California Student Gets Jail Time for Rigging Campus Election with Keyloggers

Authorities said Weaver, a third-year business student at the time, bought three keyloggers about a month before the election, installing them on 19 school computers
Authorities said Weaver, a third-year business student at the time, bought three keyloggers about a month before the election, installing them on 19 school computers

According to a court report in the University Times of San Diego, Matthew Weaver stole 745 student passwords, using them in March 2012 to cast votes for himself for campus president and four of his fraternity brothers, who were running for vice president positions.

Authorities said Weaver, a third-year business student at the time, bought three keyloggers about a month before the election, installing them on 19 school computers. From there he was able to capture hundreds of passwords, and subsequently cast ballots from the accounts of more than 630 students.

His dreams of power crumbled into just so much dust after IT technicians were alerted to unusual activity on the system during the four-day voting period. After remotely accessing one of the college lab computers, the staff sat back and watched as a user from one workstation accessed account after account after account, casting votes along the way.

It wasn’t all voting-related though – apparently succumbing to curiosity, Weaver also logged into the account of a university official and read the person’s email.

Authorities swept into action, easily tracking the IP address back to Weaver. An investigation yielded a PowerPoint presentation from early 2012 proposing the campaign. While the defense attorney characterized Weaver as simply desperate to change the direction of the student council, the presentation was focused on something more material: being campus president comes with an $8,000 stipend. Vice presidents earn a $7,000 stipend.

The investigation also uncovered damning search engine queries, such as “how to rig an election” and “jail time for keylogger.”

And to the latter point, the judge denied Weaver probation after he pled guilty to three federal charges, including wire fraud and unauthorized access to a computer. The heist was the largest student identity theft in the university’s 24-year history.

Judge Larry Burns pulled no punches in issuing his sentence. “That’s the phenomenal misjudgment I can’t get around”, he said. “He’s on fire for this crime, and then he pours gasoline on it to try to cover it up”, he added.

“Matthew Weaver is not a criminal. Matthew Weaver is a young kid who made stupid decisions and now has a federal felony”, defense attorney John Kirby told Burns. He was simply carrying out a “juvenile sense of push-back against a council he didn’t think was being run appropriately.”

The prosecution had little sympathy: Assistant US Attorney Sabrina Feve simply called Weaver “an incredibly entitled young man.”

What’s hot on Infosecurity Magazine?