Updated

U.S. education officials are standing by their finding that Virginia Tech broke federal law when it waited two hours to notify the campus that a gunman was on the loose at the outset of a 2007 shooting rampage, and then sent out an e-mailed warning that came too late for 30 students and faculty who'd gone to class only to be killed.

In a report issued Thursday, the Department of Education rejected Virginia Tech's contention that its response to the deadliest mass shooting in modern U.S. history met standards in place at the time for providing notification.

"Virginia Tech's failure to issue timely warnings about the serious and ongoing threat deprived its students and employees of vital, time-sensitive information and denied them the opportunity to take adequate steps to provide for their own safety," the report stated.

The department in January found that the university violated the federal Clery Act, which requires notification of on-campus threats to students and employees, because it failed to issue a timely warning to the Blacksburg campus after student Seung-Hui Cho shot and killed two students in a dormitory early on the morning of April 16, 2007. The massacre left 33 dead, including the gunman, who killed himself.

The report also determined that the school failed to follow its own procedures for providing such notification.

Virginia Tech could be fined $27,500 for each violation, for a total of $55,000. The school also could face the loss of some or all of its $98 million in federal student financial aid, though such an outcome is considered unlikely. A determination will be made by a Department of Education panel.

Virginia Tech spokesman Larry Hincker said the school likely will appeal if it is sanctioned.

A state commission impaneled to investigate the shootings also found that the university erred by failing to notify the campus sooner. The state reached an $11 million settlement with many of the victims' families. Two families have filed suit and are seeking $10 million in damages from university officials. A judge recently ruled those lawsuits could move forward.

One victim's mother said she was glad the university is finally facing punishment for its actions, but she took more satisfaction from the inclusion in the report of actions that Virginia Tech officials took to protect themselves that morning. Victims' families had long wanted those details included in the report of the state commission.

"They couldn't fine enough money for what happened that day and how it altered our lives," said Suzanne Grimes, whose son Kevin Sterne was injured in the shootings. "It's more about the truth of what happened. That's what I sought for all these years."

Grimes and other victims' families fought to have included in the state report documentation that some Virginia Tech staffers informed family members and others about the shootings long before the notice went out to the entire campus.

The university says that one official advised her son to go to class anyway, while another only called to arrange for a babysitter.

But the federal report notes that after word of the shootings spread but before the e-mail was sent to campus, a continuing education center was locked down, an official directed that the doors to his office be locked, the university's veterinary college was locked down and campus trash pickup was suspended.

"If the university had provided an appropriate timely warning after the first shootings (in the dormitory), the other members of the campus community may have had enough time to take similar actions to protect themselves," the report said.

Cho shot the first two victims in a dormitory around 7:15 a.m., but Virginia Tech officials did not send an e-mail to the campus community about the shootings until nearly 9:30 a.m., about the time Cho was chaining shut the doors to a classroom building where he killed 30 more students and faculty, then himself.

Virginia Tech argues that, relying on campus police, it first thought the shootings were domestic and that a suspect had been identified, so there was no threat to campus. The education department rebuffed that argument, saying officials should have treated it as a threat because the shooter was on the loose.

The university argues that the Department of Education didn't define "timely" until 2009, when it added regulations to require immediate notification upon confirmation of a dangerous situation or an immediate threat to people on campus.

"Both the law and purposeful reasoned analysis require that the actions of that day be evaluated according to the information that was available to the university and its professionals at that time," Hincker, the Virginia Tech spokesman, said. "Anything else loses sight of the unthinkable and unprecedented nature of what occurred."

University president Charles Steger was traveling and unavailable for comment, Hincker said.

The report said that since 2005, the Department of Education has stated that the determination of whether a warning is timely is based on the nature of the crime and the continuing danger to the campus.

"The fact that an unknown shooter might be loose on campus made the situation an ongoing threat at that time, and it remained a threat until the shooter was apprehended," the report said.

The report also found:

— The university's e-mail to campus stated only that "a shooting incident occurred" and that the community should be cautious. The report said the lack of specificity could have led recipients to think the shooting was accidental and that it failed to give students and employees the "information they needed for their own protection."

— The warning would have reached more students and employees and "may have saved lives" if it had been sent before the 9:05 a.m. classes began.

— That Tech's warning policy — which is required under the Clery Act — was vague and did not provide the campus with the types of events that would warrant a warning, who would deliver that warning or how it would be transmitted.

— The university's process for issuing a warning was complicated and not well understood even by senior university officials.

The Clery Act requires colleges and universities to report information about campus crime. In order to receive federal student financial aid, the schools must report crimes and security policies and provide warning of campus threats. It is named after Jeanne Ann Clery, a 19-year-old university freshman who was raped and murdered in her dormitory in 1986. Her parents later learned that dozens of violent crimes had been committed on her campus in the three years before her death.

An expert on the Clery Act said loss of federal aid is unlikely.

S. Daniel Carter, director of public policy for Security On Campus, a nonprofit organization that monitors the Clery Act, said reviews based on the law are relatively rare and that the Virginia Tech review was the 35th in two decades. No school has ever lost federal funding, and the largest fine to be levied was $350,000 against Eastern Michigan University for failing to report the rape and murder of a student in a dormitory in 2006.

Carter said he found Virginia Tech's response troubling.

"Our fundamental goal is not to place blame, but to make sure students are kept safer," he said of the Act. "But their policy arguments would be very detrimental to protecting students all across the country if they were to be accepted."

___

Associated Press Writer Steve Szkotak contributed to this report.

(This version CORRECTS Corrects spelling of shooter's name in 4th paragraph.)