Six of the nation’s top business schools, including Harvard Business School (HBS), faced a nearly unprecedented ethical dilemma this past spring when dozens of prospective students, tipped off by an online hacker, tried to gain unauthorized access to a website detailing their admissions status.

Less than a week after the breaches became public, HBS decided it would categorically reject all 119 applicants who had attempted to check their admissions status.

Carnegie Mellon’s Tepper School of Business, Duke’s Fuqua School of Business, and MIT’s Sloan School of Management followed HBS’s lead and rejected the applicants who had heeded the hacker’s instructions, while Dartmouth’s Tuck School of Business and Stanford’s Graduate School of Business (GSB) announced that they would individually examine the applications of each of the accused students.

GETTING A SNEAK PEEK

Early on March 2, an anonymous hacker posted step-by-step instructions on Business Week Online’s technology forum explaining how HBS applicants could attempt to peek at their admissions status a month early by logging in to their application and changing the URL.

“I know everyone is getting more and more anxious to check [the] status of their apps to HBS,” the hacker wrote. “So I looked around on their site and found a way.”

The hacker, who said he was rejected from HBS, posted the instructions at 12:15 a.m. under the name “brookbond,” identifying himself as a male who specializes in information technology and software security.

HBS, along with the five other affected schools, required students to submit their applications and recommendations electronically through an online admissions program called ApplyYourself.

Some students were able to see preliminary decisions, but most found only blank files. Across all six schools, 211 applicants accessed or tried to access the site detailing their admissions status.

Later that morning, Len Metheny, chief executive officer of ApplyYourself, notified the six schools of the breaches. Metheny said that his company had made the necessary changes to prevent further access to the sites by 9:45 a.m.

Business Week also deleted the hacker’s post and all other related directions, according to Kimberly Quinn, the magazine’s director of communications.

Quinn added that Business Week did not know the identity of “brookbond.”

Stephen R. Nelson, executive director of HBS’s Master of Business Administration program, said that the letters posted online were “just internal administrative devices” and not necessarily final decisions.

The Crimson, which published an article on March 3 detailing the initial chain of events, was the first newspaper to run the story.

REJECTION AND REACTION

HBS Dean Kim B. Clark ’74 issued a statement on March 7 pledging to reject all 119 applicants who had tried to learn their admissions status early.

“This behavior is unethical at best—a serious breach of trust that can not be countered by rationalization,” he wrote. “Any applicant found to have done so will not be admitted to this school.”

HBS spokesman David R. Lampe affirmed Clark’s statement.

“Legally, what they did was trespassing,” he said. “This is an area where you know you’re not supposed to be.”

University President Lawrence H. Summers offered his support for HBS’s decision.

“It was a statement that actions have consequences,” he said at an HBS faculty meeting on March 17.

But HBS also bore a substantial amount of criticism for its decision.

A group of the rejected applicants, calling themselves the “Infamous 119,” condemned the school’s reaction in anonymous statements released to the press.

Faculty Co-Director of Harvard Law School’s Berkman Center for Internet and Society Jonathan Zittrain called HBS’s move “unduly harsh.”

Lauren Weinstein, co-founder of People for Internet Responsibility, said that HBS had made a “fundamentally unfair” decision.

“The Internet is an enabling technology that makes all kinds of things easier to do in the spirit of the moment and with detachment from reality,” he said, adding that HBS should have considered the “human side” of the applicants’ actions.

BEYOND BOSTON

While the business schools at Carnegie Mellon, Duke, and MIT also chose to reject all applicants who had tried to see their admissions files, Stanford’s and Dartmouth’s schools took a different tack, electing not to take action until considering each applicant’s explanation.

Dartmouth’s Tuck School of Business announced on March 17 that it had admitted an unspecified number of the 17 prospective students who had attempted to access the site.

“We believe that integrity and accepting responsibility for one’s actions are the cornerstones of leadership,” said Paul Danos, Tuck’s dean. “We also believe that each person must be respected and valued as an individual.”

Stanford’s Graduate School of Business likewise chose to look at each affected applicant on a case-by-case basis, asking the 41 prospective students to write letters explaining their actions.

“Given the implications for each applicant, we felt that a fair process was as important as a just outcome,” said GSB Dean Robert Joss in an April 1 statement.

But Stanford eventually decided to reject all 41 applicants.

“At the end of the day, we didn’t hear any stories that we thought were compelling enough to counterbalance the act,” Joss told CNN last month.

Although each of the six schools reached their own conclusions concerning how to deal with the affected applicants, no consensus appears to have emerged dictating an appropriate response for future cases.

Kenneth S. Ledeen, chairman of Nevo Technologies and Harvard teaching fellow, explained that ethical questions raised by the incident cannot be easily resolved.

“The reason you don’t see much of a consensus is that people don’t have a clear framework through which to view it,” he said.

According to HBS spokesman James E. Aisner, HBS received 6,559 applications and provided about 1,000 offers of admission, leading to an acceptance rate of 15 percent.

HBS’s yield figure has not been finalized, but Aisner says the school expects it will hover around 90 percent.

—Staff writer Daniel J. T. Schuker can be reached at dschuker@fas.harvard.edu.