Case Study: Hacking into Harvard

Everyone who has ever applied for admission to a selective school or university or
who has been interviewed for a highly desired job knows the feeling of waiting
impatiently to learn the result of one’s application. So it’s not hard to identify with
those applicants to some of the USA’s most prestigious MBA programs who thought
they had a chance to get an early glimpse at whether their ambition was to be fulfilled. While visiting a Businessweek Online message board, they found instructions, posted by an anonymous hacker, explaining how to find out what admission decision the business schools had made in their case. Doing so wasn’t hard. The universities in question – Harvard, Dartmouth, Duke, Carnegie Mellon, MIT and Stanford – use the same application software from Apply Yourself, Inc. Essentially, all one had to do was change the very end of the applicant-specific URL to get to the supposedly restricted page containing the verdict on one’s application. In the nine hours it took Apply Yourself programmers to patch the security flaw after it was posted, curiosity got the better of about 200 applicants, who couldn’t resist the temptation to discover whether they had been admitted.

Some of them got only blank screens. But others learned that they had been
tentatively accepted or tentatively rejected. What they didn’t count on, however, were
two things: First, that it wouldn’t take the business schools long to learn what had
happened and who had done it; and, second, that the schools in question were going to be very unhappy about it. Harvard was perhaps the most outspoken. Kim B. Clark,
dean of the business school, said, ‘This behaviour is unethical at best – a serious
breach of trust that cannot be countered by rationalization’. In a similar vein, Steve
Nelson, the executive director of Harvard’s MBA program, stated, ‘Hacking into a
system in this manner is unethical and also contrary to the behaviour we expect of
leaders we aspire to develop’.

It didn’t take Harvard long to make up its mind what to do about it. It rejected all
119 applicants who had attempted to access the information. In an official statement,
Dean Clark wrote that the mission of the Harvard Business School ‘is to educate
principled leaders who make a difference in the world. To achieve that, a person must have many skills and qualities, including the highest standards of integrity, sound judgment and a strong moral compass – an intuitive sense of what is right and wrong.
Those who have hacked into this web site have failed to pass that test.’ Carnegie
Mellon and MIT quickly followed suit. By rejecting the ethically challenged, said
Richard L. Schmalensee, dean of MIT’s Sloan School of Management, the schools are trying to ‘send a message to society as a whole that we are attempting to produce people that when they go out into the world, they will behave ethically.’

Duke and Dartmouth, where only a handful of students gained access to their files,
said they would take a case-by-case approach and didn’t publicly announce their
individualised determinations. But, given the competition for places in their MBA
programs, it’s a safe bet that few, if any, offending applicants were sitting in
classrooms the following semester. Forty-two applicants attempted to learn their
results early at Stanford, which took a different tack. It invited the accused hackers to
explain themselves in writing. ‘In the best case, what has been demonstrated here is a lack of judgment; in the worst case, a lack of integrity,’ said Derrick Bolton,
Stanford’s director of MBA admissions. ‘One of the things we try to teach at business
schools is making good decisions and taking responsibility for your actions.’ Six
weeks later, however, the dean of Stanford Business School, Robert Joss, reported,
‘None of those who gained unauthorized access was able to explain his or her actions to our satisfaction.’ He added that he hoped the applicants ‘might learn from their experience’.

Given the public’s concern over the wave of corporate scandals in recent years
and its growing interest in corporate social responsibility, business writers and other
media commentators warmly welcomed Harvard’s decisive response. But soon there
was some sniping at the decision by those claiming that Harvard and the other
business schools had overreacted. Although 70 per cent of Harvard’s MBA students
approved of the decision, the undergraduate student newspaper, The Crimson, was
sceptical. ‘HBS [Harvard Business School] has scored a media victory with its hardline stance,’ it said in an editorial. ‘Americans have been looking for a sign from the business community, particularly its leading educational institutions, that business ethics are a priority. HBS’s false bravado has given them one, leaving 119 victims in angry hands.’
As some critics pointed out, Harvard’s stance overlooked the possibility that the
hacker might have been a spouse or a parent who had access to the applicant’s
password and personal identification number. In fact, one applicant said that this had
happened to him. His wife found the instructions at Businessweek Online and tried to
check on the success of his application. ‘I’m really distraught over this,’ he said. ‘My
wife is tearing her hair out.’ To this, Harvard’s Dean Clark responds, ‘We expect
applicants to be personally responsible for the access to the website, and for the
identification and passwords they receive.’

