Saturday, October 8, 2011

Losing the Whole File Cabinet - Data Loss in the Digital Age of Mobile Devices

After our Saturday class last month my vehicle was broken into and my laptop was stolen. Beyond the feelings of violation and frustration, I had also lost my "mobile office" and potentially all of the data contained therein. Police reports, insurance claims, and conversations with University Risk Management were of secondary concern as my mind raced to determine what student and employee data was on my computer. How much protected data that I was responsible for was out in the world? Was there information on my computer that put me or others at risk for identity theft, fraud, or any number of other headaches? Was there a potential blog entry that could come from this situation? Might as well make lemonade…

In our first weekend of class my group had an animated conversation about online education and the direction higher education seems to be heading. We argued about the value of the classroom/campus experience in terms of student development and the work that we all do. What does student affairs and student engagement look like in an online world? Are we ready as professionals, and as a field, to adapt to and meet his change?

We also chuckled at the fact that most of us had at least 1 (if not more) mobile devices with us in the classroom that connected us to work, family and the internet. Many of us checked our work email and worked on various work-related projects during breaks and over the lunch hour. We live in an ever increasingly digital age, where mobile devices allow us to do almost anything, almost anywhere, at almost any time. Banking, shopping, communicating, and blogging are ever present and accessible. It is only natural that education and the classroom are headed in the same direction. In many ways we are already active participants in this shift in our daily professional lives.

Recent data from the National Center for Education Statistics confirms rapid growth in the percentage of students taking at least on online class since 2000. This trend seem likely to continue and pick up speed as state funding for higher education faces further and deeper cuts. A recent conference sponsored by Academic Partnerships further highlights the crossroads of private enterprise and public education that may be the future for many institutions.

After my laptop was stolen my questions shifted from concern about how we provide student development and engagement opportunities to online learners, to more basic questions of policies and procedure. What does it mean to have private information on mobile devices such as laptops, cellphones, and tablets? How do we truly secure data when we carry the "file cabinet" with us at all times?

It seems that there are weekly news stories of 10,000 records being put at risk here, or 45,000 records being compromised there because of the theft of a laptop or other mobile device. I have several friends who were impacted by a similar theft on my campus several years ago. What do we do to ensure that our policies are keeping pace with our practices? Are we currently providing faculty and staff with the training and tools needed to protect the information on their devices?

I also began to look at all of the policies and procedures in my area that would need to be adjusted and adapted to succeed in an online environment. Code of conduct and wellness programs. Threat assessment and commuter services. My thought process about online education has shifted from philosophical to practical. Online students are here now. I am not sure if our processes are fully ready to serve and support them.

2 comments:

  1. I'm really sorry to hear about the break-in! Was it outside of our class building during the time we were meeting, or elsewhere? Thieves are getting so bold these days, it is scary. I lost a laptop years back too...stolen right out of my office! Thanks for the lemonade! :)

    I was somewhat confused by the multiple topics in the post, but the concept of confidential information becoming public knowledge struck me.

    Maybe it's my background in mental health laws, but confidential information reaching public hands (or eyes) is thought of to be one of the biggest ethics violations in the field of counseling. The solution for our field is simple--absolutely NO electronic correspondence for privileged information regarding clients. Additionally, we are encouraged to be cautious with our personal info as well.

    Email--we use client numbers at work, and at school refer to clients by the therapist's name (i.e. Kylie's first client). These emails contain only administrative info (i.e. rescheduled appts, new client intakes) or no identifying info of any kind (name, therapeutic issues, etc.)

    Cell phones--same as above. Per my personal information, I try to take a "transparent" take on the media my phone contains. I don't carry any messages, videos, or pictures that would get any negative attention. For phone calls themselves, voicemails are very basic, "This is Kylie returning your call. I can be reached at _____." The end. While some therapists blur this boundary (for who knows what reason), I never give out my personal numbers to my clients.

    Tapes of sessions--never leave the room where the recording takes place, kept behind 3 systems of lock and key.

    Laptops--obviously a gateway for a lot of private information. Every time I shut my computer down, I go to the "Safety" tab and delete all my browsing history--should wipe out all passwords, keystrokes, and even harmful cookies/spyware.

    Social media--sites such as Facebook have fairly extensive privacy setting options. We are encouraged to have these activated at all times...not necessarily a comfortable conversation to have if your client (or students?) know your relationship status, the names of your family members, and what you did last night!

    I think the issue that you're touching on is over-accessibility. We're so wound up by the multiple pathways to connection, sometimes we leave a door open here and there. Once physical possession is gone, issues can arise in the wrong hands. Yet, I think anything transported through technology can be considered public knowledge anyway!

    ReplyDelete
  2. The digital loss...something I am always afraid of. That is probably the underlying reason I keep several back ups of information and limit my technology access.

    You make an interesting point of training faculty and staff in using technology and keeping it safe. I know I did not receive any formal training on how to keep digital items safe. I assume it is taken for granted that we are all using great coding for our passwords and actually have passwords for electronic devices. This frame of thinking may be more harmful then any one of us is aware of.

    Training is a proactive step I think universities could take in helping to keep digital file cabinets among other digital items safer. One step that could be taken is taking a step back from the anytime access.

    I am aware that there are some areas in higher education where emergency access is needed but should that be the foundation for anytime access? If we could pull back from being accessed at any time would that lessen the amount of technology we have on us that could be compromised?

    I think so. If policies required us to keep university items under a 3 levels of security (similar to CSU residence halls) it could prevent technology being in a place that is easily accessible but not fully inaccessible.

    ReplyDelete