Virginia Tech violated federal law by not issuing a timely warning to students at the start of the massacre that left 32 people dead on campus, the U.S. Department of Education said in a ruling that could result in financial penalties against the university. Tech sent an e-mail notice at 9:26 a.m. — nearly two hours after the first slayings were reported — that stated a "shooting incident" had occurred.

In a 28-page letter and report to Virginia Tech President Charles W. Steger, the department disagreed with the university's claim that there was no evidence of an ongoing threat after the first two students were shot to death in a residence hall on the morning of April 16, 2007.

Tech's contention that law enforcement believed the shootings to be an act of targeted violence that did not present a larger threat "appears to be an overstatement" of the information on hand at the time, the report said. The report said Tech cannot appeal the final ruling that it violated timely warnings required by the 1990 Jeanne Clery Act.

Tech spokesman Larry Hincker said it was not clear whether the finding will result in fines or, in "the worst-case scenario," a reduction in federal financial aid. That will be determined in a separate process, he said. If sanctions are imposed, the university would have the right to appeal.

The DOE report also found that Tech did not follow its own procedures during the 2½ hours after senior Seung-Hui Cho killed the first two students and before he killed 30 students and professors and himself in a classroom building.

"But the key finding is that we didn't issue a timely warning, which we vehemently disagree with," Hincker said. Hincker said Tech is being held to standards that changed as a result of the Tech tragedy. "Fundamentally, higher education changed" that day, he said. An entire industry has been created around warning systems as a result of what happened at Tech, he said. He said Tech's warnings "were well within the standards and practices in effect at that time."

But the DOE report said that a warning determination has to be made on a case-by-case basis. In Tech's situation, two students were dead and no suspect was in custody, and the warning that finally was issued was not specific enough, it said.