A Carleton University student is facing criminal charges, accused of stealing user names, passwords, financial information and other data from 32 other students to expose security flaws in the university's student card system.

Mansour Moufid, 20, is charged with mischief to data and unauthorized use of a computer, Ottawa police said Thursday in a release.

He has been released on several conditions and will appear in court on Oct. 15.

Moufid, a second-year math student, also faces a disciplinary hearing at the university.

A student who called himself "Kasper Holmberg" gained access to the data by installing software that he wrote on a terminal in a computer lab that was attached to a card reader.

The software recorded keystrokes made on the computer and included magnetic stripe card reader software, police said.

Holmberg sent a document to the university and the victims disclosing how he did it. In a 16-page report, he concluded that the cards were not secure and should not be used.

In an interview with CBC News, Moufid admitted using the Holmberg alias.

Accused left a trail: police

Det. Michel Villeneuve said the accused has not been co-operating with police and could face penalties ranging from fines to 10 years in jail.

He added that Holmberg made a number of mistakes that helped investigators. For example, his account log-in was embedded in the electronic document he sent out.

"He's pretty smart with respect to his programming, but in terms of his hacking abilities, I think he's a novice in that area because he left many trails behind."

Villeneuve said Moufid had received a warning from the university for other computer-related incidents in the past.

The university has said it has taken measures to ensure similar incidents don't happen in the future.

The university identification card, which has both a bar code and a magnetic stripe, can be loaded with cash and used to buy food, books and computer equipment on campus.

It contains data such as the student's identification number, computer and e-mail log-in name and password, and library card number. It can also be used to unlock doors for three campus buildings, including two residences.