Felony Charges For H.S. Hacking

jayrtfm writes "Last year the Kurtztown Area High School approved a program which gave every student an iBook. Now 13 students face felony charges for violating the district's usage policy." From the article: "Shrawder said the secret password '50Trexler,' was widely-known among the student body and distributed early in the school year. It allowed between 80 and 100 students to reconfigure their laptops, he said. The more computer-savvy students began to disable the administrations' ability to spy on the students' computer use. For others, it became a game, trying to outsmart the administration and compete with fellow students who held the secret, Shrawder said."

Comments

Lets get the facts straight

[LogicX]

This news was also reported in the Reading Eagle/Reading Times.

In that article, it was said that the students were accessing porn sites, and HAD infact hacked the administrative network.

However, living in this area, I feel it necessary to point out that the papers around here can't handle technical articles, and and usually get the facts wrong. For all we know, they got the admin pass, and disabled the proxy (which was likely the n2h2 Bess Proxy), and all of this is being blown out of proportion.
Once more facts become clear, maybe we'll learn why the rest of the 80-100 students weren't charged.

I attended and worked IT for Conrad Weiser Area School District which is about 20 minutes away from Kutztown, where we had the BCIU come in to do a lot of work on machines. The BCIU is clueless, and security is their lowest priority. It wouldn't surprise me at all if the BCIU worked with Kutztown High to setup this network, making it all the easier for these kids.
Also, here are the nyud mirrors of the links:
FAQ
Kutztown Area Patriot Article
Laptop Initiative

Re:Lets get the facts straight

[Geoffreyerffoeg]

As a high-school senior who's managed to avoid getting in trouble for computer stuff, I'd like to share my experience.

If you want to bypass any restrictions, find out if the teachers mind. Many times they won't. (I was once asked to send an e-mail from school, and our school filters block all webmail..or at least they think they do.)

If you end up doing something that you think they won't mind but they do, as soon as they say something, apologize, and stop doing that. And it helps to show yourself as a white hat ahead of time, so they know you're not solely trying to break their security.

If you're doing something that you know they mind, reconsider why. Is this something you can't do more safely from home, or from a public library or Internet café?

If you're looking up porn from school, you're a ****ing idiot. Same goes if you're breaking into important stuff for the fun of it.

Re:Lets get the facts straight

[nkh]

If you want to bypass any restrictions, find out if the teachers mind. Many times they won't.

And they won't mind either if they don't understand what you want to do. The problem comes when they understand what you told them and it's too late. You'll be the only one who "touched the computer", you're the only one who "knows how it works": you're responsible. I suggest that you ask for some kind of paper signed by a teacher before doing anything. I know I'm too much paranoid but it's always safe when you have a physical proof to show when something bad happens.

Re:Lets get the facts straight

[Durandal64]

Back in my senior year of high school (wow, 4 years already), we were doing a stock market competition in my government class. We used some sort of website portal, and my partner and I were actually doing fairly well. This was at a time when nVidia stock was shooting way up, so we were buying it. But we both forgot the password to our account over Christmas break and wanted to get in.

So I got wise and spoofed an e-mail to the administrator of the system (can't remember how I got the guy's e-mail address), forging the header to look like it was from my teacher. I (posing as the teacher) told him that a couple students had lost their password, and I needed it e-mailed to a hotmail account I'd set up. I put in some excuse about how I was going to be on the road and unable to check my regular e-mail address. This was actually true. My teacher told us he wouldn't be able to check his e-mails during the break because he was going to Colorado or something.

The guy bought it. He sent my password to the Hotmail account I'd set up. Not only had he sent my password, though. He'd sent everyone else's too. And to make matters worse, he'd CC'ed it to the teacher's real account ... with the quoted text from my forged e-mail. Wonderful. I was in deep shit.

So there was no way out. My name was on the original e-mail, and it wouldn't take a genius to figure out what happened. So I copped to it. I e-mailed my teacher, explaining the whole thing, and waited the entire break. I got to class, and my teacher just told me, "Got your e-mail. It's cool." And that was it.

I risked a whole hell of a lot to save some time for a stupid game. And I got lucky that my teacher was merciful. The worst part is that I was so set on going the 1337 route that I never considered that, with the administrator's e-mail, I could've just requested my password as myself!

So I got a free lesson there. In short, I agree with you. Teenagers don't listen to this kind of stuff though, because of course, it'll never happen to them. And if it does, they'll get lucky like me. Good thing the law doesn't hold minors accountable for their decisions.

