Case in Point:
Lessons for the proactive manager

This month we continue our review of the 2017 events that were linked in Case in Point: Lessons for the Proactive Manager. This month's evaluation focuses on the category we call Compliance/Regulatory & Legal Events --- our largest category by volume over the past few years. The regulatory burden does not appear to be lessening despite some speculation and discussions about ways this burden could be reduced.

Annually, the Compliance/Regulatory & Legal Events category is the most difficult to evaluate due to the diverse ways an institution can find themselves in legal conflict. There were seven general topics that appeared more than others. However, it is important to realize this list in no way encapsulates the legal and compliance risks that are out there for our industry today.

The Top 7 2017 Most Frequent Compliance/Regulatory & Legal Events:

1. Title IX
2. NCAA
3. Speech Related Litigation
4. Employment Law Litigation
5. Hazing Litigation/Charges
6. Discrimination
7. Open Records Litigation

One emerging regulatory item that is not on the list but that institutions should be aware of are the new General Data Protection Standards (GDPR). These are European privacy related regulations that will impact US institutions in a variety of ways. For a brief overview of this regulation see this linked story from EAB. We plan to devote a future issue to GDPR and other privacy related concerns. With the recent Facebook-Cambridge Analytica controversy, institutions will almost certainly devote even more attention to privacy related issues in the coming year.

We again invite you to review the events occurring throughout higher education with a view towards proactive risk management. If you see areas of concern or risks you have influence over, take action before you become the crisis.

As always, we invite your comments and suggestions.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy

Information Security & Technology Events

Apr 17, 2018: Former Iowa wrestler Trevor Graves appeared in federal court in Davenport on Monday and pleaded guilty to transmission of a command to damage a protected computer. Graves was arrested in Denver in October 2017 and appeared in an Iowa court the next month. Graves obtained professors' usernames and passwords via a key logger and used the information to change grades for him and five other students. The charge means Graves faces up to 10 years in prison. (link)

Apr 04, 2018: After months of legal wrangling, Edmonton's MacEwan University has recovered nearly all of the $11.8 million lost to an online phishing scam. The university said it was able to recover $10.92 million before concluding legal proceedings. The university was defrauded last summer when staff failed to verify as legitimate emails requesting a change in banking information for one of its vendors. Three payments were made to a fraudulent account: one on Aug. 10 for $1.9 million; another on Aug. 17 for $22,000 and a third on Aug. 19 for $9.9 million. MacEwan University discovered the fraud after the legitimate vendor, a construction company, called to ask why it hadn't been paid. (link)

Apr 04, 2018: On March 28th, Alabama Governor Kay Ivey (R) signed into law the Alabama Data Breach Notification Act, Act No. 2018-396, making Alabama the final state to enact a data breach notification law. South Dakota Governor Dennis Daugaard signed into a law a similar statute one-week prior. The Alabama law will take effect May 1, 2018. Being the last state to enact a breach notification law, Alabama had the benefit of examining the approach in just about all of the other states and apparently drew provisions from many other state laws, including relatively detailed requirements for covered entities (as defined within the statute) and their third-party service providers to maintain reasonable requirements to protect "sensitive personally identifying information." (link)

Fraud & Ethics Related Events

Apr 26, 2018: A Lexington man accused of selling more than $500,000 in computer equipment stolen from the University of Kentucky has pleaded guilty in federal court. Toquoto Richardson, who worked as a data center operations engineer at UK, received more than $124,000 from 45 sales over a six-year period beginning in 2010, according to a plea agreement filed Wednesday in U.S. District Court in Lexington. But an internal audit revealed Richardson had sold more than $500,000 in computer equipment for personal gain over 10 years, UK said Thursday. The audit determined that the equipment came from the Information Technology department, the university said. (link)

Apr 25, 2018: A Louisiana Tech University employee faces a felony theft charge after campus police were notified about missing money. Tracey Hoyle, 45, an administrative coordinator, was charged with theft of more than $5,000. According to a news release, Tech Police were notified on April 19 that money was missing from a School of Communication account. For several years, Hoyle performed bookkeeping duties for the department, which included handling funds and receipts. The investigation found that approximately $15,000 was taken over the course of a year and a half. (link)

