Online directory goes password protected, citing phishing risks

By James Cancelarich     3/11/25 10:17pm

The Rice online directory was changed to be only accessible through a password protected site March 10. The directory contains names and contact information for faculty, staff, alumni and students, with the exception of students who have requested to have their information removed.

In an email announcing the change sent by the Office of Information Technology and the Information Security Office, the changes are attributed to enhancing security and reducing phishing scams.

Marc Scarborough, the campus chief information security officer, said that the public display of emails and, in some cases, phone numbers, as well as department and major makes phishing scams easier.

---

---

“For example, an attacker could use the online directory to target a student studying in humanities, offering a part-time job purporting to be a faculty member in a related area in order to scam money from them,” Scarborough wrote in an email to the Thresher.

The emails of staff and faculty are still available on the People of Rice page.

“Some at Rice want or need their contact information to be visible to those outside of Rice for inquiries and collaboration, and sites like People of Rice allow for faculty and staff to have that information made available,” Scarborough wrote.

Non-Rice visitors can still access the “search” function of the directory, which runs a Google search of Rice websites for keywords or names. The specific information of students, under the “people” search, is password protected.

Scarborough said that the decision came from university leadership to address the risk of phishing, but did not disclose if the changes come from any specific incident. 

---