Critics also reject the idea that the offending applicants were ‘hackers’. After all,
they used their own personal identification and passwords to log on legitimately; all
they did was to modify the URL to go to a different page. They couldn’t change
anything in their files or view anyone else’s information. In fact, some critics blamed
the business schools and Apply Yourself more than they did the applicants. If those
pages were supposed to be restricted, then it shouldn’t have been so easy to find one’s way to them.

In an interview, one of the Harvard applicants said that although he now sees that
what he did was wrong, he wasn’t thinking about that at the time – he just followed
the hacker’s posted instructions out of curiosity. He didn’t consider what he did to be
‘hacking’, because any novice could have done the same thing. ‘I’m not an IT person
by any stretch of the imagination,’ he said. ‘I’m not even a great typist.’ He wrote the
university a letter of apology. ‘I admitted that I got curious and had a lapse in
judgment,’ he said. ‘I pointed out that I wasn’t trying to harm anyone and wasn’t
trying to get an advantage over anyone. Another applicant said that he knew he had
made a poor judgement but he was offended by having his ethics called into question. ‘I had no idea that they would have considered this a big deal.’ And some of those posting messages at Businessweek Online and other MBA-related sites believe the offending applicants should be applauded. ‘Exploiting weaknesses is what good business is all about. Why would they ding you?’ wrote one anonymous poster.

Dean Schmalensee of MIT, however, defends Harvard’s and MIT’s automatically
rejecting everyone who peeked ‘because it wasn’t an impulsive mistake.’ ‘The
instructions are reasonably elaborate,’ he said. ‘You didn’t need a degree in computer science, but this clearly involved effort. You couldn’t do this casually without knowing that you were doing something wrong. We’ve always taken ethics seriously, and this is a serious matter.’ To those applicants who say that they didn’t do any harm, Schmalensee replies, ‘Is there nothing wrong with going through files just because you can?’
To him and others, seeking unauthorised access to restricted pages is as wrong as
snooping through your boss’ desk to see whether you’ve been recommended for a
raise. Some commentators, however, suggest there may be a generation gap here.
Students who grew up with the Internet, they say, tend to see it as wide-open territory and don’t view this level of web snooping as indicating a character flaw.

Source: This case study is based on ‘Hacker Hits Top Business Schools’ and ‘Schools Boot Snoopy Grad Students,’ CBS News, 4 March and 15 April 2005 (online); ‘Harvard Rejects 119 Accused of Hacking’ and ‘MIT Says It Won’t Admit Hackers,’ Boston Globe, 8 March 2005 (online); Dan Carnevale, ‘Business-School Applicants, under Cover of Anonymity, Dispute “Hacker” Label,’ Chronicle of Higher Education, 11 March 2005 (online); ‘A Lesson in Moral Leadership,’ Financial Times, 25 April 2005, 11.

The Purpose of this assignment:
1 .To demonstrate your understanding and application of the ethical dimension to business decision making.
2. To demonstrate your understanding and application of the concept of stakeholders to business decision making.
3. To demonstrate your understanding and application of ethical theories to business decision making.

This assignment is about answering 5 questions for the case study above. You need to analyse the case and loosen it up in order to answer the questions. The processes of analysing the case can be broken into some tasks then use the outcomes to answer the questions.

Questions:
1. What is an ethical problem? In terms of your explanation, what is it about the
above situation that makes it an ethical problem?
(150 words)
2. What is an ethical dilemma? Do you think that having read the instructions on
how to access the Apply Yourself website, these students faced a dilemma? Why
or why not?
(150 words)
3. When the Dean of Harvard Business School considered his response to the
situation, he should of been thinking about the implications of his decision for his
stakeholders. Identify and explain the potential implications for two key
stakeholders if the Dean had of decided to ignore the hacking.
(150 words)
4. Describe one normative theory of ethics. Explain how this theory could be used to
defend the decision of the Dean of Harvard Business School.
(350 words)
5. If you could potentially access the Massey University website to find out your
grade for this paper before it was publically released, how would you defend your
decision to access (or not) the website?
(350 words)
References: Use the articles that have been uploaded in this order. And use this textbook as well:
Shaw, W.H., Barry, V. Issa, T., & Catley, B.  (2013) Moral Issues in Business (2nd Asia-Pacific ed.). Melbourne: Cengage