Schools risk theft of SS numbers of children

Joel Reidenberg on The Washington Times, July 25, 2010

Media Source

Many states don't require collection, but still gather data

By Matthew Cella

8:05 p.m., Sunday, July 25, 2010

Schools are putting children at risk of identity fraud by obtaining their Social Security numbers when it is not required by law and often unnecessary, the Social Security Administration's Office of Inspector General has concluded.

Some school systems in at least 26 states collect the nine-digit identifiers when students from kindergarten through high school register for classes, even though the respective state does not require it as a matter of law, according to a report released last week.

Seven states require school systems to collect Social Security numbers as their primary means to track and identify students, though other methods would be as efficient, investigators said.

In one case, they found an elementary school poster contest in which students were directed to put their Social Security numbers on entry forms attached to the backs of posters.

"We believe such practices increase the risk of SSN misuse and unnecessarily subject students to the possibility of identity theft," investigators said in the report, which noted the growing number of identity theft victims who are under the age of 19. "Identity thieves often target children because they have clean credit histories, and their records may be used for years before they realize their identity has been used for criminal activities."

Additionally, the report cited an October 2009 study by the Fordham Law School Center on Law and Information Policy that showed a growing trend among state departments of education to establish databases that track students' progress over time.

The Fordham study found that privacy protections for the databases were generally lacking in the majority of states. It said 16 states warehoused children's Social Security numbers and more than 40 states "apparently failed to have data retention policies and were likely to hold student information indefinitely," according to the inspector general's report.

The coordinator of the Statewide Longitudinal Data Systems Grant Program — which is run by the Department of Education and aids states in establishing long-term tracking databases — told investigators the federal Education Department does not instruct states to collect Social Security numbers when establishing databases.

"According to the grant program coordinator, the primary reason some states collect K-12 students' SSNs is to allow States to track students as they move to post-secondary education systems and enter the workforce," Social Security Administration investigators said.

The report recommended that the Social Security Administration coordinate with state departments of education and K-12 school systems to inform them of the potential risks associated with using the numbers as student identifiers or for other purposes. It also encourages school systems to reduce unnecessary collection of the numbers and to implement stringent safeguards to protect the numbers when they are collected.

It also provided examples of what can occur when security is breached, noting that since 2005 there have been 40 school-related breaches of personally identifiable information.

Among them:

• In December 2009, a North Carolina school system accidentally sent out about 5,000 postcards with students' Social Security numbers printed on the front.

• In September 2009, 15 boxes containing hundreds of students records, including birth certificates and Social Security cards, were dumped on the sidewalk in front of their former New York high school.

• In October 2008, more than 400 identification cards were recalled from a Maryland high school when officials realized that student Social Security numbers had been printed on some of them, even though the school system assigned students distinct identification numbers. The report said the school system also appears to use the numbers in student lunch codes.