This month we begin a deeper dive into each specific category from 2020 with a focus on Information Technology. IT risks are vitally important to manage and that became even more evident as we moved to a largely remote world during 2020. Ensuring only authorized individuals are accessing our systems and data is crucial.

The top 3 types of stories in the IT category were:

1. Data Breaches
2. Cyberattacks
3. Privacy Issues

Information Technology is an important risk that will not go away for institutions regardless of the model we are operating under, but it is not the only issue in our industry. We invite you to review the stories across higher education from the prior month with a view toward proactively managing them and avoiding the headlines. As always, we welcome your comments and suggestions.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy
Follow us on Twitter

Information Security & Technology Events

Feb 18: Cyberattack: Computers on Lakehead University's campus remain unavailable for use as the institution continues to deal with a cyber attack. Lakehead announced the cyber attack Tuesday afternoon, saying at the time all computers on both the Thunder Bay and Orillia campuses were being shut down. In an update provided on Thursday morning, Lakehead said the attack was directed at its file share servers, and Technology Services Centre staff removed all access to those services as soon as they became aware of the attack. Staff are working to determine exactly which servers, and data, were affected by the attack. In the meantime, all information stored on the file servers will be inaccessible, and all campus computers unavailable for use. (link)

Feb 18: Data Breach: Multiple UAH email accounts were compromised through a phishing attempt in January, that's confirmed by the UAH Office of Information Technology. Some emails impacted did contain personal information such as name, date of birth, or social security number. However, school officials say there was no server or directory impacted and no credit card or banking information was included. On February 17, (link)

Feb 18: Ransomware Attack: The ransomware attack and subsequent technology disruption at Central Piedmont Community College continued into a second week of canceled online classes and offline email and phone systems. According to CPCC, the FBI and other state agencies are investigating the attack which was first detected last Wednesday. Based on an "exhaustive" investigation, there is no indication that any employee or student information was leaked, the school said. Online classes are canceled through Wednesday, Feb. 17, but some classes will continue to meet in person, according to CPCC. (link)

Feb 15: Privacy: The message, tucked in a routine fall-planning email to Oakland University students, took Tyler Dixon by surprise. Along with wearing masks and social distancing, students living on campus would be expected to wear a coin-size "BioButton" attached to their chests with medical adhesive. It would continuously measure their temperature, respiratory rate, and heart rate, and tell them whether they'd been in close contact with a button wearer who'd tested positive for Covid-19. In conjunction with a series of daily screening questions, the button would let them know if they were cleared for class. (link)

Feb 10: Ransomware Attack: A ransomware incident at Midland University caused a temporary disruption to the school's web systems this month. University officials say the disruption was "minimal" and that all systems are now up and running at full strength. As for what the ransomware perpetrators were after, that remains unclear according to Nelson. "We do not know what they got," Nelson said. "They did not provide that information. We know it was international." As for any potential leak of personal information, Nelson said that there has been no indication of that yet. (link)

Feb 10: Data Breach: The names and social security numbers of several Syracuse University students have been exposed after someone gained unauthorized access to an employee's email account.Last week, the university sent letters to affected students, alerting them that the university had investigated a data security breach involving some of their personal information. The unauthorized party accessed the employee's email account between Sept. 24. and 28. (link)

Feb 09: Zoombombing: As the COVID-19 virus spread worldwide in early 2020, much of our lives went virtual, including meetings, classes and social gatherings. The videoconferencing app Zoom became an online home for many of these activities, but the migration also led to incidents of zoombombing -- disruptors joining online meetings to share racist or obscene content and cause chaos. Similar apps such as Google Meet and Skype also saw problems. Cybersecurity experts expressed concerns about the apps' ability to thwart hackers. A study, however, shows that most zoombombing incidents are "inside jobs." (link)

