The university says the $100 external hard drive contains data on roughly 38,000 current and former students. It was reported stolen earlier this month from a locked room within the Office of Student Affairs on the fifth floor of the Leavy Center. An investigation later determined that the device contained information on students enrolled at the university from 1998 through 2006, as well as some faculty and staff members. The hard drive didn't contain any financial information.
Students are mad, wondering why they aren't finding out about the theft until nearly a month later. "It's a huge privacy violation. I expect better," said one student. Another said, "I'm pretty unhappy about it right now."
The theft remains under investigation by D.C. police. Students and staff are being notified this week by letters and e-mail. Arrangements are being made to provide free credit monitoring services.
I commend you for bringing attention to this important story and related issues. At the same time, I am stunned at the difference between Georgetown's reaction (relatively quick disclosure of the theft and offers to compensate victims for ID theft protection services) and the response I received from Best Buy after its Tenleytown Washington DC store allowed my computer to be stolen ("go missing", in their words) and then failed to meet its obligations under DC security breach notification laws to notify me immediately of the theft and my potential exposure to ID theft. It was months before I learned of either. Indifference towards property and privacy protection at Best Buy and other computer repair chains is a persistent and pervasive problem if recently exposed scandals* related to Best Buy (and other chainstore) computer repair technicians' handling of consumers' personal information and my own recent experience with Best Buy** are any indication.
There is room for improvement in Georgetown's response, but perhaps some attention to these issues by your team might help motivate Best Buy and other similar companies to follow Georgetown's example and adopt more effective property and privacy protection practices -- or at least to take responsibility for security breaches? Raelyn Campbell Washington, DC * For example: http://redtape.msnbc.com/2006/06/one_year_ago_ha.html?cid=100120286#comments http://consumerist.com/consumer/investigations/video-consumerist-catches-geek-squad-stealing-porn-from-customers-computer-271963.php and http://video.knbc.com/player/?id=212629 ** My experience is detailed at: http://bestbuybadbuyboycott.blogspot.com/
ABC 7 News to leave comments on news stories.