Identity Theft And Data Loss On Campus— Minimizing And Addressing Risk

Originally published in The 2007/08 URMIA Journal, published annually by the University Risk Management and Insurance Association (URMIA).

Abstract: The dawn of the cyber age has brought the development of new methods for obtaining, transmitting, and storing amounts of information more vast than the human mind can fully comprehend. Yet these advances in technology have also introduced their share of challenges, especially for colleges and universities who can now keep hundreds of thousands of constituent records in computerized systems. For these institutions, the threat of such information becoming compromised is very real. This article will discuss what is happening in regard to breaches of security, how it is happening, and what preventive measures institutions may employ to minimize the likelihood and impact of these cyber attacks.

Remember files? Those heavy metal things that stored paper, and that you could literally lock up behind a door? Once secured, it would take a Watergateian effort to get at those papersand really, who would go through that trouble?

The information storage situation on your campus today is meaningfully different. You store everything electronically (perhaps with a hard copy backup), bolstered by pass code protection, encryption, or whatever the latest security audit suggests. And while this security has become quite good, it is, nonetheless, "virtual." Unlike a physical lock and key, virtual security can be compromised remotely by sophisticated neer-do-wells from almost anywhere on the planet, at any time. And in a final irony, while physical limitations of hard copy files necessarily limited your storage capabilities, the incredible memory capabilities of todays sophisticated systems allow you to store every detail about your thousands (or hundreds of thousands) of students, employees, faculty members, alumni, donors, and contacts. So, while you can store and quickly access amazing amounts of information, so can the bad guys.

This reality has unfortunately hit home at some of our finest and seemingly best-prepared institutions: Ohio University (OU), The University of California at Los Angeles (UCLA), and The University of Colorado (CU), to name a few. While the specifics of each attack varied slightly, the basic pattern was the same: hackers improperly accessed protected information, including Social Security numbers and financial aid information, from university databases.

Now Happening at a University Near You

Ohio University had a tough 2006 on the IT front. On April 21, a cyber attack struck OUs Innovation Centers Technology Transfer Department. Thirty-five students had their Social Security numbers exposed in that data theft.¹ Just three days later, another breach occurred. The OU Alumni Relations database was the target of that data theft, and detailed information for more than 300,000 alumni and friends of the school was exposed.² Less than two weeks later, the university discovered a third incident of data theft in the schools health center, exposing more than 60,000 individuals personal information.³ In each instance, the hackers accessed and potentially "stole" names, Social Security numbers, and an array of other confidential information. Collectively, the 2006 events at OU comprised one of the largest cyber attacks ever inflicted upon a college or university.

The fall of 2006 brought the cyber attack scourge to UCLA. On November 21, 2006, technicians discovered a security breach in a database containing personal information of approximately 800,000 people. Worse yet, investigations revealed that the database had been illegally accessed on a routine basis since as early as October 2005.⁴ UCLA officials announced the news on December 12, and issued notification letters to potentially affected individuals, advising them of precautionary steps they should take to minimize the risks of identity theft and misuse of personal information.⁵ Following an extended investigation, UCLA confirmed that these breaches resulted in the illegal retrieval of approximately 28,600 per reference Social Security numbers. The university sent follow-up notices to those individuals on January 10, 2007, clarifying that the illegal retrieval of information did not necessarily mean the individuals were victims of identity theft, or that the Social Security numbers were being misused. Nonetheless, UCLAs acting chancellor reiterated, by separate letter, suggestions for preventing credit fraud and related crimes.⁶ UCLA then went a step further and established a website providing facts, investigation updates, notification information, and fraud prevention tips.⁷

Around the same time in Boulder, Colorado, while students were finishing finals and packing to leave for winter break, university officials faced similar problems. On December 15, 2006, CU announced the discovery of a computer attack on one of its servers, exposing personal information of approximately 17,500 individuals.⁸ The university notified those potentially affected, issued a press release, and provided identify theft prevention information to its community via an informational website.⁹

CU was attacked again in May of 2007. This time, a college of arts and sciences database was hit with a virus, exposing the names and Social Security numbers of almost 45,000 students.¹⁰ CU technology security investigators discovered that the virus entered the universitys server through a vulnerability in anti-virus software that was compounded because a security setting was not properly configured. In response, the university issued a press release, ¹¹ sent precautionary letters to anyone whose information was stored on the server, and established a website informing students of how to protect themselves from identity theft.¹²

