Numbers\|Social Security Numbers]] by a [[Columbia Housing\|Housing]] employee. It was discovered in June [[2008]].

	==Summary==		==Summary==

@@ Line 10: / Line 10: @@
 [[Student Services]] discovered the breach of confidentiality 16 months later, on June 3, 2008. They notified Google, who removed the offending file from the Google Code website. On June 10, 2008, they emailed all 5,000 students who were affected from an alias called "studentservices-assist@columbia.edu". Some students were offered two years of "Identity Guard CreditProtectX3SM" credit monitoring, while others were not—it is unclear why not all students were offered the credit monitoring service.
 ===Students===
-Extensive coverage on the [[Bwog]] gave affected students an outlet for their frustration. One student created a petition<ref>http://www.petitiononline.com/breach/</ref> demanding changes in the university's approach to confidential information and retributive action against the student. Interestingly, the culprit himself was the 95th person to sign the petition. However, the actual breach of security took place before the June 2007 institution of a new security policy following a similar leak in April 2007. Many students expressed anger in Bwog comments, directed at Housing for allowing the situation to happen and not offering all students the credit monitoring service, the [[Columbia University|university]] as a whole, and particularly the [[alumni|former student]] in question.
+Extensive coverage on the [[Bwog]] gave affected students an outlet for their frustration. One student created a petition<ref>http://www.petitiononline.com/breach/</ref> demanding changes in the university's approach to confidential information and retributive action against the student. However, the actual breach of security took place before the June 2007 institution of a new security policy following a similar leak in April 2007. Many students expressed anger in Bwog comments, directed at Housing for allowing the situation to happen and not offering all students the credit monitoring service, the [[Columbia University|university]] as a whole, and particularly the [[alumni|former student]] in question.
 It was possible from the cached version of the Googlecode website, which some students who received the email and subsequently searched for their names and SSNs on Google were able to find, to ascertain the name of the individual who apparently had posted the file. In particular, the cached pages indicate that the website counted at least 4 people among its contributors for a class project. According to one of the cached pages, a 2007 [[SEAS]] graduate uploaded a file called "output.xls", which has led many people to accuse him of being the "former student employee" at fault. In anonymous Bwog comments, many people excoriated the individual and called for retribution, though his own name was included on the list and it appeared to be an innocent, if stupid mistake.

@@ Line 10: / Line 10: @@
 [[Student Services]] discovered the breach of confidentiality 16 months later, on June 3, 2008. They notified Google, who removed the offending file from the Google Code website. On June 10, 2008, they emailed all 5,000 students who were affected from an alias called "studentservices-assist@columbia.edu". Some students were offered two years of "Identity Guard CreditProtectX3SM" credit monitoring, while others were not—it is unclear why not all students were offered the credit monitoring service.
 ===Students===
-Extensive coverage on the [[Bwog]] gave affected students an outlet for their frustration. One student created a petition<ref>http://www.petitiononline.com/breach/</ref> demanding changes in the university's approach to confidential information and retributive action against the student. However, the actual breach of security took place before the June 2007 institution of a new security policy following a similar leak in April 2007. Many students expressed anger in Bwog comments, directed at Housing for allowing the situation to happen and not offering all students the credit monitoring service, the [[Columbia University|university]] as a whole, and particularly the [[alumni|former student]] in question.
+Extensive coverage on the [[Bwog]] gave affected students an outlet for their frustration. One student created a petition<ref>http://www.petitiononline.com/breach/</ref> demanding changes in the university's approach to confidential information and retributive action against the student. Interestingly, the culprit himself was the 95th person to sign the petition. However, the actual breach of security took place before the June 2007 institution of a new security policy following a similar leak in April 2007. Many students expressed anger in Bwog comments, directed at Housing for allowing the situation to happen and not offering all students the credit monitoring service, the [[Columbia University|university]] as a whole, and particularly the [[alumni|former student]] in question.
 It was possible from the cached version of the Googlecode website, which some students who received the email and subsequently searched for their names and SSNs on Google were able to find, to ascertain the name of the individual who apparently had posted the file. In particular, the cached pages indicate that the website counted at least 4 people among its contributors for a class project. According to one of the cached pages, a 2007 [[SEAS]] graduate uploaded a file called "output.xls", which has led many people to accuse him of being the "former student employee" at fault. In anonymous Bwog comments, many people excoriated the individual and called for retribution, though his own name was included on the list and it appeared to be an innocent, if stupid mistake.

