Skip to Content, Navigation, or Footer.
You are the voice. We are the echo.
The Echo
Taylor University, Upland, IN
Saturday, Nov. 23, 2024
The Echo
IMG_37601.jpg

A hoaxer, a hacker and a boil water advisory

By Cassidy Grom | Echo

Thursday, Sept. 10, a mysterious sender named RJ Wiley issued a mass email cancelling the next morning's classes.

RJ-a reference to an "Over the Hedge"character known for his conniving tendencies-was actually a student.

Student’s hopes of sleeping in Friday, Sept. 11 were dashed when they learned classes were not cancelled.

This anonymous student, referred to in this story as "RJ," said the email hoax had been pre-planned; he was just waiting for the right opportunity to send it.

Over the summer, RJ noticed an email concerning fall billing mistakenly included over two thousand students, staff and faculty in the "to" field, essentially handing out a contact list for the entire campus.

RJ formatted the email list, created a Gmail account and found a marketing service to send a mass email. He performed all of these actions off-campus.

He sent a few test emails, then waited for the perfect opportunity.

"One of (my and my friends') ideas was to send an email saying dinner was starting 30 minutes late so everyone would show up at dinner at 5:30 instead of 5," RJ said.

On Thursday, one of RJ's friends mentioned the boil water advisory in passing. RJ decided it was time to act.

He was off-campus when he hit the "send" button. Students read the email, many sighing in relief that their early morning classes were cancelled.

Associate Kinesiology Professor Matt Renfrow received an email from senior Victoria Baus. She was concerned about turning in her paper on time because she thought her 8 a.m. class was cancelled.

Renfrow checked his email for the announcement. Nothing. He checked his junk mail. Again, nothing. Baus forwarded him the hoax email. To Renfrow, cancelling classes seemed reasonable. After all, Upland was under a boil water advisory.

Friday morning, students in Renfrow's Physical Fitness Prescription class showed up, but Renfrow was not there. He had gone to bed and missed the emails correcting the hoax.

RJ expressed regret for causing the inconvenience.

"(I) never expected it to have as big of an impact as it did and it never intended to waste any time or cause them trouble," he said. "That is why we only cancelled morning classes and we said check your email frequently. We expected Taylor to get ahold of it anyway and send a letter to repeal that classes had been cancelled."

Minutes after the email was sent, text messages buzzed across campus. Students had noticed that the message came from a Gmail account, not the official announcements@taylor.edu account. Within a few hours, officials sent out a correction announcing that classes were to continue as usual.

RJ had made a vital mistake. The Gmail account was not secure and he had sent a test email to his own Taylor email account.

A second student, in this article known as "George," hacked into the account.

"Google is really nice to people who 'forget' their passwords," George said. "You can easily ask for a password reset. Google will ask some simple information which could all be answered from inference."

George assumed the account had been created in September and that it had been accessed on the day the hoax email was sent out.

He gained access to the tuannouncements@gmail.com account, changed the password, and created a two-factor authorization, effectively locking RJ and everyone else out.

"The hoax was done poorly enough that I wanted to unmask who had done it," George said.

George discovered that RJ had sent test emails to RJ's private email nine days prior to the hoax.

He wanted to know who sent the fake announcement but didn't want to "totally ruin the fun" by revealing RJ's identity to the administration.

"Originally I was a little worried because obviously they found out who I was," RJ said. "But then they agreed to kinda patch up holes in my defense and cover my tracks for me so that was very helpful."

RJ has not been confronted by administration. Administration is seemingly still on the lookout for RJ. Chief information officer Rob Linehan said, "There is a stewardship issue. I don't want to just sweep it under the rug."

IT contacted Google to learn more about the hoaxer, but would need to issue a subpoena-a court order-to get more information.

Becca Robb contributed to the reporting for this article.