Case In Point: Lessons for the proactive manager

Volume 13 Number 04 | April 2021

Quotable .....

“Tomorrow hopes we have learned something from yesterday.”

-- John Wayne

This month our review of 2020 focuses on our largest category: Compliance/Regulatory & Legal events.

Several years ago, we noticed an uptick in this category and this trend has continued. You may have seen articles on the regulatory burden impacting higher education and what can be done to alleviate this costly burden on institutions. Occasionally, some legislative body will study the topic and make recommendations; however, we've yet to see this translate into an actual reduction of the requirements we face. Honestly, we see nothing on the horizon that would give any hope of a reduction in the near or far future.

When we break down the topics in this category, we see this as our top 5:

Title IX
Violence on Campus
NCAA Compliance
Academic Related Litigation
Foreign Influence

While we see no reduction in the regulatory burden ahead, we can point out three areas where we expect substantial changes. We don't anticipate these changes will do anything but add to the burden institutions face, and they will be important to follow in the months ahead.

First, we believe we will see more changes to Title IX interpretations and expectations. Second, we can confidently state that changes to NCAA compliance will occur when the Supreme Court rules in a case regarding NIL (name, image, and likeness). We discussed these in a prior issue of Case in Point. Lastly, we expect additional regulations and changes regarding foreign influence. We suggest you begin paying particular attention to these three areas, and we will attempt to help navigate any regulatory changes in Case in Point as they evolve.

Compliance issues can be overwhelming, yet they are but one component of the risks we face each day in higher education. With that said, we again invite you to review the issues from the prior month with a view toward proactively managing risks. As always, we welcome your comments and suggestions.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy
Follow us on Twitter

Information Security & Technology Events

Apr 22: Privacy Breach: Professional email etiquette has been preached over the last year as virtual learning and interactions have grown. Double-check the spelling, make sure it's being sent from your university account and if the recipient list is encrypted, make sure it stays encrypted. On the morning of April 14, the University Counseling Center sent out a feedback survey to 860 email addresses -- some students, faculty, staff and 68 accounts unaffiliated with the university -- in which the recipient list was unencrypted and visible to all who had access to the email. About 10 minutes later, Interim Director Dr. Daniel Paredes sent out a subsequent email with the subject line "DELETE PREVIOUS E-MAIL WITHOUT OPENING". (link)

Apr 22: Privacy: In 2018, Rutgers University made a move that hundreds of other universities before it had made: It switched its online learning platform from Sakai--a free, community-sourced system--to Canvas, which is owned by a company called Instructure. The switch was significant: Now the university was paying hundreds of thousands of dollars a year for a product that didn't have to be transparent about what it did with the information and data it was mining from its users. Such systems are constantly recording users' interactions with it--how long it takes a student to complete an assignment, for example, or her deleted words and keystrokes, and users' IP addresses. (link)

Apr 21: Phishing Attack: The University of Southern Indiana says they were hit with one of the most successful hacker phishing attacks they have seen. University officials say they know of at least 20 accounts that were broken into, which resulted in another 44,000 emails being sent out. The email looked like it was from the USI IT Help Desk, and said the student or faculty member had reached their email quota and asked them to click a link. If you clicked the link and entered your password, IT says your password has been stolen. If this happened to you, do this immediately: (link)

Apr 19: This information comes in the context of a U.S. cyberattack where the entire University of California system was included in those victimized in the breach, and emails soon started arriving at university-related accounts threatening to release information. The data breach involves the technology company Accellion, contracted by UC and others to transfer information. Those victimized in the breach have been warned to change their passwords and other credentials. Sanders puts the incident into context, stating: "This latest cyberattack shows how the Accellion breach continues to impact organizations. Higher education continues to be inundated with breaches and cyberattacks, and unfortunately this latest breach from the University of California system is a part of a recurring theme." (link)

