Quotable ..... “There's always a sense that people will do things quite differently if they think they have privacy.” -- Peter Thiel

We've recently had Cybersecurity Awareness Month and Compliance & Ethics Week. One topic common to these annual events is a focus on the need for organizations to properly steward the data and information entrusted to them. It's been a while since we've focused specifically on privacy, so Robert Gottesman, our Executive Director for Institutional Compliance & Privacy, will share his thoughts on this important topic.

Privacy is just one of many issues that can get institutions into trouble if they are not proactively managing risks. We invite you to review the stories across our industry with a view toward proactively managing risks for your institution and department. As always, we welcome your comments and suggestions.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy
Follow us on Twitter

Information Security & Technology Events

Nov 22: Data Breach: A software company that manages applications for academic scholarships, grants and other forms of financial assistance for college students misconfigured a cloud storage platform, leaving millions of records exposed on the open internet, according to research published Monday by UpGuard, a cybersecurity risk management firm. The company, SmarterSelect, failed to make private a Google Cloud Storage bucket containing 1.5 terabytes of data collected by an array of programs that offer financial support to students -- with documents dating from November 2020 to Sept. 29 -- around the time SmarterSelect acknowledged UpGuard's discovery. The bucket contained nine top-level directories, all containing information about the scholarship organizations that use SmarterSelect and about 150,000 PDF files of students' application materials. (link)

Nov 18: System Crash: A computer system crash has hit Friends University hard, taking out the school's Wi-Fi, e-mail and organizational software at various points over the past week, according to students and faculty. Numerous campus patrons have reported multiple and recurring problems logging in, accessing and submitting assignments, and communicating with the campus community. Members of the campus community said they've been told the problem was a virus attack of some sort. (link)

Nov 10: Data Breach: An "isolated incident" at Lander University over the summer involving some employees' paychecks being diverted was a one-time thing, according to the university. This past summer, a small number of employee paychecks or portions of a paycheck were diverted to an unauthorized bank account, according to a statement from Megan Varner Price, assistant vice president of university relations and publications. Price said a hacker gained access to the university's payroll system, but the breach was caught almost immediately by internal controls. The university worked with law enforcement and IT staff to trace what happened and affected employees were notified. All diverted funds were replaced by pay day, Price said. (link)

Nov 14: Phishing: On November 1, U of T alerted students that scam emails were being sent to their school emails. The notice warned that "many members of [the U of T] community have received an email purporting to be from the ‘COVID-19 Support Team.' This email encourages recipients to visit the ‘University of Toronto giveaway page' to be eligible for a one-time cash award." The original scam email offered $2,920 to all eligible faculty members, staff, and students due to the ongoing pandemic, claiming that U of T has decided to support community members so they could "get through these hard times." The email asked ‘qualified' community members to register with their information to be considered for the giveaway. It explained that any submission that did not have all of the information the email requested would not be processed. (link)

Fraud & Ethics Related Events

Nov 29: Rankings Fraud: A former dean of Temple University's business school was found guilty on Monday of using fraudulent data between 2014 and 2018 to boost the school's national rankings and increase revenue, federal prosecutors said. The former dean was convicted of wire fraud and conspiracy to commit wire fraud for his role in a scheme to raise the ranking of the university’s Fox School of Business in Philadelphia, the U.S. Attorney’s Office for the Eastern District of Pennsylvania said in a statement on Monday. The school's online M.B.A. program was ranked best in the country by U.S. News & World Report in the years that he falsified data. (link)

Nov 08: Rankings Fraud: In the three years since it acknowledged that its No. 1-ranked online MBA program achieved that status on the back of phony data, Temple University has paid out millions in legal settlements to former students and government monitors while implementing reforms to put that embarrassing chapter behind it. But as the former dean at the heart of the scandal faces trial this week on federal fraud charges, the university's Fox School of Business is bracing once again for one of its darkest moments to be pushed back into the spotlight. (link)

