NSIT: Computing, Networks & Phones

Quick Links:

• About NSIT
• Announcements
• Contact Us
• Documentation
• IT Policies
• Rates

Search NSIT:

Home > Services > Safe Computing > Good Password Practices > Password Escrow

Safe Computing

Password Escrow Service

Occasionally, some groups may wish to securely store passwords with a third party to prevent the loss of passwords through any number of factors. The University of Chicago Network Security Center (NSC) offers a free password escrow service for this purpose.

No packet will ever be opened by a member of the NSC, and your passwords never be seen by a member of the NSC. You will deliver us a sealed envelope, and we will return that sealed envelope when you ask for it back.

What we do for you:

• We will take an escrow packet from you.
• We will store this packet in a 650kg fire safe until you (or a registered designate) ask for it back.

How the process works:

Giving us your passwords:

To store your passwords, we need the following from you:

• A sealed envelope containing the passwords you wish to escrow with us. You may wish to put a signature across the seal, but it is not required.
• A list of people who will have the authority to retrieve these passwords. This list will be filled out by hand on a form provided by the NSC when you escrow the passwords.
• A list of people who will be notified when the seal on your envelope is broken. This list will be filled out by hand on a form provided by the NSC when you escrow the passwords.

The NSC will then take these three items, seal them in an envelope, issue you a receipt, and store them in our safe. Every six months, we will send you an email to remind you that we have a copy of your passwords. You will be expected to reply to this email so that the NSC knows that you have not abandoned your escrow packet.

At any time, we will be happy to provide you with the names of the (very small number of) NSC staff members who have access to the safe. Additionally, at any time you may make an appointment to view your envelope to ensure that it has not been tampered with.

Retrieving your passwords:

When you wish to retrieve your passwords from the safe, you must contact us to set up an appointment, giving the NSC at least 24 hours notice — although in extraordinary circumstances this requirement may be waived.

When you arrive at our office, we will check your identity by asking to see your University ID. We will then verify that you are authorized to retrieve the packet you are asking for. Once you have retrieved the packet, we will send e-mail notifications to the people listed on the contact form. If you wish, you may then re-seal the envelope and re-escrow the passwords with us. If you wish to destroy the passwords, we will provide you with access to a cross-cut paper shredder.

Retrieving passwords when no authorized person can be located:

Only a Senior Director (if an NSIT department) or a divisional Director of Computing (if a non-NSIT department) may retrieve passwords from the safe if no authorized person can be located. He or She must retrieve the passwords (or submit a new list of authorized retrievers) in person.

Abandoned escrow packet:

If the NSC has sent you three emails or more asking you to confirm that you wish to continue using our escrow service and has received no reply, your escrow packet will be considered abandoned. If the packet is abandoned, the NSC will open it, email the contact list, and cross-cut shred your unopened envelope.

Additional notes:

In the extremely unlikely event that we are forced by subpoena to turn over your passwords to a law enforcement agency or the University's General Counsel, it is possible that we would be forbidden to disclose that information to you. This should in no way undermine your confidence that your passwords will be kept in the absolute strictest of confidence.