Disappeared News

by Larry Geller

Many more thoughts have gone through my mind since posting Is there an attorney who can defend us against University of Hawaii data leaks? (10/30/2010) yesterday.

That article is in reaction to the latest leak of personal data by the University of Hawaii. This time, my personal data (including social security number) was leaked, and I’m very concerned.

The University of Hawaii's personal information breach of more than 40,000 students is the third-largest privacy breach detected by a Washington, D.C.-based privacy policy institution.

A faculty member at the West Oahu campus apparently inadvertently uploaded personal information of 40,101 students to the Web.
…
"The part that really disturbed me is when he was asked, 'Why did you move it to this server?' his answer was, 'Because I didn't have enough room on my home computer,'" said Aaron Titus, an attorney and the coalition's privacy director.  [Star-Advertiser, Privacy protector found UH data dump, 10/30/2010]

Let me list up my thoughts. I still hope there is some attorney out there who might be thinking “c l a s s  a c t i o n.”

Informed consent

I don’t recall giving the University of Hawaii my consent to use the information I submitted to them for research purposes. I provided information to them for the purposes of taking courses and later for admission. That’s it.

Maybe I signed something with fine print in it. I’m going to write to them and ask for a copy of any consent I gave them to be a subject of research.

If the research involved is considered research on human subjects, then certain federal laws may apply. I’m no expert, but for example, according to 21 CFR 50.20:

"no investigator may involve a human being as a subject in research covered by these regulations unless the investigator has obtained the legally effective informed consent of the subject or the subject's legally authorized representative."

More (from various academic sites on the Web:)

The investigator must enumerate how privacy and confidentiality concerns will be approached. Researchers must be sensitive to not only how information is protected from unauthorized observation, but also if and how participants are to be notified of any unforeseen findings from the research that they may or may not want to know.

Research methodology

A researcher does not need names and social security numbers. Established practice requires only that each data record have some unique identifier. There should be nothing in the records provided to the researcher that could associate the data with a particular individual. This is very basic.

Who was supervising this faculty member? What standards of ethics were enforced? What certifications needed to be turned in to gain access to the data?

Access to data

Who provided this data to the faculty member? A chain of custody needs to be established (if an attorney gets involved, it will come out during the discovery process). Someone turned over the personal data, and that was the first security breach. What rules applied to turning over the data? Were rules broken? Was data turned over to a researcher who had an adequate computer and procedure at work (not at home!) to safely protect the data?

If the research was considered to be human subject research, what committee approved it, what committee reviewed and authorized the release of the data to the researcher?

Research design

Whether or not this is considered human research, the research design appears flawed. There was no need for the researcher to have personally identifiable information. Again, what committee reviewed this research? What approvals were given, if any?

University lack of reaction

In the event that sensitive personal information has been breached, for example, names along with social security numbers, the university should have taken steps to immediately notify anyone affected. Time is of the essence. Perhaps someone wants to take protective action as a result of the breach. They need to know first that their data has been leaked.

I still have not been notified by UH that my data was in the batch that got out. I found out by going to the website mentioned in the newspaper article.

Failure of the university to remedy potential problems

UH did not offer to cover the cost of identity theft insurance or otherwise inform me of steps they are taking that will protect me against the potential cost of their security breach.

If information from any of the UH security leaks is in the hands of a third party, it can be sold any time in the future. This causes me a great deal of concern and even what I think is described as “mental anguish.” Who knows when the shoe will drop?

Inadequate procedures, any fix in sight?

The breached data was kept on the faculty member’s home computer. How was that allowed? Are there other instances of data on home computers, and what is being done to assure that data is not only removed but that the hard drives are being scrubbed clean? It isn’t enough to delete the data. In actuality, the data is still on a hard disk even though it is deleted. It takes a special procedure to get rid of it forever.

Have all personnel been asked to state whether they possess personally identifiable data in any form, on paper or in computer, or whether they have possessed such data and how it was destroyed?

If a home computer is stolen or sold, anything on the hard disk goes with it. The UH inquiry should include home computers. I’ll go further: action should be taken against anyone keeping sensitive personal information on home computers. And against anyone providing sensitive personal data who does not also provide procedures and checks to make sure the data is not stored improperly.

Repeated leaks are unacceptable

From my earlier article, quoting the security website that discovered the leaked data via Google:

This latest breach follows on the heels of a May, 2010 breach involving 53,000 students, and a 2009 breach involving 15,487 parents and students.

The UH is  repeat offender. A comprehensive solution is needed.

Permalink posted by Larry @ 10/31/2010 02:41:00 PM