Feb 01: Online Proctoring: The University of Illinois Urbana-Champaign announced that it will discontinue its use of remote-proctoring software Proctorio after its summer 2021 term. The decision follows almost a year of outcry over the service, both on UIUC's campus and around the US, citing concerns with privacy, discrimination, and accessibility. Proctorio is one of the most prominent software platforms that colleges and universities use to watch for cheating on remote tests. Though Proctorio and similar services have been around for years, their use exploded in early 2020 when COVID-19 drove schools around the US to move a bulk of their instruction online. So, too, has scrutiny towards their practices. Students and instructors at universities around the country have spoken out against the widespread use of the software, claiming that it causes unnecessary anxiety, violates privacy, and has the potential to discriminate against marginalized students.. (link)

Fraud & Ethics Related Events

Feb 22: Occupational Fraud: Carol Bates, the former comptroller for Bossier Parish Community College (BPCC), was sentenced today for conspiracy to commit wire fraud, announced Acting United States Attorney Alexander C. Van Hook. Chief U.S. District Judge S. Maurice Hicks, Jr. sentenced Bates, 50, of Shreveport, Louisiana, to 60 months (5 years) in prison, followed by 3 years of supervised release. Bates was also ordered to pay restitution in the amount of $286,987.08. Bates pleaded guilty on July 20, 2020 and at the hearing admitted that from 2013 to 2016, she used her position as comptroller of BPCC to access an internal BPCC computer database and make entries falsely showing individuals were due refunds by the school. These individuals were not qualified to receive the funds, and, in most cases, they were not even attending BPCC during the semesters they received the money. (link)

Feb 19: Visa Fraud: A Chinese researcher visiting Stanford University who was charged with visa fraud after she allegedly hid her military background is facing new charges, federal prosecutors said. A federal grand jury charged Chen Song, 39, with obstruction of justice, destruction of documents and making false statements to a government agency, the U.S. Attorney's Office said Thursday. (link)

Feb 15: Ethics: Records raise questions about Cleveland State University President Harlan Sands' public assertion that the university gave a $140,000-a-year human resources job to a late-applying candidate with a criminal record because all 37 other applicants lacked the "right skills and experience." Applicant evaluations reviewed by cleveland.com and The Plain Dealer show that the university ranked five other applicants as "most qualified," the same designation given to the school's eventual choice for the job of associate vice president of human resources, Douglas Dykes. (link)

Feb 15: Occupational Fraud: In late December, California State University, Chico announced four of its employees were placed on leave following a fraud investigation that found more than $1-million of misappropriated spending of university money. Documents obtained by KRCR reveal more of what the university says happened. The school's report says employees misled leaders of the department to spend university funds on personal items and to get paid for work they either weren't doing or weren't qualified for. (link)

Feb 09: Ethics: The San Mateo Community College Board has rescinded its $1.6 million contract with its chancellor emeritus, Ron Galatolo, saying that he engaged in secret unethical activities during his 20-year tenure as chancellor of the three-college district. According to the board, Galatolo received gifts of "high-end travel, concert tickets and meals" that he never reported in his Form 700 papers, legal public disclosures that high-ranking public officials must file with their employer to reveal any conflicts of interest. The board also cited "the apparent use of public funds for retirement incentives" and "undisclosed personal relationships with vendors" to the college district. (link)

Feb 03: Grant Fraud: A former University of Florida (UF) professor and researcher and resident of China has been indicted for fraudulently obtaining $1.75 million in federal grant money from the National Institutes of Health (NIH) by concealing support he received from the Chinese government and a company that he founded in China to profit from that research. Lin Yang, 43, who resided in Tampa, Florida, at the time of the offenses, is charged with six counts of wire fraud and four counts of making false statements to an agency of the United States. (link)

Compliance/Regulatory & Legal Events

Feb 24: Harassment Settlement: Former LSU head football coach Les Miles reached a settlement with a former student who accused him of harassment several years ago, and the settlement has surfaced as investigators probe the university's handling of sexual misconduct and domestic violence complaints, multiple sources with direct knowledge of the situation have confirmed to The Advocate | The Times-Picayune. The episode goes back about a decade, when a former LSU Athletic Department student intern accused Miles of "hitting on her," three of the sources said. (link)

