UA knew numbers were taboo

Arizona Daily Wildcat

CatCard Director Liz Taylor, however, said even though CatCard officials understood that releasing Social Security numbers to MCI Telecommunications Corp. was wrong, it was still "part of the plan."

"It was not an oversight - it was not like it just got by me," she said last week.

University of Arizona Procurement and Contracting Services officials told MCI July that the university could not provide Social Security numbers to vendors, according to letters obtained by the Arizona Daily Wildcat.

But without feeding student, faculty and staff Social Security numbers to MCI, the UA could not automatically register all students and employees for long distance service. Without the preregistration, students have to sign up for the service individually.

The UA collects a 35 percent commission on all revenues from calls made with a CatCard, according to MCI's contract with the university.

Dick Roberts, the UA's chief budget officer, said there was plenty of talk at CatCard Committee meetings about the use of Social Security numbers as account numbers.

"Several options were presented - Social Security numbers were brought up and identified as something we should not do," Roberts said. "The embarrassment of the matter is that even after that dialog, we had a breakdown."

MCI told the UA procurement department in a July 21 letter that "it is not necessary for the university to provide the student ID or Social Security number" - a random account number could be used.

Despite talk within the CatCard Committee, the Social Security numbers were sent off to MCI and Saguaro Credit Union two weeks before the March carding event, Taylor said.

"I cut a file to go out in mid-February with a list of students, faculty and staff that would need a CatCard," she said.

But Taylor, who leads a staff of eight employees, did not specify what happened to the file after that.

Roberts said the university was embarrassed by the release of the numbers.

"The point is, we were not being sloppy or lackadaisical," Roberts said. "We were trying to make the process instantaneous."

In its proposal, MCI warned the UA that without Social Security numbers, students could face up to a 72-hour delay before they could use their calling cards.

Students and employees began investigating the release of the Social Security numbers after one student called MCI and was asked to verify his Social Security number.

Once privacy concerns were aired to university officials, administrators took steps to retrieve the data from MCI and Saguaro Credit Union, which the UA contracted to link banking services to the CatCard.

UA Attorney Michael Proctor said releasing the Social Security numbers to MCI was probably a misinterpretation of the UA's contract with CyberMark, the company contracted to get the CatCard up and running.

That company, Proctor said, still has possession of student, faculty and staff Social Security numbers.

Proctor said Cybermark's right to keep the numbers fall under an exemption to the Family Education Rights and Privacy Act that allows universities to release information to a company contracted to maintain a university records system. The act prohibits universities from releasing "personally identifiable" student information.

"I think someone along the line misunderstood and said, 'If Cybermark has the Social Security numbers, why can't MCI?'" Proctor said.

CyberMark was contracted to provide hardware and software to the university and streamline its affiliate database.

The company's goal is "to provide a single source of information" for all university affiliates, according to its contract with the UA. Initially, the information in the database will include ISO, Social Security, bank account and enrollment information, the contract states.

UA senior buyer Tom Fiebiger, who handled the MCI contract, refused comment and forwarded calls to Procurements and Contracting Services Director Corrine Splitt. Splitt signed the final MCI contract on behalf of the UA, but did not return repeated phone calls.