Iowa State University settles with employee, pays him $52,000, and gives him back his job

An information technology employee at Iowa State University has his job back after being terminated nearly a year ago for plugging personal devices in to the institution's data center, which contained 'critical” information like social security numbers, payroll information, and student records.

The Board of Regents and Iowa State in May entered into an agreement with Michael Lowe to reduce his termination to a three-day suspension and pay him $52,813 - the amount he would have earned between July 25, 2015 and May 1.

The agreement allowed Lowe to return to Iowa State on May 2 as a computing information systems technician with a seniority date of Oct. 20, 1999. Lowe, according to the deal, was immediately placed on paid administrative leave pending a restructuring of the university's Information Technology Services department.

In addition to lost compensation, the agreement restored Lowe's vacation and sick leave accruals. Lowe could not immediately be reached for comment.

The settlement comes after an administrative law judge in September rejected an ISU appeal of a decision allowing Lowe benefits.

'The administrative law judge concludes (Lowe's) actions were not disqualifying job misconduct as (Lowe) lacked any intention of causing harm to the employer or its system and acted to remove the devices once he was told to do so and understood the situation,” according to an Iowa Workforce Development unemployment insurance appeal.

Those documents show ISU security personnel on May 27, 2015, discovered Lowe had connected two personal 'raspberry pi devices” to his employer's data center virtual local area network, or VLAN.

Even though Lowe had received initial approval from network employees to attach the devices both for work and personal reasons, Lowe's supervisors - realizing the potential risk - emailed him at 4:30 p.m. May 28 to say the devices needed to be removed by 5 p.m.

But, according to the workforce development documents, Lowe's work shift ended at 3:15 p.m. Communication shortfalls continued into the weekend, during which Lowe's supervisor instructed a student to disconnect the devices.

'The student, however, simply disconnected the Ethernet cable instead of the device itself,” according to the documents.

Upon returning to work Monday, Lowe reconnected the cable and one raspberry pi. At that time, according to the documents, a supervisor made it clear to Lowe the devices needed to be completely removed from the system.

Iowa State sent Lowe home on administrative leave until July 24, at which point he was terminated. According to the administrative law judge on the case, Lowe never had received a verbal or written warning during his tenure at Iowa State, and evidence fails to show he intentionally and knowingly acted against the employer's interests.

'While his actions may have placed the employer's data in jeopardy, (Lowe) had no knowledge of that fact prior to being told to disconnect the devices,” according to the judge's decisions. 'The employer had every right to direct (Lowe) to disconnect the devices. It also, however, had a responsibility to give him an opportunity to do so before taking disciplinary action against him.”

The judge went on to say that even if the university viewed Lowe's actions as misconduct, the fact that officials waited two months to fire him 'takes the issue out of the realm of a current act of misconduct.”

'While an investigation was necessary, the situation did not warrant a nearly nine-week investigation to determine what happened or what disciplinary action to take,” according to the judge.