Princeton demotes dean for breach of Yale admissions Web site

Computerworld - After an internal investigation, Princeton University said an admissions dean who improperly accessed the admissions Web site of Yale University has been removed from his post and offered another job at the university.
In a statement, Princeton President Shirley Tilghman said she would bring disciplinary action against members of the admissions department who also improperly entered the Yale Web site.
"Violations of basic ethical principles of privacy and confidentiality are especially serious in a university that teaches these principles and counts them among its core values. Students who apply to Princeton, or to any other university, have every right to expect that information they provide in good faith will be used only for the purposes for which they provided it, and that their privacy and confidentiality will be respected," said Tilghman in the statement. "We clearly did not meet those expectations in this case."
Last month, Princeton acknowledged that in April, Stephen LeMenager, associate dean and director of admissions, used the Social Security numbers of Princeton students to access a secure Web site for students applying to Yale University in New Haven, Conn.
LeMenager was placed on administrative leave while the university investigated the incident. Until a new position is found, LeMenager will work in the university's communications office.
In a separate statement, Princeton Dean of Admissions Fred Hargadon accepted responsibility for failing to recognize the impropriety of LeMenager's actions. Hargadon will retire next June.
Yale President Richard Levin said in a statement that Tilghman handled "a very difficult situation in an exemplary manner."
In July, the FBI field office in New Haven confirmed that it had opened an investigation into the matter but refused further comment. Today, an FBI spokesperson couldn't be reached for comment at deadline. A spokeswoman for the U.S. Attorney's Office in New Haven said today she couldn't confirm or deny such an investigation.
Tilghman said independent investigators traced 18 unauthorized log-ins to the Yale site by Princeton computers -- 14 from the admissions office in April, three from students on campus and one from a Yale applicant who used a Princeton computer.
She said LeMenager first entered the Yale Web site on April 3, using the name, birth date and Social Security number of a Princeton student he thought might have applied to Yale. When he discovered that he didn't need a password or an ID number to access the site, he told other members of the admissions office, including Hargadon, and then accessed the site three more times to demonstrate how easy it wasto gain access.
Junior staffers then accessed the site eight more times on April 3, and again on April 5 and April 15, Tilghman said. LeMenager told Yale of Princeton's entry into its Web site at a meeting of Ivy League admissions officers on May 15.
"While we do not in any way condone these actions, there is no evidence that there was any intention on Mr. LeMenager's part to do anything other than test and then demonstrate the site's security or that he used confidential information for any other purpose," said Tilghman in the statement.
A Princeton spokeswoman said the university had no further comment.

Read more about Privacy in Computerworld's Privacy Topic Center.