OU alumni sue alma mater

The lawsuit seeks class-action status.
ATHENS, Ohio (AP) -- Ohio University has been sued by two graduates whose Social Security numbers were among more than 173,000 possibly stolen in five instances of data theft from school computers since March 2005.
Donald Jay Kulpa, 31, of Cincinnati, and Kenneth Neben, 34, a former Columbus resident now living in North Bergen, N.J., argue their right to privacy has been violated.
Their lawsuit was filed in the Ohio Court of Claims in Columbus on Friday, the same day Ohio University's board of trustees agreed to spend up to $4 million to bolster computer security.
The lawsuit asks a judge to order the school to pay for credit monitoring services for the people whose personal information may have been compromised. It also requests compensation for anyone who suffers financial losses from identity thefts linked to the security breaches.
The lawsuit seeks class-action status to represent anyone who was affected, including OU students, alumni and employees.
John Burns, the university's legal affairs director, said he was expecting a lawsuit but was surprised that it seeks class-action status.
"We'll review it and we'll defend it," he said.
Marc Mezibov, a Cincinnati lawyer representing the two graduates, said the university was negligent and indifferent in failing to adequately protect personal information.
A consultants' report released last week concluded that OU's Computer and Network Services division made security a low priority for more than 10 years, though it had an annual budget averaging $11 million and recent annual surpluses averaging $1.4 million.
Also last week, the university suspended the director of Computer and Network Services and its Internet and systems manager, pending the school's investigation of the breaches.
The breaches
The university announced April 21 it had discovered a computer breach at its training center for fledgling businesses. Since then, electronic break-ins also were reported at the alumni office, health center and the department that handles records for businesses the university hires.
The data thefts have exposed 367,000 files containing personal information such as Social Security numbers, names, medical records and home addresses.
Various businesses have been sued by consumers and the government over data thefts.
Most cases are pending in court. One company, data warehouser ChoicePoint Inc., agreed in January to pay $15 million to settle Federal Trade Commission charges after thieves accessed personal information of 145,000 people through the company's massive database of consumer information.
Class action lawsuits against universities and corporations are the only way people can ensure their data will be protected, said Bruce Schneier, chief technology officer of Counterpane Security and the author of several books on computer security.
"The cost of security for a university is high and the benefits are minimal," he said. "We live in a capitalist society. If you want a company or a university to behave in a certain way, it must be in their financial interest to do so."