FERPA and authorization/authentication

Read an Inside Higher Ed article today on proposed changes to FERPA and FERPA's impact upon information technology.

One point discussed is the definition of directory information, and explicitly excluding both SSN and the local ("proprietary") student identification number that universities typically assign from the directory information category. (For information on FERPA and directory information, see this document, bottom of the screen.) Here's a short excerpt:

Others worry that the regulations are unclear in cases where a “student ID” is the same as the “user ID” that students use to log in to university Web sites and online services. Partially, the distinction boils down to authentication as opposed to identification; the former ensures that the right person is certified to view private information, while the latter merely determines one’s identity for login purposes.

Using Washington State University as an example, I would see "user ID" as equivalent to Network ID, which is public information, retrievable through a public directory. The "student ID," on the other hand, is treated as nonpublic information.

There are some good discussion points below the article, including one that suggests the risks of treating "user ID" or "student ID" information as nonpublic information.