Secretary used superintendent's password, entered system thousands of times, police say.
July 18, 2012|By Manuel Gamiz Jr. and Marion Callahan, Of The Morning Call
Most parents would do anything to help their children succeed in school, but one Weisenberg Township mother took it too far, Lehigh County authorities say.
Catherine Venusto, a former Northwestern Lehigh School District employee, used her knowledge of the district's computer system — and the superintendent's password — to change her children's grades, state police said.
Her daughter went from a failing grade to a medical exception, according to court records, and her son went from a grade of 98 percent to an even more impressive 99 percent.
When state police detectives interviewed Venusto, 45, at her home last Thursday, she admitted changing the grades and also admitted using the superintendent's passwords to gain access to district emails and personnel files, according to court records.
Venusto said she logged on to the district's computer system, even after she had left her job as a secretary for the district, out of "curiosity and boredom," according to court records.
On Wednesday, Venusto's curiosity got her charged with three counts each of unlawful use of a computer and computer trespassing, all third-degree felonies. She was arraigned before District Judge Robert C. Halal and released on $30,000 unsecured bail.
Authorities say Venusto used the superintendent's information from Aug, 23, 2010, to February 2012 to gain access to the district's human resources system, which contained thousands of files associated with district policy, contract information, employee reports and personnel information.
Authorities also say she entered the district's email system by using the passwords of the superintendent and nine other district employees.
The investigation began on Feb. 24, 2012, when Assistant Superintendent Jennifer Holman reported that a former employee allegedly accessed the district's computer system using the superintendent's sign-in and password information, authorities said.
District officials had earlier suspected something was wrong when a high school principal called to report that some teachers were concerned that the superintendent was accessing the grading system to look at their grades.
Northwestern Lehigh Superintendent Mary Ann Wright said she was sick to her stomach when that call came in asking if she had been viewing student grades.
In fact, Wright never logged into students' grades.
The February 2012 call, Wright said, triggered an immediate shutdown of the computer system. That month, district officials tightened security and log-in procedures, but didn't detail the new measures that were put in place.
"At the time, I didn't quite have a grasp of the scope of what happened, but I was immediately concerned for protected information," Wright said. "We shut down the system within three hours of learning there was a potential problem."
Venusto had been a secretary in the administration building, where her duties included creating the sign-on and password information for Wright and other school employees. After she left her job in April 2011, she continued using the superintendent's password, authorities said.
"When she resigned, we took her out of the system," Wright said. "Unfortunately she found her way around security protocol through unauthorized access to my information."
On Feb. 3, Venusto used the superintendent's information to enter the district's grade system and change her son's grade from a 98 percent to a 99 percent, according to court records. She did the same more than a year earlier, on June 16, 2010, when she allegedly changed her daughter's grade from an F to an M, or a medical leave, according to court records.
"We've been assured that those were the only two grades that were changed," Wright said.
The investigation included the use of court orders to obtain Internet-provider information of the person hacking into the computer system.
State police found that the school district had not changed any of its employee passwords since Venusto left her job.
Those court orders determined that Venusto used three different computers to gain access to the district's computer system — her home computer, one belonging to the East Penn School District and one associated with QVC, police said. After leaving the Northwestern Lehigh School District, Venusto had jobs with East Penn School District and QVC, a televised and online shopping network, police said.
The investigation showed that Venusto entered the district's grading system 110 times using the superintendent's password. It also showed she entered the district's computer system thousands of times, police said.
"The acts were intentional, criminal action to obtain protected information," Wright said in a statement posted on the district's website.
Wright said there is no evidence that any confidential information was used for illegal purposes.
"We deeply regret this incident and that this unauthorized access occurred, and we sincerely regret any inconvenience this may cause," Wright said in the statement.
She said the district is continuing to review all of its computer-security procedures.
"We are doing everything we can to prevent this from happening again, and new security procedures are in place to better assure that our systems are protected from such attempts," she said.
According to a criminal complaint:
Venusto apologized for her actions during the July 12 interview with state police, telling them she would cooperate with the investigation.
Venusto told police she never thought what she was doing was illegal. Unethical, she said, but not illegal.http://articles.mcall.com/2012-07-18/news/mc-c-northwestern-lehigh-secretary-hacks-grades-20120718_1_computer-system-student-grades-password