Campus Wide ID Project

1
Campus Wide ID Project

• Presented by Amir Dabirian and
• Susan Kachner
• Information Technology
• September 25, 2003

2
Why are we doing this?

• There is heightened awareness and concern about
  identity theft which is one of the fastest
  growing crimes committed in California
• California laws mandating the we stop using SSN
  to identify students effective January 1, 2004
• Assembly bill AB 46
• Senate bill SB 25

3
Requirements of AB46 and SB25

• May not use SSN to identify students. Must come
  up with a different identifier.
• May not publicly post or display SSN
• May not print SSN on ID cards in any format
  (barcodes, magnetic strips)
• May not print SSN in materials mailed to students
  unless required by state or federal law
• May not require students to transmit SSN via the
  internet unless the connection is secure or the
  SSN is encrypted

4
Requirements of AB46 and SB25

• The new law does not prevent the collection, use
  or release of SSN as required by state or federal
  law or the use of SSN for internal verification
  or administrative purposes

5
Security Concerns

• Concern about hackers accessing databases
  containing SSN along with other personal
  information
• New California law (SB 1386) went into effect
  July 1, 2003 requiring SSN to be encrypted in
  databases. If not encrypted and the database is
  hacked, the owner of the database must inform all
  people contained in the hacked database that
  their personal information has been compromised.

6
Current Environment

• Student Information System (SIS) is keyed on
  SSN. For students without an SSN or who refuse
  to supply SSN, a fake SSN is generated.
• Faculty SSN is also stored in SIS and is the key
  to faculty records
• SSN for students and faculty are displayed in
  SIS to most users with access to SIS

7
Current Environment

• Many databases fed by SIS also contain SSN
• In addition to broad campus access to SSN in SIS
  and other databases, student SSN was being
  printed and distributed in reports like class
  lists and grade rosters as well as in mailings to
  students

8
Recent Stopgap Measures Taken

• Campus mailings to students now suppress first 5
  digits of SSN unless SSN is required in the
  mailing
• Reports such as class lists and grade rosters now
  suppress first 5 digits of SSN
• Electronic class lists now suppress first 5
  digits of SSN

9
Project Goal

• Convert SIS to use an identifier other than SSN
  for students and faculty (we will call it Campus
  Wide ID or CWID) targeted for completion
  December 2003
• Convert Superdirectory to associate a CWID with
  each record (student, faculty, staff and others)
• Evaluate the need of other campus databases for
  their need-to-know SSN. If no need-to-know,
  convert to CWID. If there is a need-to-know,
  also store CWID and limit access to SSN.

10
Project Goal (continued)

• Encourage campus departments to use CWID rather
  than SSN including private databases and paper
  files
• Encourage campus departments to shred documents
  containing SSN when no longer needed

11
CWID Format

• 9-digit number beginning with 8 in the first
  position. The 9th position will be a
  check-digit.
• Since SSNs never begin with 8, the CWID and
  SSN will be easily distinguishable
• Only SIS and the Superdirectory will assign
  CWIDs

12
Project Status

• The Superdirectory has already assigned CWID
  values to all records but we will not publicize
  those values until the SIS migration to CWID is
  ready
• There will be a single CWID assigned no matter if
  you are student, faculty or staff
• SIS migration to CWID targeted for December 2003
• Currently meeting with owners of campus databases
  to plan how to migrate to CWID

13
What will change?

• SSN will be retained in SIS but with very
  limited access
• Students will be notified of their CWID following
  the SIS migration. Once the migration is done,
  students can continue to access TITAN Online and
  VRR using either their SSN or CWID along with
  their PIN.
• Most SIS screens will only display CWID for
  students and faculty. Student records can be
  brought up using either CWID or SSN (if known).
• SIS name search will only display CWID
• Most reports will only print CWID

14
What will change? (continued)

• Here is a partial list of many other campus
  databases that will be impacted by the CWID
  project
• CashNet
• Credentials
• Datawarehouse
• Departmental databases (private databases)
• Extended Education database
• FRS
• Health Center
• Imaging lookups (will allow either CWID or SSN
  lookup)
• Library Circulation
• Parking
• Testing Center
• Titan Card

15
Questions???