The drumbeat continued in April 2007, when administrators at the University of California, San Francisco (UCSF) began notifying both current and former students and employees about a possible computer data breach¹³ after learning a server in the office of the president had been compromised. The server was immediately taken offline, notices were mailed to the affected individuals, and an identity theft website was established. Finally, as recently as June 2007, both the University of Virginia (UVA) and the University of Iowa (UI) were in the process of sending notifications to students and faculty members to advise them of security breaches. At UVA, a hacker broke into the schools network on 54 separate days, and the records, including names, Social Security numbers, and birth dates, of almost 6,000 faculty members were accessed. At UI, various electronically-stored records, including the Social Security numbers of approximately 1,100 per reference faculty members, students, and applicants to a graduate program were compromised. Both universities announced that they would take steps to notify affected parties and enhance network security.¹⁴

How Theyre Getting In (and Why)

Similar breaches occurred throughout 2006 and early 2007 at various colleges and universities across the country, from the University of Delaware¹⁵ and the University of Texas,¹⁶ to Vanguard University¹⁷ and Johns Hopkins.¹⁸

How?

Simply put, the cybercriminals are finding a way in, and the information is getting out. From hacking into sophisticated technical servers, to compromising private information placed on public or non-secure websites, to the simple theft of a laptop and its files, schools are being attacked from a variety of different angles. Here are some of them.

The Unknown Server: In one of the most egregious OU attacks, hackers accessed a server in the alumni relations office that computing officials believed was offline. As the university learned following an investigation, the server had never been properly shut down and hackers discovered the active server still connected to the network. Although the hackers used the server primarily for sharing music files, it was connected to the broader OU network, and personal alumni and staff information was at risk of exposure the entire time.¹⁹

The Persistent Impostor: In the spring of 2007, a hacker retrieved personal information from more than 22,000 current and former University of Missouri at Columbia students through an online help desk. The hacker discovered an online form used by students to post information requests and track the status of those requests. Posing as a student, the hacker inundated the server with a number of online inquiries seeking to obtain campus-related information, and ultimately was provided with a report that included the names and Social Security numbers of students who had worked in on-campus jobs.²⁰

The Security Flaw: In the UCLA incident, the hacker discovered and exploited a flaw in database software that computer security technicians had not detected. The hacker continued to access the database for more than a year, seeking and retrieving Social Security numbers throughout the process.²¹

The Lost or Stolen Device: In 2006, a thumb drive containing student rosters was stolen from a professor at the University of Kentucky, and that simple theft exposed personal information from eight years of class rosters.²²

Why Us?

While it is hard to say for sure, one can offer several reasons why campuses have become a favorite target of hackers.

Funding: Unlike for-profit corporations, for whom data loss can mean a hit to their bottom line, non-profit educational institutions have been historically less inclined to devote significant spending to secure their information or to upgrade and improve systems that collect and store a wealth of information.

Social Security Number as ID: Many schools have historically employed Social Security numbers as a students identification number, or for a password that is used for everything from class registration to purchasing lunch. This increases the risk of fraud and identity theft.

Your Students May Be Putting You at Risk: College students have become sophisticated users of the latest computer technology and spend money on hardware and software faster, and in larger quantities, than the typical computer user.²³ This means more computer interaction with off-campus sources and, by extension, more points of vulnerability. If these students are making these contacts while connected to your server, the vulnerability of one can become a vulnerability of all.

Prevention and Mitigation

If you have been fortunate enough to avoid a cyber attackor if the dust has just settled from an attackyour institutions primary focus should be on enhancing the protection of its computer network. This protection could include physical improvements to computer security, policy changes, and, possibly, "cyber insurance." These will be addressed in turn.

Physical Techniques to Improve Security²⁴

Firewalls: A firewall is a barrier that keeps outsiders and their viruses from accessing your computer network. A firewall should be installed at every point where the computer system may come into contact with other networks, even via e-mail.

Bsystem Tests/Cyber Audits: Conducting vulnerability tests will help quantify your institutions level of data security risk. Experienced outside consultants can be retained for the specific purpose of acting as hackersthey will attempt to hack into your computer networks and, in the process of doing so, can determine where the systems are vulnerable and require upgrades. These tests, also known as "cyber audits," can also include website-based customer self-assessments, interviews with IT and security personnel, and remote network scans to test vulnerabilities in a systems firewalls, servers, and other network devices.²⁵

Encryption/Scrambling Personal Information: Personal information such as Social Security numbers, birthdates, and addresses should be encrypted and/or separated from other sensitive information.²⁶ Allowing third parties to access students records and view all personal information exposes the university to a significant risk of identity theft. Experienced IT personnel, including those already on your campus, should be able to help here.

