Binghamton University has once again dropped the ball on securing the private information of students and parents. In a titanic breach of security, Binghamton University kept payment information for every student, possibly dating back at least ten years in a storage area next to one of the most trafficked lecture halls on campus, behind a door that was not only unlocked but taped open. The information itself contained social security numbers, credit card numbers, scans of tax forms, business information (including social security numbers and salary information for employees of students' parents), asylum records and more, all kept in a haphazard and disorganized fashion, sprawled out in boxes, in unlocked (yet lockable) filing cabinets and shelving units. And, to seemingly add insult to injury, the university left dollies and a shopping cart in the room, apparently to aid in any attempted theft. (Pictures of the room are beneath the story.)

Over the recent years Binghamton University has acquired a reputation for being less than able to defend its students', and former students', personal information, especially when it comes to Social Security numbers. Over the past year alone the university has, inadvertently, e-mailed the social security numbers of 338 students in its school of management to over 200 students, has sent personal information of exchange students (including scans of passports and birth certificates) to student groups, and has, most recently, unceremoniously dumped the information of over 70 former graduate students into dumpsters on top of piles of shredded documents. In response to these egregious breaches the university administration created an Information Security Council, with a dedicated full time “information security officer” chairing the council, to make sure no new breaches would ever take place. This breach, however, is by far the worst to ever take place on Binghamton University's campus, and possibly any campus in recent history.

Last week WHRW News reporters were exploring the lecture halls of Binghamton University, a public building open to all people until very late in the evening. While wandering around they came across a door in a lecture hall which was taped open. Inside the door was what seemed to be the “hall of student records,” for lack of a better term. Inside the two floor storage space were multiple unlocked filing cabinets appearing to contain records of tuition payment for every student of, at least, the past four years. The records were sorted by year and social security number, and included at the bottom of some of them credit card numbers of the payees. Next to those filing cabinets were filing cabinets with records of students establishing residency in the state of New York, these files are much more troubling than the receipts of tuition payment because they often contained tax information, and copies of social security cards, of students' parents. One particularly troubling file contained scans of a student's social security card, drivers license and vehicle registration, scans of a letter from the U.S. Government to his mother granting her asylum, scans of the student's parent's tax W-9 tax forms, containing both their social security numbers, and scans of the tax forms for the small business they own, which included social security numbers and vital information of employees of the business.

This was, however, only the tip of the iceberg. In other filing cabinets were what appeared to be receipts of credit and debit card payments to the university, scattered around the two floor space were binders dating back as far as the mid-nineties stuffed full of papers with records of payment to the university for a variety of student accounts (sorted by social security number,) and, perhaps worst of all, a box of tax forms, containing addresses, names, social security numbers and more, sent out to students that were returned to Binghamton University due to failure of delivery. This box, the binders, and piles of important information were left on top of (lockable) filing cabinets and on book shelves with no form of security, or even seeming indexing.

It's horrifying to think that the worst part of this breach can't be placed between the taped-open door allowing easy access to such a vital room, the lack of almost any real organization or indexing of the records and documents preventing investigation into which files were stolen if a theft occurred, or the shopping cart and dollies left in the room to help, one can only suppose, expedite any information theft attempts. Perhaps the worst part of this was the location. The room in which all of this was stored has two doors opening into a regularly used classroom, and is the only access route for a catwalk over the classroom, which was the only access way for special lighting in the room. One can only imagine how many technicians and janitors may have had access to these rooms for seemingly mundane tasks.

Quantifying this breach is hard. Binghamton University has a yearly enrollment of roughly fourteen thousand people. If the information inside the room pertained only to the current students enrolled and their parents that would mean the story would effect, roughly, forty-two thousand people. However, because the information goes back at least ten years, if not more, the potential number of people effect lies well in the hundred thousands. There is no way to know if Binghamton University can keep track of everyone's information that was in the room, or if they could contact them all with information about the breach. Thankfully, however, there is no evidence, as of yet, that there was any theft or breach of security procedures. Though, given the lack of organization in the room and the ample access provided to the room, that is hardly a reassuring thought.

WHRW News has offered to cooperate fully with the university in sharing all information that it found in return for an agreement from the university that there would be no pressure placed on it by its administration, and that reporters would not be prosecuted. Despite verbal assurances that an agreement would be forthcoming, the university has since changed its tone and has declined to offer such agreement. In fact, a official of the university has said, outright, that the News Director of WHRW News should seek personal legal counsel immediately.

UPDATE: Binghamton University Police have said that they are waiting for input from Broome County DA Gerald Mollen before deciding on whether or not to press criminal charges against the journalists in this matter. If you wish to comment to DA Mollen (a publicly elected official) you may call his office at this number: 607-778-2423.

Also if you wish to comment to the university itself you may call President Lois DeFleur's office at this number: 607-777-2131.

WHRW News will keep you updated on this story as it develops.

This article was written by Robert Glass, News Director of WHRW News. To contact him you can e-mail news@whrwfm.org .