It sounds like "we don't like it and won't tell you why, we're hiding behind MIT policy and vague notions of privacy".
MIT should just demonstrate in a paper what the shortcomings are and print it, adding it to the citation tree of the original.
Looking very briefly at the paper and speculating wildly, I could imagine that the company who were subject of it - or their staff - might not appreciate it and have put pressure on MIT??
Solid amount of Streisand Effect going on here -- lots of attention has been bought to the paper (and that is everything after all!).
FERPA is federal law. It is quite likely that MIT is legally bound to not release some pieces of evidence which are crucial in this case (hypothetically, for example: that the student's educational record is inconsistent with claims made in the paper).