Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Education

Tufts Expelled a Student For Grade Hacking. She Claims Innocence (techcrunch.com) 344

An anonymous reader quotes TechCrunch: As she sat in the airport with a one-way ticket in her hand, Tiffany Filler wondered how she would pick up the pieces of her life, with tens of thousands of dollars in student debt and nothing to show for it. A day earlier, she was expelled from Tufts University veterinary school. As a Canadian, her visa was no longer valid and she was told by the school to leave the U.S. 'as soon as possible.' That night, her plane departed the U.S. for her native Toronto, leaving any prospect of her becoming a veterinarian behind. Filler, 24, was accused of an elaborate months-long scheme involving stealing and using university logins to break into the student records system, view answers, and alter her own and other students' grades.

The case Tufts presented seems compelling, if not entirely believable.

There's just one problem: In almost every instance that the school accused Filler of hacking, she was elsewhere with proof of her whereabouts or an eyewitness account and without the laptop she's accused of using. She has alibis: fellow students who testified to her whereabouts; photos with metadata putting her miles away at the time of the alleged hacks; and a sleep tracker that showed she was asleep during others. Tufts is either right or it expelled an innocent student on shoddy evidence four months before she was set to graduate.

This discussion has been archived. No new comments can be posted.

Tufts Expelled a Student For Grade Hacking. She Claims Innocence

Comments Filter:
  • by Anonymous Coward on Saturday March 09, 2019 @07:43PM (#58244504)

    Hire a lawyer and sue the fuck out the school.

  • None of that evidence proves that she didn't get a friend to hack into the system, look at the answers, and change her grades for her. Note that other students' grades were also changed; there was likely a "psst, pay me $500 and I'll give you better grades" type of scheme going on here.

    If it's her first cheating offense, her completion of the courses in question should be vacated and she should just be forced to redo them. Zero tolerance policies of expulsion on first offense go against the point of educati

    • by sjames ( 1099 )

      Likewise, we've seen no evidence that she did anything at all wrong.

      • by SuperKendall ( 25149 ) on Saturday March 09, 2019 @11:01PM (#58245290)

        The fact her grades were changed (along with others) is evidence. Her laptop *was* used for some of this hacking, even she is not denying this.

        I honestly don't know to believe her or not; lots of the alibi material also could be rigged.

        At the very least there should be an investigation that would let her return if they find someone else did it. But to say there is no evidence, is really going too far the other way.

        • by sjames ( 1099 )

          On the other hand, a RAT was found on her laptop. That and otherwise we would have to believe that she was sophisticated enough at computer security to manage all that hacking, but not enough to know she shouldn't do it on her own laptop connected to the school's LAN.

        • by sfcat ( 872532 )

          The fact her grades were changed (along with others) is evidence. Her laptop *was* used for some of this hacking, even she is not denying this.

          I honestly don't know to believe her or not; lots of the alibi material also could be rigged.

          At the very least there should be an investigation that would let her return if they find someone else did it. But to say there is no evidence, is really going too far the other way.

          The evidence in the article clearly point to some other actor using her as a scapegoat. The idea that she did this given the evidence being presented is extremely unlikely. That being said, perhaps we don't know all the facts. But given the presented facts, you would have to be a fool to think that it points at her. The quotes from the school officials demonstrates a clear lack of understanding about technical matters. And the idea that a university IT department has any sort of competency in computer

      • Likewise, we've seen no evidence that she did anything at all wrong.

        Why should we ? It's a private matter, and we are not part of this case in one way or the other.

    • by sheetsda ( 230887 ) <<doug.sheets> <at> <gmail.com>> on Saturday March 09, 2019 @09:59PM (#58245082)

      None of that evidence proves that she didn't get a friend to hack into the system, look at the answers, and change her grades for her.

      This is unfalsifiable. Nothing could prove that short of omniscience.

      Note that other students' grades were also changed; there was likely a "psst, pay me $500 and I'll give you better grades" type of scheme going on here.

      That's only the most obvious possibility. Here's another one: The hacker is amongst that group. He/she possesses MAC address+name combinations for all of those people and adjusted all of their grades in order to create uncertainty about which of them was the hacker. Cloning MAC addresses was one of many tactics the hacker used, but the methods used by the school to track the hacker happened to seize upon that particular countermeasure.

      • by gweihir ( 88907 )

        They just have the MAC address to identify her machine? No forensics on the laptop itself? That is crazy. MAC address changes are often as simple as running a single command as root. Finding the MAC address of a particular machine is a bit harder, not is that hard either if you are on-site.

