Nothing new under the sun...

When I was at Bradford university almost a decade ago they'd been letting the students in the Informatics department loose on the web for quite a few years already. They had what was essentially an anonymising proxy set up so that if any attacks were traced back to the university they wouldn't be able to identify the students involved, at least from the outside. Then they worked on the principle of, if your attempts were found out, you lost marks. I believe they're still doing it. Of course it helps that they own a Class B domain. Don't ask how it helps, it just does somehow.