Feb 24: NIL Legislation: College football players could enter the NFL draft and return to their university under the latest congressional bill. The Amateur Athletes Protection and Compensation Act of 2021 is scheduled to be introduced this week in the U.S. Senate by Senator Jerry Moran (R-Kan.). Sports Illustrated obtained a copy of the legislation. The act is the sixth congressional bill governing athlete compensation announced or introduced over the last calendar year in Washington, but is just the second to be introduced in the new Congress. (link)

Feb 23: Title IX Lawsuit: Former Wisconsin and current Detroit Lions wide receiver Quintez Cephus said in a lawsuit filed Tuesday against the university that he was used as a scapegoat during a sexual-assault investigation that resulted in his temporary expulsion. Cephus seeks unspecified damages in his lawsuit filed in federal court in Madison, accusing the defendants of violating his due process rights, violating Title IX provisions and breach of contract. (link)

Feb 22: Personal Injury Settlement: A former Cal State San Bernardino student who suffered heatstroke during a class run that left her severely brain damaged and immobile has settled her lawsuit against the university system for $39.5 million, her attorneys announced Monday, Feb. 22. The settlement is believed to be the largest ever for an injury case involving the California State University system, attorneys for Marissa Freeman said in a news release. Freeman, now 24, was running outdoors, in 95-degree heat, during a kinesiology class on Sept. 26, 2018, when she suffered debilitating heatstroke that landed her in the hospital for months. (link)

Feb 22: Confidentiality Breach: Virginia Tech found itself in hot water last Sunday after lawyers for former cadets in the university's ROTC program alleged that the university press statement about their case was a violation of confidentiality provisions in the settlement. In response, lawyers for the cadets fully disclosed settlement details. On Friday, university spokesman Mark Owczarski told The Roanoke Times that Virginia Tech is "pleased with the outcome." (link)

Feb 19: Discrimination: A professor at Oxnard College has been put on administrative leave after a video surfaced on social media that shows him berating a hard of hearing student during an online class. In the video taken by a classmate, the professor, identified as Michael Abram, appears audibly frustrated and tries to get the student's attention by calling her name, to which she responded: "I can hear you a little bit." (link)

Feb 15: Negligence Lawsuit: Two former University of Pittsburgh football players filed separate federal lawsuits against the university and the NCAA, as well as the Big East and Atlantic Coast conferences, alleging the organizations were aware of the potential health ramifications caused by concussions and repeated blows to the head but never took action to protect players. The lawsuits seek class-action status for any student-athlete who played varsity football from 1952 through the present who "suffered concussive and sub-concussive head injuries while participating in football games and practices at Pitt." They include claims for negligence, fraudulent concealment, breach of contract and unjust enrichment. (link)

Feb 12: Medical Malpractice Lawsuit: Michael Lonsway has a family history of a deadly form of skin cancer called melanoma, so he and his wife, Susan, went to the University of Michigan Health System in 1999 to have their two young daughters genetically tested. They were told the tests, performed at Yale University, showed that one daughter, Cameryn, who was 3 at the time, had a genetic mutation that put her at 60% to 80% higher risk for melanoma, and the other, Delaney, who was 5, did not. The Lonsways took "stringent protective measures" to keep Cameryn out of the sun and otherwise protected. Then, in 2016, Delaney developed skin cancer. (link)

Feb 11: Arrest: As of Thursday afternoon, Michigan State University Police Department Capt. Valerie O'Brien has been arrested and is being held at Ingham County Jail. No charges were listed in the online jail records and no hearing has been scheduled according to online court records. As a detective, O'Brien was involved in a 2014 Title IX investigation into Larry Nassar's sexual abuse. The investigation cleared him of survivor Amanda Thomashow's report that he sexually assaulted her. (link)

Feb 08: Discrimination Lawsuit: Centenary University abruptly fired four tenured professors, including the president and vice president of its faculty union, in an "outrageous" decision explained purely as a cost-saving maneuver, according to attorneys representing the professors. The former professors, including one who had served as the private university's provost, filed a lawsuit Monday claiming Centenary violated the terms of their tenure status when it terminated them in December 2019. The suit also claims the firings at the Hackettstown campus were discriminatory. Two of the professors are older than 60 and one is transgender. (link)

