I share this view as I'm sure most people do. I am an example of a person who has both an APID and ZPID, I think my MSU Net ID would be a much better way to link these two pids rather than SSN. I definitely share the view that payroll is the only department who needs access to an SSN for a staff member. I know for our admissions process SSN is required, but once a prospective student is enrolled, this information should be sanitized from all non-critical systems. I think this incident will help to tighten down the "need to know" policy of the data that is flying around in our systems. Paul Donahue Network/Security Manager/Programmer CVM Information Technology Center A227 VMC, Michigan State University Phone: 353-5551 Fax: 432-2937 >>> "Schuette, Kristin" <[log in to unmask]> 02/02/05 09:19AM >>> According to the message, all current employees and students are loaded. So, what's the point in moving from the SSN as the employee ID to the ZPid if SSN is still essentially _the_ id? While other schools are desperately trying to get away from using the SSN for the student number, luckily, MSU doesn't...but we might as well if systems such as MAGIC are allowed to use SSN as the 'reconciling' ID... The library getting SSNs in order to reconcile multiple records for people who may or may not borrow books is a very weak reason to need anyone's SSN. Perhaps AIS or ACNS could perform this reconciliation for the library, linking ZPids to APids. Kristin Schuette Information Technologist IV/S Office of the Registrar -----Original Message----- From: Matthew C Jackson [mailto:[log in to unmask]] Sent: Wednesday, February 02, 2005 8:37 AM To: [log in to unmask] Subject: Re: [MSUNAG] Notice regarding possible exposure of personal information Anyone know if SSN information was in this database for staff employees who have never used the Magic library system ? Matt Jackson -----Original Message----- From: Matthew C Jackson [mailto:[log in to unmask]] On Behalf Of Cheryl Akers Sent: Wednesday, February 02, 2005 8:30 AM To: [log in to unmask] Subject: Re: [MSUNAG] Notice regarding possible exposure of personal information Isn't the reason we got employee ID numbers to avoid having to use SS numbers in interactions with MSU? > From: Richard Wiggins <[log in to unmask]> Subject: Re: [MSUNAG] Notice regarding possible exposure of personal information Comments: To: David Cowes <[log in to unmask]> To: [log in to unmask] In-Reply-To: <[log in to unmask]> X-Virus: None found by Clam AV X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on sys04.mail.msu.edu X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=RCVD_BY_IP autolearn=disabled version=3.0.2 The Magic system is pre-loaded with customer information so that new members of the MSU community don't have to go through a lengthy process the first time they check out a book. The SSN is used to reconcile multiple records for the same person when that person has multiple MSU affiliations. /rich Cheryl Cheryl Akers, MS, CNA - [log in to unmask] Microcomputer Support - Microbiology and Molecular Genetics 2228C Biomedical Physical Sciences Michigan State University East Lansing, MI 48824 517-355-6463 X1514 "I try to take one day at a time, but sometimes, several days attack me at once." Jennifer Unlimited