The New ChicagoID: Better Than SSN
Much of the business of administration of the University is managing information about its people. Large central systems like Payroll, Gargoyle, and Griffin, their Divisional counterparts, and myriads of departmental shadow systems, exist to enable management of a variety of programs and administrative functions at all levels. The people these systems help to manage are almost always identified by their Social Security Number (SSN). Sometimes this is in addition to an internal identifier, but many circumstances still require a person to be identified either by means of something the person themselves will know, or in a manner that two different systems can agree on, and in most of these cases SSN has been used.
In this the University of Chicago is far from unique, and here and elsewhere this practice has led to "Personally Identifying Information" being overexposed and increasingly targeted by bad guys, now that they've learned to use PII to advance their nefarious enterprises. We have ethical and increasing regulatory, legal, and competitive obligations to remove that particular exposure from our list of serious issues.
And the SSN isn't even that great for identifying people. People are not assigned one by Uncle Sam if he can't count on taxing them at some point. So we make them up ourselves. Many of our systems operate independently in their recording (and manufacture) of people's SSNs, leading to situations in which one person, in the bag of protoplasm sense, is modeled in our systems by as many as three different digital ones. You can imagine this doesn't serve either the person or our administration very well.
A new identifier is now available, the ChicagoID, which is designed to be used to indicate who a record in any of our systems pertains to. It is 8 digits followed by a letter (e.g., 12345678A), so it can be stored everywhere an SSN can, but it is recognizably not an SSN. Everybody connected with the University is automatically assigned one: faculty, staff, students, hospital employees, lab school students beyond 6th grade, alumni; almost anyone for which there is any need to create a digital record. This is achieved by authoritatively housing the ChicagoID in the Master Constituency Database (MCDB), which is also the system of record for the CNetID. See the ChicagoID Generation Specification for further details on the identifier itself.
Infrastructure has been built to enable administrative processes to incorporate the ChicagoID. The MCDB provides an interface to access the ChicagoID and make translations among it and other identifiers housed there. A special client of this interface enables NSIT's Production Shop to be the front-end for incorporation of ChicagoIDs, CNetIDs, and other identifiers into batch processing. And a ChicagoID lookup application has replaced the old "who am I" in the CNet web site. This enables people to see their own ChicagoID and other information, and distributed administrators so authorized can look people up by ChicagoID or other identifiers (even by SSN, if extra-specially authorized).
The ChicagoID has been in production since late October 2006. The infrastructure depicted above is used to feed the ChicagoID and CNetID to the Payroll system in preparation for implementation of the new Time & Attendance System, and at some point the University's employee ID will be changed to be the ChicagoID. Before long, the ChicagoID will be on University ID cards and will figure in an increasing set of administrative processes. And the SSN Abatement Project will replace many current uses of SSN with ChicagoID, substantially meeting our obligation to protect the interests of those who come here to work and study.
For more information, or to initiate discussions about exactly how to incorporate the ChicagoID into specific systems and processes, please contact Tom Barton, tbarton@uchicago.edu, 4-1700, room 309 in the 1155 Building.
Last updated: 12/4/07