        • by Corbets ( 169101 )

          They just have the MAC address to identify her machine? No forensics on the laptop itself? That is crazy. MAC address changes are often as simple as running a single command as root. Finding the MAC address of a particular machine is a bit harder, not is that hard either if you are on-site.

          Everyone here knows how to spoof a layer 2 address. However, why would the school have forensic access to her PC? The most likely case is that it’s privately owned, and thus they have no control over it.

          They might, however, have been able to identify the specific port used by the MAC address and might know that it links to her dorm room (I didn’t read the article, only the summary). That sort of thing reduces the suspect pool significantly - toss in a few other clues and they might have a prepon

          • by sfcat ( 872532 )

            They just have the MAC address to identify her machine? No forensics on the laptop itself? That is crazy. MAC address changes are often as simple as running a single command as root. Finding the MAC address of a particular machine is a bit harder, not is that hard either if you are on-site.

            Everyone here knows how to spoof a layer 2 address. However, why would the school have forensic access to her PC? The most likely case is that it’s privately owned, and thus they have no control over it.

            They might, however, have been able to identify the specific port used by the MAC address and might know that it links to her dorm room (I didn’t read the article, only the summary). That sort of thing reduces the suspect pool significantly - toss in a few other clues and they might have a preponderance of evidence. We simply don’t know, as they haven’t (and won’t outside a court of law) released their version of events.

            She lived off campus and the landlord was never contacted by the school. Unless her ISP was contacted, there was no way for them to know enough to even accuse her. They didn't even know her IP address. And the school officials clearly don't understand computer forensics as they seem to think that editing a photo is the same as spoofing the cryptographic signatures on a picture.

  • by guruevi ( 827432 ) on Saturday March 09, 2019 @07:55PM (#58244554)

    In many cases security at an academic institute is a springboard to private as well as a wasteland of people without talent. On the other hand, a smart hacker would also find ways of altering access logs or create an alibi.

  • weird. (Score:5, Insightful)

    by WindBourne ( 631190 ) on Saturday March 09, 2019 @07:58PM (#58244570) Journal
    Hmmm. She really should insist on taking a comprehensive test at this point and proving herself. She has a 3.9 on the Masters and 3.5 on the Doctorate. While Tufts is not that top notch, it certainly is not a fluff school either. Simple testing should prove what she knows/does not know.
    As it is, if somebody really knows how to crack, then they would purposely change their mac (easy enough to do). I would be curious about her relationship to the other grades that changed.
    • Re:weird. (Score:5, Interesting)

      by apoc.famine ( 621563 ) <apoc...famine@@@gmail...com> on Saturday March 09, 2019 @08:22PM (#58244670) Journal

      I think the fact that she got expelled proves her innocence. If she could hack the system, she would have deleted that.

    • Tufts has the only veterinary program in New England.

      Changing a MAC may not be enough to gain access to a local network. wi-fi access can also require a local software token to register the host, and that approach is increasingly common place at universities where theft of wifi access by visitors or students who don't care to have illegal activity tracked is commonplace.

      • Re:weird. (Score:5, Interesting)

        by sheetsda ( 230887 ) <<doug.sheets> <at> <gmail.com>> on Saturday March 09, 2019 @10:04PM (#58245102)

        Changing a MAC may not be enough to gain access to a local network. wi-fi access can also require a local software token to register the host,

        From the article: "Tufts said she stole a librarian’s password to assign a mysteriously created user account, “Scott Shaw,” with a higher level of system and network access."

        Apparently librarian has the power to create network administration accounts so I suspect we're not dealing with a paragon of information security here. It would be mighty interesting to see all the MAC address logs from all the on-campus wi-fi routers and see if this MAC address was ever observed being in two places at once.

        The times the fitness tracker recorded her being asleep are meaningless - anyone could've been wearing it. But the times she was being physically observed, and particularly the instance of physically observed + not on computer are intriguing. It would also be interesting to profile the interaction of the times she was being physically observed versus the interactions taking place in the "hacking". If you're being physically observed to create an alibi, then you're using a script to do your hacking in the background and that's generally going to look much less stochastic than live human interaction.

        • Apparently librarian has the power to create network administration accounts so I suspect we're not dealing with a paragon of information security here.

          We're talking about an academic institution here. There's no higher authority than that of the librarian. I'm not even being funny here, I once saw the Chancellor of the IT school at our university walk through the library talking to a local politician (opposition at the time), and they got shushed by the librarian, apologised and left.

