Student charged with Y. computer fraud

PROVO — A federal prosecutor has charged a Brigham Young University student with fraud for tampering with four campus computers to secretly log the private keystrokes of 600 students who used the machines.

Esteban N. Rodriguez, 25, "intentionally accessed a computer without authorization and exceeded authorized access, and thereby obtained information from a protected computer," according to documents filed Tuesday in U.S. District Court.

Rodriguez declined an interview request when contacted by phone Wednesday evening. According to a BYU Web site, he is from Necochea, Argen tina.

The sophisticated software used in the break-in last spring recorded every keystroke entered on four of the computers in the Widtsoe Building open-access computer lab. The captured information was periodically transmitted via e-mail to a Hotmail account created with a bogus name. However, there is no evidence the information was used for identity theft or any other purpose, said BYU officials and Melodie Rydalch, spokeswoman for the U.S. Attorney's Office in Salt Lake City.

No motive was given for the break-in.

Investigators had speculated the crime was an inside job by someone with access to the lab's master password. Rodriguez had worked as a part-time student employee in the lab. In fact, a work phone number listed for him on a BYU Web site was for a computer lab in another campus building, the Kimball Tower.

BYU officials could not confirm Wednesday whether Rodriguez was still employed by that lab. An employee in the lab who answered the phone Wednesday night said he had not seen Rodriguez this summer.

The spyware was discovered in late April when another student employee in the Widtsoe lab noticed strange icons on two computer monitors. A sophisticated search un- covered the software on two additional machines.

BYU moved quickly to protect the identities of students. The university terminated their passwords to the campus intranet — called Route Y — so no one else could access their campus records, BYU spokesman Brent Harker said.

Each student was contacted by phone, e-mail or via a notice on their student computer accounts. They were told to change their Route Y passwords and advised to do the same with other accounts they might have accessed online from the Widtsoe Building computers.

Harker said the administrative password in the Widtsoe lab should have been changed more often.

"Since that time we've changed administrative passwords in that lab and reinforced a general policy to change those passwords routinely," Harker said. "This wasn't done from outside, it was from within."

FBI and BYU investigators seized a computer from a Provo residence and used subpoenas to gather telephone and other electronic records during an investigation.

The federal charge for fraud and related activity in connection with computers is a misdemeanor, Rydalch said. It carries a maximum penalty of up to one year in prison and a $100,000 fine.

---

E-mail: twalch@desnews.com