A University of Iowa student who feels his online security and that of all UI students who use Zoom to access classes has been compromised has brought a lawsuit against the university, alleging negligence and seeking relief and an order for the university to secure its online instruction.
Marc Muklewicz, a 46-year-old criminology student close to finishing his degree, said an unauthorized video taken of him in an online class and posted on social media led him to learn that anyone with the link to a UI Zoom course could access it without needing to log in with university credentials or with any other form of verification.
The UI has refused to remedy the situation and ensure his and other students’ data is private, Muklewicz said, and he is currently refusing to attend classes until he knows that when he logs into a course, he is safe in doing so.
“I can’t share anything academically, honestly, freely, in any sense of the word, if I can’t assure that my information is being private,” Muklewicz said.
More: University of Iowa is searching for a new dean of its graduate college. Meet the finalists
Counts listed against the university, the Board of Regents in the lawsuit filed on April 15 in the Southern District of Iowa include negligence, breach of contract, public disclosure of private facts and intentional infliction of emotional distress. Muklewicz is seeking damages and a requirement that the UI secure its Zoom classes.
Footage of student smoking e-cigarette allegedly shared on social media
Muklewicz first learned of the video taken of him smoking an e-cigarette during an online course through his wife, who started receiving messages from friends and acquaintances about an alleged post made by an affiliate of Barstool on Instagram featuring the video.
How the video was cut, leaving out the e-cigarette and only showing Muklewicz blowing out smoke, implied to some that he was using drugs during class, Muklewicz said. After realizing the video was taken during class, Muklewicz said he emailed his professor, who reached out to the Office of Student Accountability and reiterated to students that taking recordings like this one is unacceptable.
UI Public Relations Manager Steve Schmadeke said in an email the university employs “standard security protocols” for online courses, including restricting access to “authenticated students who must sign in using their unique UI credentials.”
More: Mariannette Miller-Meeks leads Iowa’s US House campaigns in fundraising, topping $1 million
“Students are expected to follow course policies and the code of student life. That code would apply if an individual were identified secretly recording a classmate using a personal device,” Schmadeke said in his email. “The university also offers support services for any student who may experience a privacy violation.”
Muklewicz said what he heard from the Office of Student Accountability was that identifying whoever took the video would be “difficult,” and the office suggested reaching out to university police and changing his name on Zoom to better protect his privacy.
UI student’s background in online security inspired investigation
Using his experience from working for Microsoft and GoDaddy in the past, Muklewicz said he found out about the Zoom security issues while trying to determine who captured the video.
“I was like, ‘This is so easy, I’ll identify it in five minutes and throw it back at them,’ but then what I came to quickly find out is, wait a minute, I accidentally was able to log in with no credentials,” Muklewicz said.
More: Tuition hikes proposed for all three Iowa public universities
According to the UI’s posted information on Zoom security, all meetings have a passcode attached for access, but all invitation links automatically include it so no one needs to enter it themselves.
If Zoom classes are accessible to anyone with the link, Muklewicz said information like students’ names, email addresses, images and other information are vulnerable. Those with more “nefarious” intentions and the know-how could use the data they get from a Zoom class to trace a student’s IP address to their location, if they’re using university wi-fi.
Student said UI told him they ‘do not maintain’ Zoom videos
While his professors have understood his concerns and the decision to stop attending classes, Muklewicz said the UI administration’s response is what led him to both file a Family Educational Rights and Privacy Act, or FERPA, complaint and a lawsuit. FERPA serves to protect student education records in all levels of learning, from elementary to post-secondary.
“If we take this serious, great. We can mitigate anything, any harm that’s been done,” Muklewicz said. “And literally, I think all they have to do is take the default permissions off of Zoom and take that and leave it to admin control.”
He was told by Mike Mueller, associate director of the Office of Student Accountability, that after review of the incident by legal counsel, this incident does not qualify as a FERPA violation as the UI does not maintain Zoom videos.
More: University of Iowa ‘intellectual freedom’ center bill goes to Gov. Reynolds. What it does:
Muklewicz, a veteran, is attending the UI with financial support from Veterans’ Affairs, and he is not currently working. He said he is working with his VA counselor on next steps and figuring out his benefits while not attending classes.
“I’m probably not going to graduate this term, it’s just compounding into a huge problem for me now,” Muklewicz said.
Muklewicz has demanded a jury trial. No date has been set.
Find this story at Iowa Capital Dispatch, which is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501c(3) public charity. Iowa Capital Dispatch maintains editorial independence. Contact Editor Kathie Obradovich for questions:kobradovich@iowacapitaldispatch.com.
This article originally appeared on Iowa City Press-Citizen: University of Iowa student’s lawsuit alleges online privacy violations
