Why is no one liable for this?

What are the six legal gaps?

1. No private right of action under the Higher Education Act.

   A school can disregard its Title IV identity-verification duties, and the person injured cannot sue on it; enforcement belongs exclusively to the Department of Education. In my view, a duty only the government can enforce, and rarely does, is not much of a duty for the person it was supposed to protect.

2. Sovereign immunity shields public institutions.

   State tort-claims acts protect public colleges from ordinary negligence claims, and the "no economic loss" doctrine defeats most of the rest — the victim's weeks of unpaid, full-time remediation work are effectively valued at zero.

3. No mandatory victim notification.

   When aid is originated against a real SSN, no law requires anyone to notify that SSN's owner; discovery is left to chance and credit monitoring. Even the No Aid for Ghost Students Act, as it advanced, requires notifying applicants whose FAFSAs are flagged — not the real owner of the identity when fraud against them is confirmed.

4. Security-data exceptions are used against the victim.

   State records laws let institutions classify origination metadata — timestamps, IP addresses, audit logs — as "security information." In this case Minnesota State did exactly that under Minn. Stat. § 13.37, while its own produced email conceded the victim, not the fraudster, is the data subject. The record of how your identity was stolen can be withheld from you.

5. FCRA damages require a blown deadline, not a suffered harm.

   If every institution eventually complies — even after months of pressure — the victim's remediation labor is legally worth nothing. The statute rewards you only if someone misses a deadline.

6. Credit freezes do not cover most federal student loans.

   Direct Subsidized and Unsubsidized Loans generally do not use the consumer credit check a freeze would block; Direct PLUS Loans are the exception — Federal Student Aid runs a credit check, and a security freeze must be lifted to apply. Federal Student Aid explains which federal loans require credit checks and the PLUS security-freeze requirement. There is still no equivalent "aid freeze" a citizen can place on their own SSN.

What fix would matter most?

A self-service federal student aid freeze: a control any person can place on their own Social Security number at studentaid.gov, exactly parallel to a credit freeze, that blocks new federal aid originations until the owner lifts it.

It would have stopped this fraud at the door: simple, voluntary, and it puts the person with the strongest incentive to prevent the fraud — the identity's real owner — in control. It is the single clearest legislative fix and this site's core policy ask.

What is this site asking Normandale and Minnesota State for?

Two things, neither of which is money: a root-cause analysis of how this application passed intake, and release to the victim, the data subject, of the origination metadata they have classified as secret.

Nothing on this site is or ever will be part of any financial demand. These are policy and transparency asks; they cost nothing and would help the next victim. For the steps a victim can take today within these constraints, see What To Do.