Nov 05: Financial Aid Fraud: At least six California community college districts suspect they have given out financial aid to fake students who have enrolled at their colleges this year. At a minimum, the breaches represent a loss of hundreds of thousands of dollars to scammers seeking financial aid from California's community colleges. It's possible that much more money was delivered to fake students, given that the system's 115 traditional colleges, enrolling about 1.8 million students, are in the midst of distributing more than $1.6 billion in federal Covid relief aid. (link)

Nov 05: Occupational Fraud: An employee at North Carolina Central University in Durham is charged with embezzling close to $1 million from the school, according to an arrest warrant obtained by CBS 17. According to the warrant, the employee embezzled a total of $900,284.59 from N.C. Central's bookstore and food services department over a period of three years, from Jan. 9, 2018, until April 30 of this year. The woman was employed by the university as a business and technology application analyst and Eagle Card office manager, the warrant shows. (link)

Nov 05: Admissions Scandal/Bribery: A former University of Southern California athletic administrator pleaded guilty to being part of a sweeping scheme to get students admitted to prestigious universities as fake athletic recruits, in exchange for bribes. The administrator was the central figure of the scheme at U.S.C., as a senior administrator who oversaw the admissions of athletes for nearly a decade before her indictment in 2019. Court documents said Mr. Singer's clients made payments of more than $1.3 million into U.S.C. accounts controlled by the administrator over a four-year period, with Mr. Singer later setting up a sham consulting agreement that paid her $20,000 per month. (link)

Nov 01: Occupational Fraud: A former University of Arkansas administrative assistant was arrested for theft and fraudulent use of a university credit card. The assistant was arrested in early October after an assistant dean at the university contacted campus police regarding a pair of suspicious charges the assistant allegedly made on university cards. The dean's initial investigation uncovered approximately 143 unauthorized purchases, totaling approximately $285,000. Further investigation by campus police identified the total number of unauthorized purchases as 248, with the transactions totally approximately $335,000. (link)

Compliance/Regulatory & Legal Events

Nov 28: Sexual Assault Lawsuit: A former University of Alberta student is suing their former history professor and the university for alleged sexual assaults. In a statement of claim filed in September 2020, Alix Kemp alleges former history professor Andrew Gow had non-consensual sexual contact with Kemp in his office and at his home in 2006. Kemp further alleges Gow had a history of grooming and engaging in sex with female students that was well known within the department and by the university's management. (link)

Nov 23: Title IX Lawsuit: Another Liberty University student who said her reports of being raped by another student last year were mismanaged and pushed under the rug has filed a lawsuit against the school. Her complaint, filed Monday in federal court, is a detailed case among a storm of similar allegations that's caused major turbulence for the Christian institution in recent months. Still a student at LU but living elsewhere, the woman filed her lawsuit anonymously as "Jane Doe," mirroring 12 anonymous women who either are former faculty or students and expressed similar complaints against the school in a unified lawsuit filed over the summer. (link)

Nov 24: COVID Refund Settlement: Columbia University agreed to pay $12.5 million to settle a lawsuit by students who claimed it failed to refund fees when it moved classes online in the spring 2020 semester because of the COVID-19 pandemic. Columbia will refund $8.56 million in fees for student activities, health services and the use of its gyms, libraries and other facilities, and pay nearly $4 million to avoid the risks of further litigation. The Ivy League school had previously given a partial fee refund. (link)

Nov 22: Sexual Abuse Settlement: San Jose State has announced that it reached a $3.3-million settlement with 15 former student athletes who were reportedly sexually harassed by a longtime sports trainer. The payout follows a federal civil rights investigation that found San Jose State did not take adequate action in response to the athletes' reports and retaliated against two employees who raised repeated concerns to the university about Scott Shaw, the former trainer and director of sports medicine. (link)

Nov 22: Public Records Settlement: The University of Washington has agreed to pay $97,000 to settle a lawsuit filed by The Seattle Times, which alleged the university failed to provide public records a reporter requested about coronavirus testing of student-athletes. The reporter, Mike Reicher, requested emails of the UW's head of sports medicine last year to learn more about the Pac-12's decision to partner with a manufacturer of rapid coronavirus tests. UW said it did not find any responsive records. But The Times obtained emails that included the UW official's emails from another Pac-12 university and provided them to the UW to show that its search was inadequate. (link)

