FBI, Princeton to investigate breach of Yale admissions Web site

Todd Weiss   Today’s Top Stories    or  Other Security Stories  

Why SaaS is Vital to Email and Web Security Avoiding the Latest Phishing Attacks Safeguarding Critical Data Customer Satisfaction with Email Archiving Systems Intercept Spam & Viruses Discover the Secret to Secure Remote Access: GoToMyPC Corporate Security White Paper Sign up to receive Security Resource Alerts

July 26, 2002 (Computerworld) -- The FBI and Princeton University have opened investigations involving a Princeton admission official who improperly logged into a Web site for students applying to rival Yale University.
In a statement today, Princeton officials acknowledged the incident, which occurred in April, when at least one admissions department worker "used the Social Security numbers of a number of Princeton applicants to access a secure Web site by which Yale informed its applicants of its admission decisions."
Princeton officials said they notified Yale officials of the incident at a May meeting of Ivy League admission officers. Yesterday, according to Princeton, Yale reported the incident to federal and state law enforcement officials.
Lisa Bull, spokeswoman for the FBI field office in New Haven, Conn., confirmed that the office has opened an investigation but refused further comment.
A spokesman for Yale in New Haven couldn't be reached for comment. Officials at Princeton, N.J.-based Princeton University said they wouldn't comment beyond their written statement.
The Princeton official has been identified as Stephen LeMenager, an associate dean of admissions, who acknowledged that he improperly accessed the Yale Web site, according to Marilyn Marks, a school spokeswoman. LeMenager, who began at Princeton as an admissions officer in 1983 and is second in command at the admissions office, couldn't be reached by telephone today. He was placed on administrative leave while the investigations continue.
Security and privacy experts said the incident provides lessons for both sides, as well as for all Web users. Most important, they said, was that both universities apparently should share the blame for this incident.
Eric Hemmendinger, an analyst at Boston-based Aberdeen Group Inc., said Yale was foolish for using easily obtained name and Social Security information to allow access to its admission status Web site. "This wasn't a question of if someone was going to do this, but when," Hemmendinger said. "It's not appropriate, but it was foreseeable."
The Rev. William Grogan, an ethicist and attorney at Loyola University in Chicago, said the combination of lax security by Yale and the "predatory ethics" at Princeton led to the incident. Many universities have unfortunately adopted the business maxim of "do whatever it takes to reach your goal," he said, even if it harms others. "That appears to be adopted in this academic culture," Grogan said.
Marc Rotenberg, executive director at the Washington-based Electronic Privacy Information Center, a privacy advocacy group, said the incident provides a stark reminder to always look at the potential downside of personal information that is posted online. "What the Princeton official did was probably wrong" and could even be illegal, Rotenberg said. "The Yale mistake was putting sensitive information online with weak access controls."
Jose Granado, a security specialist at New York-based accounting firm Ernst & Young LLP, said more accountability is needed before personal data is posted on the Internet. "These kinds of things are going to continue to happen in the future because of the amount of information online these days," said Granado, director of Ernst & Young's advanced security center in Houston.
Princeton hired Newark, N.J., attorney William Maderer to conduct an independent investigation. The university said that it "deeply regrets the improper acts that have taken place" and that it has pledged to cooperate with authorities investigating the incident. Computers and other equipment will be scoured as investigators work to determine who was involved and why the activity was undertaken.
The Web site activity by Princeton admission staff members was first reported yesterday by the Yale Daily News, Yale's undergraduate campus newspaper.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"A couple of weeks ago at..." Read more... "Most security companies tend to take a horizontal approach looking to capitalize on the finance, service provider, and federal government..." Read more... Read more Security posts or See all Blogs

Elgan: You can be Batman, too Study: IT jobs will drop in 2009 RIM fixes critical BlackBerry Enterprise Server bug More top stories...

Apple's recall demand would probably kill Psystar, says IP attorney DNS flaw discoverer says more permanent fixes will be needed AT&T muffs free iPhone Wi-Fi offer again

11 cool new apps for the iPhone With the opening of Apple's App Store, the iPhone takes a revolutionary leap from cool mobile phone to hot mobile platform. See our list of apps you should definitely check out for yourself. Google is doing WHAT? Its motto is "Don't be evil" — but it looks like anything and everything else imaginable is pretty much fair game — not to mention some wildly rumored projects that we asked the company to confirm or deny. The new face of R&D: What's cooking at IBM, HP and Microsoft The talk at three big research houses is all about "open innovation." Is that a feel-good catchphrase or the R&D strategy of the future? Review: The iPhone 3G was worth the wait After months of waiting for a 3G-based iPhone — and hours waiting in line to actually buy one — Ryan Faas says it "packs quite a punch, both in its design and in the 3G and GPS capabilities" it offers. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this webcast, free, compilments of Webroot Software Go to the webcast  Computerworld Executive Bulletin: Building a Robust Antivirus Defense Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing  Eliminate SPAM, Gain Productivity Get this white paper now! (Source: MessageLabs) Learn all about the dangers and the costs of spam in all its forms - from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses - and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. New Fujitsu High-End Itanium Windows- and Linux-Based PRIMEQUEST Servers Offer the Utmost in High Availability New Fujitsu High-End Itanium-Based PRIMEQUEST Servers Offer Industry-Leading System Management for Linux and Windows Web Security SaaS: The Next Generation of Web Security View more whitepapers

• Elgan: You can be Batman, too
• Study: IT jobs will drop in 2009
• RIM fixes critical BlackBerry Enterprise Server bug
• More top stories 

Security Management Zone Security management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones

Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day. New baits

"Security Directions" virtual trade show 2008's Code-Red Security Issues for Protecting the Enterprise Webcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter

In Security Stripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Our columnist describes how asserting the importance of information governance is crucial to making that asset tangible, addressable and protected. Click here to read the latest column by Jon Espenschied