University Allows Student Journalist Who Discovered Data-Security Flaw to Remain

September 30, 2007

A student at Western Oregon University, who discovered while working at the campus newspaper that the institution had left private information about some applicants out in the open, on an unsecured computer network, will not be kicked out of the university. A disciplinary committee, which met on Friday to determine the student’s fate, decided that he could stay.

Blair W. Loving, a 29-year-old senior English major and copy editor for the student paper, had been accused of violating the university code of conduct because he accessed sensitive material on a university computer, The Oregonian reported. The incident, which occurred in June, had already cost the job of the newspaper’s faculty adviser, Susan Wickstrom.

The trouble started on June 5 when Mr. Loving, while working at the student-run Western Oregon Journal, logged on to the university’s network and opened a file that contained the names and Social Security numbers of 100 applicants to Western Oregon’s College of Education. He told The Oregonian, a newspaper in Portland, Ore., that he found the file by accident, and was shocked to see how much confidential information it contained.

Mr. Loving says he made a copy of the file and immediately told the editor at the student paper, who informed Ms. Wickstrom of the discovery that same day. She reportedly kept a copy of the file given to her by the students. The editor also informed College of Education officials; the newspaper went on to publish a story about the security lapse that month.

By June 7, university administrators had begun an investigation. It is not clear what they did to shore up computer security, but it is clear that they felt both Mr. Loving and Ms. Wickstrom may have violated the institution’s computer-use policy. Ms. Wickstrom — who did not immediately inform the administration of the data breach — was notified on August 8 that her contract would not be renewed. Mark Weiss, Western Oregon’s vice president for finance and administration, said that he could not comment directly on the dismissal because it was a personnel matter. But he stated that a journalism adviser should be able to inform students about the importance of privacy as well as the importance of press freedom.

Mr. Loving went before the Student Conduct Committee on Friday. Tina Fuchs, dean of students, told The Oregonian that she would not comment on the decision because it was confidential.

Mr. Loving told the Portland newspaper that he would be allowed to remain at the university, but he would have to write a proposal for helping students understand the responsibilities of using the computer system. And he would have to write a commentary in the student paper about the importance of reading campus policies.

The university, for its part, agreed to restore Mr. Loving’s computer access. —Josh Fischman