TABLE OF CONTENTS:
At it’s regular meeting on October 27, 2000, the Rutgers University Senate approved recommendations presented by the Senate Student Affairs Committee regarding the use of social security numbers as student identification numbers.
One specific recommendation resulted in a "charge" for Rutgers University Computing Services (RUCS). RUCS was asked to perform an analysis to assess the impact to university administrative computer systems to accommodate the replacement of student social security number with a new unique student identifier.
This document presents the results of the analysis performed by RUCS.
It should be noted that the analysis presented in this report was limited to the administrative computer systems supported by RUCS. The analysis did not include university and departmental systems supported outside of RUCS. Neither did it include any other technical or procedural implications that could result from the replacement of social security number with a new student identification number. Therefore, this report should not be viewed as a complete and comprehensive assessment of the implications of changing the current practice of using social security number as student ID.
Also relevant to the topic of this report are the current discussions and planning that are taking place regarding the implementation of a new, integrated student system. Decisions made regarding the replacement of social security number as student ID should be made with this in mind.
Rutgers University is one of the many higher education institutions that use social security number as the student identification number. Twenty-six out of forty-four AAU schools responding to a survey in January 1999 use social security number as student ID.
Prior to 1987, Rutgers used a six digit unique student number for student identification purposes. The movement to change this student ID to social security number was led by Rutgers central administrative offices (Admissions, Financial Aid, Registrar and Student Accounting) and supported by RUCS. Driving factors for the change included:
Recent concerns about the linking of names and social security numbers and the resulting potential for identity theft have made the use of social security number as student ID a visible issue. Elimination of social security number as student ID is seen as one way to reduce the risk of identity theft. In support of this position, during the fall of 2000, the Student Affairs Committee of the University Senate drafted specific recommendations that were approved by the University Senate. (see attachment 1 – Report of the Rutgers University Senate Student Affairs Committee and Executive Committee – Use of Social Security Numbers as Student Identification Numbers). A review of this attachment provides a more detailed discussion of the concerns surrounding this issue. The attachment also details the committee’s recommendations and resolution.
UNIVERSITY SENATE CHARGE TO RUCS
One recommendation from the University Senate Student Affairs Committee was that the university "make a commitment to use unique student identification numbers" and to perform a "cost benefit analysis", which would assess the time and cost implications of converting university administrative systems to accommodate "student identification numbers that are not social security numbers".
Since RUCS is not responsible for all Rutgers University computer systems, the charge to RUCS results in an analysis limited to only those administrative computer systems supported by RUCS. As mentioned earlier, this report does not address computing systems or processes outside of RUCS that could be impacted by a replacement of social security number with student ID. This report does not address other policy and procedural implications that might need to be considered by various university administrative offices and departments.
RUCS ADMINISTRATIVE COMPUTER SYSTEMS
Administrative Computing Services (ACS), a division of RUCS, supports many of Rutgers University administrative computer systems. ACS currently supports over 25 major systems and 150 smaller systems and subsystems that support:
The ACS systems supporting student administration are comprised of over 1500 computer programs, 700 jobs, 30 databases, hundreds of on-line screens and reports and hundreds of database tables and system files. The student ID field is accessed by the great majority of these programs and exists on many of these screens, reports, database tables and files.
Furthermore, the student ID field is used as the primary key for most of these systems and databases. With student ID used as the internal system key for most student records processing, the student social security number is intricately tied to most student transactions processed through ACS student systems. Additionally, social security number is a necessary key on various interface files incoming to and outgoing from ACS, mainly in the admissions, financial aid and student financial services areas.
This information is meant to give an appreciation for the scope of the ACS student systems environment and the proliferation of the student ID field in these systems.
Finally, it should be noted that student social security number and all other sensitive student data is treated as confidential within ACS systems and is secure and accessible only by authorized individuals.
Scope
As indicated earlier in this report, the scope of the analysis was limited to the administrative systems supported by RUCS/ACS. As described in the previous section, this includes the applications that support student administrative processes, online student and faculty services and academic reporting for both internal and external use. The analysis was limited to the impact to these systems resulting from replacing social security number with a new unique student ID. The analysis did not include any other procedural or administrative issues that could result from replacing social security number with a new student ID.
Methodology
The charge to RUCS was to assess the changes necessary to convert university administrative systems to accommodate "student identification numbers that are not social security numbers".
A small steering committee was assembled to provide context and guidance for this effort. The team included Kathleen Scott - FAS Faculty member and Chair of the University Senate, Ken Iuso - University Registrar, Brian Rose - Director for Compliance and Student Policy Concerns, Don Gordon – ACS Assistant Director of Student Systems and Joseph Percoco – ACS Director of Application Development.
Preliminary discussions with ACS technical managers took place to discuss the best way to replace social security number with a new student identifier. During initial discussions it was acknowledged that this type of effort would be a large undertaking, calling for extensive modifications similar in scope to the Y2K remediation effort. This was due not so much to technical complexity but rather due to the following reasons:
The possibility of using the 14 position RU Connection Card ID number was ruled out due to the following:
After determining all impacted software components (i.e. programs, jobs, databases, files…), work estimates were made for the various phases of system lifecycle development including analysis, design, specification, programming, unit testing, system testing and integration testing. Estimates were also made for database administration tasks, system infrastructure tasks, database and file conversions, development of new software for generation of new unique student ID’s, and for project management and supervision tasks.
