George W. Bush is the president of what country? How many U.S. states are there?
It was apparently as simple as answering secret password questions such as these to hack into the personal network account of a student or faculty member last semester.
CSUN students Lena Chen, 20, and Jennifer Ngan, 19, are charged with infiltrating the campus account of a political science professor late last May, changing their grades and those of about 300 classmates.
In addition, the account’s initial password was changed and all incoming messages were forwarded to their own e-mail address. Later, they purportedly found personal information and used it to order pizza, sign up for magazine subscriptions and order a shipment of CDs under the name of the professor.
At their arraignment last month, the two defendants entered a “not guilty” plea and are scheduled to appear at the San Fernando Superior Courthouse on Sept. 26 for a pretrial proceeding. Neither Chen nor Ngan could be reached for comment.
For privacy reasons, the campus has chosen not to disclose the professor’s name.
“CSUN police were able to track the two students through the university server when the same account was accessed simultaneously,” said Frank Mateljan, spokesman for the L.A. city attorney’s office, at which point Chen reportedly confessed to the entire affair.
There was no indication during the initial police investigation that any of the other students in the political science course they were taking were involved, Mateljan said.
Chen and Ngan were then directed to William Watkins, vice president of student affairs, who said he met with the students to hear their response to the charges brought against them so as to determine the proper punishment.
The result was that they were “held accountable” for their alleged actions, said Watkins, who would not confirm if the former students were suspended or expelled.
Both face criminal charges.
Chen faces two counts of illegally accessing a computer network, one count of altering that network, and one count of illegal use of private information. Ngan also faces two counts of illegally accessing a computer system, and one count of acquiring private information with the intent to defraud.
If convicted, they could spend one year in prison for each count, said Mateljan, though the sentences are often only one year, as multiple charges are typically merged.
Michael Zweiback, U.S. attorney in the cyber crimes and intellectual property unit, said that in these cases sentencing depends on the motives of the perpetrators and on whether their hacking caused a considerable amount of financial damage.
Ken Swisher, vice president of CSUN public relations, said the original grades have been restored and that the CSUN Web portal security will be updated, making it more difficult for hackers to deduce the passwords of students or of faculty.
“We’re always updating our security,” Swisher said. “It’s part of our normal process.”
Al Arboleda, information security officer, said students and faculty will now choose questions to answer from a predetermined list to retrieve forgotten passwords.
Some of the private information of faculty members has also been removed from their personal accounts, said Arboleda, who is redesigning the Web portal to make it more than just an online tool students use to add their classes and check their schedules.
Zweiback said universities often experience these breaches because their systems are designed to be user friendly and, as a result, security becomes a second priority.