@@ Line 117: / Line 117: @@
 == External links ==
-* [http://www.bwog.net/articles/credit_monitoring_mystery_solved]
+* [http://www.bwog.net/articles/credit_monitoring_mystery_solved Bwog: Credit Mystery Solved]
 * [http://www.bwog.net/articles/hilarious_housing_dining_social_security_number_mishap Bwog: Hilarious Housing & Dining Social Security Number Mishap]
 * [http://www.bwog.net/articles/ssn_snafu_protests_go_digital Bwog: SSNafu Protests Go Digital]

@@ Line 1: / Line 1: @@
-The '''housing SSN security breach''' emerged in June 2008.
+The '''Housing SSN security breach''' was an accidental public posting of 5,000 [[w:Social Security Numbers|Social Security Numbers]] by a [[Housing]] employee. It was discovered in June [[2008]].
-According to Scott Wright, Columbia's Vice President for Student Auxiliary & Business Services, a "former student employee" inadvertently posted a file on the internet in February 2007 that contained the names and SSNs of over 5,000 students. The file in question seems to have been an Excel spreadsheet called "output.xls", which seems to have been posted at "http://cu-super-hw2.googlecode.com/files/output.xls". The spreadsheet has since been taken down, along with the rest of the "cu-super-hw2" website. However, various parts of the website remain online in the caches of search engines, including MSN.<ref>http://cc.msnscache.com/cache.aspx?q=73381023649685&mkt=en-US&setlang=en-US&w=8006b6d6,9ed44b4&FORM=CVRE9</ref><ref>http://cc.msnscache.com/cache.aspx?q=73424566345560&mkt=en-US&setlang=en-US&w=ea9b6e99,e55de10f&FORM=CVRE</ref>
+==Summary==
 [[Image:Xlsgoogle.png|thumb|right|A google search showing partial contents of the file.]]
-These cached pages indicate that the website counted at least 4 people among its contributors, one of whom was Sven Hafemeister. According to one of the cached pages, Hafemeister uploaded a file called "output.xls", which has led many people to accuse him of being the "former student employee" at guilt. Hafemeister has since graduated, but while at Columbia he was a SEAS comp sci major and student athlete<ref>http://www.gocolumbialions.com/ViewArticle.dbml?SPSID=43592&SPID=3876&DB_OEM_ID=9600&ATCLID=612091&Q_SEASON=2006</ref>. He recently took down his [[Facebook]] page.
+==Response==
-[[Image:http://www.columbia.edu/cu/wrestling/images/wrestlers/hafemeister_sven_2006.jpg|thumb|right|The leaker himself]]
+It was possible from the cached version of the Googlecode website, which some students who received the email and subsequently searched for their names and SSNs on Google were able to find, to ascertain the name of the individual who apparently had posted the file. In particular, the cached pages indicate that the website counted at least 4 people among its contributors for a class project. According to one of the cached pages, a 2007 [[SEAS]] graduate uploaded a file called "output.xls", which has led many people to accuse him of being the "former student employee" at fault. In anonymous Bwog comments, many people excoriated the individual and called for retribution, though his own name was included on the list and it appeared to be an innocent, if stupid mistake.
-Student Services discovered this breach of confidentiality on 3 June 2008. They notified Google, who removed the offending file from the Google Code website. On 10 June 2008, they emailed all 5,000 students who were affected from an alias called "studentservices-assist@columbia.edu". Some students were offered two years of "Identity Guard CreditProtectX3SM" credit monitoring, while others were not - it is unclear why all students were not offered the credit monitoring. According to comments on Bwog, students who received these emails and subsequently searched for their names and SSNs on Google were still able to find the spreadsheet. It seems this was because Columbia did not also ask Google to remove the file from its cache. One student has created a petition to protest Columbia's incompetence.<ref>http://www.petitiononline.com/breach/</ref>
+==Two Versions of the Email==
-A similar (though less widespread) SSN scandal happened just over a year ago in April 2007.
+=== Email that offers credit monitoring ===
 <blockquote>
 From: studentservices-assist@columbia.edu<br/>
@@ Line 81: / Line 84: @@
 </blockquote>
-== Alternative email that doesn't offer credit monitoring ==
+=== Alternative email that doesn't offer credit monitoring ===
 <blockquote>
 From: studentservices-assist@columbia.edu<br/>

