About 7,000 students may be affected by a “worm” that infected a computer system at Cal Poly.
On Oct. 3, the worm was identified in a system used in conjunction with campus telephone billing. Personal information was discovered on the system, which included names and Social Security numbers of students living in residence halls from 2001 to 2005.
“(The information) shouldn’t have been there. It was an ITS mistake,” said Tim Kearns, Cal Poly’s chief information officer.
Kearns said the information was removed after the worm was discovered.
Once the worm was detected, the infected computer was removed from all other networks and programs were used to identify the worm. After destroying the worm, letters were sent out.
The worm, W 32/ Tilebot-GV, acts like a virus, and usually generates spam and takes over computer networks.
“As far as we know, it wasn’t used for anything,” Kearns said.
He said no complaints of spam or any other type of complaint was reported, but letters are still being mailed out to notify students of the potential threat to their security.
The letters are being sent to comply with California civil code. The California Senate Bill 1386 requires “any state agency to disclose any breach of security of the system to any California resident whose unencrypted personal information is reasonably believed to have been acquired by an unauthorized person.”
The bill was passed just four years ago, and has been effective only since July 2003. Any security breaches before that date have not been reported. All records only date back to December 2003. Since then there have been 10 reports of security issues.
While the reports continue to increase, protecting students seems to be an endless process.
“It’s very complicated,” said Vicki Stover, Cal Poly’s chief information security officer.
Phasing out the use of the Social Security number around campus is a main objective. Right now, Kennedy Library most food service areas, and housing use a different identifying number, said Stover.
At the beginning of the school year, all students were issued new ID numbers. Last year, students’ Social Security numbers were removed from the magnetic strips of PolyCards.
“You have to do a step-by-step process. It takes a lot of time,” said Stover.
Kearns said as of now, the “phasing out process” is to be completed in about a year.