Stolen Data Spurs Fears for Privacy

UC Berkeley graduate students, prompted by the recent theft of a computer containing more than 98,000 names and Social Security numbers from a Sproul Hall office, are reacting swiftly-cancelling credit cards, contacting banks and freezing accounts.

"You can't control your personal information anymore," said political science graduate student Jonathan Hassid who placed a fraud alert on his file after university officials released the news Monday.

Hassid is among the 98,369 current UC Berkeley graduate students and former applicants whose applications were on the hard drive of the laptop stolen March 11.

Victims spend an average of 175 hours and $800 to resolve identity theft problems, according to the California Office of Privacy Protection.

Identity thieves commonly use a Social Security number to obtain a credit card, car loan or mortgage loan in someone else's name, said Joanne McNabb, the agency's chief.

"Disreputable persons may contact you offering to help and falsely identify themselves as affiliated with UC Berkeley," said Associate Dean Jeffrey Reimer in an e-mail to individuals whose data was stored on the stolen machine.

The security breach is the latest in a series of similar crimes at UC campuses.

Last August, a hacker broke into a UC Berkeley computer and obtained the names and Social Security numbers of 600,000 participants of a government program designed to assist elderly and disabled individuals at home.

In a similar incident discovered last April, a hacker broke into UC San Diego's campus network and accessed identity information about more than 300,000 students, applicants and alumni.

Laptops with sensitive information were also stolen from UCLA and UC Merced last spring.

UC Berkeley officials said this month's crime is especially unfortunate because of recent efforts to bolster information security. IS-3, the campus policy that requires data on portable devices to be encrypted, was updated last fall.

The campus has also moved forward with nine recommendations to improve the security of information technology. Changes include upping minimum security requirements for systems with sensitive data and increasing staff and student awareness of protective measures.

"We're constantly increasing security on campus," McCredie said.

Several precautions are available to those affected by this month's theft.

The first step is to flag credit files with a fraud alert, said California Office of Privacy Protection chief Joanne McNabb. This will prompt many creditors to call a validation phone number and will not affect existing credit accounts, she said.

"If you're the identity thief, you'll probably leave," she said.

A more drastic possibility is to freeze credit, cutting off access almost entirely, she said.

Currently, California and Texas are the only two states to pass laws requiring companies and government agencies to inform everyone whose information may be compromised in a security breach.

Sen. Dianne Feinstein, in response to this week's incident, said Congress should expand federal legislation aimed at preventing identity theft and restore funding to a federal identity theft grant program in support of law enforcement.

In a press conference Monday, she said the heist "clearly demonstrates the need for a comprehensive approach to identity theft in order to give Americans more control over their personal information."

Tags: