Case Study: Hacking into Harvard
Everyone who has ever applied for admission to a selective school or university or
who has been interviewed for a highly desired job knows the feeling of waiting
impatiently to learn the result of ones application. So its not hard to identify with
those applicants to some of the USAs most prestigious MBA programs who thought
they had a chance to get an early glimpse at whether their ambition was to be fulfilled. While visiting a Businessweek Online message board, they found instructions, posted by an anonymous hacker, explaining how to find out what admission decision the business schools had made in their case. Doing so wasnt hard. The universities in question – Harvard, Dartmouth, Duke, Carnegie Mellon, MIT and Stanford – use the same application software from Apply Yourself, Inc. Essentially, all one had to do was change the very end of the applicant-specific URL to get to the supposedly restricted page containing the verdict on ones application. In the nine hours it took Apply Yourself programmers to patch the security flaw after it was posted, curiosity got the better of about 200 applicants, who couldnt resist the temptation to discover whether they had been admitted.
Some of them got only blank screens. But others learned that they had been
tentatively accepted or tentatively rejected. What they didnt count on, however, were
two things: First, that it wouldnt take the business schools long to learn what had
happened and who had done it; and, second, that the schools in question were going to be very unhappy about it. Harvard was perhaps the most outspoken. Kim B. Clark,
dean of the business school, said, ‘This behaviour is unethical at best – a serious
breach of trust that cannot be countered by rationalization. In a similar vein, Steve
Nelson, the executive director of Harvards MBA program, stated, ‘Hacking into a
system in this manner is unethical and also contrary to the behaviour we expect of
leaders we aspire to develop.
It didnt take Harvard long to make up its mind what to do about it. It rejected all
119 applicants who had attempted to access the information. In an official statement,
Dean Clark wrote that the mission of the Harvard Business School ‘is to educate
principled leaders who make a difference in the world. To achieve that, a person must have many skills and qualities, including the highest standards of integrity, sound judgment and a strong moral compass – an intuitive sense of what is right and wrong.
Those who have hacked into this web site have failed to pass that test. Carnegie
Mellon and MIT quickly followed suit. By rejecting the ethically challenged, said
Richard L. Schmalensee, dean of MITs Sloan School of Management, the schools are trying to ‘send a message to society as a whole that we are attempting to produce people that when they go out into the world, they will behave ethically.
Duke and Dartmouth, where only a handful of students gained access to their files,
said they would take a case-by-case approach and didnt publicly announce their
individualised determinations. But, given the competition for places in their MBA
programs, its a safe bet that few, if any, offending applicants were sitting in
classrooms the following semester. Forty-two applicants attempted to learn their
results early at Stanford, which took a different tack. It invited the accused hackers to
explain themselves in writing. ‘In the best case, what has been demonstrated here is a lack of judgment; in the worst case, a lack of integrity, said Derrick Bolton,
Stanfords director of MBA admissions. ‘One of the things we try to teach at business
schools is making good decisions and taking responsibility for your actions. Six
weeks later, however, the dean of Stanford Business School, Robert Joss, reported,
‘None of those who gained unauthorized access was able to explain his or her actions to our satisfaction. He added that he hoped the applicants ‘might learn from their experience.
Given the publics concern over the wave of corporate scandals in recent years
and its growing interest in corporate social responsibility, business writers and other
media commentators warmly welcomed Harvards decisive response. But soon there
was some sniping at the decision by those claiming that Harvard and the other
business schools had overreacted. Although 70 per cent of Harvards MBA students
approved of the decision, the undergraduate student newspaper, The Crimson, was
sceptical. ‘HBS [Harvard Business School] has scored a media victory with its hardline stance, it said in an editorial. ‘Americans have been looking for a sign from the business community, particularly its leading educational institutions, that business ethics are a priority. HBSs false bravado has given them one, leaving 119 victims in angry hands.
As some critics pointed out, Harvards stance overlooked the possibility that the
hacker might have been a spouse or a parent who had access to the applicants
password and personal identification number. In fact, one applicant said that this had
happened to him. His wife found the instructions at Businessweek Online and tried to
check on the success of his application. ‘Im really distraught over this, he said. ‘My
wife is tearing her hair out. To this, Harvards Dean Clark responds, ‘We expect
applicants to be personally responsible for the access to the website, and for the
identification and passwords they receive.