Re:Lets get the facts straight

[Austerity Empowers]

You can be more rebellious, doubly so since you're a senior.

Altering the OS of your school provided laptop is probably not illegal, depending on what exactly you do. Unless you're unleashing a virus or destroying hardware, I really doubt anything will stick. I'm guessing this is the kind of thing the ACLU would help you with if you actually got in trouble.

Accessing material over the internet by using existing holes in school firewalls/proxies is NOT illegal. Most of us do it all the time at work because our IT departments are insane (but leave port 80 open with a proxy to censor us...may as well just leave them all wide open). Anyway unless you are attacking their network (router, firewall, proxy) in some way, it's not illegal or even immoral.

Now hacking in to their network, changing grades, destroying machines, altering network configurations, that's all illegal, immoral and just plain mean spirited. As with any other crime however, you should absolutely not admit to anyone what you've done without the counsel of a lawyer. This goes for any crime, even a speeding ticket. You have the right to remain silent, use it. Even if they promise to let you off, bring in a lawyer. Never play around with such things, I know some honest people who thought they were doing the right thing and got it handed to them. The right thing is to remain silent.

The more money it costs to enforce idiotic network policies and excess legal entanglements, the less likely anyone is going to want to be involved with it. If it isn't actively hurting someone, then I think after this neo-fascist insanity passes, people will ignore it.

Re:Lets get the facts straight

[Geoffreyerffoeg]

...it's not illegal or even immoral.

They make us and our parents sign an acceptable use policy or somesuch saying that we won't so much as breathe on their routers after eating onions. I think this is enforceable as a contract since my parents signed it and the entire minor-immunity thing doesn't apply to them.

you should absolutely not admit to anyone what you've done without the counsel of a lawyer.

In one particular case a month or two ago, it didn't help much: I used the unblocked Windows file sharing to help a user edit her files from outside the computer lab. Of course she went to the teacher's classroom and explained what we did well before I got there (I had thought the teacher wouldn't mind), so pleading the fifth wasn't a viable option.

Re:Lets get the facts straight

[mrjackson2000]

I've been in a similar situation, and i'll say this. If you have a few teachers on your side and maybe a friend w/ a parent on the school board you will be fine.
Almost all the stuff that i did was white hat, reinstalling windows, fixing drivers, but i knew more than the admin and that made them fear me. after everything blew over i went right back to doing that stuff for one of the labs.

Re:Lets get the facts straight

[Grym]

Altering the OS of your school provided laptop is probably not illegal, depending on what exactly you do. Unless you're unleashing a virus or destroying hardware, I really doubt anything will stick. I'm guessing this is the kind of thing the ACLU would help you with if you actually got in trouble.

Exactly. Unless you actually stole/damaged things--they'd be hard-pressed actually go through the trouble of ruining your life. It's this very fact that saved me back in the day.

Back when I was a senior in highschool (Class of '02), there was a computer-geek rebellion which I, by some strange twist of fate, found myself leading. It all started when the county bought some really nice computers for the fiber optic computer lab. Some of us got the bright idea to bring in cracked copies of Quake 2, Tribes 2, Unreal Tournament, and a bunch of other games to play during lulls in the classes. Most of the teachers didn't care. In fact, one of them even used "game time" as an incentive to get his lackadaisical senior students to do their assignments--with a lot of success I might add.

Then one of the hard-nosed teachers found out and made a habit of deleting the games. Of course, this was easily overcome by making copies of the game files locally and adding a few ifexist lines to the autoexec.bat of every machine to recreate the game should it be deleted. This worked for awhile until the county computer techs were called in to "See what was wrong."

Hoping to keep games off the computers, the county bought Clean Slate, a program used to lock down pre-XP computers. On the surface, the program seemed pretty tough. *All* changes/files created were removed every time the computer was restarted and only authorized programs were allowed to run. Of course, the BIOS was set as HD first to prevent bootdisking. The program was a huge hassle to both students and teachers alike.

This was first overcome by: 1) corrupting/resetting the BIOS 2)bootdisking in 3) REMing out the relevant lines in the autoexec and windows startup files. This entire process took approximately 20 seconds once you got good at it. And we did get good at it--there were over 300 computers in the school and every computer was unlocked (oftentimes the same day it was locked down). Unlocked computers were set with a blue background to indicate that they were fixed.

Eventually we wised up and just installed a keylogger on one of the computers scheduled to be locked down. Sure enough, you had to type in the password every time you installed the software. With the password (which worked throughout the school), many people actually used Clean Slate to protect the games from being deleted--which was just beautiful.

