Identity theft and student ID numbers

Probably the best thing I did as director of the Colorado Student Association was successfully lobby for legislation (which I wrote) prohibiting the use of Social Security numbers as student ID numbers. Here's a clip from the University of Colorado faculty newspaper, The Silver and Gold Record:

Bill would ban use of SSNs as student numbers

January 30, 2003

By Marianne Goodland

HB 1175, sponsored by Rep. Nancy Spence (R-Centennial), would require all institutions of higher education in Colorado to set up randomly-generated identification numbers and end the practice of using SSNs as student ID numbers. Currently, institutions must use SSNs to interface with the federal government on financial aid, student employment and selective service registration. Barbara Todd, CU-Boulder registrar, said this week that it is legal for an institution to use the SSN as a student identifier, and that SSNs routinely appear on class rosters and in the Student Information System (SIS). Faculty use SSNs to look up student records in the SIS and to verify student identities in classes.

It is illegal for anyone to display a student's SSN without his/her consent, which might occur through posting grade lists on a faculty office door. Those lists often identify the student with all or part of the SSN. It is also illegal to pass a roster around in a class to ask students to check-off their names if that roster includes the SSN. "Anytime an instructor passes a roster around or posts it on his/her door, it is displaying student information without the student's consent," Todd said.

Ryan McMaken of the Colorado Student Association testified Monday that the Family Educational Rights and Privacy Act (FERPA) has for almost 30 years prohibited the release of student Social Security numbers to anyone other than those with a "legitimate educational interest." Most institutions have taken steps to ensure that they do not use a student's SSN to identify the student, McMaken said, but many of the violations still occur at the classroom level. "It often depends on the preference or policy of the individual faculty member," McMaken told the committee.

Violations occur even when only a partial SSN is used, such as on class exams or papers. Three years ago, the U.S. Department of Education ruled that the release of even a partial Social Security number violated FERPA, and McMaken told the committee that in Colorado faculty often use the last four digits in a SSN to identify students on exams or papers. However, he said, many Colorado residents have the same first five digits, and as a result it would be easy for someone to identify the entire SSN once the last four digits are known, he said.

In addition, according to CSA, students have complained that SSNs are often required to renew library books over the phone or online and the numbers are printed on ID cards required for access to dorms, cafeterias and other facilities. McMaken said such violations "are blatantly illegal."