VERMONT STATE COLLEGE FACES ADDITIONAL FALLOUT FROM COMPUTER STOLEN FROM SCHOOL Burlington Free Press.com Top Stories: "State colleges face criticism for handling of information in stolen laptop computer

Published: Sunday, April 9, 2006
By Sam Hemingway
Free Press Staff Writer

Harry Swett loves his job working in the mailroom at Lyndon State College.

'It's a wonderful place,' said Swett, a 15-year employee from Danville who's just a month shy of his 60th birthday. 'There's a lot of good people up there.'

These days, though, he said the atmosphere at Lyndon State College is unsettled. He blames that on the theft of a laptop computer containing sensitive financial and personal data, and what he views as the tardy explanation about what it all might mean to the Vermont State Colleges community.

'There's a lot of angst,' Swett said. 'You can see it on people's faces. You can feel it in the air.'

The laptop, stolen Feb. 28 in Montreal from the locked car of a Lyndon State information technology employee, contained personal and financial information on an estimated 20,000 employees and students throughout the state college system, which includes Lyndon, Castleton and Johnson state colleges, Vermont Technical College and Community College of Vermont.

Details about the theft were not disclosed for three weeks, even though the data at risk included people's Social Security numbers, birth dates, bank account numbers and payroll information.

In addition, the state college system did not formally alert area banks until March 27 and waited until last week to confirm that the sensitive data in the stolen computer was not encrypted, or coded in a way to prevent unwarranted access to the information.

Robert Clarke, the system's chancellor, said his administration has handled the incident swiftly and appropriately. Administrators wanted to be sure what they told employees and students was accurate before they said anything.

"We were very concerned about the employees," he said. The disclosure delay was necessary because, at first, "people didn't know exactly what was on the computer.

" The presidents of the three unions representing the state-college system employees -- all of whom happen to be based at Lyndon State -- aren't so sure.

"It seems like this is the kind of information they should have been forthcoming with sooner," said Theresa Conant, president of United Professions Local 6217, which represents full-time faculty. "How could the owner of the laptop not have known what was on it?"

Ernest Broadwater, representing the Vermont State College Faculty Federation for part-time faculty, and Janis Henderson, representing nonprofessional staff employees, want Clarke to promise that workers will not have to foot the bill for taking steps to protect their personal and financial information.

"I think it's something they need to address," Broadwater said.

Clarke, in an interview Friday, was not ready make such a guarantee, but said the idea was under consideration.

"We're in discussions with the board of trustees about it," he said "We're trying to determine the most appropriate step to take." Laptop theft

Circumstances surrounding the Feb. 28 theft of the laptop computer remain unclear.

Clarke said Friday he had not seen a police report on the incident. College system employees who want to prohibit access to their credit bureau file need the police report as documentation to support their request.

What is known is that the laptop computer belonged to Lyndon State and that the female employee to whom it was assigned was on vacation in Montreal at the time of the theft. The laptop was hidden under a seat in the locked car, but her skis were visible in the back seat. Thieves apparently broke a car window and took the skis, laptop and other items.

Karrin Wilks, the state college system's vice president for academic and strategic planning, said it was not unusual for the employee to carry a laptop with sensitive personal and financial information while on vacation.

"The employee is extremely dedicated and sometimes works while on vacation," Wilks said. "Many of us work on vacation."

Clarke said systemwide data was on the computer because the five colleges share tasks such as payroll and billing services to keep the system's administrative costs as low as possible.

Within an hour of the theft's discovery, the state colleges did change laptop passwords and block access to the colleges' computer network. Determining what was on the stolen laptop was far more problematic because some of the sensitive data were in unopened e-mail attachments or in deleted e-mails that might still be in the laptop's memory.

"We had to go back and find out who may have sent e-mails out," Wilks said. "It took longer than anyone wanted it to. I'm a Vermont State Colleges employee, and I was frustrated, too."

The good news, Clarke said, is that there is no evidence the sensitive data on the laptop has fallen into the wrong hands.

"The system has not been violated," Clarke said. "Whoever got that laptop has not tried to enter the system."

Clarke said hundreds of colleges have had similar computer security breaches and that, in nearly every case, no one's personal or financial information has been misused. Information delay

Swett said what bothers him most is how administrators have handled the disclosure of information about the incident.

"The way I was brought up, if you do wrong, you go to the person and admit it," said Swett, who grew up on a farm in Danville. "Then you promise to make it whole, learn from your mistake and try not to repeat it."

In this case, he said, that didn't happen. The employees and staff were notified about the theft in a March 21 e-mail, three weeks after the theft. Clarke followed that with a March 24 update.

In his most recent update April 4, Clarke disclosed that the personal and financial information was not encrypted. Clarke said that information should not have come as a surprise.

"We never thought it was encrypted," he said. "It was not new information to us, but we were asked about it, so we put it in the update."

Conant said she was irritated that administrators failed to divulge any information about the laptop case at a mid-March systemwide communications committee meeting with union representatives, and held back news that the data were unencrypted during another committee meeting March 31, where the laptop case was discussed at length.

"We are not happy they decided to keep the information so close to the vest," she said. "They never 'fessed up."

Swett said he didn't understand how serious the laptop theft was until March 28, when the Lyndon State community was shaken by a second breach of security involving the college's computer system.

According to college administrators, a hacker illegally used an information technology employee's password to gain access to a Lyndon State computer and send out a campuswide e-mail alluding to the laptop incident.

"Recently 20,000+ VSC student, alumni, faculty and staff identities were compromised through the theft of a stolen VSC laptop," the e-mail said in part. "Increased security measures are supposedly coming soon, but obviously not soon enough."

It advised everyone, as administrators already had, to take steps to protect their financial assets.

Clarke last week called the hacker's action an "egregious violation" and said police are investigating the incident. The identity of the hacker remains unknown.

"This was 10 times worse than having the laptop stolen," Clarke said. "This was done with willful intent."

Contact Sam Hemingway at 660-1850 or e-mail at shemingway@bfp.burlingtonfreepress.com What to do Here's what employees and students in the state colleges system should do to protect themselves as a result of the theft of the Lyndon State College laptop computer:Contact the fraud department of any of the three major credit bureaus.Trans Union: (800) 680-7289, or http://www.transunion.com/.Experian: (800) 397-3742, or http://www.experian.com/Equifax: (800) 525-6285, or http://www.equifax.com/. Who's affected According to the latest update from the Vermont State Colleges, those affected include people who worked at Lyndon, Johnson and Castleton state colleges, Vermont Technical College or Community College of Vermont between June 2002 and November 2005; and students who attended any of the colleges between June 2002 and December 2004