photo by: Douglas County Sheriff's Office

Varun H. Sarja

A former University of Kansas student who hacked into the school’s computer system and changed his failing grades to A’s was granted probation for the resulting felony convictions. He also must write letters apologizing to the professors he fraudulently signed in as.

As the prosecutor and his defense attorney had requested in a plea agreement, Varun H. Sarja, 20, of Olathe received a year and a half probation, with an underlying 18-month prison sentence that he could be ordered to serve should he fail at probation.

Douglas County District Court Judge Kay Huff sentenced Sarja Monday.

Sarja, who has no prior criminal record, agreed to the terms of his probation, including that he would apologize directly to those affected by writing letters to the university and the professors involved.

Sarja previously assured the judge, upon his conviction in May, that he had removed keystroke logger software — which is what he used in the KU computer crimes — from all of his electronic devices and would not access it again. Keystroke loggers are devices that plug into computers and record everything that’s typed, enabling hackers to obtain usernames and passwords for others’ accounts and computer systems.

Sarja initially was charged with 18 felony counts. He pleaded guilty to two counts each of identity theft and unlawful computer acts, and the remaining counts against him were dismissed.

Sarja was a freshman studying engineering at KU during the 2016-17 school year, when he used a keystroke logger to steal instructors’ confidential login information, hack into multiple campus computers and change F’s to A’s.

A KU School of Engineering academic adviser noticed in spring 2017 that Sarja — who was on academic probation at that time — had an A in math and began checking into the situation along with the math professor.

An ensuing investigation by KU police revealed that Sarja had changed almost all of his 10 grades that year, starting in December, and stole teachers’ login credentials to do it. Sarja told detectives he loved engineering, wanted to be successful and was scared to tell his parents he had failed classes.

KU held a hearing to remove Sarja from the university in summer of 2017.

The Journal-World first reported the cybersecurity breach in October 2017, after details were shared at a KU School of Engineering Senate meeting, but the involved student was not named.

The criminal charges were filed against Sarja in November 2017.