Former UI student sentenced to 4 months in federal prison for changing grades, copying exams

DAVENPORT - A former University of Iowa student was sentenced to four months in federal prison for using keyloggers - hardware that can capture the keystrokes of someone without their knowledge - to access the university's computer network to change grades and get copies of exams.

Trevor J. Graves, 23, pleaded guilty in April in U.S. District Court to unauthorized access and damage to the University of Iowa's computer network. He was sentenced Thursday. Graves admitted during the plea hearing that he knew the UI Iowa Courses Online computer network was protected when he accessed it from May 2015 to Nov. 15, 2016.

During this time period, Graves used a keylogger on computers and fraudulently obtained professors' user names and passwords, accessed the computer network, and deleted and changed student grades, according to court documents. Specifically, Graves accessed the system and, without authorization, changed course grades for himself and five other students.

The complaint shows in mid-December 2016, a UI professor discovered an irregularity in Graves' assignments, and quiz scores had been changed in a program that only instructors can access with passwords unique to them. The professor notified officials and an internal investigation started.

The dates and times faculty members sign into their accounts are maintained in a log by the university's information services technology department, according to court documents. The system also tracks when a student record is changed and provides what internet address is used to log into the system.

Iowa City police conducted a search at Graves' residence on Dec. 29, 2016, and found several items, including thumb drives, four cellphones and two keyloggers, according to court documents. In 2017, other students told authorities about Graves giving them copies of exams.

The university's information technology costs associated with the internal investigation, response to the discovery of the network breach, and remedial steps taken to update the information technology security was about $67,900, court documents show.

In addition to Graves' prison sentence, U.S. District Judge John Jarvey of the Southern District ordered Graves to pay restitution of $67,900 to the university.

This investigation was conducted by the Federal Bureau of Investigation, the University of Iowa Department of Public Safety, and the University of Iowa.

l Comments: (319) 398-8318; trish.mehaffey@thegazette.com