Protecting Your Privates

At the annual Educause Policy Conference, in Washington, Fred H. Cate, director of the Center for Applied Cybersecurity Research at Indiana University, asked audience members if they knew how much data a typical college keeps about each of its students. Not only are names and Social Security numbers collected, but a prodigious amount of other information is usually stored in a centralized database.

Students’ grades, disciplinary records, and course listings are kept there. Their high-school records, application information, and letters of recommendation also remain on file.

Financial-aid information, including parents’ salaries and tax information, is stored along with the students’ records. So is medical information from the institution’s health-care facility.

The information can even pinpoint their daily whereabouts, through listings of students’ class schedules and their use of wireless Internet-access points and security swipe cards, which they need every time they enter a dorm room or eat a meal. What’s more, the computer records what kind of car a student drives — including the license-plate number — for distribution of parking passes.

"Banks might have some of this. Hospitals have some of this," Mr. Cate said. "We have it all."

And it doesn’t end when a student graduates. Information on alumni’s locations and salaries are often kept for fund-raising purposes.

Hackers see colleges as gold mines of private information, Mr. Cate warned. Colleges must protect that information to save their students from identity theft and potential stalkers.

"Why would you bother hacking anyone else," said Mr. Cate, "when you can just go to a university?"