After a petition created by BU students that voluntarily asked students for their identification numbers was posted on two web sites, students said they were concerned by how such information could end up searchable on Google.
The ‘KEEP RESNET LABS OPEN!’ petition, which began in the spring, collected about 2,300 signatures. It asked students to list their name, student ID number, school and year, and then posted the data on petitiononline.com.
The BU Association for Computing Machinery, a computer science club, also posted a text file, which contained the student names and ID numbers from the petition site, to its own site. ACM members said an in an email that they were conducting a project to audit the security of BU identification cards.
‘BU IDs used in this analysis were self-posted by students in a public forum . . . and thus were a readily-available source for testing theories as to how the BU ID numbering system works,’ ACM members said in an email.
Though the distribution of Boston University identification numbers is not a major security risk, students should be more careful with the personal information they share online, BU officials said.
BU asked the club and the petition site last summer to remove the ID information and the club complied, Dean of Students Kenneth Elmore said.
‘I contacted the student that posted that petition and asked her if there was any way to take that column off,’ Elmore said.
However, Elmore said the Google cache of the document is still online and cannot be deleted.
‘You shouldn’t be putting things like your ID or social security number online,’ Elmore said. ‘Use the net, but don’t put things like that on.’
One of the creators of the petition, College of Arts and Sciences junior Rizwana Seeham, said she and the other creators decided to ask for ID numbers to authenticate signatures, but the information was voluntarily.
‘We made sure to tell people that if they were not comfortable with writing their ID numbers that they didn’t have to write it,’ she said.
For the ACM members use of the information, they said any weaknesses in the system would be first reported to BU and corrected before being released to the public.
‘We hope to demo discovered vulnerabilities in the BU ID system to IS&T later this fall,’ according to the email from ACM.
Information Services and Technology Vice President Tracy Schroeder said in an email that the club made no request to BU for ID information.
‘BU would only provide BU ID numbers to a BU department or service provider with a legitimate business need for the information and evidence provided that the information would be secure,’ she said.
Schroeder said a BU ID number by itself cannot be used for much around campus.
‘A student ID number alone does not grant access to anything,’ she said.’ ‘The ID number was created as an alternative to more sensitive forms of identification, such as the SSN.’
Housing Director Marc Robillard said he agreed in an email.
‘A BU ID number does not have any utility by itself,’ he said. ‘In order to access student information you would need a student’s name, login name and Kerberos password.’
Schroeder said security problems related to ID numbers are rare.
However, Robillard said students should still be careful with personal information.
‘There is no particular security risk associated with giving someone your BUID number,’ he said. ‘However, it is not a good idea to share personal information with a person or people you do not know.’
Many students said they were not aware of any security risk with ID numbers.
School of Management sophomore Shareen Roshan, who signed the petition with her ID number, said she did not think much about it at the time.
‘I think I just assumed that because it was an official petition . . . they needed the BU ID numbers,’ she said. ‘But obviously I’m going to think twice before doing that again.’
She said students probably did not think about the security problems when signing.
‘I guess we don’t really think about the consequences of doing that,’ she said. ‘We just assume that they were trying to do good, keeping the ResNet labs open.’
Roshan said BU should do more to inform students about security risks.
‘They need to stress to never give your BU ID number out,’ she said.
CAS sophomore Ben Gibbons, who did not sign the petition, said he would not have considered the possible security risk.
‘Before now, I wouldn’t have thought twice,’ Gibbons said. ‘Common sense should be enough. After all, you wouldn’t share your social security number.’
Staff reporter Jamie Lutz contributed to the reporting of this article.