Nov 20: Emotional Distress Settlement: The alcohol- and drug-fueled antics of a star Hunter College professor cost the City University of New York $1.25 million to settle claims by his aggrieved staffers, according to a report. CUNY and a psychology professor and sex and drug researcher reached the hush-hush settlement with six staffers who worked with the professor at his Center for HIV Educational Studies & Training, known as CHEST, The Chronicle of Higher Education reported. (link)

Nov 20: Lawsuits: A Fordham social work professor fired over a claim he masturbated during a Zoom lecture and the student who captured the act on her cell phone are suing the university, claiming officials violated both their civil rights in the response to the incident. The student ended up failing a different social work course, retaliation, she says, for lodging the complaint. The professor has denied any self-gratification during the class, claiming he's incapable because he suffers from erectile dysfunction. He said that what he was actually doing was frantically trying to send an email while having to urgently urinate and the movement on the video was just a function of his discomfort. (link)

Nov 18: Free Speech Investigation: A U.S. House subcommittee opened an investigation Thursday into whether the University of Florida interfered with academic freedom and free speech when it stopped three professors from testifying as experts in a lawsuit challenging Florida's election law, before reversing course. Members of the House Subcommittee on Civil Rights and Civil Liberties sent a letter to UF president Kent Fuchs requesting documents and communications regarding the creation of the school's conflicts-of-interest policy and its denials of faculty requests to engage in outside activities. (link)

Nov 16: Vaccine Mandate Settlement: Western Michigan University athletes who were told they could not compete without getting the COVID-19 vaccine have settled with the university and received assurances their legal fees would be paid. The stipulated agreement between the 16 athletes and the university would allow U.S. District Judge Paul Maloney to enter a permanent injunction against Western's vaccination requirements for the athletes, according to a statement from the athlete's attorney. (link)

Nov 16: Sexual Misconduct: Florida State University quietly fired one professor, suspended another who resigned a few months later and allowed a third to remain on the job after it determined they committed sexual misconduct in separate incidents with students, according to disciplinary records. The formal investigations were all previously undisclosed. At least one ran until the summer of 2021. In each case, investigators concluded that the three faculty members violated the university's sex discrimination and sexual misconduct policies. FSU made no announcements about the cases or outcomes. (link)

Nov 16: Sex Crimes: A former University of Michigan music professor will spend about five to six years in prison after pleading guilty Tuesday to a felony charge of transporting a female minor across state lines for sex.The professor was in a supervisory role of the female, "abused his position of trust as a violin teacher and mentor," Woodward said, and engaged in "a pattern of activity involving prohibited sexual conduct." The professor, who joined UM as a violin professor in 1989, was placed on paid leave by UM in 2018 after allegations of sexual misconduct against him were brought forward by former students he taught in the 1970s and 1980s in Nebraska and North Carolina. (link)

Nov 15: Retaliation Lawsuit: Two unnamed Yale Law School students filed a complaint Monday against three Law School administrators and the University for allegedly "blackball[ing]" them from job opportunities after they refused to endorse a statement in the ongoing investigation against law professor Amy Chua. The students, referred to as Jane and John Doe throughout the lawsuit, are suing the University and Yale Law School Dean Heather Gerken, Law School Associate Dean Ellen Cosgrove and Director of Diversity, Equity & Inclusion Yaseen Eldik on the grounds of breach of contract, intentional interference with prospective business relationships and defamation, among others. (link)

Nov 10: Before the night was over, Liz Kelman would have a better idea of who Jeffrey T. Parsons really was. At the moment, he appeared to be having the time of his life. As a tray of liquor shots circulated around the party at the Stonewall Inn, an iconic gay landmark in New York City, Kelman watched while Parsons laughed with his colleagues from the HIV-research lab he directed. At the time, Kelman had worked for only a couple of weeks at the Center for HIV/AIDS Educational Studies and Training, known as CHEST. What little she knew of Parsons had come from her new colleagues, who had described the director as tempestuous and quick tempered, known to berate subordinates in the middle of the office. (link)

