EagleTribune.com, North Andover, MA

June 21, 2013

Andover man charged in elaborate college-hacking scheme

By Bill Kirk

---- — ANDOVER — An Andover High School graduate has been charged with 18 felonies in Indiana following allegations that he hacked into his professor’s computers during his undergraduate years at Purdue University and changed multiple grades.

Roy Chaoran Sun, 25, of 1 Robinswood Way, joined two classmates in a complex and advanced hacking scheme in which they replaced professors’ keyboards with ones that logged their keystrokes. They then used the information from the key-loggers to hack into those professors’ accounts and change their grades, prosecutors allege.

According to probable cause affidavits, Sun, an electrical engineering student, changed eight Fs and one D to As. He is accused of changing the first grade, the D, in December 2008 and continuing to change grades through May 2010, when he graduated from Purdue, according to an affidavit.

Following his arrest last month in Brookline on a warrant out of Purdue, Sun reported to Indiana to face the charges. He was released on $125,000 cash bail and $125,000 surety, and, according to court documents, was allowed to return to Andover to live with his parents until his next court date at the end of August. He was ordered to surrender his passport to Purdue University police and told not to leave the country.

Yesterday, a woman answering the door at 1 Robinswood Way in Andover declined to comment, saying she was busy.

In court documents filed with Tippecanoe County, Sun also gives an address of 14 Longwood Drive, Apt. 8, Andover. Nobody answered the door at that address yesterday.

Most recently, Sun had been a graduate student at Boston University. According to a BU spokesman, he attended the school for the spring semester and is no longer a student there.

Colin Riley, executive director of public relations at BU, said federal confidentiality rules prevented him from releasing any further information.

Purdue Police Chief John Cox said police at Purdue and BU are sharing information about the investigation.

According to one local media report, Sun was arrested on May 29 at 1 John St., Brookline, by Brookline police and charged on a warrant out of Purdue for computer hacking violations. He gave police at that time the Robinswood Way address.

Sun was joined in the scheme by Mitsutoshi Shirasaki, 24, and Sujay Sharma, 24, both of West Lafayette, police allege. All three are charged with multiple counts of conspiracy to commit computer tampering, conspiracy to commit burglary and conspiracy to commit computer trespass. Sun also faces a misdemeanor charge of computer trespass.

The charges originally were filed in April, but were unsealed and made public last week, according to the Journal & Courier of Lafayette.

Sun’s attorney, Jack O’Bryan, could not be reached for comment.

According to an Associated Press story, the investigation began when an engineering professor contacted the university’s information technology security services department in November because someone had changed his password. He reported it happened again in December.

Shirasaki’s girlfriend told investigators that he changed his grades and her grade. She said he did it by picking the locks of the professors’ offices and installing key logging devices he would later use to obtain their login and password information.

Sharma told police in February that he acted as a lookout when Shirasaki picked locks to get into the professors’ offices, according to the affidavits. He said Shirasaki bought locks and practiced picking them.

Purdue police searched Shirasaki’s apartment on Feb. 5 and found a key logging device and a lock-picking tool set, the affidavits state. Shirasaki told authorities Sun told him how to change the grades in the fall of 2009 and that Shirasaki acted as the lookout for Sun.

According to probable cause affidavits, Shirasaki changed 24 grades, including 13 F’s to nine A’s and four B’s, according to the affidavits. He also is accused of changing one of his grades from an A to an A+, and switching the grade of his girlfriend from an A to an A+.

Sharma, a nuclear engineering major, is accused of having just one grade changed — a D to an A in an engineering course, the affidavits state. He’s also accused of accessing course tests and acting as Shirasaki’s lookout.

Tippecanoe County Prosecutor Pat Harrington said Shirasaki has not yet been arrested because he is in Japan. Tippecanoe County Jail staff said Sharma was released on bail in May and Sun on Friday.

Shirasaki and Sharma most recently were seniors at Purdue, but are no longer students there, said Jeffery Stefancic, associate dean of students. Sun graduated in 2010.

Stefancic said Sun’s degree is being reviewed, and a hearing will be held to give him an opportunity to respond to the allegations. Last month, Purdue adopted a process for degree revocation.

An internal audit of grade changes found no other anomalies, Cox said.

Sun had been in trouble before. In 2009 he was facing charges of terroristic mischief after he left a box at the Parking Services building on the Purdue campus that some believed might have contained a weapon of mass destruction.

Turns out it was a wheel lock, or a Denver boot, along with a ticket and $20 in cash that he owed in parking fines. Charges were never filed after Purdue students rallied to his cause.

In 2007, according to court documents, he pleaded guilty to criminal recklessness. The court papers do not specify what he did but he was ordered to stay out of bars, pay a fine, submit to random drug and alcohol screening and keep away from a victim, who was named in the court documents. He was also placed on probation for one year.

It appears that while he was at Andover High School, in 2005 he was a member of the student government.

Material from the Associated Press was used in this report.