Policy Changes to Improve Security

Draft or Revise Your Data Security Policy²⁷: An institution-wide data security policy should be implemented, outlining methods by which individual employees and students can secure the computer network. This should include the creation of unique passwords (combination of letters and numbers, small caps and large caps), password changes on a routine basis, and an immediate process for deleting user names and passwords of matriculated students and discharged employees.

Limit Use of Social Security Numbers: A very basic method to minimize illegal access to personal information is using identifiers other than Social Security numbers, particularly for students. Hackers are aware that student ID numbers are often nothing more than a Social Security numbers with an additional attached digit.

Preferred methods would be the use of partial Social Security numbers (e.g., the last four digits), a combination of other personal information (prior street addresses, parents birthdates, etc.) jumbled together to create a unique identifier, or creation of a randomly-selected, institution provided ID number that does not correlate to anything else. To move in this direction, some institutions have drafted Social Security number policies intended to limit, and ultimately eliminate, the use of Social Security numbers on campus except where absolutely necessary. The University of Pennsylvania, for example, has adopted a draft policy (soon to be final) that "calls on staff, faculty, contractors, and agents of the above to inventory their online and offline Social Security numbers and reduce the above risks [associated with SSN# use] by, in priority order: (1) eliminating this data altogether, (2) converting it to PennID [a unique campus ID], (3) truncating the data to capture and display only the last four digits, [or] (4) when the complete SSN is clearly necessary, ensuring strict security controls to protect the full data."²⁸ This sliding scale planwith complete elimination of Social Security numbers as the ultimate (but perhaps unattainable) goal, and strict controls on their usage as the minimum requirementmakes good sense.

Cyber Insurance? Of course, any discussion of risk mitigation must include insurance. A number of insurance companies have begun offering "cyber insurance" for organizations seeking protection in the event of data loss, data theft, or security breaches. To date, these policies may cover the following: (1) legal liability to the organization for security and privacy; (2) crisis management and notification costs associated with a security breach; (3) any losses resulting from funds paid to terminate the threat of a computer attack; (4) any expenses incurred as a result of a computer security breach; and (5) any cost incurred by an insured to restore information that is corrupted.²⁹

These policies are, for most underwriters, in their infancy. Premium calculations can be difficult, and whether all underwriters will offer these policies, or whether they will offer them to what may be seen as "high-risk" educational institutions (and on what terms), remain open questions. Early indications are that the cost will be linked to the size of the student body. A 4,000-student institution, for example, may spend approximately $5,000 per year for $1 million in coverage.³⁰ A school with as many as 20,000 students may be able to obtain $3 million in coverage for $50,000 a year.³¹ And in a slightly more complex policy structure, Lloyds of London issued a cyber policy with a $70,000 premium to a non-disclosed 11,000-student private college. The policy limits were $1 million for claims brought by the school on its own behalftypically for property damage to its computer system caused created by a virus or attackand up to $3 million for claims brought by third parties against the school for identity theft/data loss, etc.³²

If you are considering cyber insurance, you should have a security audit performed, as that likely will be a precondition for coverage. In addition to campus head count, your premium is likely to vary based on the outcome of the audit, and a low security score may result in denial of coverage or in an unpayable premium.³³

There are other risk mitigation products to consider. Following a security breach involving a stolen USB drive, Louisiana State University (LSU) entered into a year-long agreement with a credit agency to provide its students, faculty, and staff with free credit report monitoring and up to $2,500 in identity theft coverage. LSU will pay the credit agency $150,000 for the one-year agreement.³⁴

Your School Has Been Hit, So Now What?

You have performed a cyber-audit, adopted new data protection policies, analyzed your coverage options, and tightened up your servers. Despite these efforts, your institution was just struck by a cyber attack. Now what?

Notification

In the event of a cyber attack on campus, an immediate investigation and response is critical. The faster students, alumni, and faculty know of potential exposures, the faster they can act to protect their identity and their credit. In addition to being good policy, in some states notification is legally mandated. Many states have enacted security breach notification laws that dictate when and how to notify potential victims of data security breaches.

