How do you save on expenses? Don’t spend money on security. How do you make systems easy to handle? Simplify them. Simplify them to the point where even the dumbest could handle the process; to a point where you don't even need to try to teach someone procedures. In a pre-Magna Carta class system, cater to the elite and ignore the peons. Last weekend, these judgement calls came home to roost at the University of Victoria.
Many are talking about the break-in at UVic last weekend. Saturday night, an insecure building holding the personal info of 11,000 people was broken into. It’s unclear when Saanich Police learned of this and when UVic learned of it. Members of the community listening to the CREST system live, said they heard Saanich Police attending. Ironically, I had learned Saturday night that CREST was available via the Internet (Saturday Night Live was truly horrible, so I listened to CREST instead). I turned in at 12:30AM, so the police activity happened after this time frame. UVic learned of this break-in much later. According to their press releases, they learned Sunday afternoon that a break-in had happened on the 1.5km x 1.5km sized campus. Just how many hours elapsed between break-in, the police discovery and the UVic discovery is muddy.
The thieves made off a safe, cash and some other stuff. At first, this was described as a “random” theft. I don’t associate “Human Resources” and “safe”, so I can’t guess if they had a safe or how big it was. According to UVic president, David Turpin, the safe was bolted down. When I had to get a bolted door off of a jalopy, I needed a friend’s help. I had to plan for that. Whoever took the safe, had to know what they were getting into and they must have come prepared. It was not random. The thieves made off with a back-up drive full of unencrypted payroll data contained in that safe.
Monday: UVic management and HR staff mugged for the cameras. They gave interviews to CTV News, Chek News and the Times-Colonist, to name a few. Staff going about their work within a hundred yards were oblivious to all this. They were oblivious that they were in the cross-hairs for identity theft. Many of the staff are clerical and support staff. They largely go home by 5PM. At 6PM, UVic emailed its staff and faculty. The next morning, UVic staff saw a pile of mundane emails in their inbox and deleted those typical messages like the HR stuff including the message with news of this exploit. Many of the staff learned of this exploit via Facebook and Twitter-- they didn’t hear of it first from their employer. I guess the affairs of the ivory tower would be of no concern to the lowly serfs tending the fields.
It’s frequent that students will have their laptops and bags stolen. In some cases, the suspect will be visible, security will be alerted and security will make the 400 ft. trip to attend... in 90 minutes or less. They arrive to find that the culprit is long gone. If they’re lucky, the victim is gone too leaving this as a non-crime because it will not result in a report. This is unfortunately common in law enforcement: crime rates appear low because the statistics are based on reported crimes. If a crime is unreported, or if a police officer can convince a victim to not file the crime, then it’s unreported. If the workload is heavy response times will be poor. If there is a high volume, it’s because there a lot of crimes and incidents. If the crime stats for the campus and reported crimes are low, what’s happening?
They face the housekeeper’s dilemma: a housekeeper could clean-up; or they could assess all of the dirt and cleaning tasks and know the size of the task. How will you know how dirty your home is if you don’t assess? What if your house is so dirty that all you can do is note all of the cleaning that needs to go on and never get to it? You’re left with a dirty house, a perpetual workload, and accurate records of said dirt.
The security workload is supposedly so heavy that they cannot attend quickly. Because the workload is so heavy, they have to make compromises to handle it all: if the buildings were alarmed, then alerts (false and otherwise) would be blare out until security attended. They would make a very indelible metric: the alarm would sound for all to hear. Likely, the alarm system would clearly log the time between being tripped and being attended. In the case of the UVic HR break-in, that was approximately as much as 15 hours. The specifics supplied are vague-- the break-in supposedly happened from Saturday night / Sunday morning (likely 9PM on) and was discovered on Sunday afternoon (likely before 3PM). As anyone with a $30/month home security system can attest: if your alarm is tripped, you have less than 30 minutes before Saanich police are slapping on the cuffs. You better phone in your passcode quickly, or else.
Alarmed buildings could be ringing out all over the campus should alarms be implemented. The idea of the absent minded professor is on full display at the university. Back that up with blustering professors who have tyrannized the students and staff. If you put alarm systems in place, the faculty, staff and students not set them, may trip them up frequently and may apply enough pressure to the administration to have alarm systems removed. This is a campus where deodorants are banned in some offices because of the scent; and fluorescent lights are demonized. Imagine how ardent their resistance would be versus a screeching alarm that sounds off because they didn’t add “disable alarm” to their morning routine.
This theft could have boiled down to a lack of manpower in campus security. An unfortunate stat that was admitted in this break-in: since January 2010, UVic has ousted 3,900+ employees. Some are short term staff, some are teachers who’s terms have lapsed; but many are rank-and-file support staff. You can’t have attrition levels that heavy without some of those bodies coming from UVic security. UVic is unionized. The pay (compared to 7-11 salaries) is very good. Over ⅓ of the people on their recent payroll records are former employees? That attrition rate is higher than the Soviets saw in their defense of Stalingrad. How bad must the working conditions be for the turn-over to be this high?
Will the theft be solved? Who knows: it is a high profile crime. A lot of people are talking about it, so it could mean that someone’s loose lips reveal a trail to the culprits. But here are some numbers to consider:
7,000 staff were given paid time-off to deal with this. Coast Capital Savings reported that people had to wait several hours to see one of their staff. The bank is just one stop along the way. This means that UVic is on the hook for 3,500 days (0.5 days per employee) to 10,500 days (1.5 days per employee) of lost productivity. At a median wage of $12/hour x 7 hrs., that’s $294,000 to $882,000 of lost productivity. In terms of campus security officers, that’s the wage of one security officer for 7 to 20 years of employment. If they thought they were saving money by letting attrition reduce the surplus population of staff, they were wrong.
UVic has pledged to cover the expenses of new bank account set-ups. “Ka-ching!” said the banks. Instead of flagging accounts, banks and credit unions are cancelling the old accounts; and issuing new bank accounts and new cheques. When one customer questioned this $50 expense, the teller responded, “What do you care? UVic has to pay for it.” So credit unions/banks are reaping $50+ for each cancellation and the cost gets passed on up to UVic. (let’s say most of 11,000 go for this: $500,000 in make-goods). You know the transactions are going to foul up. The banks will reap the reward in NSF fees and the like. UVic, reeling from what is over a million dollar mistake, may get more closed-fisted in its policies when people’s mortgage and car payments start to bounce as a result.
As a taxpayer, I am personally outraged. Universities are heavily subsidized by my tax dollars. UVic is either going to deliver less for the dollars I pay; or ask for more of my money to pay for their administrative failures. This entire affair underlies that education, intelligence and competence are three concepts decoupled from one another. The campus has thousands of learneds. They have buildings full of stored knowledge. Their faculty spend years toiling away on esoteric intellectual pursuits. You’d think they’d be bright enough to buy an alarm system and smart enough to know how to use one.
