Toward the end of my senior year of college, the Dean of the College solicited nominations for senior orator. This year was different than years past because t

Toward the end of my senior year of college, the Dean of the College solicited nominations for senior orator. This year was different than years past because the school's computer systems had recently been integrated with one another in a $26 million boondoggle (a story for another time). The office sent out a link to a webapp where each student could submit two nominations. The webapp was a form containing the first and last names of each student and (dramatic pause) it was keyed on student id. I phoned up a friend and confirmed his id number. [Is disseminating a list of the student body a FERPA violation?] The wheels in my head started turning a bit. The university obliges each student to carry health insurance. If you can't prove you have insurance, you have to eat the school's program. Opt-out was done through a web form where you entered your name, DOB, and student id number. I went back to that form, plugged in my info and BAM, it presented me with the old opt-out page pre-populated with all of the health insurance information I had previously submitted. With the aforementioned friend's permission, we verified that it worked on his account too. Ugh. I walked to the IT Helpdesk and informed them of the problem and the page was promptly killed. It took them 21 days to fix.