Apr 09: Mistaken Letters Mailed: At the height of college decision season, the University of Kentucky emailed 500,000 high school seniors an acceptance letter to a "selective" College of Health Sciences program that usually accepts 35 to 40 students a year. The acceptance email was sent to seniors on March 15 saying, "We are pleased to inform you that you have been accepted into the selective Clinical and Management program in the University of Kentucky College of Health Sciences for the Fall 2021." The University admitted to LEX 18 the emails were sent in "error." University of Kentucky Spokesman Jay Blanton said the emails were sent using the school's Customer Relationship Management (CRM) tool. (link)

Apr 06: Data Breach: Michigan State sent out an email to just under 350 people yesterday notifying them that Title IX case files from Michigan State were a part of a data breach of Bricker and Eckler Law Firm, which assisted in Michigan State's Title IX investigations, Michigan State's Title IX Communications Manager Christian Chapman said. Bricker and Eckler is an Ohio law firm that is the parent company of INCompliance Consulting, which was hired by the University to assist in Title IX investigations and hearings. Bricker and Eckler underwent a ransomware attack between Jan. 14 and Jan. 31, which leaked personal information from its clients, including information from INCompliance Title IX investigations that they were a part of at Michigan State. (link)

Apr 02: Cyberattack: Brown University, a private US research university, had to disable systems and cut connections to the data center after suffering a cyberattack on Tuesday. The Ivy League school's IT staff said the attack focused on the university's Windows-based devices and asked faculty and staff to switch to computers running other operating systems, smartphones, or tablets. Since the attack hit Brown's network, the university's IT staff has brought back online most www.brown.edu websites, the library.Brown.edu domain, and listserv services. Brown's IT staff is still working on restoring connectivity and bringing additional systems back online to return operating status to normal. (link)

Apr 01: Ransomware/Data Breach: A number of prominent U.S. colleges have become the newest, unlucky recipients of a cybersecurity migraine currently affecting dozens of organizations all over the world. You may have heard something about Accellion--the global cloud provider whose secure-file transfer product (called FTA) was beset by a hacking campaign back in December. As of Thursday, at least six different universities have allegedly had their data leaked to the dark web--the likes of which includes quite sensitive information. The victims are: Stanford University, the University of Maryland Baltimore, the University of Miami, the University of California Merced, the University of Colorado Boulder, and the Yeshiva University, a prominent private research university based in New York City. (link)

Apr 01: Data Breach: On February 3rd 2021, 200,000 students and employees at Simon Fraser University (SFU) had their academic data as well as their personal identifiable information, including their name and date of birth, compromised. Following this serious data breach, a lawsuit has been issued against the university citing the failure to have preventative measures in place to protect student and employee data. As a consequence, the university could not adequately prevent or detect any unauthorised access of private and confidential data. (link)

Apr 01: Phishing Scam: The Internal Revenue Service today warned of an ongoing IRS-impersonation scam that appears to primarily target educational institutions, including students and staff who have ".edu" email addresses. The IRS' phishing@irs.gov has received complaints about the impersonation scam in recent weeks from people with email addresses ending in ".edu." The phishing emails appear to target university and college students from both public and private, profit and non-profit institutions. The suspect emails display the IRS logo and use various subject lines such as "Tax Refund Payment" or "Recalculation of your tax refund payment." It asks people to click a link and submit a form to claim their refund. (link)

Fraud & Ethics Related Events

Apr 21: Ethics: More than 35 years after 11 bodies were found in the rubble of the MOVE rowhome, new questions have emerged over how two universities treated the remains of one victim. The remains, never conclusively identified, were turned over to a University of Pennsylvania professor by an official investigative commission for additional forensic examination shortly after the 1985 disaster on Osage Avenue. Ever since, the material has been shuttled back and forth between Penn and Princeton University. The remains -- a pelvic bone and part of a femur -- were initially subjected to detailed analysis by Penn anthropology professor Alan Mann and kept at the Penn Museum. (link)

