The report said the university violated the Clery Act requiring a timely warning to the campus when crimes or threats are reported.
Virginia Tech disputed the report and said the standard at the time allowed the university to use its best judgment after consulting with law enforcement. School officials said that's what they did.
The university has also been criticized by the state of Virginia for not notifying the campus about the shootings more quickly.
Thirty-three people died in the April 2007 rampage.