There’s nowhere left for Oklahoma State University to hide.
The man in charge of interpreting the federal student privacy law for more than two decades, LeRoy Rooker, told the Tulsa World in an interview this week that Oklahoma State was under no legal requirement to withhold information about campus sexual assaults from the police.
Rooker’s interpretation flatly contradicts Oklahoma State legal counsel Gary Clark’s insistence that the Family Education Rights and Privacy Act (“FERPA”) forbade the university from alerting campus police about a string of reported sex crimes by a 22-year-old OSU senior.
The student, Nathan Cochran, was charged Dec. 12 with three counts of sexual battery — a month after Oklahoma State disciplinary authorities learned of the first allegation against him.
Between the time OSU suspended Cochran in a closed-door proceeding and the time of his arrest, police suspect that he committed several more assaults — assaults that might have been prevented had the university come forward promptly. And Cochran might never have come to the attention of law enforcement if not for an anonymous tip that a student newspaper reporter relayed to campus police.
To understand why Oklahoma State’s reliance on FERPA is so obviously unfounded, it’s important to understand what the law does and doesn’t protect.
FERPA requires colleges and schools to protect the privacy of “education records” — in other words, documents. As the head of the Department of Education’s Office of Family Policy Compliance — the office that enforces FERPA — Rooker issued an interpretation letter in 2006 that very clearly explains the distinction:
FERPA applies to the disclosure of tangible records and of information derived from tangible records. FERPA does not protect the confidentiality of information in general, and, therefore, does not apply to the disclosure of information derived from a source other than education records, even if education records exist which contain that information. As a general rule, information that is obtained through personal knowledge or observation, and not from an education record, is not protected from disclosure under FERPA.
What this means — as Rooker explained to the World‘s Zack Stoycoff — is that, when the first victim came forward and notified OSU Student Affairs that he’d been molested, no “education records” existed yet. Which means there was no FERPA privacy to violate.
Said Rooker, the government’s chief FERPA enforcer for 21 years: “Just forget FERPA at that point.”
Which means Student Affairs could have picked up the phone and alerted the OSU Police Department that a suspected sex offender was loose on campus.
But they chose not to.
Giving Oklahoma State the benefit of the doubt, it’s possible that people in Student Affairs had received inadequate training — there are no shortage of charlatans selling “FERPA compliance training” that is as reliable as driving lessons from Lindsay Lohan — and genuinely believed that notifying the police would violate federal law.
But that is not the most logical explanation, because it presumes an implausible level of incompetence. The most logical explanation is that Oklahoma State hid behind knowingly false claims of “student privacy” in an attempt to keep the crimes from leaving a public-records trail at the police department that would have generated unflattering publicity.
Oklahoma State had already forfeited the benefit of the doubt on FERPA by its knowing misuse of the statute to obstruct reporters’ requests for public records. For instance, the university continues to insist — despite two court rulings and a cerebrum’s worth of common sense to the contrary — that parking tickets (documents that are left on public display on people’s windshields) are confidential education records exempt from Oklahoma’s open-records law.
Because of Oklahoma State’s history of frivolously invoking FERPA in furtherance of protecting its image, the university’s reliance on FERPA in this instance must be viewed with deep skepticism.
OSU President Burns Hargis has turned the matter over to a board of regents task force, but that plainly is an inadequate response. Because Oklahoma State now faces significant civil liability to anyone who was victimized after the university’s failure to give a timely public warning, OSU regents and administrators have an irreconcilable conflict of interest: They can’t issue a report finding the university negligent, which would be useable in court as a signed institutional confession.
What’s needed is a credible and transparent external investigation — by some combination of the Department of Education, the Justice Department, and/or the local district attorney — that is at liberty to trace Oklahoma State’s wrongdoing as high up as it goes, and impose the full measure of sanctions it warrants.