Nov 11: NCAA Compliance: Bluefield State committed certification violations over the course of a three-year period when it improperly certified 21 student-athletes across eight sports, according to a decision released by the Division II Committee on Infractions. As a result of the improper certifications, the 21 student-athletes competed in a total of 225 contests while ineligible and received actual and necessary expenses associated with the contests. The NCAA enforcement staff and school agreed that the violations occurred due to gaps in the school's compliance program and demonstrated that Bluefield State failed to monitor its certification process. (link)

Nov 08: Sex Abuse: For more than a decade, San Jose State University officials allowed a now-disgraced head athletic trainer to continue treating female athletes because, they said, he was cleared of sexual harassment allegations by a 2010 in-house investigation. But a two-page summary of that investigation, released for the first time late Friday, shows how deeply flawed the initial review was, relying almost entirely on interviews with the trainer's subordinates who said Monday how their input was distorted and their concerns ignored. (link)

Nov 08: First Amendment Lawsuit: Three University of Florida professors who were barred from testifying in a lawsuit against the state's new voting law filed a federal lawsuit Friday alleging their First Amendment rights were violated and asking the court to strike down the school policy that led to a "stifling of faculty speech against the state." The lawsuit came despite the university's reversing its decision earlier Friday and allowing the three faculty members, all political science professors, to participate in the voting rights lawsuit after all -- as long as they did so on their own time and did not use school resources. (link)

Nov 05: Meth Manufacturing: The story sounded like it was made for Hollywood: Two chemistry professors in a small Arkansas college town accused of cooking methamphetamine in their school laboratory. On the night of Oct. 7, 2019, a chemical spill occurred in Room 304 at Henderson State University's Reynolds Science Center. The next day, a strong odor filled the building, forcing the school to evacuate the building and cancel classes. Weeks later, two professors were arrested and charged with manufacturing meth and other drug-related offenses. (link)

Nov 05: Child Pornography: A former professor and dean at Georgia State University, has pleaded guilty to possession of child pornography. Images and videos of children as young as five years old, engaged in sexually explicit conduct, were among the items confiscated. In November 2020, Georgia State University's Cyber Security Department ("GSU Cyber Security") alerted the FBI that an employee was accessing websites which appeared to contain child pornography through the university's network. (link)

Nov 04: NCAA Compliance: The Missouri State women's volleyball program committed numerous violations involving recruiting, benefits, athletically related activities outside the playing season, and impermissible coaching activity, according to a decision released by a Division I Committee on Infractions hearing panel. Additionally, the former women's volleyball head coach was personally involved in many of these violations and permitted others, thereby violating head coach responsibility rules. As a result of these violations, Missouri State failed to monitor its women's volleyball program. (link)

Nov 02: The Board of Trustees of Georgetown College has fired the president. The college says on Sunday, October 31, they were informed of allegations of a sexual assault of a female College employee, inappropriate behavior with another female College employee, and other conduct in violation of the president's employment agreement with the College. Officials say they took immediate steps to investigate the allegations and engaged outside counsel to continue the investigation. (link)

Nov 01: Online Classes Lawsuit: A judge ruled a lawsuit alleging Montana State University breached its contract with students with the shift to online learning during the pandemic can move forward in district court. Plaintiff Anthony Cordero filed a claim in Lewis and Clark County District Court, where Judge Michael McMahon ruled last week that the claim of a breach of contract could move forward after lawyers for the university asked the court to dismiss the case. The university transitioned to full online learning on March 23, 2020, due to growing public health concerns around the coronavirus. It did not offer in-person classes again until August 17, 2020. (link)

Nov 01: Title IX & "Pass the Harasser": It started with a target. Phoebe had come to Augustana University with the assurance that she and her professors would be close--the South Dakota school advertised a 12:1 student-faculty ratio, and as a sophomore in 2014, she'd already been invited to bond with an instructor off campus. She and her new advisor, Professor Daniel Howard, shared a number of hobbies: an interest in insects, a commitment to snark, and a love of trap shooting. It was the beginning of a seven-month relationship that Phoebe initially believed was consensual, and that would end with his wife's discovery of the relationship, and an anonymous Title IX report. (link)

