Former student hacker jailed for selling university exam answers

The defendant recruited his housemate to sell the papers to other students

Hayder Aljayyash (South Wales Police)

A former student has been sentenced to 20 months in prison for hacking into a university computer system and selling answers to exams for thousands of pounds.

Hayder Aljayyash, 29, was studying for a Master’s degree in embedded system design at the University of South Wales.

He had pleaded guilty at a hearing at Cardiff Crown Court to breaking into the university’s IT system between November 2017 and May 2019.

Aljayyash, who was born in Iraq and had sought asylum in Britain, remained undetected for 18 months by using “very sophisticated” techniques, the court heard.

He recruited his housemate and fellow student Noureldien Eltarki, 30, to find students to buy the exam answers.

Eltarki, who was born in Libya, also plead guilty and was given a nine-month suspended sentence and ordered to do 200 hours of unpaid work for agreeing to sell the unlawfully obtained exam answers.

Mathematics lecturer Liam Harris suspected that something was amiss while marking an exam in May 2019.

He found that a number of students had answered the questions using the exact solutions – with five students even copying the typing mistakes – from his original working papers, prosecuting barrister Jim Davis said.

The university then set up a “war room” to investigate the situation and ascertain the size of the data breach. About 140 million log records were processed, which identified an IP address linked to a house in Brook Street, Treforest.

The house was where Aljayyash and Eltarki were both living.

Police arrested Aljayyash on 30 May 2019, and seized his USB sticks and a laptop that held “numerous files which matched those downloaded as part of the university breach,” Mr Davis said.

About £17,000 was also seized, news website Wales Online reported.

Aljayyash used staff log-in details – acquired using a “sophisticated key logging device – to access the network almost 700 times, the court heard.

It was found that he had hacked the system to download 216 files that were exam papers, coursework, marking, and reports.

The court heard Aljayyash made about £20,000 in total, including £6,500 from one second-year student. Aljayyash paid Eltarki £300 or £400 each time for finding students to buy the stolen papers.

Sentencing Aljayyash, Judge Wynn Morgan told the defendant had “obvious talent and skill,” but that his actions were motivated by “financial greed”.

He called the scheme “very sophisticated” and said it had “damaged the reputation” of the university, which spent £100,000 on its investigation and new security measures.

The court heard Aljayyash was “ashamed” of his actions, and that he has been intent on “helping use the internet for good” by volunteering at a charity shop fixing laptops and helping other asylum seekers to learn how to use technology.

Susan Ferrier, who defended Eltarki, told the court that he had realised he had made as “stupid a decision”.

Judge Wynn Morgan told Eltarki that the “scheme was evidently not your idea – but you attempted making money on the side which is self-evidently wrong”.

Aljayyash plead guilty to three counts of obtaining articles by unauthorised access to computers and two counts of committing an act to impair reliability of data in computer. Eltarki plead guilty to money laundering and transferring criminal property.