An Information Technology investigation has revealed that a laptop stolen from a faculty member's Baton Rouge home may contain personally identifiable information for about 750 University students.
But University officials released a notification letter to potentially affected students April 15 - more than 10 days after receiving news of the theft. The faculty member notified University officials April 4, but officials did not contact LSUPD.
The laptop is owned by the E.J. Ourso College of Business, and may have included students' Social Security numbers, full names and grades, according to a notification letter The Daily Reveille obtained Tuesday. The letter was signed by Brian Nichols, chief IT security and police officer, and Robert Sumichrast, dean of the E.J. Ourso College of Business.
Sumichrast said the University involved LSUPD almost immediately following news of the theft.
But LSUPD Chief Ricky Adams said the University did not contact them, nor did the department conduct any investigation connected to the theft.
Nichols said the University has a general policy of notifying parties of similar incidents within 10 days of their occurrence. Officials missed that limit by one day.
Sumichrast said though the 11-day time frame may seem long, officials composed the letter "much faster" than April 15. Sheri Thompson, IT Communication and Planning Officer, said they delayed notifying students to give themselves time to investigate and to collect the names and contact information for all potentially affected students.
Thompson also said the faculty member did not immediately realize that the laptop could contain personal information.
"People aren't necessarily aware of what they've got on their computers," Thompson said. "Thinking about what was lost on the computer is sometimes an afterthought."
Sumichrast said he could not reveal the name of the faculty member, citing privacy concerns.
IT officials said the laptop is still missing, but Thompson said that to her knowledge no students have reported suspicious activity on their accounts.
Sumichrast said the incident reinforces the University's need for tighter electronic security.
"It taught us the importance of some of the improvements LSU is making in securing confidential information," Sumichrast said. "It highlights to faculty members in the college that they need to keep computers secure, [and] it highlights to students, staff and faculty the vulnerability today with electronically stored information."
Thompson said the University is moving to eliminate Social Security numbers from all systems and databases, but "cleaning up" all University venues for possible theft will take years.
"There is still going to be a lot of information out there from instructors," Thompson said. "They keep things on their desktops as well as their laptops, [and] teachers have Social Security numbers in their gradebooks or on pieces of paper."
The notification letter also outlined possible actions students may take to protect their identities. Nichols said students can visit the IT Web site for more information.