After time and cost estimates were completed for each application area, results were compiled, total person-days were tallied and total cost was calculated based on existing market rates for contracted personnel. Contracted personnel were considered in order to minimize "opportunity lost" costs. In other words, contracted personnel would be used in order to allow current ACS staff to continue to work on other important projects which would need to be terminated if ACS staff needed to work on this initiative.
Results
In order to replace social security number with a new student identification number, work will need to be performed across all major ACS student administrative systems and many minor systems. As to be expected the bulk of the cost is attributed to work performed across the core student systems including Undergraduate and Graduate Admissions, Registration, Student Financial Services and Financial Aid.
Tasks will need to be performed across all phases of the system development lifecycle including systems analysis, design, specification, coding, unit test, integration test and system test. Additionally, data base administration tasks, operational set-up, source code control and turnover, program compilations and job set-ups will need to occur. Database and file conversions would also need to be completed and tested.
See attachment 2 – Report to the University Senate Cost Analysis for the detailed work breakdown estimates and related cost estimates.
As seen in attachment 2, a cost of $1.2 million is estimated for this initiative. Cost estimates are based on person-day estimates multiplied by a daily contracted rate of $750. Estimated work duration for these ACS system enhancements is between 1 and 2 years depending on the degree to which ACS staff could assist contracted personnel and the degree to which additional system changes could be controlled. Regarding the former, ACS staff would be needed to assist contracted personnel "ramp-up" in their understanding of the ACS systems environment. Regarding the latter, system changes would need to be controlled in order to allow software stability over the course of the project, especially during the testing phase.
At a summary level, the estimate shows that much of the cost (42%) is attributed to testing as is to be expected in this type of initiative. It is especially, important that integration testing between applications be done thoroughly due to the matching of student transactions on student ID.
Coding accounts for a small percentage (16%) of total cost as would be expected. Coding includes logic changes (65% of coding costs) and changes to reports, online screens and internal file and table references (35%).
Data conversions account for 15% of total cost. Data conversions include databases (17% of conversion cost), current generation files (21%) and historical files (62%).
Analysis/design/specification account for 10%. Supervision and project management, database administration and operations account for the remaining 17% of the cost.
It is estimated that over 950 software components are impacted in some way, shape or form.
Examples of coding include:
Additional Considerations
The following are additional considerations that should be taken into account:
After considering the implementation option discussed above, and realizing that it could be viewed as cost-prohibitive, the technical team reconvened to assess smaller scale options that might help address the issue, but at a lower cost to the university.
Rather than focus on a total replacement of social security number with a new student ID across administrative systems, the emphasis shifted to improving social security number confidentiality without causing major impact to existing administrative systems. The idea was to propose a lower cost solution that could help eliminate unnecessary use of social security number. This idea is founded on the fact that the heart of the problem lies in extraneous or "public" use of social security number and not as much in the existence of student social security number within the secured administrative systems environment where data is protected and limited to authorized individuals.
In order to help develop this option, student concerns regarding the use of social security number outside of the core administrative systems was solicited. The following list submitted by Ken Swalagin, Secretary of the University Senate, provides examples of these issues:
Rutgers would establish a new student ID to be used for "public" activities such as some of those listed above. This new student ID would be mapped to the existing student ID (currently social security number for most students). This mapping would be made available to students over a secured web site. A student would be able to look-up his/her new student ID based on entering their current student ID (social security number). The student could then use this identifier for many of the activities mentioned above. In the limited cases where an office or organization needed to either track back to the student or retrieve information from an administrative system, an authorized individual could retrieve the student’s social security number from the mapping table.
This option is attractive in that it insulates the existing administrative systems, calling for relatively minor changes to existing applications. As compared to the option discussed earlier, this solution can be implemented in a shorter time frame and at a lower cost. The downside is that, while this solution could help resolve many of the concerns on the above list, it will not address all of the concerns. For instance, students would still be required to present social security number to core administrative offices such as cashiers and registrar.
In order to implement this solution the following would need to be provided by ACS:
In response to a request from the Rutgers University Senate, this report has provided a detailed analysis for the replacement of social security number as the student identification number in RUCS administrative computer systems. This report has shown that this replacement would be a large and costly undertaking. This report has also cautioned that the costs reported should not be viewed as complete. A more comprehensive analysis beyond RUCS computing would need to occur to provide a complete analysis.
This report suggested an alternative, potentially more cost beneficial option that could resolve some concerns by limiting "public" use of social security number. This option could be viewed as an interim solution until the implementation of a new enterprise wide student system.
This report has also suggested that any decision to move forward needs to be weighed against additional factors, including opportunity lost costs and the potential for a large investment in the near future for implementation of an enterprise-wide integrated student systems package.
Attachment 2: Cost Analysis Spreadsheet