Critics also reject the idea that the offending applicants were ‘hackers. After all,
they used their own personal identification and passwords to log on legitimately; all
they did was to modify the URL to go to a different page. They couldnt change
anything in their files or view anyone elses information. In fact, some critics blamed
the business schools and Apply Yourself more than they did the applicants. If those
pages were supposed to be restricted, then it shouldnt have been so easy to find ones way to them.
In an interview, one of the Harvard applicants said that although he now sees that
what he did was wrong, he wasnt thinking about that at the time – he just followed
the hackers posted instructions out of curiosity. He didnt consider what he did to be
‘hacking, because any novice could have done the same thing. ‘Im not an IT person
by any stretch of the imagination, he said. ‘Im not even a great typist. He wrote the
university a letter of apology. ‘I admitted that I got curious and had a lapse in
judgment, he said. ‘I pointed out that I wasnt trying to harm anyone and wasnt
trying to get an advantage over anyone. Another applicant said that he knew he had
made a poor judgement but he was offended by having his ethics called into question. ‘I had no idea that they would have considered this a big deal. And some of those posting messages at Businessweek Online and other MBA-related sites believe the offending applicants should be applauded. ‘Exploiting weaknesses is what good business is all about. Why would they ding you? wrote one anonymous poster.
Dean Schmalensee of MIT, however, defends Harvards and MITs automatically
rejecting everyone who peeked ‘because it wasnt an impulsive mistake. ‘The
instructions are reasonably elaborate, he said. ‘You didnt need a degree in computer science, but this clearly involved effort. You couldnt do this casually without knowing that you were doing something wrong. Weve always taken ethics seriously, and this is a serious matter. To those applicants who say that they didnt do any harm, Schmalensee replies, ‘Is there nothing wrong with going through files just because you can?
To him and others, seeking unauthorised access to restricted pages is as wrong as
snooping through your boss desk to see whether youve been recommended for a
raise. Some commentators, however, suggest there may be a generation gap here.
Students who grew up with the Internet, they say, tend to see it as wide-open territory and dont view this level of web snooping as indicating a character flaw.
Source: This case study is based on ‘Hacker Hits Top Business Schools and ‘Schools Boot Snoopy Grad Students, CBS News, 4 March and 15 April 2005 (online); ‘Harvard Rejects 119 Accused of Hacking and ‘MIT Says It Wont Admit Hackers, Boston Globe, 8 March 2005 (online); Dan Carnevale, ‘Business-School Applicants, under Cover of Anonymity, Dispute “Hacker” Label, Chronicle of Higher Education, 11 March 2005 (online); ‘A Lesson in Moral Leadership, Financial Times, 25 April 2005, 11.
The Purpose of this assignment:
1 .To demonstrate your understanding and application of the ethical dimension to business decision making.
2. To demonstrate your understanding and application of the concept of stakeholders to business decision making.
3. To demonstrate your understanding and application of ethical theories to business decision making.
This assignment is about answering 5 questions for the case study above. You need to analyse the case and loosen it up in order to answer the questions. The processes of analysing the case can be broken into some tasks then use the outcomes to answer the questions.
1. What is an ethical problem? In terms of your explanation, what is it about the
above situation that makes it an ethical problem?
2. What is an ethical dilemma? Do you think that having read the instructions on
how to access the Apply Yourself website, these students faced a dilemma? Why
or why not?
3. When the Dean of Harvard Business School considered his response to the
situation, he should of been thinking about the implications of his decision for his
stakeholders. Identify and explain the potential implications for two key
stakeholders if the Dean had of decided to ignore the hacking.
4. Describe one normative theory of ethics. Explain how this theory could be used to
defend the decision of the Dean of Harvard Business School.
5. If you could potentially access the Massey University website to find out your
grade for this paper before it was publically released, how would you defend your
decision to access (or not) the website?
Case Study: Hacking into Harvard