|
Web Exclusives:PawPlus September 11, 2002: Admission
office investigation concludes By Argelio Dumenigo Summertime at Princeton and its undergraduate admission office is usually a peaceful time. Vacations loom, summer hours begin, and there are months to go before the full onslaught of the admission process kicks in again. This year, however, the discovery of unauthorized uses of applicants' personal information to access a Yale University Web site splintered that peace, putting Princeton on the ugly end of a media frenzy and leading to the eventual departure of the admission office's two highest ranking members. On August 13, after nearly three weeks of speculation, President Tilghman stepped up to a podium in the MacLean House to describe what an internal investigation by a former federal prosecutor had discovered about what happened at the admission office during the first few weeks of April, when staffers there on 14 different occasions accessed a Web site Yale had set up to let applicants know if they had been accepted. Many of the facts of what some media outlets had fun calling "Ivygate" or "Ivy League Hacking" were already known before Tilghman stepped to the microphone: Eight students' names, birth dates, and social security numbers were used to access Yale's online notification site. Yale found out about the breach of its Web site after Princeton's Stephen LeMenager, the associate dean and director of admission, mentioned getting onto the site during an Ivy League admission officers meeting in May. Yale investigated the breaches and turned its information over to the FBI and Connecticut police, which continue to investigate the case. Tilghman learned of the incidents after Yale President Richard Levin called her on the evening of July 24. Levin also let her know that the Yale Daily News was about to break the story on its Web site the following day. The university had already apologized to the students involved, and LeMenager was immediately put on paid administrative leave pending an internal investigation What was not known was the motivation behind the online entries and what the university was going to do with LeMenager, who had served as the office's second in command after nearly 20 years of exemplary service, and Dean of Admission Fred Hargadon, who headed the office for the last 14 years and had not made any public comments on the matter since the story broke. As she read from a five-page, prepared statement that would later be forwarded to all university employees and posted on the university Web site, Tilghman explained how investigator William Maderer, who was hired because he had no connections to Princeton, had discovered that LeMenager was the first to enter the Yale site on April 3, just hours after Princeton admission letters to the Class of 2006 had been mailed out. Just as he admitted to a Yale student reporter three weeks earlier, LeMenager had gone into the site to check its security because Princeton was considering a similar system, Maderer learned. He went in fully expecting that he would be asked for a password or an ID number, but LeMenager was "surprised" that there was no added security beyond name, birth date, and social security number and told Hargadon and other members of the admission staff about his discovery. (The lack of security on the Yale site also made the New Haven school a target of bad press.) In the course of the next hour, he demonstrated what he had discovered to other staff members three more times, using the names and confidential information of two more Princeton applicants. Eventually several members of the Princeton staff entered the site on April 3, and there were other unauthorized entries on April 5 and a final visit on April 15. Despite all of the conjecture drummed up by those who painted the incident as Ivy League competition for students run amok, the investigation revealed that the integrity of last spring's admission process had not been affected and that curiosity was the main motivator for the online entries, Tilghman said. The investigation uncovered "no evidence that there was any intention on Mr. LeMenager's part to do anything other than test, and then demonstrate, the site's security or that he used confidential information for any other purpose." The university's investigator also decided that the motive in the later visits by other staff members was "simple curiosity—There is no evidence that this information was ever used in any way beyond satisfying that curiosity," Tilghman said. But she later added, "At the same time, it is clear that it was (LeMenager's) action that started a chain of events that led to more junior members of the admission staff accessing the site." Tilghman went on to announce that LeMenager had been removed from his position and that Hargadon would be retiring once he completes his term in June 2003. Neither LeMenager nor Hargadon attended the press conference. Calls for comment to LeMenager's attorney Brian Neary were never returned. According to Tilghman's statement, LeMenager agreed to his removal from the admission staff. Hargadon would have been retiring in June regardless of the revelations, but considering the circumstances, Tilghman said, she believed it was important to move up the timing of the announcement. In a written statement, Hargadon said he is "ultimately responsible for the manner in which we conduct the university's admission process and the manner in which all members of the admission office staff conduct themselves in the course of that process." "I also accept responsibility for not having called attention to the impropriety of such behavior immediately upon learning of the initial unauthorized accessing of the Yale site by a senior staff member," said Hargadon, who pledged to restore the integrity of his office. A search for his replacement will begin in the fall. LeMenager was placed in the university's office of communications and will be there until he and the university find an administrative position "commensurate with his considerable talents and experience," explained Tilghman. The members of the 30-person admission office who either entered the Yale website or who were aware that the website was being entered and did nothing were also disciplined, Tilghman said. Citing university policy, she said she could not say how many other staffers were involved or exactly what the disciplinary action entailed. "I think that the actions that were taken by our admission staff were breaches of ethical behavior and breaches of confidentiality," said Tilghman. The admission staff will also be going though a training program on their responsibilities when it comes to privacy and confidentiality and that measures will be established to ensure compliance. University officials will now be reviewing Princeton's policies on issues of privacy and its practices regarding the security of data. The university had already approved in the spring a request from its Office of Information Technology to add a new position of Information Technology Security Officer, and applications for that position are currently being reviewed. Princeton's president said she hopes that the incident will not shake the confidence of future applicants. "I think that we have responded very effectively in beginning the process of restoring the confidence that we have always enjoyed," she said. Yale's President Levin said that Tilghman handled a very difficult situation in an exemplary manner and immediately recognized the seriousness of the problem. "I am impressed by the thoroughness of Princeton's internal investigation and confident that all concerned now recognize the importance of protecting the privacy of college applicants," Levin said in a statement.
|
