It sounds like "we don't like it and won't tell you why, we're hiding behind MIT policy and vague notions of privacy".
MIT should just demonstrate in a paper what the shortcomings are and print it, adding it to the citation tree of the original.
Looking very briefly at the paper and speculating wildly, I could imagine that the company who were subject of it - or their staff - might not appreciate it and have put pressure on MIT??
Solid amount of Streisand Effect going on here -- lots of attention has been bought to the paper (and that is everything after all!).
The apparent issue is that the data appears to have been entirely fabricated and is a lie. The author appears to simply be a fraud
FERPA is federal law. It is quite likely that MIT is legally bound to not release some pieces of evidence which are crucial in this case (hypothetically, for example: that the student's educational record is inconsistent with claims made in the paper).