New York Times
July 26, 2002

Princeton Pries Into Web Site for Yale Applicants
By KAREN W. ARENSON

At the height of the college admissions season in early April, the director
of admission at Princeton and possibly others in his office improperly and
repeatedly
entered a Web site set up to let Yale applicants know if they had been
accepted as students, officials at both Ivy League universities confirmed
yesterday.

Yale officials filed a complaint yesterday with the Federal Bureau of
Investigation. Princeton officials apologized for what they called a
"serious lapse
of judgment" by the director, Stephen E. LeMenager. Princeton placed him on
administrative leave pending an investigation of the incident, which was first
reported yesterday by the online edition of The Yale Daily News, the
undergraduate newspaper.

Mr. LeMenager acknowledged that he had entered the Yale site by using the
birth dates and Social Security numbers of Princeton applicants who had
also applied
to Yale, the Yale Daily News report said.

Yale investigators found that their computer site had been improperly
entered 18 times and that 11 applicants' records had been called up without
authorization.

The temporary site, new this year, was designed to flash a congratulatory
message if an applicant had been admitted. Those who were not accepted received
a simpler message. The site also included information about applicants'
extracurricular and academic interests. It warned that only prospective
students
should use the site. Not even their parents were permitted to log on.

Neither university was willing to comment on what might have been Mr.
LeMenager's motive for entering the site. He has been with the Princeton
admission
office since 1983 and was promoted to associate dean and director of the
office in July 2001. He did not respond to e-mail or telephone messages
yesterday,
and the university said he would not be available.

But The Yale Daily News reported that Mr. LeMenager said he had gained
access to the Yale site because he was curious about its security. "It was
really
an innocent way for us to check out the security," Mr. LeMenager was quoted
as saying. "That was our main concern of having an online notification system,
that it would be susceptible to people who had that information ¯ parents,
guidance counselors and admissions officers at other schools."

Princeton officials did not learn of the intrusion until late Wednesday
evening, when Yale's president, Richard C. Levin, called Princeton's president,
Shirley M. Tilghman. She and other Princeton officials spent much of
yesterday trying to learn more about what had happened and discussing what
to do.

A Princeton spokeswoman, Marilyn Marks, said yesterday, "We deeply regret
that information provided by students in good faith was used inappropriately by
at least one official in our admission office."

Princeton officials said the university plans to hire an outside
independent counsel to investigate whether anyone other than Mr. LeMenager
had misused
the Yale Web site and other aspects of the case, including the motive.

The report stunned and puzzled other college officials. Some saw it as a
disturbing sign of how frenzied the college admissions process has become,
particularly
at elite institutions like Yale and Princeton, which receive more than 10
applications for every place in their first-year classes. (Yale had 15,400
applications
this year for a class of 1,300, while Princeton had 14,521 applications for
a class of 1,160.)

"This report reflects the heightened craziness about admissions decisions,"
said James O. Freedman, a legal scholar and the former president of Dartmouth.
"It probably wouldn't subvert the Constitution, but it is competitiveness
taken to a dastardly length."

Robert Schaeffer, the public education officer for the National Center for
Fair and Open Testing, who follows college admissions closely, said this case
illustrated how the competition by selective colleges for a handful of top
students had become "an arms race in which each side tries to one-up the
other."

It was not clear yesterday if there was anything that stood out about the
applicants whose records were looked up. The two universities would not
identify
them or reveal their admissions status. The editor in chief of The Yale
Daily News, Chris Michel, a history major who is from Dublin, in northern
California,
speculated that Princeton officials could have been trying to learn more
about the students' interests or other personal information available on
the Web
site.

"That could have provided informational advantage to Princeton beyond just
whether a student was accepted or rejected," Mr. Michel said. "As a student,
it's especially disturbing to find that a university would exploit
information like this. We put a lot of trust in universities."

Some legal experts said that the behavior appeared to cross both ethical
and legal lines. Jeffrey Rosen, an associate professor at the George Washington
University Law School, said that if the allegations proved accurate, "there
is a decent case that Princeton was guilty of a federal misdemeanor under the
federal computer fraud and abuse act that prohibits anyone from
intentionally accessing a computer without authorization or exceeding
authorized access."

Stephen Gillers, vice dean at the New York University School of Law, called
the actions a betrayal of student trust. "The only antidote is serious
discipline
of those involved," he said. "Treating the incident lightly would compound
the harm."

Yale officials learned of the unauthorized activity on the Web site in
June, and then conducted their own investigation, but the university said
yesterday
that it would not release the internal report. Yale officials said that
they had reported the incident to state and federal law enforcement authorities
and to the applicants whose information was looked up.

One report went to the F.B.I.'s New Haven office. "We're in the process of
assessing the situation to determine if there was a federal violation," said
Lisa Bull, a spokeswoman for the office. She said that the division's
computer investigation squad was likely to investigate it first.

In a statement released yesterday, Dorothy K. Robinson, Yale's vice
president and general counsel, said: "We have also notified Princeton and
expect that
they will follow up appropriately. We are deeply concerned about the
privacy of our students."

Yale is one of a growing number of universities that allow applicants to
learn electronically whether they have been admitted, without waiting for
notices
to arrive by mail. Some systems require a special prearranged password.
Yale's Web site, set up last winter, did not.

Mr. Rosen, the George Washington law professor, said that that was not
enough protection for securing confidential information. "It's quite
remarkable that
Yale set up a Web site with only a Social Security and birth date as
passwords," he said. "These things are so easily obtained."

Harvard also used the Internet to provide prospective students with quicker
notification of admissions decisions this year, but it sent e-mail messages
to applicants rather than requiring them to log onto a Web site.

"Our computer science people advised us to use e-mail because it would be
more secure rather than setting up a special Web site, which they said would be
possible to break into," said William R. Fitzsimmons, dean of admissions
and financial aid at Harvard.

About a hundred of the e-mail admissions decisions that Harvard sent to
students in December failed to reach them and ended up bouncing back for a
variety
of reasons.

The University of Pennsylvania, like Yale, used an Internet Web site for
the first time this year to allow students to learn whether they had been
admitted
on April 3, but students had to have a specially assigned password to gain
access.

"We had about 12,000 inquiries to the site in six or seven hours, from
among almost 19,000 applicants," said Lee Stetson, the university's dean of
admissions.
"We avoided using Social Security numbers for confidentiality and because
of the potential for their misuse."

Thomas Conroy, a Yale spokesman, said Yale planned to use a Web site again,
but with "additional security."

Copyright 2002 The New York Times Company |
Permissions |
Privacy Policy 


VICUG-L is the Visually Impaired Computer User Group List.
To join or leave the list, send a message to
[log in to unmask]  In the body of the message, simply type
"subscribe vicug-l" or "unsubscribe vicug-l" without the quotations.
 VICUG-L is archived on the World Wide Web at
http://maelstrom.stjohns.edu/archives/vicug-l.html