Colleges failing computer security.

If recent events are any indication, some U.S. colleges need to be taught how to protect computers containing personal information.

In April, administrators at the University of California, Berkeley, revealed that a computer laptop containing the names and Social Security numbers of nearly 100,000 people--mostly graduate school applicants--had been stolen. It was the second time in six months that UC Berkeley has been involved in such a theft.

Just days earlier, Northwestern University reported that hackers who broke into computers at its Kellogg School of Management may have accessed information on more than 21,000 students, faculty, and alumni. And the same month, officials at Chico State University announced a computer breach that may have exposed personal information on 59,000 current, former, and prospective students.

There is no evidence that any of the compromised information has been used to commit fraud. But, according to the New York Times, these incidents highlight the vulnerabilities of modern universities, which are "heavily networked, widely accessible, and brimming with sensitive data on millions of people." In other words, they are ripe targets for cyber criminals.

"Universities are built on the free flow of information and ideas," Stanton S. Gatewood, chief information security officer at the University of Georgia, told the Times. Georgia is investigating a hacking incident last year that may have exposed records on 20,000 people. "They were never meant to be closed, controlled entities. They need that exchange and flow of information, so they built their networks that way," said Gatewood.

According to Gatewood, that free flow has translated into a highly decentralized system that has traditionally granted each division within a university a fair amount of autonomy to set up, alter, and otherwise maintain its own fleet of networked computers. This means various servers that handle mail, web traffic, and classroom activities in a university's colleges don't necessarily report to the central IT infrastructure within the university system.

Other challenges include aging equipment and the use of Social Security numbers as a primary means of identifying students, faculty, and staff. Several states--Wisconsin, California, Arizona, New York, and West Virginia--now ban or limit the use of Social Security numbers in this way, according to the Times. Many universities have already abandoned or are in the process of moving away from using Social Security numbers as the primary means of identifying students.

But a 2002 survey by the American Association of Collegiate Registrars and Admissions Officers indicated that at least half were still using it as the primary identifier for students in their databases. And because the number has been used to link so many records across so many different databases in so many different departments for so long, abandoning it completely may be impossible.

For instance, it took the University of Michigan seven years to migrate to randomly generated identifier numbers in 2003. But officials say myriad entities both inside and outside the university still use Social Security, numbers, forcing universities to continue to handle them. Most of the national testing agencies, for instance, still use Social Security numbers to identify, the scores of incoming students.

Of course, some are adept at protecting their data, and experts say many universities have better security in place than some corporations. Still, data collected by the Office of Privacy Protection in California, for example, showed that universities and colleges accounted for about 28 percent of all security breaches in that state since 2003--more than any other group, including financial institutions.