Apr 21: Grant Fraud: Today, a federal grand jury in Carbondale, Ill. returned an indictment charging a mathematics professor and researcher at Southern Illinois University -- Carbondale (SIUC) with two counts of wire fraud and one count of making a false statement. According to court documents, Mingqing Xiao, 59, of Makanda, Illinois, fraudulently obtained $151,099 in federal grant money from the National Science Foundation (NSF) by concealing support he was receiving from the Chinese government and a Chinese university. (link)

Apr 21: Fraud: Denis Onderi Makori of Cobb County, Georgia, has been indicted for laundering more than $2 million from an unspecified university in Pennsylvania. According to the Department of Justice, Makori and various other individuals used a business email compromise (BEC) scheme that led the university to unknowingly transfer over $2 million to the bank accounts that he allegedly controlled. From there, he "moved and laundered the funds between and among bank accounts associated with his logistics company, and then to bank accounts in Kenya, to himself, and to other persons associated with him." (link)

Apr 20: Public Funds Management: Alumni, faculty and legal observers are expressing outrage over Oregon Health & Science University's selection of former U.S. Attorney General Eric Holder at the astonishing hourly rate of more than $2,000 an hour to examine the medical school's handling of sexual misconduct and discrimination complaints. They've raised questions as to whether OSHU adhered to public contracting laws, whether the university used a competitive selection process with a request for proposals and if not, why not. The agreement apparently doesn't include a cap on the overall amount, a common standard for public contract offers. OHSU says none of those contracting laws apply to them. (link)

Apr 16: Occupational Fraud: A former college director is facing charges after allegedly stealing nearly $45,000. Panama City Police say former Gulf Coast State College Executive Director Margaret "Margie" Mazur had undocumented charges on a college credit card. They say the transactions dated back to 2018. The charges reportedly had nothing to do with college business and had no documentation to back them up. Mazur was placed on administrative leave last November and resigned shortly after. She turned herself in on Wednesday and has been charged with grand theft. Officials say additional charges could come and the investigation is ongoing. (link)

Apr 16: False Information Fraud: Acting United States Attorney Jennifer Arbittier Williams announced during a press conference today that Moshe Porat, the former Dean of Temple University's Richard J. Fox School of Business and Management ("Fox"), has been indicted on charges that he conspired and schemed to deceive the school's applicants, students, and donors into believing that the school offered top-ranked business degree programs, so they would pay tuition and make donations to Temple. The Indictment charges Porat with one count of conspiracy to commit wire fraud and one count of wire fraud. (link)

Compliance/Regulatory & Legal Events

Apr 27: Harassment Settlement: In the spring of 2018, a student at the University of New Orleans told administrators biology professor Shawn Vincent asked her for sex in exchange for an A in his class. UNO administrators suspended Vincent immediately, and days later, when the student turned over to university officials text messages and an audio recording of Vincent, UNO President John Nicklow fired him within hours. Despite the university's swift response to her complaint, the student argued in a lawsuit against the state of Louisiana that university officials should never have hired Vincent. He'd been arrested for using the internet to solicit an underage girl for sex eight years earlier. She said they should have fired him when they learned of that arrest. (link)

Apr 26: Sexual Assault Class Action: Seven women filed a class-action lawsuit against LSU Monday, alleging that their claims of sexual assault, harassment, domestic violence and stalking were ignored by the university. The lawsuit is the latest hit for LSU, which has been mired by multiple sexual assault scandals in recent months. At least three lawsuits have been filed on behalf of women who claim the school protected athletes and athletics department staff and allowed a misogynistic environment to fester in the department. The suit also alleges a violation of RICO statutes, which means it is alleged there was an enterprise constructed to hide the sexual misconduct of athletes. (link)