Nov 01: Title IX Settlement: The state agreed Monday to pay from its general fund nearly $400,000 to settle a lawsuit brought by University of Iowa female athletes who contended plans initially announced last year by the UI to cut women's swimming and diving was a Tile IX gender equity violation. The UI was compelled to settle after an earlier court opinion stated the women were likely to succeed with their lawsuit, Lopiano said. She surmised the university thought, "We don't want to waste this money in court. We don't want this reputation." (link)

Nov 01: Title IX Lawsuit: A former University of Minnesota gymnast is suing the school for its decision to drop men's gymnastics after last season, arguing its decision was a flawed and unlawful interpretation of Title IX. Sophomore Evan Ng seeks the program's reinstatement in his lawsuit, which was filed Friday in U.S. District Court for the District of Minnesota against the university's president, board of regents and athletic director. The suit argues men's gymnastics was cut based on a "misguided, unlawful, and unconstitutional attempt to comply with Title IX." (link)

Nov 01: NCAA Violations: South Florida has been fined $10,000 and placed on three years' probation for NCAA violations committed by the football and women's basketball programs. The NCAA Committee on Infractions announced Friday its approval of a negotiated resolution with USF that ended an 18-month investigation. The school and NCAA agreed Level II violations occurred within the Bulls' football program under former coach Charlie Strong and in the women's basketball program under longtime coach Jose Fernandez. (link)

Nov 01: Breach of Contract Settlement: A former University of Utah autism researcher on Friday was awarded $760,000 in a lawsuit that argued the university breached its contract with her by terminating her in retaliation for reporting research misconduct. Judith Zimmerman was hired in 2005 as an assistant research professor in the U.'s psychiatry department. According to the complaint filed in 2017, Zimmerman expressed concerns to multiple administrators in 2012 about employees obtaining unauthorized access to sensitive health data. She was later terminated in mid-2013. (link)

Campus Life & Safety Events

Nov 26: Student Death: The family of a UNLV student who died after a fraternity boxing match is demanding answers. The I-Team has learned that Nathan Valencia collapsed after the fight ended on November 19th. He passed away four days later. His family told the I-Team he suffered brain injuries which he could not recover from. "I was like this, this thing, it's like an underground fight club," Joe Castro said. He told the I-Team that he is a longtime friend of Valencia's. Castro said Valencia did not have boxing experience but wanted to participate in the charity event as a member of his fraternity, Sigma Alpha Epsilon. (link)

Nov 21: Racial Issues: Fitchburg State University in Massachusetts hosted several "processing" spaces segregated by race in response to the Kyle Rittenhouse trial verdict, which found Rittenhouse not guilty on all charges. The Fitchburg State University Center for Diversity & Inclusiveness announced the "processing" spaces in an email to campus community members, which also erroneously stated that Jacob Blake was killed. The four "processing" spaces include a "Students of Color Processing Space," "White Student Ally Processing Space," "Faculty and Staff of Color Processing Space" and a "White Faculty and Staff Ally Processing Space." (link)

Nov 16: Sexual Assault: A maintenance supervisor at a North Carolina community college was arrested in connection with an on-campus sexual assault and stalking of a high school student enrolled in an early college program, school officials said Tuesday. The student reported being assaulted at Mitchell Community College in downtown Statesville, according to a news release by the Iredell-Statesville Schools. The accused has been a grounds maintenance supervisor at the community college for 10 years, officials said. (link)

Nov 13: The second-year Washington coach was suspended by the university on Monday following an incident last Saturday in which he was seen shoving and hitting redshirt freshman linebacker Ruperake Fuavai on the side of his helmet. According to a report Saturday by The Seattle Times, the coach is alleged to have also shoved a player in 2019, his sixth season as a Washington assistant and the year before he took over the head coaching role. The Times reports the incident took place in the locker room during halftime of the Huskies' game at Arizona on Oct. 12, 2019 -- a game in which Washington trailed 17-13 at the half but eventually won 51-27. (link)

