Down at Duke Law School, they have a highly regarded new dean: David F. Levi, former Chief Judge of the Eastern District of California. But maybe what they really need is to create a new position: "Cyber-Security Czar."

It appears that their website has been hacked. Visitors to the site see the message at right.

In addition, a security breach has compromised the safety of the personal information of some applicants to the law school.

Emails sent to current Duke law students and applicants to the law school, after the jump.

EMAIL MESSAGE TO DUKE LAW SCHOOL STUDENTS

Current members of the law school community received this information:

Dear Law School community,

Thank you very much for your patience as we continue to work to restore our web site and understand the full ramifications of the attack on our web site and server. The attack was a criminal act, and it is now being investigated by law enforcement officials. We know that some of you have questions about the attack, and we want to provide as much information as we can without compromising the ongoing investigations. I'll attempt to do that here.

Earlier this evening, the Law School sent emails to about 3,200 prospective and current applicants notifying them that some of their personal information was exposed during the recent attack on our web site. We have no evidence that the intruders actually downloaded or acquired any of this information. Nonetheless, we know the intruders had the opportunity and the tools to do so, and we therefore felt it was important to notify those who might have been affected as quickly as possible.

Following is a set of questions and answers to help explain what has happened and address concerns you may have:

What happened?

On Thursday, Nov. 29, at about 3:30 p.m., we detected unauthorized links and coding in our web site. As soon as a breach was confirmed, we took the site offline and launched our investigation. By Friday, it appeared that we had removed the unauthorized content, and we reposted the web site. Our continuing investigation, however, found that the web server had been compromised, and that the attack had penetrated more deeply than originally thought. We took the web site down again by Saturday morning pending a more complete security scan by the university's IT Security Office. We do not believe that any new problems were introduced during the short time that the site was reposted.

As we further evaluated the site, we found that several databases stored on the server were exposed during the attack. We also determined that the first intrusion occurred in early November, when a directory of foreign files was inserted into the site. Another set of files was deposited on Thanksgiving Day. We believe that nothing was done with these files until the attack began on the afternoon of Nov. 29.

What was on the exposed databases?

There were two databases containing sensitive or potentially sensitive information. The first held records containing information submitted by prospective applicants who were requesting information from the admissions office. A small percentage of those prospective applicants had provided Social Security numbers when they completed our online request form. That group of 1,400 prospective students received notification today about the security breach. Two individuals in this group are current first-year students; they have been notified of the breach by Law School officials.

Duke University has a policy not to gather Social Security numbers, except in a limited number of circumstances including some transactions with applicants and prospective applicants. The Social Security numbers in this database were no longer being used, and we had in fact stopped collecting them from applicants earlier this fall. But the database had not been purged of old data. We are reviewing our policies to ensure we are in full compliance with all policies that pertain to the handling of Social Security numbers.

The second database in question included contact information and self-generated passwords for about 1,800 current applicants who were using our web site to track the status of their law school applications. Even though our second database did not contain Social Security numbers, we also have notified this group of the security breach, in case the passwords they used on our site are the same as the passwords they use on other sites.

How has this affected the Law School faculty, staff and students?

Other than the two current students whose information was contained in the prospective applicant database, no personal information for faculty, current students, staff or alumni was exposed during this security breach. Our Groupwise email system was not affected.

What has been done to advise and help the people who were affected?

When we determined that the databases had been exposed during the attack, we quickly began the process of notifying those who were affected. We consulted with law enforcement officials and university counsel to ensure that the notifications would not interfere with our investigation or any investigation an outside agency would conduct. We sent emails and are following up with letters to those whose Social Security numbers were exposed. We also sent email notification to those whose contact information and passwords were exposed. Both groups were advised of precautionary steps they can take to monitor their credit. We have set up a special phone number and email address for applicants who may have questions, and our admissions staff is talking with them and trying to address their concerns.

What has been done to secure the web site and prevent this from happening again?

Over the weekend, we moved the site off our web server to allow us to install a completely new operating system and new software. While that was being done, we also reviewed all the data from the old server's system for remnants of the intrusion. We believe the core sections of the site will be restored Tuesday evening or Wednesday morning, although some pages and services will take longer to restore. The application status tracker is being restructured so that it will not require passwords. Social Security numbers have been removed and will not be stored on our web server.

What is the state law regarding information security?

The North Carolina Identity Theft Protection Act requires that people whose sensitive personal information, such as a Social Security number, is exposed in a security breach be notified of that breach. The relevant statute can be found at
http://www.ncga.state.nc.us/EnactedLegislation/Statutes/PDF/ByArticle/Chapter_75/Article_2A.pdf.

We are continuing our investigations into how this attack occurred and what additional steps can be taken in the short and long term to further secure our web site and all our electronic data. We will update you on our progress in coming weeks, and we will provide a full report to the community once the investigation and security planning is complete. In the meantime, if you have any questions or concerns, please feel free to contact me ([email address redacted]), Liz Gustafson ([redacted]), or Jill Miller ([redacted]).

Sincerely,

Melinda Vaughn
Executive Director of Communications
Duke University School of Law

EMAIL MESSAGE TO DUKE LAW SCHOOL APPLICANTS

Aspiring Duke law students received this message:

Dear [redacted]:

On Nov. 29, 2007, technical administrators at Duke Law School discovered that our website was compromised by electronic intruders. As soon as we learned of the breach, we took our site offline and launched a full security evaluation. During that investigation, we discovered that some personal information you provided for the purpose of tracking your application status could have been accessed by the intruders. That information includes home addresses, phone numbers, email addresses and the passwords you created to access your application status information.

While a separate database containing some Social Security numbers also was compromised during the attack, the application status tracker does not contain Social Security numbers and your Social Security number was never at risk. In your case, we are primarily concerned about the security of your password as it is linked to your email address. [Ed. note: Other applicants received an email message indicating that their SSNs were compromised. See here.]

We have no evidence that the intruders actually downloaded or acquired any of this information. Nonetheless, we know the intruders had the opportunity and the tools to do so.

If you use the same password for Duke Law that you use on other websites or online accounts, we recommend that you change those passwords. You may also consider monitoring your credit and placing a 90-day fraud alert on your credit report, both of which you can do for free through any of the three major credit bureaus. See www.annualcreditreport.com or http://www.ftc.gov/bcp/conline/pubs/alerts/infocompalrt.shtm for more information and instructions.

The security and safety of our community is of utmost importance to us, and Duke University works hard to protect the personal information of prospective students and other community members. We are taking all possible steps to address this breach and prevent it from happening again.

We have notified law enforcement agencies and will notify any relevant government agencies about Duke’s response. The intrusion was confined to our web server; data stored in other systems at the Law School and around campus were not compromised.

We regret that this situation occurred, and we apologize for any inconvenience to you. Please do not hesitate to contact me or Mark Hill, Director of Admissions, by calling [redacted] or emailing [redacted] if you have any questions or concerns.

Sincerely,

William J. Hoye
Associate Dean
Admissions and Financial Aid