Apr 26: Falsified Report Lawsuit: The University of Oregon has filed a federal suit against a former campus cop, alleging he lied in police reports and withheld key evidence in an alleged malicious prosecution of a Latino bicyclist he stopped at gunpoint in 2018. The university fired the university officer, Troy Phillips, in the fall of 2019 for his dishonesty. The state agency that certifies police officers has opened an inquiry into Phillip's case. The university also agreed last week to pay $115,000 to the family of the bicyclist, Eliborio Rodrigues Jr., who later died in an unrelated encounter with Eugene police. The payment settled a pending tort claim, or notice to sue the university, which was brought by Rodrigues' estate. (link)

Apr 25: Whistleblower Lawsuit: One of the central figures in the San Jose State sexual abuse scandal has filed a lawsuit against university trustees and athletic director Marie Tuite, alleging retaliation for his whistle-blowing. Women's swimming and diving coach Sage Hopkins, whose persistence in reporting accusations of sexual misconduct by former director of sports medicine Scott Shaw prompted a second investigation that substantiated the allegations, filed the suit last month in Santa Clara County Superior Court. (link)

Apr 23: Sexual Harassment: During 16 years teaching at the University of Michigan, Bruce Conforth stocked his lectures with tales from a life filled with boldfaced names: He had rubbed elbows with Bob Dylan, played music alongside B.B. King, apprenticed for the abstract expressionist Willem de Kooning and befriended the poet Allen Ginsberg. Students clamored to enroll in his courses on blues music and the American counterculture, later raving about how he had changed their lives. But there was a dark side to Mr. Conforth, according to Ms. Brown and other women who said the teacher used his charisma and, sometimes, Svengali-like manipulation to sexually harass his students. (link)

Apr 20: Free Speech Law: With the governor's signature, a new free speech policy governing the state's 11 public colleges and universities is now law. "North Dakota is ahead of the curve compared to a vast majority of states," said Joe Cohn, the legislative and policy director for the Foundation for Individual Rights in Education, or FIRE. Among the many changes the bill makes, it says schools can't limit speech to certain areas of campus known as "free speech zones"; deny activity fee funding to a student group based on its viewpoint or prohibit guest speakers based on their views or content of the speech. (link)

Apr 20: NCAA Violations: The NCAA Division I Committee on Infractions announced on Tuesday it has placed the athletic department at UTEP on one-year probation along with a $5,000 fine for Level II violations within the football and softball programs. According to UTEP director of athletics Jim Senter, UTEP self-reported the violations to university compliance. As detailed in the approved agreement, the Committee on Infractions, NCAA enforcement staff, and UTEP administration agreed the football program exceeded the maximum number of allowable countable coaches, specifically, defensive and offensive quality control specialists provided skills instruction during practices. (link)

Apr 20: Harassment/Discrimination Lawsuit: A federal lawsuit filed Monday accuses Canisius College of allowing sexual harassment and discrimination on its men's and women's cross country/track and field teams and ignoring reports of sexual assault until one freshman athlete was allegedly raped. The lawsuit, which names the college, head track coach Nathan Huckle, athletic director William Maher and former athlete Donovan Glavin as defendants, stated that male athletes would "get female athletes high so that they could have sex with them," a practice the lawsuit describes as "smoking a girl up." (link)

Apr 20: NCAA Violations: The NCAA Division I Committee on Infractions on Tuesday approved a negotiated resolution agreement regarding self-reported violations that occurred in the Youngstown State University football program. YSU's football program faces penalties after an assistant coach had impermissible contact with a prospect and the program permitted three football staff members to recruit off campus without completing the coaches certification test, according to an agreement released Tuesday by the committee. The university and the committee also agreed that the school failed to monitor its football program. (link)

Apr 16: Sexual Abuse: In the school's first public admission of fault, San Jose State University president Mary Papazian apologized Thursday to athletes who say they were sexually abused by an athletic trainer and acknowledged that a 2009 investigation clearing him was wrong. The case has cast SJSU on a national stage of shame with Michigan State University and the University of Southern California. SJSU and the California State University system are facing a handful of legal actions over the handling of a 12-year-old case that alleged athletic trainer Scott Shaw had inappropriately touched 17 women athletes under the guise of physical therapy. Shaw continued treating athletes at San Jose State for 10 years after the initial investigation. (link)

