After a series of e-mail blasts were sent to UChicago students and faculty in his name last Wednesday, fourth-year Kevin Zhang filed complaints of cyber fraud and identity theft with police. Through his personal blog, Zhang has gone public with the alleged sender of the e-mails, an individual not affiliated with UChicago.
The unsolicited e-mails sent last Wednesday, claiming to be from Zhang, a computer science and biological sciences double major, invited students to check out an anonymous posting Web site, Uchicagoanon.com. In the vein of similar Facebook pages, the site endeavored “to discover the hidden secrets of Uchicago through the anonymous sharing of thoughts,” according to the message sent from Zhang’s e-mail address. The e-mails, sent from a mailing list through MailChimp, an e-mail marketing service provider, were sent to an unknown number of UChicago-affiliated recipients.
Third-year Emily Laackman, who received the e-mail, said, “It’s kind of popping everywhere, the whole idea of trying to get engagement of students, either like UChicago Crushes or Confessions…so I just assumed it was one of those.”
The UChicagoAnon Web site is now offline and the mailing list has been disabled by MailChimp.
According to his blog, Zhang said he suspects the e-mails to be connected to a previous batch of e-mail blasts delivered on May 26, which invited recipients to submit a written list of achievements for consideration to an alleged UChicago secret society. According to his write-up of the investigation, available on his blog, Zhang traced the e-mails to a Dartmouth student, who currently seems unaffiliated with the University.
Zhang said he was able to figure out the identity of the alleged sender by cross-referencing the domain name with the records of an associated Web site. Tracking down the sender took “less than an hour,” he said.
“I caught a lucky break, sort of,” he said.
According to Zhang’s account of the incident, the e-mail blasts were sent in retaliation to critical comments he made about UChicagoAnon on posts advertising the Web site in various UChicago Facebook groups.
“I posted comments about the severely flawed nature of the site…and for the next week or so, I didn’t think much of the site,” Zhang said on his blog. “Whoever created UChicagoAnon apparently got very butthurt about my comments, and instead of taking them constructively he/she decided to retaliate, in the form of a criminal act.”
Zhang’s case has been filed with multiple law enforcement agencies, including the University of Chicago Police Department (UCPD), the Chicago Police Department, the East Brunswick Police Department in East Brunswick, New Jersey, where the alleged sender of the e-mail is from, and the Internet Crime Complaint Center (IC3).
While the UCPD cannot speak about individual cases, UCPD spokesperson Robert Mason did confirm that the victim of the reported incident has been contacted by UCPD Investigative Services Bureau.
Zhang also reported the incident to Dean of Students in the College Susan Art. While she said she was unable to speak to the particulars of any student case, she stated that internal disciplinary proceedings and a University investigation require that both the victim and the accused of a cybercrime be two University of Chicago students.
Despite the incident, Zhang does not see the University as especially vulnerable to cybercrime, pointing to the inherent difficulties of multijurisdictional cyber fraud.
“I would say that we don’t have any more or less tools than any other institution to combat cybercrime. For example, our directory server is public: if you type in a name, it will give you information,” he said. “That can obviously be exploited for sinister purposes. So that’s one thing, that people are really starting to realize now is that it’s possible.”