Apr 19, 2018: As WKTV reported officially last week, fraudulent salespeople have been using the name of Hamilton College to approach local businesses and scam them out of money.The College's Campus Safety department has been handling this particular scam for over a year. The use of trusted school names as a scamming strategy has affected many colleges across the country, and this particular incident marked one of many fraudulent cases involving Hamilton College's name. (link)

Apr 13, 2018: Two employees are accused of stealing from Coastal Alabama Community College in Bay Minette and Thomasville. We're talking thousands of dollars worth of property, including ice machines, toilets, even used gym flooring. Campus officials aren't saying much about the investigation but did confirm it to FOX10 News in the following statement: "Dr. Gary Branch, president of Coastal Alabama Community College, confirmed that two college employees have been arrested concerning the misappropriation of college property. One of the involved parties is no longer employed at the college. The matter continues to be under review and investigation and no further comment will be made at this time." (link)

Apr 09, 2018: A Franklin County man is facing charges after pawning property owned by Duke University, according to a Wake County arrest warrant. Troy Daniel Mortenson, 28, of Youngsville, is facing two counts of felony obtain property by false pretense after authorities say he pawned computers belong to Duke University at two Raleigh pawn shops. The warrant does not say how he obtained the computers or if he's an employee of the university. (link)

Apr 04, 2018: The president of a Christian college in Springdale has pleaded guilty in what prosecutors called a kickback scheme involving his school. Oren Paris III had faced a trial Monday with former state Sen. Jon Woods and consultant Randell Shelton. Instead, the president of Ecclesia College pleaded guilty Wednesday in federal court in Fayetteville. Prosecutors say Paris paid kickbacks to Woods and then-Rep. Micah Neal in return for $550,000 in state grants in 2013-14, using Shelton's consulting firm as a go-between. Neal pleaded guilty last year but has not been sentenced. (link)

Apr 02, 2018: A Gulfport resident is accused of embezzling $11,600 while she worked at Mississippi Gulf Coast Community College. Christina Lee Mullins, 34, is scheduled for trial in Aug. 6 on the felony charge. She worked for more than nine years at MGCCC, most of that time as a continuing education specialist, according to the school. A routine audit revealed inconsistencies that led to her arrest in November 2016, MGCCC said in a statement. (link)

Mar 30, 2018: The Ohio State University announced that Ching-Shih Chen is no longer an employee at Ohio State after learning he committed research misconduct. The federal Office of Research Integrity received allegations regarding the misconduct asserting an image of manipulations existed in a number of published articles. After further review, the university found that Chen committed research misconduct relating to figures in eight journal articles and planned to terminate his employment as a result. Chen admitted he intentionally falsified data and resigned in September. (link)

Compliance/Regulatory & Legal Events

Apr 10, 2018: A woman who attends Michigan State University filed a federal lawsuit against the school Monday alleging that three former men's basketball players sexually assaulted her at an off-campus apartment in 2015 and that she was discouraged from reporting what happened. The woman and players are not named in the suit, which was filed in U.S. District Court in Grand Rapids. It seeks compensatory and punitive damages. (link)

Apr 05, 2018: Brandeis University has fired its head men's basketball coach over complaints of discrimination and unprofessional behavior, according to a letter posted Thursday on the school's website. President Ronald D. Liebowitz said in the letter that last year several students filed "serious discrimination complaints" about the coach, alleging racially biased harassment, among other charges. Liebowitz did not identify the coach. But a spokeswoman for the Waltham school confirmed the coach was Brian Meehan, who was hired in 2003. (link)

Apr 03, 2018: University of Idaho has put Athletic Director Rob Spear on paid administrative leave for 60 days while it investigates failures in reporting sexual assault complaints in 2012 and 2013, the university announced Tuesday. Students have called for Spear's firing in the wake of a March 8 Idaho Statesman report that he failed to properly report sexual harassment complaints against a football player in April 2013. (link)

Apr 02, 2018: A former Ball State instructor of mathematical sciences was found guilty of four counts of child exploitation and four counts of possession of child pornography Monday. Brian Siebenaler was originally arrested in 2016 on 36 preliminary charges -- 22 counts of possession of child pornography and 14 counts of child exploitation -- after an investigation assisted by the Indiana State Police Cyber Crime Unit. University Police Department detectives were notified by Ball State's Information Technology Services that "suspicious activity" was observed on a university computer in an open classroom in the Robert Bell Building. (link)