By enacting the California Security Breach Information Act in 2003, California became the first state to mandate consumer notification for data security breaches where personal information has or may have been improperly accessed.³⁵ The California Act defines "personal information" to include Social Security numbers, medical information, drivers license numbers, bank account numbers, or credit card numbers. California requires notification to affected individuals of all security breaches involving unencrypted data.³⁶

More than half of all states have subsequently enacted similar statutes based on the California model.³⁷ While not identical, these laws share common attributes:

What is covered: "Personal information" is almost uniformly defined as California first defined it, and a "data breach" is commonly defined as an "unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business."

Timeliness of notice: In the event of a breach, institutions that own the compromised personal information must provide prompt notice to an affected state resident. In addition, if the breach occurs while the data is in the care of someone or an entity other than the datas owner, prompt notice must be given to the owner of the data.

Methods of notice: Typically, the state laws provide that notice may be satisfied by:

• Written notice through the mail
• Electronic notice in conformity with the Federal Electronic Signatures Act
• Substitute notice through e-mail, website publication, or major statewide news media if the costs of providing notice would exceed a certain threshold (such as $250,000), or if more than a certain number of individuals are affected, or if the institution does not have sufficient contact information
• The institutions own notification system, if it meets the timeliness requirements of the security breach notification law in question

Destruction of unneeded sensitive information: Institutions that no longer have a reasonable business or educational purpose for collecting and storing personal information must take reasonable measures to destroy or encrypt the information so that it is unreadable and undecipherable.³⁸

P.R./Handling the Media

In addition to fixing your campus system, you may well need to fix your campus. A data breach will engender great consternation among your students, faculty, and alumni, and if it is a meaningful breach, the press may also get involved. You must be prepared to appease apprehensions and deal with the media.

There are several ways to attack this. For example, following a security breach in April 2006, the University of Texas opened a call center and assembled a response team to address inquiries and concerns.³⁹ Other schools have established websites to provide pertinent information and updates, as UCSF did in April 2007 in response to its attack.⁴⁰ And when the press calls, you want to be able to point to the panoply of protective measures you already had in place and those that you are putting in place, and be able to do so quickly. It is imperative to know what security you have, what it can (or cannot) do, and who is responsible for these issues on your campus.

The Fallout of An Attack

Financial Loss

Institutions faced with security breaches may suffer more than just the loss of data and reputational harm. First, the actual cost of responding to the attack takes a toll. Ohio University estimates that it has spent more than $77,000 simply distributing letters to those individuals affected,⁴¹ not to mention the cost of operating a response website and hotline, and investigating the breach. Because incidents of data theft often bring to light flaws, holes, and vulnerabilities in a universitys data security systems, costs associated with upgrading technology and enhancing security are also inevitable.

Lawsuits

Civil lawsuits related to data theft are becoming more common, as state statutes designed to protect personal information and prevent identity theft are giving rise to civil claims. Employees have sued employers,⁴² customers have sued financial institutions⁴³ and data storage companies,⁴⁴ and, at Ohio University, two graduate students sued the school for privacy violations stemming from data thefts from school computers.⁴⁵ Those students are seeking to have the litigation certified as a class action, and are demanding that the university pay for credit monitoring systems for the approximately 137,000 people whose personal information was compromised in the data theft.⁴⁶

While claims are being filed, courts appear reluctant, at least for now, to recognize a cause of action for failure to protect personal information.

In one federal court action, bank customers sued the bank and four of its employees in connection with the alleged improper use of plaintiffs personal financial information. The customers asserted violations of state and federal consumer protection statutes, violations of the federal Racketeer Influenced and Corrupt Organizations Act (RICO), as well as basic common law claims for conversion and negligence.⁴⁷ More specifically, the customers complained that the bank failed: "to implement and follow the security procedures; to protect the confidentiality of customer information; to guard against the misuse of that information; and to detect, report, and stop suspicious activities of employees."⁴⁸ The federal district court dismissed these claims, noting that the statutes at issue did not expressly provide for a private right of action to enforce privacy obligations, but instead left enforcement to state and federal regulators. Finding no legislative intent to create a private right of action, the court refused to imply one in the statutes or in common law and dismissed plaintiffs claims.⁴⁹

