Angelo PC

***UPDATE***
The Angelo State University website no longer lists students’ names and email addresses. Small victory for email security fans.

---

Back in January of last year, I contacted Angelo State University (ASU) to alert them to a potential problem, regarding the privacy of their students. Their website’s student directory had listed every student, by name, including their “ASU” email address. I was a little astonished to see that they would care so little, not only about the privacy of their students, but that they would offer-up this large list of email addresses to any spammer that wanted them.

So, I “farmed” the addresses and put them in a text file, just to prove a point. I sent an email, with the attached text file, to their Information Technology/Web Oversight department. I explained how this was a privacy issue, for their students, and a spammer’s dream-come-true.

To whom it may concern,

I was just browsing your site and found the student directory. I was absolutely astonished to see that the actual email address of every student on campus! For the life of me, I can’t understand how someone could be so lax about your students’ privacy. Attached is a list of every one of those email addresses, just to prove a point. It would take almost no effort at all to spam all of these addresses or to sell the list to an
email marketing company. I’m hoping that you will update the page, using a PHP-based email system, with a contact form, where the email addresses are never displayed on the page or in the source code…”

I received a response stating that they were still “reviewing their options” on how best to resolve the problem. I’ll remind you…this was in January of this year…roughly ten months ago!

Thank you for contacting us regarding your observations and concerns.

Regarding the student directory listing, this is an item that we have also been reviewing. We have been researching and comparing the different options to see what is going work best in our environment. As we determine the best option, we will update the pages.

I sent a follow-up email, in August, with no response.
Not wanting to see the ball dropped, I just checked their student directory. Was I amazed to see that nothing had been done to protect their students’ identities or to protect their students’ addresses from being picked-up by spammers? No…not really. I expected nothing, more or less, than what I saw.

Now, I fully understand that these addresses are provided by ASU and shouldn’t be used as “private” email addresses, but I’m certain that a portion of the students do just that.

Am I the only one who sees this as a problem? If I were a student at ASU, I would definitely voice my concern. I think the students are the ones that need to get this changed, not me.