Princeton behind online espionage? Covert admissions activity hits the Ivy League. (In The News).

It might look as if Shirley Tilghman, president of Princeton University, is letting her admissions staff off easy for hacking into Yale's Web site. Tilghman is reassigning Stephen LeMenager, the director of Admissions at Princeton (and a Princeton employee for 20 years) to another job. At press time, it wasn't clear what his new assignment would be. His boss, Fred Hargadon, Dean of Admissions, will stay on the job until his planned retirement begins next July.

In a detailed, five-page statement issued in late summer, Tilghman stressed how important student confidentiality is to Princeton. In addition to conducting their own internal investigation, Princeton officials have set about to train admissions personnel on the sanctity of student privacy. But internal measures may not be enough: The Federal Bureau of Investigations is currently looking into whether Princeton violated the Family Educational Rights Privacy Act, which protects student privacy.

In all, individuals accessed data on 11 Yale applicants a total of 18 times. In most cases, computers in the Princeton Admissions office were used to access Yale's admissions information. Four Web site visits were conducted outside the Princeton Admissions office and appear to be student access situations. (One student, for example, was visiting Princeton and looked up Yale admissions status from a library computer; another checked on Yale admissions status for a sibling.)

Tilghman's statement notes the "integrity of the admissions process was not affected by these actions." And indeed, Princeton's admissions letters were sent out April 2, a day before staffers hacked Yale's Web site. Still, considering that the competitive process was already complete, why would LeMenager and his staff even bother to hack the site? According to the Admissions director, he says he only wanted to peek at Yale's site to see how it worked. Princeton is apparently considering a similar online setup, which allows applicants access to their admissions information. As it turns out, the Yale site was quite easy to crack: it was accessible with no more than a student's name, Social Security number, and birth date.

But the turn of events is prompting new questions about online scrutiny. With more admissions processes migrating online, one question is: Should schools set up more complicated access codes? Kenneth Green, founding director of the Campus Computing Project (www.campuscomputinq.net), notes this would protect student information, but would create more work for Admissions offices. Young applicants are prone to forget issued codes, he points out, which will only force them to call and e-mail campus offices to re-establish online access. "It will be a tradeoff," says Green, who adds that he is not exactly surprised by the turn of events. "The word on the street is that students are getting into all types of IT systems. This is the most publicized [action] and the most offensive to date."

For its part, Yale has promised to tighten security on its Web site, although a spokesman could not say what the new, improved security measures would be, or how much they will cost.

Says Joyce Smith, Executive Director of the National Association for College Admission Counseling (www.nacac.com), "We are aware that with the use of technology, all kinds of things come to light." She urges the higher education community to use the Princeton/Yale incident as a "learning experience." This latest occurrence should be used as a motivator for tightening up the online process, she says.