Can departments sanction students who do not take sufficient precautions to protect their work? One of my colleagues was teaching an introductory programming course this past spring. He discovered several students cheating by taking code from a public GitHub repository, which contained all the answers for this class. This repository already had an issue opened on it by a professor from another large school, who requested that it be taken down because his students were using it to cheat. No response.

Fortunately, the student left some identifying information in the comments, which we were able to use to determine that he attends our school, in our department. We attempted to contact him to request that he remove the offending code--unfortunately, emails to both his departmental email and his GitHub email went unanswered.

The department has a student code of conduct which states that students must take "all reasonable precautions" to prevent others from using their work. While this student is clearly in violation of that, we can't exactly fail him out of a course he passed over a year ago, and failing him out of course he's currently taking seems petty.

We've considered escalating this to the department, but we're not sure if the department can actually do anything about this. Can a department in the US punish a student for helping other students cheat even if the student is not taking the class where the cheating is occurring? If so, what should be done? If not, might there be anyone at the school that can do anything? This is a large, public state school.
Can a department in the US punish a student for helping other students cheat even if the student is not taking the class where the cheating is occurring? 


I don't know what you can do legally, but morally I think it would be wrong to try to prevent the student from making his/her coursework from past years' courses public. Making the work public could help the student market themselves to prospective employers, and has multiple other benefits for both the student (ego boost, impressing friends, fulfilling an altruistic desire to provide a useful internet resource they worked hard to create, gaining valuable experience using github, and more) and the internet (people from all over the world could download and use the code). Who are you and your colleagues to say that your selfish needs of not having such code available for download online because it facilitates cheating by your colleague's students are more important than the needs of the student and others who can genuinely benefit from the student's work? I think your premise that the student is doing something wrong is simply incorrect.


  If so, what should be done? If not, might there be anyone at the school that can do anything?


Yes, something could be done; you and your colleague could free yourselves of the harmful mindset of trying to control what your students are doing with coursework they worked hard to create after they finish taking your classes. As Massimo Ortolano suggests in the comments, stop taking the easy way out of giving the same assignments year after year and then blaming others for how easy it is for your students to cheat, and instead put in the work to give original assignments.