      • Tokens are trivial to bypass. I do it all the time at hotels (so my family doesn't have to re-validate a half dozen devices every 24 hours when the token expires). You just set up a WiFi router in client mode (so it acts like a wireless adapter). Have it spoof your laptop's MAC address if necessary. You then connect your laptop to the router, and login to the hotel WiFi via the router's WiFi. The hotel WiFi reads the MAC address off the router, the token is validated via the laptop (which since it's go
      • Tufts has the only veterinary program in New England.

        Your point? She's Canadian. Shouldn't have been a problem attending there [canadianve...arians.net].

  • by Actually, I do RTFA ( 1058596 ) on Saturday March 09, 2019 @08:03PM (#58244582)

    The article is making it sound sad that she only had 4 months left on her degree. That probably caused Tufts to have to act sooner. Expelling her is probably significantly easier than revoking her degree if issued. If she was a first year, they probably could have taken more time.

    But now, if she is later exonerated, they can let her back in for her last set of classes a year late.

  • "Date stamps are easy to edit," said Knoll. "In fact, the photos you shared with me clearly include an 'edit' button in the upper corner for this exact purpose," she wrote, referring to the iPhone software's native photo editing feature. "Why wait until after you'd been informed that you were going to be expelled to show me months' old photos?" she said.

    Why show the photos any earlier? It sounds like she didn't know she would be expelled until she was accused of this hacking. What did this genius expect? That Filler would just walk up randomly to people to share a photo of her on a weekend trip? I mean, would that not be MORE suspicious? "Excuse me, just in case you might in the future accuse me of hacking the university computers last weekend I thought I'd show photographic evidence I was out of town."

    I thought these people worked at a school.

    • by Shaitan ( 22585 )

      You are making a lot of assumptions here, not the least of which is that they determined the punishment before levying the charge. Just for a second entertain the possibility the university staff aren't all idiots.

      • by Kjella ( 173770 )

        You are making a lot of assumptions here, not the least of which is that they determined the punishment before levying the charge. Just for a second entertain the possibility the university staff aren't all idiots.

        Actually I think that's a very small assumption, cheating on an exam is a big offense. Hacking school systems to cheat? Maybe you can get away with it at 14 but at 24 I'd say that's a pretty much automatic expulsion. It's more like "do we have enough evidence to prosecute" level of offense.

      • Re: (Score:3, Insightful)

        by blindseer ( 891256 )

        If they don't want to be taken for idiots then perhaps they could open up a bit on what really happened. It sounds like the student was called to answer for her supposed crimes while not given any time to build a defense. She probably forgot about the weekend trip until she dug into her schedule for the months prior. Do you remember where you spent every weekend for the past year? When she did bring up evidence in her defense then they dismissed it as something she likely doctored.

        This looks like a kang

        • This looks like a kangaroo court.

          At a college? We can't have that!!!???

        • If they don't want to be taken for idiots then perhaps they could open up a bit on what really happened.

          Why? Answering to the court of public opinion is only likely to get them in trouble should they ever have to answer to an actual court. The university doesn't own anyone a comment on someone's sob story to the media.

          It sounds like the student was called to answer for her supposed crimes while not given any time to build a defense.

          I've been on the university side of this discussion and I call bullshit. Expulsion is no swift matter, and a claim like this most definitely will have gone through multiple levels of escalation over months.

          She probably forgot about the weekend trip until she dug into her schedule for the months prior. Do you remember where you spent every weekend for the past year? When she did bring up evidence in her defense then they dismissed it as something she likely doctored.

          Oh? Weren't you just saying the university should open up on what "really" happened? It so

  • Nobody who is innocent has an alibi ready to go. Real people in the real world don't have documentation putting them elsewhere most of the time because they don't expect to need it. People who have that documentation ready to go, especially for a large number of incidents, made sure they'd have it to prove their innocence which means they aren't innocent at all.

    • I dunno, if you use an Android phone with Google maps, by default, you can probably retrieve detailed info about your location and movements unless you've turned that feature off. I happened to have it on for several years, which turned out to be lucky if unintentional, as I used it to successfully defend myself in a legal matter. I could show times and places on a series of maps Google had tracking my phone checking in that were incompatible with the crazy claims of somebody accusing me of some totally irr

    • Comment removed (Score:4, Insightful)

      by account_deleted ( 4530225 ) on Saturday March 09, 2019 @08:31PM (#58244706)
      Comment removed based on user account deletion
    • by godrik ( 1287354 )

      Or maybe she is a maniac instagrammer so she has pictures of every hour of her life?

