Last week, The Eagle wrote about a glitch in the my.american.edu Web portal that allowed outsiders to access personal records about 13,000 network users, including financial information and Social Security numbers. While the problem has been fixed, there is still another problem that has to be taken care of - the responsiveness of the administration. This problem is not isolated and in fact, manifested itself earlier in the year in the controversy at WAMU. Often, it seems that unless the University is threatened by bad publicity, it neglects to critically evaluate itself.
A year ago, a student approached the University about the Web portal problem and exposed the consequences of having an insecure Web site, which include identity theft. The University neglected to adequately respond and my.american.edu remained open for identity theft for a year. Up until a week ago, outside users could access tax forms, financial records and Social Security numbers. In the hands of an outsider, this information could be used to take out loans, buy cars and houses and commit crimes that can take many years to fix.
In this case, the data of some 13,000 network users were open market for over a year. To put this in perspective, there are over 10 million cases of identity theft each year that result from garbage diggers, hackers and other criminals. Once a credit card or Social Security number is used illegally, the victim can face problems for years as he or she tries to re-establish an abused reputation.
In light of these dangers, The Eagle recommends that the University critically evaluate the Web portal and other possible security glitches before it develops an abused reputation of its own. It is unsettling that it took an article in The Eagle for the University to examine the portal before it solved the problem. It is also upsetting that millions of dollars worth of problems at WAMU weren't solved until a tip was given to The Washington Post.
While The Eagle does not pretend to have the answers to securing the Web portal, we do have some questions for the administration. First, should everything be online? Where is the line drawn between convenience and disaster? Is it necessary to have financial records and Social Security numbers online? Also, when the University gets a tip in the future, will it respond immediately or wait until threatened with bad publicity?
We understand that AU is not just a university, but a business as well. As a result of that, it can't be as ideologically pure or economically perfect as we desire. It is run by people who are not perfect, who have good intentions and who want to make the University a better place. But like any successful business, it must respond to the complaints of its customers and adapt to new challenges. If it fails to do these things, then bad publicity follows and the school, its students and its employees, are all affected for the worse.
When The Eagle surveys last fall and the past week, we can't help but see a pattern of neglect until exposure. Time and again, problems are presented to University employees, which aren't solved until a whistleblower goes to the press. This shouldn't be the way a business or a university operates.
In closing, The Eagle believes that the University needs to evaluate the Web portal and the way it responds to problems. If it continues to wait until the last minute to address its problems, then it won't have the chance to develop a culture that responds quickly and effectively to what ails it.
