FBI investigates grade change hacking at Santa Clara
Instead of an internal probe, Santa Clara University asked the feds to find an intruder who boosted the grades of current and former students.
After a Santa Clara University undergraduate tweeted that he had unexpectedly been questioned by FBI agents, the school itself acknowledged that it has asked the feds to investigate how an intruder electronically altered a few dozen grades.
Mark Loiseau, 25, a senior electrical engineering student, received an unpleasant surprise this morning: three FBI agents showed up at his off-campus apartment wanting to have a friendly chat with him.
FBI agent Jeffrey Miller and his colleagues had complete dossiers on him and his friends, Loiseau told CNET this afternoon. "They had all my grades. They had pictures of me."
It started out as a friendly conversation, Loiseau said, but then the FBI agents began to suggest that he was involved in illegally changing his or someone else's grades. After receiving a denial, the trio of agents said that lying to a federal agent was a crime and that they wanted to search his computers.
Miller showed up at the apartment equipped with printouts of data from Google and Verizon--presumably extracted with a subpoena or similar legal process. "They asked, 'Why did you delete all of your Google Voice history? You placed calls around the time of the intrusions on your Google Voice number,'" Loiseau said. "They had tons of pages of Verizon records."
After Loiseau, whose resume includes work on developing solar cells using organic semiconductors, posted a note on Twitter today, CNET contacted Santa Clara University. (Santa Clara is a Jesuit school founded in 1851 that's located in the heart of Silicon Valley.)
The school responded a few hours later with a statement from university President Michael Engh, who said an electronic intrusion affected the grades of a "handful" of current undergraduate students and about 60 former ones. The intrusion took place between June 2010 and July 2011, and the grades were all adjusted upward, he said.
Dennis Jacobs, Santa Clara's provost, told CNET that in early August, a student notified the university that one grade on her transcript was different than she had remembered. "When our registrar's office looked deeper into her grade change, they could find no reason for the grade change," he said. "It was an anomaly."
The university contacted local police and then the FBI's cybercrime unit, Jacobs said.
Santa Clara's decision may have increased the odds of locating the person behind the intrusions will be caught, but it also raised the stakes. Computer hacking is treated as a serious federal felony that includes the possibility of years in prison, especially if multiple intrusions occurred.
That means instead of treating the investigation as an internal affair, the university chose to expose a member of its community to the full force of an ungentle U.S. criminal justice system.
"Is this the sort of thing that ought to be dealt with inside the university instead of calling in the FBI?" asks Marcia Hofmann, a senior staff attorney at the Electronic Frontier Foundation in San Francisco. "I think I would have ordered an internal investigation to try to understand exactly what happened and then I would have considered my options from there."
Hofmann adds: "It may not be a good idea to penalize a young person so severely under those laws that it's going to derail that person's life."
Meanwhile, Loiseau, the undergraduate student, is looking for an attorney to represent him if the FBI comes calling again. At least, he says, he didn't give the agents permission to search his computer without a warrant. Not all of the music and video files on it, he acknowledges, may enjoy a provenance that's above reproach.
He recalls saying, "Actually, I feel like we should hold off on this. I don't want this searched until I can talk to a lawyer first."
Update 8:30 a.m. Tuesday: A spokeswoman for Santa Clara University called us this morning to say that the school's public statement "was prepared well in advance" and wasn't necessarily linked to Mark Loiseau's Twitter post. She didn't elaborate, however, on what exactly prompted the university to acknowledge the hacking late in the afternoon.