Figuring out what we were doing, they started to Norton Ghost the computers so that a direct install and password entry was not required. They also correctly configured Clean Slate so the BIOS couldn't be so easily corrupted. This too was eventually circumvented when we found out that Clean Slate is unable to apply its file protections to Novell Netware shared drives. If worse came to worse, and you had enough alone-time with the computer, you could always remove the case and reset the BIOS password with the pin.

Throughout this whole process, there was one rule among those involved: DO NOT DAMAGE THE COMPUTERS. Do not delete the Clean Slate files--only disable them. Do not put porn, ect. on the computers.

This turned out to be our saving grace. Eventually the computer technicians got fed up with our school. The network usage for our school was something like 30 times other schools in the county. Of course, all of this was occurring when the county was assuring the state that its computers would be ready for the new computer-based Standard of Learning (SOLs) tests. Bad timing. Entire meetings of the county school board were apparently based upon the

Re:Lets get the facts straight

[ComputerSlicer23]

Quick lesson in how the law works.

You can't commit a felony by breaking a contract. You can be found in breach of contract in a civil court for breaking a contract. You go to court to have a them help figure out what the restitution for failure to comply with the contract. A lot of the times, the penalites are spelled out in the contract.

So, being charged with a felony has absolutely nothing to do with any type of paperwork you or your parents signed. In order to be charged with a crime, you have to violate a criminal law.

There are so many silly laws about computers, that I won't be shocked to find out that there is some law that could be used against someone who isn't supposed to gains administrative access to a computer.

Kirby

Re:Lets get the facts straight

[Austerity Empowers]

I think I did not attend my last 3 months of high school, totally flaked on 2 "required' projects and basically disappeared (I was hand coding the mandelbrot set in assembly using some VESA book I found. It was quite hard to get info about the FPU so it was sorta trial and error). I may have showed up once or twice I can't recall, it was a busy period.

So my GPA went from 4.0 to 3.65 or some nonsense (Amazing how 8 Fs in the last quarter can really make a difference!). Didn't seem to affect anything, it's expensive for colleges to refuse admission they already gave you (it's hard for them to go as people they've already rejected), and high schools can't really hold you back. All those lame threats they make are really just that. Anyway no one checks, it goes right in there with your permanent record.

I'd be more concerned about getting stuck with criminal charges right as you turn 18. That's nasty and really can affect you even if it doesn't stick.

Re:Lets get the facts straight

[beren12]

I had a similar experience, back in '00. I was one of the few people who excelled at computers all throughout high school, and my teachers knew it. I was often helping them out of some jam or another.

The Library (hah) staff did not like me, because I wouldn't do their bidding. That's also where the main (Novell 4!) server was and things were stupidly locked down.

There were a few of us that made a website for the school (after I got bored of doing it myself). We knew the admin password for the network (admin). Damn, he was a really, really lousy admin. We helped keep things running a little smoother than he could.

Senior year, some other genius also guessed this amazingly secure password and started to have some fun. He made himself a few admin accounts, and played with teachers files...after he was bored of that, he decided to take down the network. He locked it so it would only boot from cd, and corrupted novell somehow, and it took the "admin" over a week to get it working correctly. I believe the kid was eventually suspended, or at least the next year he was 600 mi away living with his dad :-)

Because the staff feared people with more knowledge then they had, I was banned from using the library the last 3-4 months of my senior year of high school. This included the TV studio, where I would take refuge from bad sub teachers and work on electronics projects and watch TV. I was never charged with any wrongdoing, it was just because I had the ability to learn to do those things and I was in the library the day it went down (but hours after it was down!)

Re:Lets get the facts straight

[FredMenace]

Why lock the damn things down in the first place? The people who should be charged with a crime are the idiots trying to interfere with the kids learning constructive skills. Lock down the servers and administrative files, but let the kids do with the individual computers what they will, other than downloading/storing porn or illegal materials, launching cyberattacks, etc. So long as they still do all their schoolwork etc., what's the harm?

Re:Lets get the facts straight

[MPHellwig]

Well I am the network administrator on a high-school and the most effective solution to prevent damaging of the systems was to educate the *TEACHERS*.

Besides that, the student geeks on my school are mostly gamers and by allowing every 2 to 3 month a school-only lan party they are quit carefull these days on "their" hardware. Of course I get asked alot of times what the Administrator password is, I always respond that I would tell them what it was last week. To be honest I don't know the Administrator password, I blocked that account name ages ago....

