Stanford Databases

Stanford maintains a number of databases containing student information. Most are used for internal purposes, such as keeping track of registered students, university bills, etc. These are generally private and do not allow public access, except for updating or maintaining your own personal record (for example, Axess). 

Many databases, however, do allow public access. Most students are familiar with the “whois” database which provides directory information on all students and staff. A typical whois record looks something like:

This is a “Stanford-Only” view, which means that one needs a Leland username to access this information. This data often includes phone numbers and mailing addresses, which most students seem to consider private information. Since it is generally only available to members of the Stanford community, most students are happy to share this information.  

Until a few years ago, students had little control over which information was included in the whois database. Even worse, this database was publicly available on the Internet for anyone in the world to view. Now students can use a system called “Stanford.Who” to control what information is shared with Stanford community members and what is shared with the outside world.

The whois database is not the only source of directory information about students. Some other University databases exist which do not provide student control over which information is displayed. Any student can access these databases, but in practice, only few know how.

Prism

Prism is a set of old database applications provided for University staff use. This server was formerly the main interface to the Stanford Library card catalogs, which is how many students became familiar with the server and its functionality.

The Prism interface looks something like:

Most of the applications available are clearly intended for administrative use only; indeed, save the fact that Stanford University sometimes affords students administrative status, it is unclear why all members of the community are granted access to this system.

The services offered by this system can be used to learn a student’s past grades, current bill status, etc. Many of the services have security systems installed so that only certain members of the community have access. But since hundreds of University staff have this access, many students who are employed part-time as advisors or other roles can easily use the system by borrowing a co-worker’s telnet session. One project member knows at least two Stanford students who frequently perused other students’ academic records while employed by the University.

In addition, some Prism files allow unrestricted access by any Stanford community member. One such file is the “Student Directory” in the “Student and Academic” section. This service provides a simple search engine that can locate any registered student by name. An example result appears below:

Notice that this record contains even more information than the corresponding whois database record. In this case, we have learned the student’s current residence, which may not have been previously identified by whois, and even her room number. We also know her PO Box number and home address in Arizona.

Clearly this database can be used to harass or even stalk members of the Stanford community. Since students have no control over what information is displayed in this database, privacy is not an option for many students who wish to hide such personal information.