|
A procedural mishap at New Mexico Tech’s Computer Center may have allowed the Social Security numbers of a few thousand people to be publicly available to anyone with a Tech computer account for nearly five years.
William Colburn, Tech graduate, former Tech employee and Tech Community College instructor and current Tech student, said he found copies of an accounting file containing more than 3,000 Social Security numbers stored in two locations on a publicly searchable disk on the TCC server.
Tech’s Public Information Officer, Thom Guengerich, said the problem has been taken care of.
"We don’t dispute that some files were accidentally and inadvertently made open," Guengerich said, in a telephone interview on Thursday, Oct. 14. "When it came to the university’s attention, they were deleted."
Guengerich said the university has already addressed Colburn’s concerns, in a letter to the editor published in the Albuquerque Journal on Sept. 29 and reprinted in El Defensor Chieftain on Oct. 2. In the letter, Guengerich wrote that Colburn had discovered in 2005 that a small number of students’ Social Security numbers were "searchable on the Internet."
"When he pointed out the deficiency in our system, New Mexico Tech administrators took action to ‘plug the hole,’" the letter said.
According to Colburn, Guengerich’s letter doesn’t accurately reflect what he found, and when.
It was in January of this year, not 2005, Colburn said, that he found two copies a file stored on the TCC servers, containing not just his own personal Social Security number, but what appeared to be the Social Security numbers of at least 3,000 other people, if not more. According to Colburn, the copies had been created in 2005, and had been publicly available since they were created five years ago to any and all TCC users.
Colburn estimates that at any given time at least 3,000 people have a TCC account, including students, faculty and staff members and their spouses, alumni, NRAO employees and some visitors. Over the course of five years, considerably more than 3,000 people who have come and gone from the Tech community could have had access to them.
Alarmed by his discovery, on Jan. 18 Colburn wrote a letter to Tech’s Director of Information Services, Joe Franklin, containing the file name, along with its creation date and the two locations where he found it.
Franklin remembers receiving the letter.
"The way I understand it, he brought the letter to me because he felt the problem wasn’t being resolved over at the Computer Center," Franklin said. "I referred it to the vice president over the TCC, Dr. Peter Gerity, and they took care of it."
Shortly thereafter, Colburn looked again and the files were gone, but he wasn’t satisfied. "They were removed fairly quickly, but I got no response," he said. "The thing I’m upset about is Tech’s ongoing refusal to provide any accountability."
Alleged password theft
According to Colburn, he began raising concerns about security lapses at the TCC with Tech officials five years ago.
Like many Tech alumni, Colburn maintains an account on Tech’s computer system. In 2005, he said, he discovered that the security of his TCC account had been breached, and that a copy of his private e-mail and the "ssh DSA key" for his account had been placed on a publicly available disk where any one could read them.
"An ssh DSA key is a string of computer information that allows anyone to log in to an account without knowing the password," Colburn said. "Basically, it’s your password. My password was stolen, and made public."
Colburn filed a complaint, using the TCC’s ticket system for reporting a problem, or making a complaint or request.
When he checked again, his e-mail and key and been removed from the publicly available disk, but he said he never received any response or notification from the TCC answering his questions or informing him that the problem was being taken care of.
After repeated efforts, Colburn said, he gave up trying to find out how the problem had occurred, until he learned that the same thing had happened to at least one other TCC account holder. In this case, he alleged, not only was the password stolen, but other information, including tests and test results, was compromised.
Colburn said he filed yet another ticket, and received, some time later, a notice telling him that his ticket had been canceled, with no action taken.
At that point, he said, he sent multiple letters up the chain of command to Dr. Peter Gerity, Tech’s vice president for Academic Affairs, and received no response.
The complete lack of response, Colburn said, led him to believe that Tech was engaging in a cover-up. He decided to do his own investigation.
Colburn said he started by trying to search the TCC ticket system for any complaints, beginning with his own, of stolen passwords and private information being made public.
Colburn was an employee of the TCC from 1993 until 2004. As one of the people involved in creating the TCC ticket system, Colburn knew where to look, or so he thought.
"All those records, every ticket filed with the TCC, existed in a database program that was accessible in full to anyone with a TCC account until the summer of 2009," Colburn said.
