Campus crime log disclosed identities of minors

For at least four years, the Division of Public Safety has been improperly disclosing the identities of juveniles who were arrested, in violation of a Pennsylvania law protecting the confidentiality of minors.

DPS maintains a PDF document on its website that is updated every business day with information about crimes, such as retail theft and assault, reported on and near campus. Until recently, the names and addresses of people under 18 years old were written in white text in the crime log — making them invisible to the eye but accessible via copy-and-pasting and in Google searches, oftentimes appearing as the top hit.

After The Daily Pennsylvanian notified DPS of the issue on Aug. 23, administrators acted quickly — the document was removed from the website within 10 minutes. An updated version correcting the problem was posted two days later, and no personally identifiable information is currently available online.

The updated format omits the names and addresses of all people who have been arrested — regardless of age — and the text in the PDF is not searchable.

The DP has crime log documents as far back as October 2009 that include identifying information of minors who were arrested. DPS did not comment on how the problem began.

Related: DPS will report more sex crime info in crime log

Under the Pennsylvania Juvenile Act, police and court records may not include identifying information of minors — except in particular circumstances, such as if the courts judged that a juvenile over 14 years old committed a crime equivalent to a felony.

“They have a constitutional right to protect their reputation under the Pennsylvania Constitution,” said Marsha Levick, co-founder of the Juvenile Law Center and an adjunct professor in the Law School. “There’s the truth element — of course, they were arrested — but they have a statutory right to have those records private.”

While the Penn Police Department is a private force, it is still bound to the confidentiality requirements regarding juveniles — a fact noted in the previous version of the crime log document and acknowledged by DPS officials.

When the problem was brought to her attention, Vice President for Public Safety Maureen Rush said, “We will look into this situation.”

DPS did not comment on the rationale behind providing less information in the updated format, nor did it specify whether it is a temporary or permanent solution. DPS issued a statement, attributed to Rush, in response to inquiries from the DP this week.

“When DPS began posting a PDF version of its daily crime log on the DPS website, we took measures to secure the identifying information for juvenile offenders; as per the Pennsylvania Juvenile Act,” the statement reads. “A technically savvy user intentionally took steps, through a concerted effort, to breach this confidential data. DPS, working with [Information Systems and Computing] Security, has taken immediate action to ensure that this data is secure.”

Although the identifying information was not immediately visible, it was vulnerable to discovery because it was searchable. In many cases, Penn’s crime log was the first result of a combined Google search for the names and addresses of the minors who were arrested.

Related: Leak prompts look into Penn’s computing and privacy policies

“Any employer could just Google [their] name and address,” said Riya Shah, an attorney at the Juvenile Law Center and also a Law School adjunct professor. She expressed concern that private criminal records databases would have archived the information, though the DP found no identifying information in a thorough search of public records databases and court records.

While it would be possible for people whose information was revealed to take legal action against the University, they would have to show a compelling, direct link between personal harm and the illegal disclosure in order to win.

“The best case — literally, legal case — scenario is if one of these kids is looking for … a job at McDonald’s, and McDonald’s does a search within 30 days and the name comes up. Of course they’re probably not going to get the job,” Levick said. However, she added, it would be hard to definitively prove a direct link in such a situation.

Absent someone suing Penn, there are no statutory sanctions for violating the confidentiality requirement in the Juvenile Act.

Regardless of legal consequences, Levick said, “there’s no question they are violating kids’ rights.”

The crime log — which includes all crimes reported on campus — is required by the Clery Act, a 1990 law mandating the disclosure of crime and security statistics by all colleges and universities that receive federal funding and have a police force or security department.

The information is gathered both from calls placed directly to the Penn Police, as well as daily updates with Philadelphia Police Department crime reports in the Penn Patrol Zone — which spans from 30th to 43rd streets and Baltimore Avenue to Market Street. The crime log includes the date and time the crime occurred and was reported, a brief description of the crime, its location and whether a suspect was arrested.

DPS previously reported suspects’ names, ages and addresses when the report resulted in an arrest. However, the University is not bound by Clery standards to report the names of suspects, said Mitch Yanak, the DPS official who oversees Clery compliance.

Penn’s online crime log includes the previous 30 days’ reports, and there is no online archive of previous copies of the crime log.

Reporting practices vary across Ivy League schools. Several schools have long-term archives of previous crime logs published on their websites — going back as far as August 2006, for Princeton University — but not all schools report the identities of suspects who were arrested. In addition, while Penn’s crime log provides the specific building where crimes occurred, other schools’ location reporting is much less precise.

Please note All comments are eligible for publication in The Daily Pennsylvanian.