Project might be linked to graduate research at IU

IU Ph.D. student Chris Soghoian is facing scrutiny from the FBI and the Transportation Security Administration for research he might have been doing for the University. IU is "reviewing" the case to see whether Soghoian's Web site, which generated fake Northwest Airlines boarding passes, has University ties, said IU Director of Media Relations Larry MacIntyre.\nSoghoian, who intends to earn his doctorate in Informatics with a focus in computer security, created the site to point out a "loophole" in airport security but never printed or used a fake boarding pass, according to his blog at http://slightparanoia.blogspot.com.\nNo criminal charges have been filed at this time, but MacIntyre said the University began its investigation Friday afternoon when the site was brought to its attention. Though MacIntyre said he wasn't sure how the University found out about the site, Friday the FBI first visited Soghoian's home and Rep. Edward Markey, D-Mass., publicly called for Soghoian's arrest. \n"As soon as we knew about (Soghoian's) Web site and the letter on Rep. Markey's Web site calling for Chris' arrest, our University counsel immediately began looking into it to find out what the situation was," he said. \nThe Office of University Counsel would not comment on the situation. \nThough MacIntyre said the site was not hosted on University-owned equipment, Soghoian's three professors have speculated it might have been related to his doctoral research. \nSoghoian's chosen path of study is focused on how Informatics is used in society, and he experiments with identity in travel, according to a Web site Soghoian's adviser, Informatics professor L. Jean Camp, published. However, Camp said she doubted the site was for any particular class. \nMarkus Jakobsson, also a professor in the School of Informatics and instructor of one of Soghoian's information security classes, said Soghoian discussed his research with him before he set up the site. He said Soghoian brought his findings to class last week before the site gained publicity. Jakobsson said Soghoian was simply doing the kind of research graduate students are expected to do but wasn't sure if this specific project was meant to contribute to his doctoral dissertation.\n"These students must define their own research, of course, and he has designed his to deal with airport security," Jakobsson said. "It's normal for Ph.D. students -- they're encouraged to be creative. Any research they do usually goes towards dissertation, but I can't tell whether this goes towards research for the University or his own."\nA link to Soghoian's research is featured on Stop-Phishing.com, the Web site of an IU anti-phishing group that Jakobsson oversees.\nSteven Myers, an Informatics associate professor and an instructor of Soghoian in a security seminar class, said he knew Soghoian as a student and was on his doctoral admissions committee. He said he found Soghoian's fake boarding pass generator online Friday morning and e-mailed it to several students and faculty, including Soghoian, because Myers didn't realize his student had created it at that time. He said he wanted people to see it as an example of an interesting government loophole. Soghoian let Myers know it was his own work, and Myers said after further reviewing the matter, he has begun to believe Soghoian's work might be related to IU.\nThe University has no set time frame to complete the investigation, and there seems to be no obvious verdict, MacIntyre said.\n"... It appears Chris had good intentions but bad judgment," he said.