Records Destruction Costs Ohio University

Ohio University has settled a suit filed by two former information-technology administrators, conceding that its decision to redact information from a consultant’s report on data security holes discovered in 2006 amounted to a state public-records law violation. In exchange for the $90,000 settlement, former computer systems administrators Todd Acheson and Thomas Reid agreed to dismiss a lawsuit seeking damages, The Columbus Dispatch reported.

The men were fired after an independent audit held them personally accountable for flaws in the university’s network security system that left student and alumnae personal and medical information, including up to 173,000 Social Security numbers, vulnerable for more than a year.

Acheson’s attorney, Fred Gittes, argued the university’s failure to disclose records related to the independent investigation was “part of a larger university effort to scapegoat these two individuals by hiding information,” according to the Dispatch.

A university panel reviewing the case in 2006 found Reid and Acheson were unjustly blamed and that fault extended to other university officials. Acheson and Reid sought reinstatement but the university balked—Provost Kathy A. Krendl wrote to both employees chiding them for “failing to take the necessary proactive steps to protect confidential information,” according to an Associated Press reported quoted by The Chronicle of Higher Education.

University attorney John J. Biancamano tells the Dispatch the school, which destroyed consultant’s notes in addition to its redactions, was worried about disclosing details that could aid future hacks into the computer system. In the wake of the recent settlement, OU will issue a new version of its final report fully disclosing documents related to the independent auditor’s investigation, according to a separate Chronicle of Higher Education report.