office investigation concludes Staff disciplined and
By Argelio Dumenigo
Summertime at Princeton and its undergraduate admission office
is usually a peaceful time. Vacations loom, summer hours begin,
and there are months to go before the full onslaught of the admission
process kicks in again.
This year, however, the discovery of unauthorized uses of applicants'
personal information to access a Yale University Web site splintered
that peace, putting Princeton on the ugly end of a media frenzy
and leading to the eventual departure of the admission office's
two highest ranking members.
On August 13, after nearly three weeks of speculation, President
Tilghman stepped up to a podium in the MacLean House to describe
what an internal investigation by a former federal prosecutor had
discovered about what happened at the admission office during the
first few weeks of April, when staffers there on 14 different occasions
accessed a Web site Yale had set up to let applicants know if they
had been accepted.
Many of the facts of what some media outlets had fun calling "Ivygate"
or "Ivy League Hacking" were already known before Tilghman
stepped to the microphone:
Eight students' names, birth dates, and social security numbers
were used to access Yale's online notification site.
Yale found out about the breach of its Web site after Princeton's
Stephen LeMenager, the associate dean and director of admission,
mentioned getting onto the site during an Ivy League admission officers
meeting in May.
Yale investigated the breaches and turned its information over
to the FBI and Connecticut police, which continue to investigate
Tilghman learned of the incidents after Yale President Richard
Levin called her on the evening of July 24. Levin also let her know
that the Yale Daily News was about to break the story on its Web
site the following day.
The university had already apologized to the students involved,
and LeMenager was immediately put on paid administrative leave pending
an internal investigation
What was not known was the motivation behind the online entries
and what the university was going to do with LeMenager, who had
served as the office's second in command after nearly 20 years of
exemplary service, and Dean of Admission Fred Hargadon, who headed
the office for the last 14 years and had not made any public comments
on the matter since the story broke.
As she read from a five-page, prepared statement that would later
be forwarded to all university employees and posted on the university
Web site, Tilghman explained how investigator William Maderer, who
was hired because he had no connections to Princeton, had discovered
that LeMenager was the first to enter the Yale site on April 3,
just hours after Princeton admission letters to the Class of 2006
had been mailed out. Just as he admitted to a Yale student reporter
three weeks earlier, LeMenager had gone into the site to check its
security because Princeton was considering a similar system, Maderer
He went in fully expecting that he would be asked for a password
or an ID number, but LeMenager was "surprised" that there
was no added security beyond name, birth date, and social security
number and told Hargadon and other members of the admission staff
about his discovery. (The lack of security on the Yale site also
made the New Haven school a target of bad press.)
In the course of the next hour, he demonstrated what he had discovered
to other staff members three more times, using the names and confidential
information of two more Princeton applicants. Eventually several
members of the Princeton staff entered the site on April 3, and
there were other unauthorized entries on April 5 and a final visit
on April 15.
Despite all of the conjecture drummed up by those who painted
the incident as Ivy League competition for students run amok, the
investigation revealed that the integrity of last spring's admission
process had not been affected and that curiosity was the main motivator
for the online entries, Tilghman said.
The investigation uncovered "no evidence that there was any
intention on Mr. LeMenager's part to do anything other than test,
and then demonstrate, the site's security or that he used confidential
information for any other purpose."
The university's investigator also decided that the motive in
the later visits by other staff members was "simple curiosityThere
is no evidence that this information was ever used in any way beyond
satisfying that curiosity," Tilghman said.
But she later added, "At the same time, it is clear that
it was (LeMenager's) action that started a chain of events that
led to more junior members of the admission staff accessing the
Tilghman went on to announce that LeMenager had been removed from
his position and that Hargadon would be retiring once he completes
his term in June 2003.
Neither LeMenager nor Hargadon attended the press conference.
Calls for comment to LeMenager's attorney Brian Neary were never
returned. According to Tilghman's statement, LeMenager agreed to
his removal from the admission staff.
Hargadon would have been retiring in June regardless of the revelations,
but considering the circumstances, Tilghman said, she believed it
was important to move up the timing of the announcement.
In a written statement, Hargadon said he is "ultimately responsible
for the manner in which we conduct the university's admission process
and the manner in which all members of the admission office staff
conduct themselves in the course of that process."
"I also accept responsibility for not having called attention
to the impropriety of such behavior immediately upon learning of
the initial unauthorized accessing of the Yale site by a senior
staff member," said Hargadon, who pledged to restore the integrity
of his office. A search for his replacement will begin in the fall.
LeMenager was placed in the university's office of communications
and will be there until he and the university find an administrative
position "commensurate with his considerable talents and experience,"
The members of the 30-person admission office who either entered
the Yale website or who were aware that the website was being entered
and did nothing were also disciplined, Tilghman said. Citing university
policy, she said she could not say how many other staffers were
involved or exactly what the disciplinary action entailed.
"I think that the actions that were taken by our admission
staff were breaches of ethical behavior and breaches of confidentiality,"
said Tilghman. The admission staff will also be going though a training
program on their responsibilities when it comes to privacy and confidentiality
and that measures will be established to ensure compliance.
University officials will now be reviewing Princeton's policies
on issues of privacy and its practices regarding the security of
data. The university had already approved in the spring a request
from its Office of Information Technology to add a new position
of Information Technology Security Officer, and applications for
that position are currently being reviewed.
Princeton's president said she hopes that the incident will not
shake the confidence of future applicants. "I think that we
have responded very effectively in beginning the process of restoring
the confidence that we have always enjoyed," she said.
Yale's President Levin said that Tilghman handled a very difficult
situation in an exemplary manner and immediately recognized the
seriousness of the problem.
"I am impressed by the thoroughness of Princeton's internal
investigation and confident that all concerned now recognize the
importance of protecting the privacy of college applicants,"
Levin said in a statement.