Security breaches on Whitman campus prompt changes in swipe system

Shelly Le

Disclaimer: The name of the student charged with these offenses was removed from this article on Oct. 22, 2020 and replaced with “Philip Forest.” The original charges were vacated from his record five years ago and he is no longer legally required to report them, so The Whitman Wire has chosen to honor the the time that has passed and the consequences he has already faced, while still maintaining a record of these events.

This article was co-authored by Patricia Vanderbilt.

On the Whitman campus, Whitman ID cards are both credit card and key. One swipe allows access to dorms and other campus buildings, authorizes purchases to a student account, charges meals or flex dollars from a Bon Appétit meal plan and checks out materials from the library.

In the aftermath of recent security breaches around campus and the arrest of senior Philip Forest on Thursday, Oct. 27, Chief Information Officer Dan Terrio sent an email to Whitman staff, faculty and students regarding the need for changes to the current swipe card system. At this time, Forest has not been formally charged with a crime.

“I have consulted with President Bridges and the senior leaders on campus about this matter,” Terrio said Wednesday, Nov. 2. “Together we decided that the prudent course of action for the College is to re-encode all faculty, staff and student ID cards.”

Re-encoding ID cards will take place from Monday, Nov. 7, to Sunday, Nov. 13, in the Cordiner Hall foyer.

The change comes after an investigation of a number of invalid or unusual swipes at points of entry throughout the campus over the past few weeks.

“We saw card swipes trying to gain entry into areas, whether it was invalid or valid, that didn’t make sense for that particular individual trying to gain access,” said Terrio.

Whitman College Technology Services and Campus Security are working together on the investigation.

“All of a sudden we realized that somebody . . .  had an ID card that they shouldn’t have had, and they were accessing facilities,” said Craig McKinnon, assistant director of security.

He said that swipes were attempted at six buildings from nine different entry points. One of the facilities in question was Reid Campus Center.

“There have been some unusual things that have happened in Reid,” said Associate Dean of Students Barbara Maxwell. “One morning, my custodian came in, and the door by the  Pioneer  office: that is an emergency exit only: someone had exited out of it and the alarm was ringing.”

The alarm, which requires a key to shut off, was triggered between midnight and 4 a.m. on Sunday, Oct. 2, when the custodian came to the second floor of Reid to clean. The building is closed between midnight and 8 a.m. on weekends.

“The other odd thing was he said that the lights were on in  the  Pioneer  office, as if somebody had been in there. And that’s really the odd, unexplained situation that led me to ask some questions,” Maxwell said.

When swipe records were checked, the most recent entry swipe to the  Pioneer  office was from a Whitman  staff member’s ID around 8:30 p.m. on Saturday, Oct. 1. According to Maxwell, the staff member had not accessed the  Pioneer  office and had not lost his ID.

Pioneer  Editor-in-Chief Patricia Vanderbilt  left the office around 8:20 p.m. that night.

“Whoever swiped in swiped in pretty quickly after she left, but then no one swiped in for the rest of the evening,” Maxwell said.

Maxwell noted that this incident could have simply been a student who went down the emergency exit stairs rather than the regular exit at the other end of the hallway.

“There’s multiple things that could have happened,” she said. “To this day, I really don’t have a good explanation.”

Each Whitman ID card has a magnetic stripe on its back, also known as a magstripe.  The information on the card is read by magnetic sensors such as the card swipes on the entrances to buildings and offices on campus.  Magnetic stripes are limited in the amount of information that they can hold.

Dean of Students Chuck Cleveland responded affirmatively when asked if the Whitman ID number was the only information that goes into the making of the card.

“You can gain access to some locations on campus if you have an ID number,” Cleveland said.

The magnetic sensors are able to read a variety of information from the ID number,  such as the cardholder’s access to buildings or the amount of flex dollars in the account.

According to Terrio, the current magnetic swipe system is 12-15 years old. It is set to be updated in the near future, before it reaches its “end of life” in November 2012 and is no longer supported by the vendor.

“We will be interested in replacing the system, probably this summer time frame,” Terrio said.

In the meantime, Terrio notes that certain aspects of  Whitman  security  should be reconsidered. A security consultant from outside of Whitman has been called in to provide advice on the security practices in place on campus.

“Through this process, I think that the college as a whole needs to have some conversation about access, access to facilities, who has access, when people have access,” Terrio said.