Feb 08: Child Pornography: Colorado State University (CSU) says that a professor previously placed on leave due to an allegation involving sexually explicit photos has been arrested by Fort Collins Police Services (FCPS). CSU said a school employee reported in October 2020 that he believed he saw sexually explicit images of children on the computer of Boris Kondratieff, an entomology professor. The school said it immediately informed the Colorado State University Police Department (CSUPD), which opened a criminal investigation. The school also said Kondratieff was placed on leave, which prohibited him from interacting with CSU students, engaging in CSU outreach activities and being on CSU grounds. (link)

Feb 08: Wrongful Death Lawsuit: More than three years ago, Najee Ali Baker, a Winston-Salem State University student, was shot to death on Wake Forest University's campus. Now, a lawsuit filed over his death is headed to trial. According to court papers filed in U.S. District Court on Jan. 27, a trial has been tentatively scheduled to start on Oct. 4. It's not clear whether the trial will be held in Winston-Salem or Greensboro. Baker, a WSSU football player from New York, was shot to death on Jan. 20, 2018. He had been leaving a party that was held at The Barn on Wake Forest University's campus. Two men -- Jakier Shanique Austin and Malik Patience Smith -- would later be charged in his death. (link)

Feb 02: FOIA Lawsuit: The University of Michigan is being sued by the American Council of Trustees and Alumni over alleged violations of the Freedom of Information Act. In December, ACTA filed a complaint in the Michigan Court of Claims on behalf of Lance J. Johnson, a UM Law School graduate who made a gift to the school in 2007. Johnson previously said the gift was for an annual legal seminar to study the feasibility of appointing independent legal counsel for children involved in custody disputes. But Johnson claims the law school only "sporadically" had the workshop. (link)

Feb 01: Title IX Lawsuit: When Hayden Richardson transferred to Northwestern University for her sophomore year, she hoped that joining the cheerleading team would provide a sense of community and excitement at an unfamiliar school. But early in her first season, the "dark side" of the program emerged, according to a federal lawsuit Richardson filed Friday against Northwestern. In the 58-page complaint, Richardson details repeated instances where she said she was groped by drunken fans and alumni during university-sanctioned events, alleging the cheer team's head coach required female members to "mingle" with powerful donors for the school's financial gain. (link)

Feb 01: COVID-19 Lawsuits: There is a current wave of class action lawsuits against institutions of higher education. Over 150 class action suits have been filed. Students are seeking reimbursement of their tuition, room and board, and fees predominately asserting breach of contract, unjust enrichment, and conversion claims based on higher education institutions transitioning from in-person courses to online or remote-learning models and suspending on-campus service including student housing. On January 8, 2021, the U.S. District Court for the District of Maryland dismissed one such case, rejecting a student's four count complaint alleging breach of contract and unconstitutional taking in violation of the U.S. and Maryland Constitutions. (link)

Feb 01: NCAA Violations Cost: The University of Tennessee shelled out more than $100,000 in less than two months to investigate potential NCAA Level I and II violations that led to the firings of several coaches and staff, including former head coach Jeremy Pruitt. Termination letters for two assistant UT coaches reveal that the university and the NCAA are looking into possible player recruiting violations. UT provided billing statements it received in the past two months. So far, the law firm has billed UT $106,642 for its services. This only includes consulting work and expenses that occurred during the months of November and December. (link)

Feb 01: Criminal Sexual Conduct: Peter Chen, a computer science professor at the University of Michigan, was arraigned Wednesday on one count of Criminal Sexual Conduct in the First Degree. According to University spokesperson Rick Fitzgerald, Chen was immediately placed on administrative leave following his arraignment. Chen's Winter 2021 teaching duties have been re-assigned according to Fitzgerald. (link)

Feb 01: Free Speech Lawsuit: When University of North Texas music professor Timothy Jackson published an essay critical of a fellow music scholar's speech on "music theory's white racial frame," UNT graduate students and faculty demanded that Jackson face punishment for expressing those views, which they deemed "racist and unacceptable." Jackson has now filed a federal lawsuit against the university, a graduate student, and several faculty members. (link)