In another recent case, a federal district court in Arkansas dismissed class action allegations of failure to protect personal data brought against a data storage company. The court found the injuries alleged were merely speculative. While the breach had occurred, plaintiff had no evidence nor could she assert that her personal information was actually used in a way that harmed her. The case accordingly was dismissed because of plaintiffs lack of standing.⁵⁰

While the small body of case law to date is favorable, as the problem of identify theft and data loss continues to grow in the public consciousness, the legal landscape may change as well. It is not much of a stretch to see a negligence claim making it to trial: by requiring (employees/faculty/students) to use the universitys servers, the university assumed a duty to make those servers safe. An alleged failure to secure those servers resulted in a cyber attack and was a breach of that duty. Because of that breach, harm resulted to the (employees/faculty/students). The case may not yet exist in your jurisdiction, but it is coming.

Conclusion

Cyber attacks are nearly impossible to prevent, but that reality will not appease concerned students, faculty, or alumni. Just as colleges and universities routinely take steps in the "real world" to protect their campus, an expectation is growing for identical protection in the "virtual world." And it can be done.

As discussed, protecting against identity theft and data loss is ultimately not unlike other risk mitigation on campus: identify the bad guys, identify what they are doing and how, and then take proactive steps to ward them off. While this is particularly difficult in the world of electronic data, where the technology is constantly changing, it is a necessary effort that will require your legal, IT, and risk managers to work together. Hopefully this article provides some assistance in that effort.

Footnotes:

1 Terms like data theft, data loss, and hackers have become part of everyday language in the field of data theft prevention. "Data loss" occurs when data is lost from a data-storage device in any manner, including misplacement, human error, hardware or software failure, or theft. See "What is Data Loss?," available at http://www.bostoncomputing.net/consultation/databackup/dataloss/.
"Data theft" is used to describe an incident in which information is illegally copied or taken from a business, institution, or individual. This type of information typically includes Social Security numbers, credit card information, and other personal information. See definition for data theft, available at http://www.computerhope.com/jargon/d/datathef.htm.
"Identity theft" refers to the crime in which an impostor obtains critical personal information, such as Social Security or drivers license numbers, in order to impersonate someone else. See "What is identity theft?," available at http://searchsecurity.techtarget.com/sDefinition/0,290660,sid14_gci801871,00.html.
Acts of data theft and identity theft are often committed by "hackers," a slang term for a computer enthusiast with knowledge of computer programming. Hacker has taken on a more pejorative meaning and often refers to individuals who have gained unauthorized access to computer systems and databases. See definition of hacker, available at http://www.webopedia.com/TERM/H/hacker.html.
A database can refer to any collection of electronically stored information. See definition of database, available at http://www.webopedia.com/TERM/D/database.html.
When a hacker or other individual illegally accesses a database, the personal information stored on the database is said to be "compromised." In other words, when it is known or suspected that the personal information has been viewed or accessed by someone unauthorized to do so, that information has been compromised.

2 Alumni & Faculty/Staff Data Theft, May 1, 2006, available at http://www.ohio.edu/datatheft/alumni/index.cfm.

3 "Ohio University Continues to Take Steps to Secure Computer Systems Against Attempts to Breach University Databases," May 11, 2006, available at http://www.ohio.edu/outlook/05-06/May/485n-056.cfm; "Hudson Health Center Data Theft," May 11, 2006, available at http://www.ohio.edu/datatheft/student/index.cfm.

4 UCLA identity alert, available at http://www.identityalert.ucla.edu/index.htm.

5 UCLA notification letter, Dec. 12, 2006, available at http://www.identityalert.ucla.edu/ID_alert_letter.pdf.

6 UCLA follow-up letter, Jan. 10, 2007, available at http://www.identityalert.ucla.edu/ID_alert_followup_letter.pdf.

7 See http://www.identityalert.ucla.edu.

8 "CU-Boulder Reports Security Breach In College Of Arts And Sciences Advising Computer," Dec. 15, 2006, available at http://www.colorado.edu/news/releases/2006/437.html.

9 See "Facts About Identity Theft," available at http://www.colorado.edu/its/security/awareness/privacy/identitytheft.pdf.

10 See "CU Boulder Arts and Sciences Server Hacked on May 12," May 22, 2007, available at http://www.colorado.edu/news/releases/2007/224.html.

11 Id.

12 See "CU Boulder Responds to Computer Security Incident," available at http://www.colorado.edu/its/security/aac052007/.

