Updated

Federal education officials have found Virginia Tech broke the law when it waited two hours to warn the campus that a gunman was on the loose, too late to save 30 students and faculty who went to class and were killed in the 2007 rampage.

The U.S. Department of Education issued a report Thursday rejecting the university's defense of its conduct and confirming that the school violated the Clery Act, which requires that students and employees be notified of on-campus threats.

The report concludes that the university failed to issue a timely warning to the Blacksburg campus after student Seung-Hui Cho shot and killed two students in a dormitory early on the morning of April 16, 2007.

"Virginia Tech's failure to issue timely warnings about the serious and ongoing threat deprived its students and employees of vital, time-sensitive information and denied them the opportunity to take adequate steps to provide for their own safety," the report stated.

Virginia Tech officials did not send an e-mail to the campus community about the shootings until two hours later, about the time Cho was chaining shut the doors to a classroom building where he killed 30 more students and faculty, then himself.

The federal department first found that Tech broke the law in January, but the university had its chance to respond to the allegations.

That response was soundly rejected in Thursday's report, which brought satisfaction for some victims' family members who have repeatedly called for more accountability from school officials for their actions on the day of the shootings.

The university could lose some or all of the $98 million in student financial aid it receives from the federal government, and could be fined up to $55,000 for two violations — failing to issue a timely warning and not following its own emergency notification policy.

Any sanctions will be decided by a Department of Education panel and federal officials have not provided a timeline for when sanctions might be announced. Virginia Tech spokesman Larry Hincker said the school likely will appeal any sanctions. University president Charles Steger was traveling and unavailable for comment, Hincker said.

Some of the arguments in Tech's defense centered around the definition of a "timely" warning. The university argued there was no definition of "timely" until two years after the shooting, when the DOE required schools to immediately notify people on campus upon confirmation of a dangerous situation or an immediate threat.

The university argued that the definition of "timely" is still not clear.

"Today's ruling could add even more confusion as to what constitutes a 'timely warning' at a time when unambiguous guidance is needed," Hincker said. "It appears that timely warning is whatever the Department of Education decides after the fact."

The federal report countered that since 2005, the Department of Education has stated that the determination of whether a warning is timely is based on the nature of the crime and the continuing danger to the campus.

While Thursday's finding makes official the federal verdict for the university, it echoes some of the conclusions already made by a state commission that investigated the shootings. That panel also found that the university erred by failing to notify the campus sooner.

The state reached an $11 million settlement with many of the victims' families. Two families have filed suit and are seeking $10 million in damages from university officials. A judge recently ruled those lawsuits could move forward.

One victim's mother was satisfied that the federal report included actions that Virginia Tech officials took to protect themselves that morning. Victims' families had long wanted those details included in the report of the state commission.

"They couldn't fine enough money for what happened that day and how it altered our lives," said Suzanne Grimes, whose son Kevin Sterne was injured in the shootings. "It's more about the truth of what happened. That's what I sought for all these years."

The university said one official advised her son to go to class anyway, while another only called to arrange for a baby sitter.

But the federal report notes a few actions on campus after word of the shootings spread but before the e-mail warning was sent: a continuing education center was locked down; an official directed that the doors to his office be locked; the university's veterinary college was locked down; and campus trash pickup was suspended.

"If the university had provided an appropriate timely warning after the first shootings (in the dormitory), the other members of the campus community may have had enough time to take similar actions to protect themselves," the report said.

S. Daniel Carter, director of public policy for Security On Campus, a nonprofit organization that monitors the Clery Act, said he found Virginia Tech's response troubling.

"Our fundamental goal is not to place blame, but to make sure students are kept safer," he said of the Act. "But their policy arguments would be very detrimental to protecting students all across the country if they were to be accepted."

The Clery Act requires colleges and universities to report information about campus crime. To receive federal student financial aid, the schools must report crimes and security policies and provide warning of campus threats. It is named after Jeanne Ann Clery, a 19-year-old university freshman who was raped and murdered in her Lehigh University dormitory in 1986. Her parents later learned that dozens of violent crimes had been committed on her campus in the three years before her death.

The report also found:

— The university's e-mail stated only that "a shooting incident occurred" and that the community should be cautious. The report said that could have led recipients to think the shooting was accidental and that it failed to give students and employees the "information they needed for their own protection."

— The warning would have reached more students and employees and "may have saved lives" if it had been sent before the 9:05 a.m. classes began.

— That Tech's warning policy — which is required under the Clery Act — was vague and did not provide the campus with the types of events that would warrant a warning, who would deliver it or how it would be transmitted.

— The university's process for issuing a warning was complicated and not well understood even by senior officials.

The financial impact for Tech is not decided. An expert on the federal Clery Act said loss of federal aid is unlikely.

Carter said reviews based on the law are relatively rare and that the Virginia Tech review was the 35th in two decades. No school has ever lost federal funding, and the largest fine to be levied was $350,000 against Eastern Michigan University for failing to report the rape and murder of a student in a dormitory in 2006.

___

Associated Press Writer Steve Szkotak contributed to this report.