Re:Lets get the facts straight

[Nogami_Saeko]

I suggest using "Deep Freeze" instead for locking-up lab computers so they reset-on-reboot. It's pretty solid software - and fairly difficult to remove afaik.

The network version also allows locking/unlocking/monitoring over the network, and you can generate 1-time codes for workstation access so people won't be able to unfreeze even if they snag the password with a keylogger of some sort.

I've heard that it does interesting things to the boot record so that if deep freeze doesn't boot the system (ie: you try and bypass with a floppy or other bootable media), the harddrives aren't readable (unconfirmed).

N.

Re:Lets get the facts straight

[jwdb]

and HAD infact hacked the administrative network.

Sorry, but they hadn't. The article clearly stated that although they had the administrator password and had removed the access restrictions on their own computer, at no time was the central server in danger.

Jw

Re:Lets get the facts straight

[raju1kabir]

Anyway, we were all learning to program and one of the more savvy programmers wrote a program to calculate PI and store the results to the HD. Once he finally got it working he wanted to try to run it on the server as a benchmark. Well, we were all new to programming and it turned out that the program used an infinite loop and wrote directly to the HD. Yes, that's right, it accessed the HD directly, on the hardware level.

I call BS. This is the most implausible story I've ever read in all my long years of reading people's stupid made-up stories on Slashdot.

Re:Lets get the facts straight

[miskatonic alumnus]

If you're doing something that you know they mind, reconsider why. Is this something you can't do more safely from home, or from a public library or Internet café?

If you're looking up porn from school, you're a ****ing idiot. Same goes if you're breaking into important stuff for the fun of it.

Maybe. But I don't think that is the point. Is it reasonable and just to damage a child's future for a minor infraction? After all, children do not have all the rights, responsibilities, and protections of an adult. Childhood is the time for making (and learning from) mistakes. When are we going to get away from this puritanical witch-hunting mindset?!?

Re:Lets get the facts straight

[Peaceful_Patriot]

So please, if you're attending a school or a university, just remember we're trying to keep things running so you guys can learn something. It isn't a contest.

But it is a contest. Guess you've forgotten what it's like to be a kid. Unfortunately, your 'them against us' attitude is what makes it fun. I worked in the public schools and administered the computer lab for several years. I had the best luck by ignoring the harmless stuff, and recruiting the help of the geeks.

Re:Lets get the facts straight

[llefler]

Amazing. At some time in our life, most of us have trumpeted computers in classrooms as teaching aids. It was bad enough that the result has been diversion of scarce tax dollars and distractions in the classroom. We've built a system of ignorant purchasing and a general lack of training for the teachers we supply these tools to. But now, we build an environment where we turn the students into criminals over juvenile jokes and 'inappropriate' curiosity.

If I were a parent in these school districts, I would refuse to allow my kids to have the school computers. And if there was ANY detrimental effect on their grades or education, I'd file a lawsuit. These heavy handed policies endanger the future of students in those districts.

If administators had been this ignorant when I was learning my skills, I wouldn't have worked with computers for the last 20 years. At a tech school I attended we used a system 34. I found out the hard way that you don't name a BASIC program Merge. It resulted in the system being frozen for hours while the history file filled and then printed. We also found that with the menuing tools and a set of manuals, we could get into functions we weren't intended to use. When the admin found out, instead of calling the cops he tightened security and the told us we weren't supposed to be using those functions and that he had locked us out.

When you give a child a learning tool, you don't punish them for exploring. The problem here isn't students hacking computers, it's the adults not properly supervising them. You wouldn't turn a bunch of HS students loose in the wood shop unsupervised.

Re:Lets get the facts straight

[metamatic]

Well, I have a similar story that I can vouch for as true...

Using BBC Micro computers attached to an Amcom E-net, I discovered that it was possible to write just a few more bytes than I supposedly had allocated to me as space. My guess is that there was some sort of K=1000 vs K=1024 bug between the client and server. The interesting thing was that the free space reported for my user area on the server then wrapped around to a very large 4-byte integer (or a negative integer which was reported as a large positive one).

I was naturally curious as to whether I really now had that much disk space, so I decided to write a quick program to create a very large disk file. I ran it, and it verified that yes, I did indeed now have megabytes of disk space. (This was back in the days when a floppy disk held 100K.)

So, I deleted the file, cleaned up my disk space, and thought no more of it.

The next day I heard that the next few users' disk areas on the server had mysteriously been overwritten with random junk...

So the only major differences between my story and the one you find implausible are (a) it was a server writing directly to disk without bounds checking because of a bug; and (b) I wrote junk to the file rather than digits of pi.

