This morning’s Greenville Cage Liner had a huge headline proclaiming “Southside High Web site shut down, Student information was publicly available.” My gut reaction was that Greenville School District had screwed up again with their data security, until I read a bit further into the article. At that point, my disgust was redirected toward the Greenville News for trying to stir up controversy where there was none.
First, there is the problem with the data itself. Apparently what was available were the student PermNums from SASIxp. SASIxp is the state-wide system for tracking student information, and the PermNum is a unique identifier for each student in the district. Having the PermNum available is not like making Social Security numbers public. It grants no access to student information, and cannot be used for identity theft. The other information that was available were temporary student login names and passwords for a practice program the district was using. Big deal! This information was set to expire anyway, and listing on a website was only a convenience for the students and teachers, and did not constitute any breach of security.
The next problem was the availbility of the data. According to the article, there were no direct links to this information. One could only find it by doing a search of the website. My first question would be to ask what search terms the person was using to find the information. Was this person actively scanning for information such as this, or did they just stumble across it?
Greenville News indicated that this article was based on a reader’s tip. I’m assuming it was the same reader that stumbled upon the information in the first place. The submission of the tip, and the News’ decision to publish the article is nothing less than an attempt to create problems for the district. However, Greenville School District isn’t entirely innocent in all of this. They overreacted by shutting down Southside’s website. They should have left everything in place, as is, and told Greenville News to get their facts straight. By taking such drastic steps, they gave the News the excuse to run this on the front page, when it shouldn’t have gotten any attention at all.
It seems to me that there is a mentality that loves to create controvery for public entities. School districts are prime targets for some reason. If the district screws up, it should be held accountable, but knit-picking like this serves no one’s interest.
Well said. You inspired a poster to give them whatfor in their chat forum. 😉