“This was a Wayne’s World scene gone awry…” says an attorney for 23-year-old Andrew Harris. “They were Wayne and Garth in a blue Pacer with a dumb idea and a mixed run of luck,” he told the Philadelphia Inquirer:
Harris previously had filed an application for federal student aid, and noticed that the government form would redirect to the IRS and import his own tax returns automatically. Harris and his fellow classmate Justin Hiemstra wondered: What would happen if they posed as one of Trump’s offspring? Could they use an application for aid to land the returns and scoop the nation’s biggest newspapers? Tiffany Trump had graduated in May 2016 from the University of Pennsylvania and had announced she was going to graduate school at Georgetown University. It could work.
Six days before the 2016 election, Harris and Hiemstra went to Haverford College’s computer lab and logged in using another student’s credentials. They accessed a Free Application for Student Aid (FAFSA). When they attempted to register under the name of Trump’s child, they were stunned to discover an application under that name already existed. Using Google, they successfully guessed most of the answers to a series of challenge questions to reset the password. Stymied four times on one of the security questions, they gave up.
What they didn’t realize was that the Department of Education was monitoring all traffic on the FAFSA site. The failed attempt sent up a red flag. The IRS dispatched federal investigators to Haverford shortly after.
Last month Pulitzer Prize-winning tax journalist David Cay Johnston told the paper “It’s surprising they didn’t catch them until four tries.” They also reported that while Harris was expelled from the college, 22-year-old Hiemstra was allowed to graduate, and both men have pleaded guilty to accessing a computer without authorization and attempting to access a computer without authorization to obtain government information
When sentenced in December, they’ll face a maximum of two years in prison, two years of supervised release, and a $200,000 fine.
Read more of this story at Slashdot.