13 "Data Thieves Hit University of California, San Francisco," consumeraffairs.com, Apr. 5, 2007, available at http://www.consumeraffairs.com/news04/2007/04/uc_data.html.

14 "Two Universities Hit by Security Breaches," June 11, 2007, available at http://www.informationweek.com/software/showArticle.jhtml;jsessionid=JUBS1B3C4D454QSNDLQCKICCJUNN2JVN?articleID=199903218.

15 "Public Safety Reports Computer Security Breach," UDaily online, May 23, 2006, available at http://www.udel.edu/PR/UDaily/2006/may/breach052306.html.

16 "Unauthorized Access of Computer Records Discovered at The University of Texas at Austin," Apr. 23, 2006, available at http://www.mccombs.utexas.edu/datatheft/release_4.23.06.asp.

17 Vanguard University identity alert, Jan. 26, 2007, available at http://www.identityalert.vanguard.edu/notification.htm.http://www.ci.costa-mesa.ca.us/docs/pdpress/2007-01-26-Grant-Theft.pdf . The above reference has expired (NPW)

18 "Johns Hopkins Loses Data; Congress Aflutter," consumeraffairs.com, Feb. 7, 2007, available at http://www.consumeraffairs.com/news04/2007/02/jhu_data_breach.html.

19 See Paula Wasley, "More Holes Than a Pound of Cheese," The Chronicle of Higher Education, at A40, Sept. 29, 2006.

20 See "Hacking the Help Desk," May 9, 2007, The Chronicle of Higher Education, available at htttp://www.chronicle.com/wiredcampus/index.php?id=2056.

21 See Brock Read, "UCLA Warns 800,000 That a Hacker May Have Obtained Personal Information," The Chronicle of Higher Education, at A31, Jan. 5, 2007.

22 See Vincent Kiernan, "Two Incidents Put More Than 200,000 Students at Risk of Data Theft," The Chronicle of Higher Education, at A21, Jun. 30, 2006.

23 See James Martin and James E. Samels, "10 Trends to Watch in Campus Technology," The Chronicle of Higher Education, at B7, Jan. 5, 2007.

24 See Nick Brookins, "Seven Ways to Prevent Computer Hacking," Detroit Regional Chamber, available at http://www.detroitchamber.com/detroiter/articles.asp?cid=49&detcid=130; and Paul Freudenberg, "Take Precautions to Prevent Computer Hacking," Portland Business Journal, July 27, 1998, available at http://www.bizjournals.com/portland/stories/1998/07/27/focus8.html. 104 URMIA Journal 200708

25 NetDiligence is one such company that provides such "cybersecurity assurance services." See http://www.netdiligence.com/services.htm.

26 Encryption is a process whereby individuals illegally viewing information on the computer network will not be able to view the personal information because it will be in an unreadable text, only viewable through the permitted key. Freudenberg, supra note 27.

27 A data security policy establishes policies for management of a universitys data and defines responsibilities for the protection of the data. Examples of adopted data security policies may be found at http://www.gsu.edu/security, Georgia State Universitys Security Awareness and Incident Prevention leaflet; and Institution Data Resource Management Policy, The University of Michigan Standard Practice Guide, at 601.12, available at http://spg.umich.edu/pdf/601.12.pdf.

28 See http://www.upenn.edu/almanac/volumes/v53/n34/fc-ssn.html.

29 Dan Briody, "Online Indemnity," Inc.com, April 2007, available at http://www.inc.com/magazine/20070401/technology-insurance-sidebar. This link has expired.

30 Andrea L. Foster, "Worried About Hackers? Buy Some Insurance," The Chronicle of Higher Education, at A42, Oct. 13, 2006.

31 Id.

32 Id. Outside claims are typically claims concerning confidentiality with unsecured private information.

33 Id. at A42.

34 Andrea L. Foster, "LSU Arranges Identity-Theft Insurance for Students and Employees," The Chronicle of Higher Education, at A33, Sept. 22, 2006.

