Clearly the article was wrong, but the reporter could only go off of what the hospital told him or her, and that does not seem to have included the professor's contact information. Rather, I'm guessing the message that got out of the IT department was "we got hacked by a professor", which then likely mutated via the rumor mill into the details about a class demonstration.<p>If anything, I think this shows the hospital gave the professor a lot more benefit of the doubt than I would have expected.<p>The professor did himself no favors with his email:<p><pre><code> I am Sam Bowne, an instructor at City College
San Francisco, and I found two security problems
on your server with a Google search.
Your FTP server has been compromised, and some
files named "w0000000t" were added to it.
</code></pre>
If I'm the IT administrator who receives this message, then after reading the first two sentences, I've already jumped to the conclusion that <i>this professor</i> is the individual who compromised my server! "Hi, I found security issues with your server, and now it's compromised!"<p>Sure, once you've read the intro by the professor, the meaning is clear, but think of yourself as a sysadmin getting this email, without the context of "I just found this, I had nothing to do with it" in your brain, and how are you going to react? Once the idea that the sender of this email is a hacker who broke into your server has entered your mind, it's going to be very hard to interpret it differently. Given that, the guy got treated pretty nicely by the story and the hospital in the end.