Indiana University accidentally shares grades of 100,000 students
Indiana University has taken down an online tool that allowed users to calculate grade point averages after the university’s newspaper discovered it was possible for any student to use the tool to view other students’ grades.
The Daily Student reported on Feb. 4 the school took down the tool after being notified that grades had been exposed for at least 100,000 current and former students at the IU-Bloomington, IU-Purdue University Indianapolis and IU-Purdue University Columbus campuses, dating back to 2015. The paper reported it may also have exposed grades of students at other campuses in the nine-campus system.
The tool, which is operated by the university’s Office of the Vice Provost for Undergraduate Education, has been in use since 2018.
The Family Educational Rights and Privacy Act prohibits schools from disclosing a student’s grades to another student without written prior consent of the student or a parent. It stipulates that grades posted publicly use a code known only by the teacher and the student.
A university spokesperson told The Daily Student the calculator was designed to be used faculty and staff but said he didn’t know how it became available to students. Students were able to access the tool after logging into a student system protected by two-factor authentication.
FERPA guidelines encourage education institutions to follow security-controls standards set by the National Institute of Standards and Technology to avoid such mishaps, which can potentially result in a university’s forfeiture of federal funding.
The university did not respond to requests for additional information.