Sometime in the summer of 2009, Colburn said, during the time when he wrote multiple letters to university officials that went unanswered, the database program was converted to a Web page and disappeared from public view. When he began searching for his own complaint and couldn’t find it, he decided to make a formal Inspection of Public Records Act request, asking to be allowed to inspect all the tickets in the TCC ticket system.
"This really started with me trying to find my own ticket that I filed," he said.
Tech’s response was to inform Colburn, in writing, that his request would cost him nearly $18,000, payable in advance. The reason given for the fee was that the ticket system contained almost 18,000 records, any of which might contain exempt information, such as a student ID number or Social Security number. Each ticket would have to be printed out, and an employee would have to be assigned to manually redact any exempt information.
Eventually, in November 2009, Colburn filed a complaint with the Attorney General’s Office. While waiting for the AG to investigate, Colburn came across the file containing all the Social Security numbers.
How it could have happened
Colburn said he has since written letters about the Social Security numbers being publicly available to numerous people, including Rep. Don Tripp, and Sens. Howie Morales and David Ulibarri, 7th Judicial District Attorney Clint Wellborn, Attorney General Gary King, the US Department of Education Family Compliance Office, and the Social Security Fraud Hotline.
In the meantime, Colburn said he believes he has discovered how the problem occurred, by searching the internet.
According to a TCC ticket he found "via Google" Colburn said, the information stored on two TCC disks named "lithium" and "thorium" was backed up onto a specific TCC server on March 11, 2005.
"Thorium contained old accounting records," Colburn said. "(The server) is where I found the Social Security numbers. The date of (that ticket) corresponds to the date the file was created."
Colburn said he believes the security lapses were accidental.
"It’s easy to understand how it could have happened," he said. "The problem is, they don’t appear to care. They’re not investigating it, they’re just covering it up instead of doing anything about it."
An example of what Colburn characterizes as a desire to cover-up the lapses is the new license agreement he was told he must sign in order to keep his TCC account. Inserted at the bottom of the agreement is the statement, "All communication with the TCC becomes the property of the TCC and is not governed by the Public Records Act. I, the user, understand, acknowledge, and agree to be bound by the conditions outlined in this document."
Colburn said he had consulted with the Attorney General’s Office and was told the clause wasn’t enforceable. In a telephone interview on Sept. 2, Sarah Welsh, executive director of the New Mexico Foundation for Open Government, explained, saying that the Inspection of Public Records Act would still apply.
"They can try to make things confidential by fiat," Welsh said, "But you can’t just make up your own exemptions. The TCC is still a public entity."
El Defensor Chieftain called Gerity’s office on Tuesday Oct. 12, and was referred to Guengerich.
In a telephone interview on Tuesday, Oct. 12, Guengerich said he had spoken with Mike Topliff, director of the TCC, and been assured that the archive containing Social Security numbers that was inadvertently made publicly available was not in fact available for five years. Guengerich said, however, that he didn’t have sufficient details or dates to adequately and appropriately respond to Colburn’s allegations.
In a telephone interview on Wednesday, Oct. 13, Topliff, who has held his position since 1995, said he would have to research the matter more thoroughly before responding to specific questions, and that any response would have to be cleared through Gerity.
El Defensor Chieftain made three more calls to Gerity’s office between Tuesday, Oct. 12, and Friday, Oct. 15, that were not returned.
Still no word
Meanwhile, Colburn is still waiting to hear from Tech about those public records he asked to inspect.
"They told the Attorney General’s Office and the newspapers that they were going to make them available to me, but they’ve never told me that," he said in a telephone interview on Tuesday, Oct. 12. "As of today, Tech has not contacted me at all to inform me when or how they will fulfil my request. They have not provided me with a single record."
Guengerich said the university is currently working on Colburn’s request.
"My understanding is that Joe Franklin has written a program to redact any exempt information in the records, but that a person is still required to go through and check each one manually to verify that no confidential information was missed," he said.
Guengerich said the plan is to make the records available for Colburn to inspect, in batches of 500, as soon as possible.
"The reason for the delay in contacting Mr. Colburn is that the administration is waiting on an answer from legal counsel and the Attorney General’s Office as to whether the proposed method and delivery is acceptable to the state," Guengerich said.
Souce:http://www.dchieftain.com/dc/index.php/news/2263-computer-security-at-tech-questioned.html
|