All across the country, colleges and universities are putting their students, faculty and staff at risk for identity theft, just by collecting Social Security numbers, even when necessary by law.

In late March, a University of California at San Francisco server that stored the names, contact information and Social Security numbers of about 3,000 cancer study subjects and potential subjects was stolen from a locked office. In May, the names and Social Security numbers of almost 90,000 people associated with the State University of New York at Stony Brook were accidentally posted on a publicly accessible Web site.In the last few years, dozens of institutions, including New York University, Northwestern University, Ohio University, the University of California at Los Angeles and Utah Valley State College, have reported security breaches involving thousands of Social Security numbers each.

As the fall term approaches, some institutions across the country are making the final push to convert campus identification systems from Social Security numbers to randomly assigned numbers in time for the start of classes.

The American Association of Collegiate Registrars and Admissions Officers last released a study on the use of Social Security numbers in 2002.

As of 2001, 50 percent of the 1,036 responding institutions reported using Social Security numbers as the primary identification number, while 41 percent said they assigned identification numbers to students that were independent of their social security numbers, while still using social security numbers as a secondary form of identification.

Since then, scores of institutions have eliminated the use of Social Security numbers where at all possible, said Barmak Nassirian, the association’s associate executive director. Though institutions must collect Social Security numbers for tax purposes, general practice is not to “force students to disclose the number involuntarily” for basic identification, he said. “It’s fairly mainstream now that schools use a random student ID number … There are very few institutions left that use [the Social Security number] as a primary identifier.”

But the change, Nassirian said, “is a major information technology project that is very time consuming and expensive.”

The University of Georgia has begun a multi-year effort to eliminate Social Security numbers this summer, planning for the conversion to randomly-assigned nine-digit numbers for student identification on class and grade lists in the fall. “This measure is just a Band-Aid,” said Rodney L. Parks, associate registrar for operations -- the first step in the process of disconnecting identification from Social Security numbers.

The nine-digit identification number comes from the 16-digit number that the university has printed on all identification cards for at least a decade, Parks said, making it easy for students to remember since it’s used everywhere from the campus gym to the health center to local restaurants. “In making the first change away from SSNs,” he said, “it made sense to go with a number that students are familiar with, that they’ll be able to remember when taking an exam and filling out a ScanTron.”

But because the identification numbers are printed on easy-to-misplace red, black and white plastic cards, Georgia has not adopted the numbers for all purposes. Students will still need to type in their Social Security numbers and a PIN number to login to the university’s Online Access to Student Information Systems (OASIS), where they register for classes, update address information and access other sensitive material.

Nonetheless, Parks said he hopes the university can eliminate the use of Social Security numbers for OASIS logins in 2008. “For us, it’s a three step change, from Socials to [the last nine digits of the 16-digit] numbers to a third alternative, maybe by next year.”

Auburn University is also in the process of a conversion, requiring all students, faculty and staff to renew their identification cards by Aug. 29 in time for a campus-wide switch from Social Security numbers to assigned nine-digit numbers scheduled to coincide with the university’s first football game of the season on Sept. 1.

Most campuses in Texas A&M University system have transitioned to randomized identification numbers in the last few years and the Corpus Christi branch began the changeover early this year, Marshall Collins, the assistant vice president for marketing and communications, said. “We were naturally in the process of introducing this new system, just as many other universities are.”

But in a case of “what would be considered bad timing,” Collins said, the university has had two incidents of lost student Social Security numbers since June when a professor traveling in Madagascar lost a flash drive that may have contained the Social Security numbers of 8,000 current and former students. Earlier this month, a student accidentally took a class roster including Social Security numbers off a professor's desk, returning it two days later, once students had been told to search for it. The randomized identification system will be launched next month.

“It’s just one of those odd circumstances,” he said. “Something goes wrong just as you’re going about changing it."