Apr 15: NCAA Violations: More than three and a half years after the FBI's sting on college basketball ensnared a member of the USC staff, the Trojans have finally learned their penalty. The USC program is receiving two years of probation and a series of recruiting restrictions in connection with former assistant Tony Bland's actions, the NCAA Committee on Infractions announced Thursday. However, the Trojans avoided a postseason ban. "Despite the former associate head coach's underlying violations, the committee noted that unlike other individuals in similar cases, he met his obligation when he participated in the NCAA investigation and provided information relevant to the investigation," the NCAA summary announced. (link)

Apr 13: Scapegoat Lawsuit: The University of Utah's former police chief and four officers, including an officer accused of mishandling explicit photos of murdered student Lauren McCluskey, have filed a claim against their former employer alleging they were treated unfairly in the wake of the student's death.Former Chief Dale Brophy, who resigned in October 2019; Miguel Deras, the U. officer who reportedly showed his colleagues explicit pictures of McCluskey he obtained as he investigated her report that she was being harassed and blackmailed; and three other former department members -- Rick McLenon, Mario Sellick and Aaron Nelson -- are demanding $10 million from the university. (link)

Apr 06: Discrimination/Retaliation Lawsuit: Top Louisiana State University officials conspired to cover up football coach Les Miles' sexual harassment, then engaged in a years-long retaliation against the employee who reported it, the employee alleged in a series of federal and state lawsuits expected to be filed this week. Sharon Lewis, LSU's associate athletic director of football recruiting, named several senior officials who she claims tormented her, discriminated based on sex and race, underpaid her and contributed to LSU's systemic failure to protect students and hold perpetrators accountable for gendered violence and harassment. (link)

Apr 07: Cyberstalking: A former track and field coach at various universities was arrested and charged today in connection with a scheme to trick female student-athletes, through sham social media accounts, into sending him nude or semi-nude photos. The defendant also allegedly cyberstalked at least one female student-athlete. Steve Waithe, 28, of Chicago, Ill., was charged by criminal complaint with one count of cyberstalking and one count of wire fraud. According to charging documents, Waithe was employed as a track and field coach at Northeastern University in Boston from October 2018 to February 2019. It is alleged that during that time, Waithe frequently requested to use female athletes' cellphones under the pretense of filming their form at practice and at meets. At times, he was observed "scrolling through" the phones. (link)

Apr 06: Title IX: Two months after the U.S. Department of Education launched an investigation into how LSU reports and investigates crimes on campus, the same federal agency has opened a second probe into LSU focusing on sexual assault and harassment. LSU spokesman Ernie Ballard confirmed Tuesday that the university has received "notice from the Department of Education, Office of Civil Rights, of an investigation into Title IX compliance." (link)

Apr 05: Negligence Lawsuit: The state has agreed to pay a former University of Northern Iowa football player $150,000 after he suffered "significant" injuries while participating in a research study being run by another former UNI Panther -- and NFL player -- Chad Rinehart. Iowa City native and Regina High School standout Philip H. Arendt, 23, in September 2019 sued the state for negligence after he -- as a scholarship offensive lineman for the UNI Panthers -- in March 2017 was asked to participate in a graduate study program, the lawsuit said. All offensive and defensive linemen were asked to participate in the study, which assistant kinesiology professor Jacob Reed was supervising. (link)

Apr 01: Sexual Misconduct: The entire faculty of the Askew School of Public Administration and Policy at Florida State University has denounced the handling of sexual misconduct allegations against one of their own former professors and called on administrators to revisit the FSU investigation and retroactively fire Dr. Richard Feiock for cause. Feiock, 62, a widely acclaimed professor at the Askew School who frequently obtained grants that benefited the school, quietly resigned last year amid a sexual misconduct investigation sparked by the disclosure of sexually explicit emails, photos and text messages exchanged by the professor and a foreign student. A university inquiry noted that Feiock had been repeatedly investigated for allegations of sexual misconduct dating back at least to 1991. He had been counseled, but allowed to remain on the faculty for more than 30 years. (link)

