An unnamed Ohio State student was expelled from the university over the summer from using a professor’s login to change grades. Casey Cascaldo | Photo Editor

An Ohio State student hacked into the Carmen account of two professors to change his and several other students’ grades during the spring semester, according to an email an administrative official in the Department of Mechanical and Aerospace Engineering sent to students in both majors.

Blaine Lilly, associate chair for undergraduate programs, wrote last week that a mechanical and aerospace engineering student, was expelled after using a keylogger, a type of surveillance technology used to monitor and record each keystroke typed on a specific computer’s keyboard, to obtain the Carmen passwords of the professors.

The student was not named in the email.

“I want to be absolutely sure that you’re aware of the consequences of doing something like this,” Lilly wrote in the email. “Take a minute to consider the consequences of leaving OSU with a felony conviction rather than a degree.”

The program includes more than 1,500 majors and pre-majors, according to the College of Engineering’s 2017 annual statistical report.

Lilly declined to comment after The Lantern obtained the email Tuesday.

Ben Johnson, a university spokesman, said in a statement that federal law prohibits the discussion of specific cases.

“If found in violation, students receive sanctions based on the nature and severity of the violation in accordance with university standards and protocols,” Johnson said in the statement.

News about the student comes after the university announced Thursday that Duo, an online security company that offers two-factor authentication services, will be required to log in to Carmen.

It will be put in place during autumn break, according to the Board of Trustees.

While the university did not confirm if this misconduct case is a contributing factor, the Duo log-in system would help prevent this kind of situation, Johnson said.

“In the uncommon case that accessing a Carmen account is part of an academic misconduct issue, this security tool also helps guard against that misconduct,” Johnson said in the statement.

In his email, Lilly wrote that the student’s case was taken to the Committee on Academic Misconduct where a panel of faculty and students determine if misconduct has occurred. Every student who is charged with academic misconduct has the right to a hearing before the committee.

Johnson said in the statement, “Behavior that may also violate local, state or federal law may be referred to the proper law enforcement authorities for further investigation and action as deemed appropriate by those agencies.”

Johnson said that a few points of Lilly’s email needed clarification.

In his email, Lilly wrote that because the student changed the grades of other students, this also is a violation of the Family Educational Rights and Privacy Act — a federal law that protects the privacy of students’ education records. That could result in a felony conviction. Lilly wrote that this case against the student is still pending with the university.

Lilly wrote that Ohio State took two similar cases to the federal court last year.

Johnson said another email will be sent out the engineering students in the next couple of days, clarifying the details of Lilly’s email.