Campus Life & Safety Events

Feb 23: Anthem Protest: Tennessee Republicans are up in arms over a state college basketball team's decision to kneel last week during the playing of "The Star Spangled Banner," prompting legislators to warn the public university system not to allow student athletes to do so again. A firestorm of controversy has surrounded the action by players on the men's East Tennessee State University basketball team, who during a Feb. 16 game at the University of Tennessee at Chattanooga dropped to one knee on the court as the national anthem played. (link)

Feb 22: Free Speech: The newest federal guidance for colleges and universities investigating sexual misconduct emphasizes due process for both the accuser and accused. Among other requirements, institutions are legally obligated to presume the accused is innocent prior to starting any investigation. That's not what happened at Pacific University in Oregon, where one professor of education who made controversial comments about gender says he was told to quit or be found culpable in an investigation under Title IX of the Education Amendments of 1972, the federal law prohibiting gender-based discrimination. (link)

Feb 22: Racial Issues: UCLA runner Chris Weiland has been dismissed from the track and field and cross-country teams after a video recording and text message exchange showing him using racist, homophobic and sexist language surfaced on social media, sparking widespread outrage. The 4-and-a-half-minute video, posted on an Instagram account called "ucla_is_racist" and shot inside a darkened car, appears to show Weiland talking about his girlfriend cheating on him with another man before he asks her to leave. Weiland, who is white, goes on to use a racial slur in a cellphone call that can be heard in the video, verified as Weiland by multiple people close to the program. (link)

Feb 17: COVID Testing Policies: Late last month, Yidong "Ivor" Chen, a fourth year physics PhD student from China, faced a disciplinary committee made up of students, faculty and staff for testing non-compliance. Chen says he explained to the committee that he lives off-campus with his mother, who he says is high risk for complications from COVID-19. Chen says he works remotely. He says statements on the university website led him to believe that if he was living and working off-campus, that he didn't need to test every week. (Chen also says he applied for and received a testing exemption for the spring semester.) A representative for the Graduate Employees' Organization, the union that represents graduate workers, says it took the committee less than 10 minutes to come to their initial decision in Chen's case: dismissal for a full year, 80 hours of community service, two reflective essays, and a no trespass order barring Chen from setting foot on campus while he's dismissed. (link)

Feb 16: Racial Issues: At least three New Jersey universities have reported racist attacks during virtual Black History Month events. Rutgers University, Rider University and the New Jersey Institute of Technology told CNN they are investigating racist incidents in which individuals interrupted virtual Black History Month meetings with racist remarks and imagery. It is unclear whether the incidents at the three universities are connected. (link)

Feb 16: Free Speech: COVID-19's consequences for education have not been limited to location, access, or, in the University of California, Berkeley's case, temporary bans on outdoor exercise. On campuses across the country, speech and due process rights have been challenged, too, as administrators struggle to respond to the pandemic. At the Foundation for Individual Rights in Education (FIRE), we have been paying careful attention to how these trends have impacted vital student and faculty rights in higher education. In this report, COVID on Campus: The Pandemic's Impact on Student and Faculty Speech Rights, FIRE gives readers a clearer picture of what institutions have done wrong, how they can do better, and the broader challenges to education posed by the past year. (link)

Feb 14: Burglary: As a result of an investigation by Fayetteville State University Police, a suspect has been arrested after a student awoke to a man standing inside her bedroom around 4 a.m. Friday, officials said Sunday. The victim, who lives in University Place Apartments, says she heard a noise and woke up to find the man standing in her room staring at her. The man then fled the area. "Something told me to wake up obviously and when I woke up there was a man standing at the end of my bed watching me sleep," the victim said. The suspect had reportedly been seen walking in the area of multiple buildings and checking for unlocked doors in the University Place Apartments complex. (link)

Feb 12: Greek Life: Friday, Syracuse University suspended a Greek Life organization for its involvement with three "large" parties that occurred within the community in the last six days. In a news release, Syracuse University said 20 new COVID-19 cases can be linked to the parties. They warn that more cases are likely to follow. The university says the students who attended the parties "will be referred to the Office of Student Rights and Responsibilities for Stay Safe Pledge violations and will be charged." (link)