Campus Life & Safety Events

Apr 21: Campus Climate: A new survey reveals that college students do not feel comfortable openly disagreeing with professors on controversial topics or expressing an unpopular opinion on social media, raising questions on whether or not America's colleges remain a place for the open expression of ideas and thoughtful debate. The study, conducted by Real Clear Politics, surveyed students at more than 500 colleges and universities across the country. The issues that students felt were most difficult to have an open and honest conversation about are some of the most debated issues nationally. (link)

Apr 21: Abuse Allegations:Louisiana Tech University is reviewing its ties with a Ruston-based training center for the blind following multiple allegations of sexual abuse, racism and other misconduct at the center. "We are currently reviewing the terms of our relationship with the Louisiana Center for the Blind," said Louisiana Tech spokesperson Tonya Oaks Smith in a statement to Gambit. Founded in 1985, LCB was established to provide blind and visually impaired children and adults training in life skills ranging from reading braille to traveling with canes. (link)

Apr 20: Racial Issues: A lecturer at SUNY Buffalo State College is under review after comments she made about Black Lives Matter were recorded and posted on social media. This as many students across campus are demanding Buff State leaders address racially-charged incidents at the school, where there was a protest Tuesday. The protest highlighted how emotions are breaking out at Buff State. Students are demanding college leadership address recent racially-charged incidents. One of them involving a part-time instructor. (link)

Apr 19: Free Speech Lawsuit: Former Virginia Tech women's soccer player Kiersten Hening has filed a federal lawsuit against Hokies women's soccer coach Chugger Adair, alleging that after she refused to join her teammates kneeling before games this season, the coach engaged in a "campaign of abuse and retaliation" that led her to leave the program. The suit seeks a ruling ordering Adair to "undergo First Amendment training," and to have Hening reinstated on the team, in addition to unspecified monetary awards for compensatory, punitive and nominal damages and costs associated with her case. (link)

Apr 19: Sexual Assault: A Utah State University football player was arrested Sunday on suspicion of sexually assaulting a woman.The 22-year-old player entered the bed of a woman while she slept, according to a probable cause statement, wearing only his underwear. The woman woke up, pushed him and told him to leave, at which point he put his clothes back on and left. Witnesses who spoke with the woman reported that the she told them the player touched her inappropriately and assaulted her, per the probable cause statement. The police document also stated the player had been seen entering multiple rooms in the university dormitory where the woman lived. (link)

Apr 14: Free Speech: San Diego State University students expressed outrage Tuesday over a professor's use of a cultural stereotype about Blacks in an online class -- anger that was followed a short time later by campus officials defending the teacher's right to make a point about racial ideology. The statement by SDSU officials was posted in response to a brief clip on Twitter of Professor Robert Jordan giving a pre-recorded, hour-long Introduction to Cinema class that was held on Monday. "In the :50 video, the professor gives an example of a racist view or ideology," the SDSU statement said. "Professor Jordan insists the clip in no way represents his personal views or opinions." (link)

Apr 07: Hazing: A University of Mississippi student faces aggravated assault charges after police said he sprayed cleaner into the mouth of a fraternity pledge during a hazing ritual, causing serious internal injuries. Adam Peavy, a lawyer for the injured student, said the hazing took place at an Oct. 11 ceremony where pledges were supposed to receive fraternity pins at the Pi Kappa Alpha house in Oxford. (link)

Apr 01: Student Deaths: Two Western Nebraska Community College students have died at the Western Nebraska Community College Aviation Maintenance facility in Sidney as a result of a tragic accident. The names of the deceased students were not released pending notification of the students' families. WNCC Public Relations and Marketing Director Allison Judy told the said the incident occurred early Thursday morning during instructional time at the Sidney campus main building. She said there's about 15 students in the aviation program. (link)

If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site.