35 Cal. Civil Code § 1798.82 (WEST 2007)

36 Unencrypted data is at greater risk of being stolen and used for illegal purposes.

37 An Act Requiring Consumer Credit Bureaus To Offer Security Freezes; C.G.S.A. § 36(a)-701(b) (Effective Jan. 1, 2006) [Connecticut]; Computer Security Breaches, 6 Del. C. § 12B-103 (Effective June 28, 2005) [Delaware]; Unlawful Use of Personal Identification Information, F.S.A. § 817.5681 (Effective July 1, 2005) [Florida] (providing for monetary penalties for failure to meet notification requirements); Personal Information Protection Act; IL ST CH 815 § 530/15; (Effective Jan. 1 2006) [Illinois] (act applies only to "data collectors," defined to include such persons as government agencies, public and private universities, and financial institutions, among others); Act to Protect Maine Citizens from Identity Theft, Notice of Risk to Personal Data, 10 M.R.S.A. § 1348 (Effective Jan. 31, 2006) [Maine]; Identity Theft Prevention Act, N.J.S.A. § 56:8-163 (Effective Jan. 1, 2006) [New Jersey] (act also imposes data disposal requirements and limits the use of residents Social Security numbers); Information Security Breach and Notification Act, N.Y. Gen. Bus. § 899-aa (Effective Dec. 7, 2005) [New York] (violators of act subject to legal action by the state Attorney General); Identity Theft Prevention Act, N.C.G.S.A. § 75-60 (Effective Dec. 1, 2005) [North Carolina] (expanding definition of personal information to include bank account numbers, credit and debit card numbers, personal identification or PIN codes, and fingerprint and biometric data); Breach of System Containing Personal Information, Oh. St. § 1349.19 (Effective Feb. 17, 2006) [Ohio] (narrowing notification requirement to only in instances when it is reasonably believed that the breach caused or will cause a material risk of identity theft); and Breach of Personal Information Notification Act, 73 P.S. § 2301 (Effective June 20, 2006) [Pennsylvania] (narrows breach requiring notification to only incidents that are believed to have caused or will cause injury to a resident of the Commonwealth).

38 Catherine M. Bump, et al., Summary of State Data Security Laws as of March 2006, 865 PLI/Pat 39, 43-44 (2006).

39 http://www.mccombs.utexas.edu/datatheft/index.asp.

40 "UCSF Establishes Identity Theft Website, Hotline," USCF Today, Apr. 4, 2007, available at http://pub.ucsf.edu/today/cache/news/200704043.html.

41 Jim Phillips, "OU Has Been Getting an Earful About Huge Data Theft," Athens News, June 12, 2006, available at http://www.athensnews.com/issue/article.php3?story_id=25220.

42 Mannacio v. General Electric Co., Cal. Super. Ct., CV-065227 (Dec, 5, 2006). The plaintiffs, employees of the corporation, claimed that a stolen laptop resulted in theft of the unencrypted personal information of approximately 50,000 employees. The employees brought a class action suit asserting claims of negligence against their employer. The complaint alleged that the notice provided by the corporation of the breach was inadequate in that it did not provide sufficient information for those affected to protect themselves from improper use of the stolen information. The complaint sought full disclosure of the type of information accessed, as well a compensation for costs plaintiffs incurred in protecting themselves from identity theft. See "Data Breach Class Action Filed for Negligence Related to Stolen Laptop," Jackson Lewis, Dec. 14, 2006, available at www.jacksonlewis.com/legalupdates/article.cfm?aid=1039.

43 Smith v. First Century Bank, No. 3:04 CV 591 (E.D. Tenn. 2005); see discussion infra at p. 15, n.53-54.

44 Bell v. Acxion Corp., No. 4:06CV0485, 2006 WL 2850042 (E.D. Ark. Oct. 3, 2006). Defendants information storage database was hacked and client files were compromised. The plaintiff, a client of the defendant, filed an action seeking damages, alleging defendants lax security put her at risk of receiving junk mail and becoming a victim of identity theft. Id. at *1.

45 "Whos suing OU right now, and why?" Jim Phillips, Athens News, Mar. 29, 2007.

46 Id.

47 Smith v. First Century Bank, No. 3:04 CV 591, 2007 WL 956652, *1 (E.D. Tenn. Mar. 29, 2007) (The district court dismissed plaintiffs claims under the RICO statute for failure to allege sufficient evidence to establish necessary elements of RICO violations.).

48 Smith v. First Century Bank, No. 3:04 CV 591, 2007 WL 1035125, at *2 (E.D. Tenn. Mar. 30, 2007) (alleging violations of the Gramm-Leach-Bliley Act (GLBA)).

49 Id. at *3-4.

50 Bell, 2006 WL 2850042, at *2. The district court did not address the specific question of whether a claim to recover damages resulting from a data security breach could survive had plaintiffs been able to demonstrate standing.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.