SSNs of Laredo ISD Students Missing In Possible Data Breach

A disk holding the Social Security numbers of thousands of current and former high school students in the Laredo Independent School District — a total of 24,903 — has gone missing, according to the Texas Education Agency. 

TEA spokeswoman Suzanne Marchman said the agency first became aware of the situation in January, when officials with the University of Texas at Dallas' Education Research Center contacted the TEA looking for sensitive data they had requested from Laredo ISD — data that was supposed to be sent to the TEA first.

At that point, the TEA contacted Laredo ISD for the package tracking number, only to learn that the CD had been signed for at the William B. Travis Building in Austin, which houses five state government agencies, including the TEA. But the CD, which contained Social Security numbers for thousands of 11th and 12th graders over multiple years, was never delivered to James Van Overschelde, the TEA's former director of educational research and policy who was working with UTD on the project — and the agency doesn't know who signed for it.

Marchman said it's not "typical protocol" for a school district to transmit confidential data through the mail, adding that UTD should not have been requesting Social Security numbers in the first place. She said the TEA, which, along with the Higher Education Coordinating Board, reviews education research projects using confidential data, never approved the project. Van Overschelde no longer works at the agency, and Marchman said she did not know the circumstances of his departure.

"Basically, this was going on without our knowledge," she said.

Reached by The Texas Tribune Tuesday night, Van Overschelde said he left the TEA in June and had no knowlege of the Laredo ISD data. While at the agency, he said he was the contact person for university education research centers, and it was possible that the district — using an outdated form — may have still sent the data to his attention. He also contradicted Marchman, saying it was "standard protocol" for the agency to receive confidential data through registered mail. Often, he said, the files the agency recieves from districts are too large to send electronically.

In an e-mail to the Tribune, UTD spokesman John Walls wrote that the university "became aware in February that an affiliated researcher of the ERC had requested that data be sent from the Laredo ISD to the TEA, and that diskette could not be found." Walls said that when ERC officials contacted Laredo ISD, they were told "their standard policy would be for the diskette to be encrypted, so there was no concern of a security breach."

But Veronica Castillon, Laredo ISD's spokeswoman, said Tuesday that this was the first the district had heard of the lapse. She said the district is trying, with the help of the TEA, to gather all of the facts before commenting on case.

George Beckelhymer, president of Laredo ISD's Board of Trustees, said he was also unaware that the information had gone missing. 

"I am trying to be sure we are looking in the right spot if we are looking for blame on this," he said. "Is it really LISD’s blame? Did UTD use an inappropriate method to request the [information] and then tricked us? Does the TEA have fault that they didn’t have the proper personnel to sign legitimately?"

Beckelhymer also added that, while he doesn't like "sharing" Social Security numbers, he doesn't think the fact that they're missing is "a big deal."

But state Rep. Richard Peña Raymond, D-Laredo, said he thought the situation was of great concern, specifically because of the information UTD requested. 

"Are they entitled to them [the Social Security numbers] somehow under open records? I am concerned and bothered that UT-Dallas, or any entity, should be entitled to that information," he said. "Why the hell does UT-Dallas need Social Security numbers from kids in Laredo? I assume LISD responded because they thought they were supposed to." 

Van Overschelde said in his experience, a university education research center would request information like Social Security numbers in order to track individual students throughout a study — anonymously. The TEA deidentifies the data before sending it on to researchers, he said.

"For example, if students in the district are getting eye glasses, and we want to know if recieving eyeglasses has an effect on their academic performance," he said, "we need to know the subset of kids that received eyeglasses" — and deidentified social security numbers could be used to keep track of them.