An unusual morning delivery

Identity theft is a serious concern for people living in the 21st century. However, despite one’s attempt to protect his or her identities, it is oftentimes easy for others to gain access to private information.

At Portland State, the opportunity for identity theft may be just be around the corner, sitting in a box outside the Vanguard advertising office in Smith Memorial Student Union.
Such was the case when Ann Roman, the Vanguard‘s advertising adviser, showed up to work at 8 a.m. on Monday, May 17. According to Roman, a 10 inch by 10 inch by 15 inch carton was found outside of her office that contained over 200 files of PSU employees, faculty and graduate students.

An anonymous person delivered the box with a typed letter expressing frustration at PSU’s lack of regard for personnel information that contains social security numbers, home addresses, time sheets and letters of offers, according to the letter.

“Management continues to sweep this stuff under the carpet…as though it’s no big deal and no harm done,” the letter reads. “All these people should be informed of the lack of security and the potential for their identity to have been compromised.”

Roman was instructed to deliver the box immediately to the vice provost for Student Affairs Jackie Balzer. As of now, the box has been sealed up and is sitting in the office of Cathy LaTourette, director of Human Resources, waiting to be inventoried.

Several questions remain, such as how and why the box—which contains potentially sensitive information about PSU employees—was left out in the open. Roman’s office is located in a traffic-heavy area in the SMSU lobby. This hallway receives not only PSU students, but also outside guests, construction workers and occasional transients.

Perhaps even more alarming is that, according to the letter, the box was first found outside an elevator in Science Building One.

This was not the first time an incident such as this one has occurred.

“[PSU] has boxes like this one all over the campus,” the letter read. “Sitting in nooks and crannies, closets and hallways.”

Cathy LaTourette, associate vice president for Human Resources, said she is surprised and finds the incident highly unusual and unacceptable. She said that the first order of business is to go through the files in the box and notify all persons whose information may have been compromised by the incident.

“We’re going to have an investigation and track down everyone and send them a letter explaining the situation,” she said. “We’re going to be interested in understanding how it got to be there.”

According to LaTourette, the protocol to handle this type of incident was developed after something similar happened in the past. In 2007, a box containing employee files was found sitting outside the Rearguard’s office in the relatively quiet SMSU sub-basement.

At the time, an editor for the Rearguard took the box into the office and failed to report the incident immediately. When it was discovered, the university contacted the Campus Public Safety Office, whose officers then proceeded to lock the office without informing the Rearguard staff. Eventually, the box was turned over. 

In the previous incident, a majority of the files belonged to employees who no longer worked at PSU, LaTourette said. All of them were notified about the situation and no complaints were filed against the university.

“In the end, we learned that it was an unusual situation and it had to do with an old [piece of] furniture that contained the files that was left in the basement of the Extended Studies Building,” Latourette said. “Instead of taking it to HR, someone brought it to the Rearguard office.”

LaTourette said by next week her office will finish with the inventory process and will know for certain what kind of information is in the box that was delivered to the Vanguard‘s ad office. HR and individual departments both store records of their employees, in separate locations. 

“The files are stored in cabinets that are locked up at the end of the night by HR and you will need a key to get in,” she said.

According to Roman, the incident reminded her of a similar incident that occurred at Western Oregon University a few years ago. In 2007, a student at WOU discovered a file on the university’s server containing the names, social security numbers and GPAs of between 50 to 100 students that could be accessed by anyone.

Brian Loving, a student at WOU, then made a copy of the file and handed it over to the Western Oregon Journal, the university newspaper.

The newspaper then published a report about the incident that prompted campus officials to send IT staffers to search the newspaper’s office, without permission, to retrieve the file. Instead of admitting its fault, the university put Loving through a disciplinary hearing and fired the paper’s adviser over the mishandling of data.

According to Carol Gabriellie, a facilitator at the PSU president’s office, any employee who wants to know about the proper channel to go through if he or she has a complaint in regards to the incident can contact the Ombuds office.

LaTourette said the HR office is also willing to talk to all PSU employees about the risks that they may face in having their personal information exposed.