Dawson College is under scrutiny over the expulsion of a 20-year-old computer science student following his discovery of a defect in a province-wide computer software system used by the school and by most Quebec CÉGEPs.
In an article published Jan. 21 by The National Post, it was reported that the student, Ahmed Al-Khabaz, informed Dawson administration in September that the software system Omnivox was dangerous when it comes to the personal security of students. Al-Khabaz claims he found it by accident while working on a mobile application for students to be able to access their college accounts more easily.
After informing the school’s director of Information Services and Technology, François Paradis, about the problem, Al-Khabaz attended a meeting on Oct. 24 where he was congratulated along with colleague Ovidiu Mija, for their work. Paradis said that he and Skytech, the makers of Omnivox, would fix the problem immediately.
Two days later, Al-Khabaz ran a software program called Acunetix, made to test websites for their weaknesses, to verify that the issues he had discovered were fixed. The phone rang moments later. It was Edouard Taza the president of Skytech.
“The first thing I was thinking when they called was that I […] was doing something right, since I found a vulnerability in their website,” Al-Khabaz told The Concordian. “But the moment he called my home, he told me something very shocking.”
Dawson College’s administration proceeded to expel him for his actions.
“We stand by our decision,” said Donna Varrica, the college’s communications co-ordinator.
Varrica explained that Al-Khabaz demonstrated a “complete violation of code of conduct” and that this was a case beyond the administration’s control. Varrica explained that the institution cannot legally discuss the case.
There is currently a petition being circulated across social media outlets titled “Hamed Helped” which advocates that Al-Khabaz be reinstated as a Dawson student. As of press time, close to 4,000 people have signed the petition.
“The petition is awesome and I’m happy, but the message wasn’t just about me going back to college, but to let people know what’s going on with our systems,” Al-Khabaz said. “Companies like Skytech should be more secure.”
The letter Al-Khabaz received from administration explaining his expulsion was released online by CBC Monday. The letter states that “following a thorough analysis of the serious professional conduct issue,” Al-Khabaz was expelled based on several factors, including attempting to gain access to the college and external information systems — a clear violation of Dawson’s IT policy.
However, at the end of the letter, it states that Al-Khabaz has the right to appeal to the academic dean within 10 working days, but when he appealed to both the academic dean and the director-general, both denied his request.
Ethan Cox, the journalist who wrote the story for The National Post explained that the issue lies in whether or not the expulsion “fits the crime.”
In a non-disclosure agreement Al-Khabaz agreed to sign in order to avoid charges from the Royal Canadian Mounted Police and potentially facing six to 12 months jail time, he was prohibited from discussing confidential or proprietary information he found on Skytech servers or any information relating to it.
“I was really scared, I thought the best thing to do was just to obey,” Al-Khabaz said. “I think after all the events, they completely misunderstood my intentions.”
The agreement also prevented him from discussing the existence of the non-disclosure itself, which kept him from explaining his side of the story when the computer science program voted in a 14-1 vote to have him expelled.
“I didn’t think Dawson would do that. When I signed the disclosure, I told [Taza,] since we collaborated, ‘how about you tell Dawson to calm down, since we’re collaborating and no harm is done’,” Al-Khabaz said. “He told me he would do it, but [I] had no confirmation that he actually did.”
Moments before the interview with Al-Khabaz Monday night, he confirmed that Skytech sent out a press release stating that they were willing to put Al-Khabaz in a private CÉGEP and give him a part-time job at Skytech. There was also a formal apology included within it.