University of Iowa student files suit against college alleging online privacy violations

A University of Iowa student who feels his online security and that of all UI students who use Zoom to access classes has been compromised has brought a lawsuit against the university, alleging negligence and seeking relief and an order for the university to secure its online instruction.

Marc Muklewicz, a 46-year-old criminology student close to finishing his degree, said an unauthorized video taken of him in an online class and posted online led to his learning that anyone with the link to a Zoom course at UI could access it without needing to log in with university credentials or any other form of verification.

The UI has refused to remedy the situation and ensure his and other students’ data is private, Muklewicz said, and he is currently refusing to attend classes until he knows that when he logs into a course, he is safe in doing so.

“I can’t share anything academically, honestly, freely, in any sense of the word, if I can’t assure that my information is being private,” Muklewicz said.

Muklewicz first learned of the video taken of him smoking an e-cigarette during an online course through his wife, who started receiving messages from friends and acquaintances about a post made by an affiliate of Barstool on Instagram featuring the video.

How the video was cut, leaving out the e-cigarette and only showing Muklewicz blowing out smoke, implied to some that he was using drugs during class, Muklewicz said. After realizing the video was taken during class, Muklewicz said he emailed his professor, who reached out to the Office of Student Accountability and reiterated to students that taking recordings like this one is unacceptable.

UI Public Relations Manager Steve Schmadeke said in an email the university employs “standard security protocols” for online courses, including restricting access to “authenticated students who must sign in using their unique UI credentials.”

“Students are expected to follow course policies and the code of student life. That code would apply if an individual were identified secretly recording a classmate using a personal device,” Schmadeke said in his email. “The university also offers support services for any student who may experience a privacy violation.”

Muklewicz said what he heard from the Office of Student Accountability was that identifying whoever took the video would be “difficult,” and the office suggested reaching out to university police and changing his name on Zoom to better protect his privacy.

Using his experience from working for Microsoft and GoDaddy in the past, Muklewicz said he found out about the Zoom security issues while trying to work out for himself who could have taken the video.

“I was like, ‘This is so easy, I’ll identify it in five minutes and throw it back at them,’ but then what I came to quickly find out is, wait a minute, I accidentally was able to log in with no credentials,” Muklewicz said.

According to the UI’s posted information on Zoom security, all meetings have a passcode attached for access, but all invitation links automatically include it so no one needs to enter it themselves.

If Zoom classes are accessible to anyone with the link, Muklewicz said information like students’ names, email addresses, images and other information are vulnerable. Those with more “nefarious” intentions and the know-how could use the data they get from a Zoom class to trace a student’s IP address to their location, if they’re using university wi-fi.

While his professors have understood his concerns and the decision to stop attending classes, Muklewicz said the UI administration’s response is what led him to both file a Family Educational Rights and Privacy Act, or FERPA, complaint and a lawsuit. FERPA serves to protect student education records in all levels of learning, from elementary to post-secondary.

“If we take this serious, great. We can mitigate anything, any harm that’s been done,” Muklewicz said. “And literally, I think all they have to do is take the default permissions off of Zoom and take that and leave it to admin control.”

He was told by Mike Mueller, associate director of the Office of Student Accountability, that after review of the incident by legal counsel, this incident does not qualify as a FERPA violation as the UI does not maintain Zoom videos.

Counts listed against the university in the lawsuit include negligence, breach of contract, public disclosure of private facts and intentional infliction of emotional distress, and Muklewicz is seeking damages and a requirement that the UI secure its Zoom classes.

Muklewicz was able to attend the UI with financial support from Veterans’ Affairs as a veteran himself, and he is not currently working. He said he is working with his VA counselor on next steps and figuring out his benefits while not attending classes.

“I’m probably not going to graduate this term, it’s just compounding into a huge problem for me now,” Muklewicz said.