Feb 09: Protesters Arrests: Five people, students and former students, were detained outside the Marshall Student Center on charges of trespassing and served notices to appear after being told to disperse, according to the University Police Department. They were there for a rally calling attention to the climate for free speech on college campuses in Florida. Participants were protesting state legislation that proposes increased penalties for protesters who block traffic or participate in "disorderly assemblies." (link)

Feb 05: Free Speech: To Kimberly Diei, a pharmacy graduate student at the University of Tennessee, her posts on Twitter and Instagram were well within the bounds of propriety. She was just having fun. "Sex positive," she called them. But to the university, her social media messages were more than just a bit racy. After an anonymous source reported them for a second time, a disciplinary panel declared Ms. Diei's posts "vulgar," "crude" and not in keeping with the mores of her chosen profession. In September, it ordered her expelled. (link)

Feb 04: Free Speech Settlement: The University of Illinois has settled in a lawsuit brought by a free speech group claiming that the Urbana-Champaign campus was violating the First Amendment with rules surrounding political and other forms of speech. Fox News previously reported on the lawsuit, which was filed in 2019 and targeted three particular aspects of the university's practices: the bias response team (BART), restrictions on posting flyers for political candidates, and "no contact directives" (NCT) that effectively function as restraining orders. (link)

Feb 03: Sexual Assault Settlement: A judge ordered the Rhode Island School of Design to pay $2.5 million to a former student who was raped while abroad on a three-week school trip in Ireland in 2016. The ruling Tuesday found that the school had not provided students keys to lock their doors in the housing provided to them on the trip and that its negligence allowed the attack to happen, the Providence Journal reported. The student, who was earning a joint degree with Brown University at the time, attended a three-week art program in Ballyvaughan, where she and other students were staying in four-bedroom houses arranged by the university and were not given keys to lock their bedroom doors. (link)

Feb 03: Free Speech: eaders from all three of Iowa's public universities Tuesday apologized to lawmakers for "egregious" incidents on their campuses that suppressed First Amendment rights and quelled free speech -- largely affecting conservative students -- and committed to taking corrective action. "Since October, we've been reviewing what happened, how the process worked and didn't work, and we're working to implement steps that will prevent this from happening again," University of Iowa College of Dentistry Dean David Johnsen told the House Oversight Committee. (link)

Feb 02: Greek Life: Penn State has suspended the Alpha Chi Chapter of Sigma Chi fraternity through summer 2024 following "significant violations" of COVID-19-related policies, the university announced Monday. Sigma Chi entered interim suspension on October 2 after Penn State's Office of Student Conduct investigated allegations made against the fraternity relating to violations of the university's COVID-19 guidelines and State College's ordinance. (link)

Feb 01: Athletes' Safety: College football players sustained far more concussions during practices than they did in games, medical researchers reported on Monday, a finding certain to add to the yearslong debate about regulating training regimens across the sport. Much less clear is whether the college sports industry will nationalize safety reforms like those adopted by the N.F.L., which limits the number of full-contact practices per season, or some college conferences. But with the N.C.A.A. and its members facing urgent decisions on other fronts, including the coronavirus pandemic, far-reaching new rules may not be imminent. (link)

Feb 01: Free Speech: Suzanne Jones was "floored and shocked" when she was fired without warning from Collin College on Thursday. Beloved by colleagues and students, the education professor has worked there since 2001 and serves on the school's faculty council. But Jones said she was let go out of the blue for challenging the college's COVID-19 reopening plans; she'll leave at the end of the spring semester. (link)

Feb 01: COVID-19 Staff Changes: Staff at Georgetown University are railing against a program that asks them to temporarily take on health-related roles during the pandemic -- such as conducting wellness screenings, registering visitors to campus or security -- or go on unpaid leave. It comes as the school has designed a spring semester that will include about 200 hybrid courses, increased access to campus facilities and brought twice as many residential students to campus than in the fall. In preparation, the university revamped a program that places employees into temporary public-health-oriented jobs. (link)

If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site.

Back to top

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Office of Audit, Compliance & Privacy is listed as the source.