    • by Anonymous Coward on Saturday March 09, 2019 @08:44PM (#58244736)

      All of these statements lead me to believe you have not interacted with a college-age human in quite some time.

      You see, we have these things that we call 'smartphones' now, that are really just sophisticated tracking devices that log our exact whereabouts down to the meter, chronicle every interaction we have with other people via online services, and tag every photo we take with them with timestamps and geographic coordinates. From the moment they get one, real people in the real world keep these devices on their person or close to hand for almost every waking moment of their lives, so much so that not having verifiable documentation of exactly where you were, what you were doing, and when you were doing it is the more unusual scenario.

      That said, none of this necessarily implies this person is innocent; my only point is that having an alibi ready to go has been the default state of the smartphone-carrying world for roughly a decade now.

    • by Kjella ( 173770 )

      Real people in the real world don't have documentation putting them elsewhere most of the time because they don't expect to need it.

      Meh, if you have the Facebook app they probably know more about where you've been than you do.

    • Nobody who is innocent has an alibi ready to go. Real people in the real world don't have documentation putting them elsewhere most of the time because they don't expect to need it. People who have that documentation ready to go, especially for a large number of incidents, made sure they'd have it to prove their innocence which means they aren't innocent at all.

      I could easily produce lots of data to support alibis that I didn't previously know I needed, because I log lots of my life. Google Maps tracks my phone's location all the time, and it's basically never further from me than the next room. I use a sleep tracker, and that data is logged to Fitbit. What I eat is also logged to Fitbit, with timestamps. Same for my workouts. My meditation sessions are logged by Headspace. My work is logged in EMACS org mode, down to a resolution of a few minutes... and much

    • by sjames ( 1099 )

      So you're saying if she floats she's a witch and we kill her, but if she drowns she's innocent?

    • Mmmmm, I disagree.

      Carry a cellphone and chances are you can account for most of your movements during a typical day. If you use credit cards then you have another nearly unimpeachable set of data points to track your whereabouts at specific times.

      I also don't recall the article stating that she had an alibi "ready to go". Where did that idea or claim come from?

    • Wait, are you really arguing "If she can prove she is innocent, she's guilty?"

      If so ... what the fuck are you smoking?
  • by Anonymous Coward on Saturday March 09, 2019 @08:26PM (#58244694)
    My fave part: "“I thought due process was going to be followed,” said Filler, in a call. “I thought it was innocent until proven guilty until I was told ‘you’re guilty unless you can prove it.'”"

    Really? I'm pretty sure the last few years has shown for universities it is "guilty until sentenced - maybe we'll revisit the evidence in a year or two,after your life is ruined".
  • by Anonymous Coward on Saturday March 09, 2019 @08:46PM (#58244746)

    Tufts is either right or it expelled an innocent student ...

    This is why tertiary institutions shouldn't be allowed to act as the police. I realize, in this case, that much of the behaviour relates to academic integrity but the case should have been referred to the FBI.

    Also, she should sue for defamation and loss of income.

  • The university's side is not told here. The university will not reveal information to TechCrunch. So all we have here is the expelled student's version of events. It would be very strange indeed if it didn't suggest her innocence when she's the only person telling the story.

  • Maybe she was framed. You gotta admit it would be a great way to get rid of her.

    Yes, it would take a pretty motivated person to do something like this, but I've known people who wouldn't be above this kind of behavior if they had the skills to pull it off.

  • "It's never twins." - Sherlock

  • Donation? (Score:3, Interesting)

    by greylion3 ( 555507 ) on Sunday March 10, 2019 @08:27AM (#58246644)

    I'd like her to sue Tufts, and I'd donate $50 towards that.

  • by X!0mbarg ( 470366 ) on Sunday March 10, 2019 @09:04AM (#58246766)

    Isn't that a "Right" down there in the Excited States?
    Or does that not apply to Colleges and Universities?
    It's a shame she doesn't have the money to fight this, or a decent lawyer could likely get her a HUGE settlement, with compensation for everything she has to endure over all this B.S.
    Looks like she'll be suffering under the (potentially) false accusations (and summary conviction) op these offenses against the institution.
    I'd just like to know: Just how much evidence contrary to the accusation does she need to be exonerated, or is she just doomed?

Truly simple systems... require infinite testing. -- Norman Augustine

Working...