Last week the PSPA Board discovered that Andover’s 2009-2010 Student Directory was exposed online, prompting its removal and reevaluation of the online directory format. The directory was uploaded to Scribd, “a social publishing site, where tens of millions of people share original writings and documents,” according to the Scribd website. Maureen Nunez, Director of Risk Management and Administrative Services, said that the directory appeared to have been online since November of 2010. The school does not know who posted the directory on Scribd. A parent alerted Rebecca Sykes, Associate Head of School, who then notified Nunez and members of the Communication Office, including Tracy Sweet, Director of Academy Communications, and Stephen Porter, Director of Public Information. Nunez was “very surprised” to learn of the leak of the directory. She said, “As you know, the only way to get to [the directory] is if you have PA credentials.” Nunez sent an official request to the website using a template provided by Scribd’s “Support Desk” to ask for the immediate removal of the document because it contains personal information about minors and is copyrighted material. The company responded to Phillips Academy request within an hour, and the file was removed from the website the evening of the same day, around 7 P.M. Nunez said, “I have no idea why someone would [upload the directory] because it clearly puts people’s information at risk. It’s not anything that anyone should want to do. The directory is very much intended for on-campus use.” Nunez stressed that posting documents like the Student Directory on external websites puts people’s personal information at risk. She added that students had never given the school any permission to make their names, phone extensions, email addresses and other similar information available to the public. “There’s nothing to be gained by taking that information and posting it on a website,” Nunez said. “We rely on people’s good judgment.” However, Nunez said that the leak would have been more dangerous if it included students’ actual home addresses like it had previously. “[Home addresses] were removed when we went electronic because we didn’t want that to be out there,” explained Nunez. Now only students’ hometowns are listed in the directory. Only those with Phillips Academy login credentials could access the PDF versions of the various campus directories online. A clause below the links to the directories states that they are “intended for the sole use of faculty, staff and students of Phillips Academy, as well as current parents.” The school also prohibits commercial use of the information provided in the directory. Stephen Porter, Director of Public Information and Web Publishing said, “You can always worry about making things publicly available electronically. The reality is that there is no perfect way to make information available and not have there be a danger of somebody forwarding pieces of it. “What you can do electronically is to make it as difficult as possible for people to do that,” he continued, citing the example of the “Contact Us” page on Andover’s website, which contains a listing of the faculty and staff’s contact information. He explained that the information on the website can’t be downloaded all at once, making it harder to share all at once. Porter continued, “But even when things were in hardcopy, if somebody wanted to work hard enough, the could take a hardcopy, scan it, and post it. It’s really a matter of trying to protect the information as best you can and walk the line between providing convenience to the people you’re trying to serve, our students, faculty, and staff, and maintaining a reasonable level of protection.” Nunez said that she and Paul Murphy, Dean of Students, discussed whether the school should create a stronger warning against inappropriate use of the directories to prevent cases like the recent online leak. According to Nunez, Murphy suggested digitally watermarking directory pages to make clearer that use of the directories should be kept within the Andover community. As a general warning, Nunez advised students to be cautious of what they post online. “People just blindly put things up, [but] the sites don’t look at what’s being posted,” she said. “Don’t put things out there that you don’t want everyone to be able to see.”