Nov 12: Bomb Threats: A teenage gamer in Virginia is said to be involved in the recent spate of bomb threats at colleges and universities in the tri-state area, law enforcement sources familiar with the investigation told NBC News. It was not immediately clear which specific threats the 14-year-old was involved in, but there have been scares in recent weeks at Yale University in New Haven, Connecticut; Cornell University in Ithaca, New York; Brown University in Providence, Rhode Island; and Columbia University and NYU in New York City. Each incident has led to building evacuations and campus alerts sent to students, faculty and staff, and each was later deemed safe. (link)

Nov 12: Hazing: Four months after suspending its baseball program, UC Davis announced Friday that the team's head coach was resigning after an investigation revealed young players had for years been subjected to hazing rituals that included binge drinking, strippers and jokes about gay sex. In July, UC Davis announced it had suspended the team pending an unspecified investigation into "credible allegations of misconduct primarily related to hazing," according to an online letter to the UC Davis community by Chancellor Gary May. At the time, he released no details. (link)

Nov 11: Terroristic Threats: On Thursday, Nov. 11, a freshman University of Nebraska-Lincoln student was arrested by the University of Nebraska-Lincoln police department after making death threats against Chancellor Ronnie Green on the social media platform Yik Yak. According to an affidavit for the arrest warrant obtained by UNLPD, officer Agustin Champion testified that the department responded on Sept. 6 to a voicemail from a Yik Yak supervisor left on Aug. 31 that a post had been made which read "Just planted a 2nd B0mb in the chancellors office!!! #HesMyChancellor" (link)

Nov 10: Fraternity Suspension: Pi Kappa Alpha fraternity was suspended from The University of Mississippi on Wednesday until 2025 in connection with a hazing incident involving a bottle of cleaning solution that landed a pledge in the hospital. The decision follows an investigation that uncovered acts of hazing in an Oct. 11, 2020, incident at the fraternity house. Pi Kappa Alpha International Fraternity and Ole Miss arrived at the decision together following a joint inquiry, according to the emailed statement from Lisa Stone, director of communications for Ole Miss. (link)

Nov 06: Speech/Racial Issues: The Seattle men's basketball coach has been placed on administrative leave and the school is reportedly investigating incidents in which he allegedly used racial slurs. According to Stadium Basketball Insider Jeff Goodman, the coach used the "N-word" during the summer and Thursday. Goodman reports the latest incident occurred after a Black player used the word during a scrimmage and was called into question by an official. The coach then repeated the word, Goodman writes, by asking the player "Did you say the N-word?" (link)

Nov 04: Hostage Situation: A 37-year-old armed man was taken into custody Thursday morning on the University of Oregon campus after he allegedly held two students hostage in Hamilton Hall and set off a fire alarm in the UO Knight Law Center. The man was taken into custody without incident after the hostages were able to text his location in the dorm to police. He was armed with a loaded 9 mm pistol and had extra ammunition, UO Police Chief Matt Carmichael said. (link)

Nov 01: Drugging/Sexual Assault: USC acknowledged Friday a "troubling delay" in warning the campus community about allegations of drugging and sexual assault by a fraternity last month as a rare faculty protest added to mounting criticism about the university's handling of the crisis. In a message to the campus community Friday night, USC President Carol Folt said that a university confidential reporting program received five to seven disclosures of possible drugging and possible sexual assault at a fraternity in late September. The information, however, was not shared with the campus community until Oct. 20, when the Department of Public Safety posted an alert that the university had received a report of sexual assault and reports of drugs being placed into drinks at the Sigma Nu fraternity house, "leading to possible drug-facilitated sexual assaults." (link)

Nov 01: Fraternity Suspension: In the wake of a sexual assault investigation, the largest fraternity at Boston University has been suspended after breaking a moratorium on all activities that was imposed by the Dean of Students, the university said. "Effective immediately and until further notice, your organization, the Mu Psi Chapter of Kappa Sigma Fraternity, is suspended from official recognition by Boston University," John Battaglino, assistant dean of students and director of student activities wrote in a letter written to the fraternity. (link)

If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site.

Back to top

---

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Office of Audit, Compliance & Privacy is listed as the source.