Apr 02, 2018: A former Ole Miss student has filed a federal lawsuit against the university and the state College Board alleging he was a victim of gender discrimination from his long-term suspension for what he calls a false sexual misconduct allegation. The lawsuit, filed in federal court in Jackson, uses the pseudonym Andrew Doe for the expelled student. His lawsuit seeks a jury trial for damages as well as an injunction to prevent the university from including the discipline in his school records. (link)

Apr 02, 2018: The University of Iowa has been ordered to pay a Cedar Rapids contractor nearly $21.5 million following a yearslong legal battle over its work on the new Stead Family Children's Hospital and Hancher Auditorium. Documents made public this week show an arbitration panel issued the final award March 5 in Modern Piping Inc.'s favor, noting the contractor "incurred substantial expense in performing additional work for which Iowa was clearly responsible to pay." That cost far exceeded the project's original $270.8 million budget due in part to the UI's ill-advised choice for project delivery and contracting strategy, according to a 2015 internal audit reviewed by The Gazette. (link)

Mar 30, 2018: A former Iowa State University lecturer, who was arrested last year for public intoxication during a class he was teaching, has pleaded guilty to a reduced charge, court records show. Gordon Branch Knight, 56, was fined $200 plus court fees and ordered to obtain a substance abuse evaluation, records filed in mid-March show. In late November, Iowa State campus police were contacted by a university official who had received an anonymous report that Knight was slurring his speech during his class lecture, police have said. (link)

Campus Life & Safety Events

Apr 27, 2018: Authorities have made in arrest in the slaying of a Georgia college student who was shot on campus nearly three years ago. The Georgia Bureau of Investigation said in a news release that 23-year-old Justin Devon Stephens has been charged with murder in the death of Christopher Starks at Savannah State University. Starks was a 22-year-old student when he was shot inside the campus Student Union building on Aug. 27, 2015. The GBI has said Starks appeared to have been in an altercation before the shooting. No one else was injured. (link)

Apr 26, 2018: A Drake University professor has been allowed to resign effective June 1 after an internal investigation last fall found that he spanked female students and had them sit on his lap, the Des Moines Register has learned. Mahmoud Hamad, an associate professor in Drake's political science department, is currently on a leave of absence and "has no teaching or academic responsibilities" at the university, said Sue Mattison, Drake's provost. (link)

Apr 23, 2018: A Connecticut university is shutting down for the day in response to an illness that has sickened about 100 students. John Clark, the president of Western Connecticut State University in Danbury, says he consulted with state, local and university health officials before deciding to close the school for Monday. He says the decision was made "to protect our university community from infection and spread of the disease." (link)

Apr 23, 2018: Two Yale University students were robbed at gunpoint inside a dormitory building early Monday morning. The Director of the Office of Public Affairs and Communications, Tom Conroy, confirms to News 8 that at around 1:34 a.m., two undergraduate students encountered a man inside a room at the Timothy Dwight College. Officials say that the man then displayed a handgun and stole a computer, before fleeing the college. (link)

Apr 22, 2018: Syracuse University has filed disciplinary charges against 18 people after offensive videos from a fraternity event surfaced last week. Department of Public Safety Chief Bobby Maldonado announced campus investigators had filed the complaints in an email to the campus community. He said an investigation into the videos was continuing and others "may be implicated in the coming days." The 18 students were removed from campus "out of an abundance of caution and ongoing concern for our campus community," Maldonado said. He said alternative arrangements would be made for their classes. (link)

Apr 20, 2018: Penn State is disbanding three student clubs at the end of the semester because the university considers them too risky. Penn State Outing Club, Nittany Grotto Caving Club and Nittany Divers Scuba Club are "losing recognition due to an unacceptable amount of risk to student members that is associated with their activities," university spokeswoman Lisa Powers said in an email. (link)

Apr 18, 2018: All options are on the table in dealing with the Fresno State professor who called Barbara Bush "an amazing racist" shortly after the former first lady died, university president Joseph Castro said Wednesday. "A professor with tenure does not have blanket protection to say and do what they wish," he said. "We are all held accountable for our actions." Castro declined to comment specifically on how the university may handle Randa Jarrar's case, citing personnel matters. (link)

Apr 17, 2018: Cal Poly State University president Jeffery Armstrong announced Tuesday in an open letter to the campus community he is suspending all Greek life on campus, after learning of another recent incident of racially insensitive behavior at a fraternity. The news comes a little over a week after the highly-publicized incident of a student wearing blackface at a party hosted by the Cal Poly chapter of the Lambda Chi Alpha fraternity. (link)