← Older revision		Revision as of 12:14, 13 June 2008
Line 6:		Line 6:

	These cached pages indicate that the website counted at least 4 people among its contributors, one of whom was Sven Hafemeister. According to one of the cached pages, Hafemeister uploaded a file called "output.xls", which has led many people to accuse him of being the "former student employee" at guilt. It seems that Hafemeister used the spreadsheet with student data to complete a homework for CS4733 Computational Aspects of Robotics. Hafemeister has since graduated, but while at Columbia he was a SEAS comp sci major and student athlete<ref>http://www.gocolumbialions.com/ViewArticle.dbml?SPSID=43592&SPID=3876&DB_OEM_ID=9600&ATCLID=612091&Q_SEASON=2006</ref>. He recently took down his [[Facebook]] page.		These cached pages indicate that the website counted at least 4 people among its contributors, one of whom was Sven Hafemeister. According to one of the cached pages, Hafemeister uploaded a file called "output.xls", which has led many people to accuse him of being the "former student employee" at guilt. It seems that Hafemeister used the spreadsheet with student data to complete a homework for CS4733 Computational Aspects of Robotics. Hafemeister has since graduated, but while at Columbia he was a SEAS comp sci major and student athlete<ref>http://www.gocolumbialions.com/ViewArticle.dbml?SPSID=43592&SPID=3876&DB_OEM_ID=9600&ATCLID=612091&Q_SEASON=2006</ref>. He recently took down his [[Facebook]] page.
		+
		+	[[Image:http://www.columbia.edu/cu/wrestling/images/wrestlers/hafemeister_sven_2006.jpg\|thumb\|right\|The leaker himself]]

	Student Services discovered this breach of confidentiality on 3 June 2008. They notified Google, who removed the offending file from the Google Code website. On 10 June 2008, they emailed all 5,000 students who were affected from an alias called "studentservices-assist@columbia.edu". Some students were offered two years of "Identity Guard CreditProtectX3SM" credit monitoring, while others were not - it is unclear why all students were not offered the credit monitoring. According to comments on Bwog, students who received these emails and subsequently searched for their names and SSNs on Google were still able to find the spreadsheet. It seems this was because Columbia did not also ask Google to remove the file from its cache. One student has created a petition to protest Columbia's incompetence.<ref>http://www.petitiononline.com/breach/</ref>		Student Services discovered this breach of confidentiality on 3 June 2008. They notified Google, who removed the offending file from the Google Code website. On 10 June 2008, they emailed all 5,000 students who were affected from an alias called "studentservices-assist@columbia.edu". Some students were offered two years of "Identity Guard CreditProtectX3SM" credit monitoring, while others were not - it is unclear why all students were not offered the credit monitoring. According to comments on Bwog, students who received these emails and subsequently searched for their names and SSNs on Google were still able to find the spreadsheet. It seems this was because Columbia did not also ask Google to remove the file from its cache. One student has created a petition to protest Columbia's incompetence.<ref>http://www.petitiononline.com/breach/</ref>