Apr 16, 2018: A suspect is in custody after a freshman was fatally stabbed at Binghamton University. It was the second killing of a student there in five weeks, leaving the campus tense and grieving. The victim, Joao Souza, 19, was attacked in his dormitory suite around 10:30 p.m. on Sunday. Timothy Faughnan, the university's police chief, said at a news conference Monday morning that emergency responders had found Mr. Souza "seriously injured from what appeared to be stab wounds from a knife" and taken him to the hospital, where he was pronounced dead. (link)

Apr 11, 2018: A fraternity at California Polytechnic State University was sanctioned by its national organization on Tuesday after students dressed as gang members, including one in blackface, during the college's annual multicultural event over the weekend. On Monday, the college placed Lambda Chi Alpha on interim suspension while it investigated. On Tuesday, the national fraternity office said it had placed the chapter on "limited operations," sanctions that restrict it from participating in formal activities. (link)

Apr 09, 2018: A student at the University of the South is behind bars Monday, indicted by a grand jury after a fraternity house caught fire on campus. Investigators say 22-year-old Philip Roper of Richmond, Virginia intentionally set the fire. On Friday, the Franklin County grand jury indicted Roper, charging him with arson and burning personal property. (link)

Apr 07, 2018: A 22-year-old Lehigh University student from China is charged with ethnic intimidation and other offenses after racist graffiti was found in a residence hall Thursday night. Yukai Yang was in Northampton County Prison under $10,000 bail Saturday on charges that also include institutional vandalism and criminal mischief. (link)

Apr 06, 2018: Piano students at Utah State University endured a "pervasive culture" of sexism, a "disturbing" pattern of sexual violence and psychological abuse by faculty, an investigation has revealed. Four music instructors were accused of assaulting or harassing students, those who complained faced retaliation, and women received 41 cents for every dollar of scholarship funding given to men. And university officials failed to act for years, investigators concluded. (link)

Apr 06, 2018: A New Orleans 18-year-old was arrested Thursday after police say he robbed a man at gunpoint in a Southern University residence hall, according to Southern University Police. Tawane Williams, 18, is accused of holding a gun up to another man's head Thursday just after midnight, searching through the man's pockets and stealing his money, according to his arrest report. The victim told police that Williams was one of three men who held him at gunpoint to rob him in Jones Hall on Southern University's campus, the report says. (link)

Apr 04, 2018: The University of Maine System trustees unanimously approved a policy on political speech and impartiality, despite objections from students and faculty members who wanted more time to discuss a decision that some fear could restrict their free speech rights. The policy makes clear that the publicly funded system, to maintain its tax-exempt status, should remain impartial to partisan political activity. (link)

Apr 04, 2018: A University of Chicago police officer shot a student who charged at him with a metal pipe late Tuesday, school officials said. University police were responding to a robbery call when they encountered a young man -- later identified as a U of C student -- carrying a long metal pipe, the university's president and provost said in a joint statement. The student was bashing car and apartment windows, police said. When officers told the young man to drop the pipe, he refused and instead charged at one of the officers, officials said. That officer shot the student in his shoulder. (link)

Other News & Events

Apr 10, 2018: The Arizona Supreme Court on Monday ruled that young immigrants protected from deportation under an Obama-era program will no longer be eligible for in-state tuition at the state's public colleges. The court unanimously agreed with the Arizona Court of Appeals, which ruled that federal and state laws do not allow Maricopa Community Colleges to grant in-state tuition to Deferred Action for Childhood Arrivals recipients, also known as "dreamers." (link)

Apr 04, 2018: Broward College failed to give a valid reason why President David Armstrong will be paid his full $381,000 salary for a year after he steps down in June, the state's Auditor General determined. A new audit report recommends against paying him the full sum, which comes to $421,000 after benefits are added. But the college disagrees, saying the expense "will prove its worth over time." It's unclear whether the state Department of Education, which sometimes withholds funding to schools following Auditor General findings, will intervene. (link)

If you have any suggestions, questions or feedback, please e-mail me at robinmk@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site at https://www.auburn.edu/administration/oacp.

If you have any suggestions for items to include in future newsletters, please e-mail Robert Gottesman at gotterw@auburn.edu.

Back to top