Even as late as the 80s it wasn't all that uncommon for PC software to write directly to the hard disk for speed reasons. So I rate the original story "plausible".

Re:Lets get the facts straight

[FredMenace]

If they choose to screw around rather than doing their homework, they're probably going to fail their classes, no? And if they're failing to do the required work, you focus on that. Say "do what else you want with your time, but do get your homework done." Some of them DID say that certain teachers used game playing etc. as a reward for finishing work, and that it was very effective.

Porn I can agree should be kept off those computers, and there would probably be some jousting between students and tech support over this, but the draconian lockdowns do NOTHING but taunt the kids into breaking the rules. (Even these kids were operating under self-imposed rules, such as not messing with the server, not deleting any programs, etc.)

It's the arrogance of "educators" that usually gets in the way. Once they start trying to prevent the kids from messing around a little, it can turn into a war (and a source of entertainment for the kids, as well as a distraction from their actual schoolwork), then the teachers/administrators can say "see, I told you so, they only want to fool around and distrupt things, they don't want to learn".

Regardless, I bet those kids learned more constructive skills during that schoolyear from the hacking and yes, from playing computer games (not to mention dealing with the stupidity and arrogance of the people in power), than they were likely to learn in their classes.

Re:Lets get the facts straight

[mollymoo]

I though it may not be BS. People did do stuff kind of, almost, like that 15+ years ago. But then I saw the little twerp's web page. He's 16. So they must have been using a proper OS, not a BBC Micro with a 5MB hard drive. Hmm, writing your own device drivers when you're 13, 'new to programming' and can't spot an infinite loop? Bullshit.

You should check out the bullshitter's web page, make sure you follow the link to his 'myspace' to see just how cool he is. If you're too lazy here are some choice quotes:

I'm a ninja with 1337 skills. I hate hippies and liberals, except for the liberals I don't hate. Even though things like this (MySpace) are for moderately faggy people, I was persuaded to create one despite my lack of faggy-ness.

I am very picky when it comes to girls.

Status: Single

Your Fears: that i'll end up sucking at life

Ah well, I guess he's still got time...

I just don't get it

[Pxtl]

What is it that causes legal-types to completely lose their marbles whenever anything high-tech happens? This seems roughly the equivalent of doodling in a textbook (in eraseable pencil) and sharing a Maxim magazine around in the halls. Hardly a felony.

Re:I just don't get it

[tolkienfan]

Unfortunately, under the law, accessing a computer system without authorization is a very serious crime.

And furthermore, the courts have decided that violating an acceptable use policy amounts to accessing the computer without authorization.

Worse, it is accepted within the courts that an existing "terms of use" or whatever does not have to have been read nor accepted for it to be enforceable.

It is presumed that such a policy exists, and it is the burden of the user to find and read it.

It sucks!
I am not a lawyer, this is not legal advice

Re:I just don't get it

[MillionthMonkey]

What is it that causes legal-types to completely lose their marbles whenever anything high-tech happens?

They don't know how to parlay the common sense they use in the real world to a virtual realm with which they are unfamiliar.

Plus, the professions they are in are usually dominated by "guardian" personality types. Such people tend to be comfortable with rigid interpretations of language and law, so if something falls under the rubric of "hacking" they will pigeonhole it as one specific type of behavior. Their reaction to it is determined not by the details of the behavior itself, which they may or may not understand, but the pigeonhole they have classified it into. Hacking is hacking. Hence the old saying that "the law is an ass."

When Mitnick was arrested the cops wouldn't let him have a phone. They thought he could launch nuclear missles by whistling into a phone at specific frequencies.

Re:I just don't get it

[KlomDark]

Yes, it IS legal advice. Don't bullshit us, boy. You're going to jail, soon as I can get your school administrator to press charges. Don't leave town in the meantime.

Re:I just don't get it

[bladesjester]

Welcome to the fun that was unleashed by the Computer Fraud and Abuse Act (1986) among other pieces of legislation and hyped through the roof by the FBI and Secret Service in the late 80's and early 90's.

That sort of thing set all of the precidents for the insane rulings that you see for this now.

In-house punishments please!

[garcia]

"I knew it was against school policy," he said. "But I didn't know it was a felony."

Of course they didn't. You know why? Because, "Students who violate the computer policy will be disciplined" does not imply that criminal charges will be filed. It implies that the students could receive in-school sanction.

This is a bunch of hyped up and unnecessary bullshit. If you're going to give laptops out you better bet that they are going to be used for unintended purposes. By bringing criminal charges you are doing nothing but wasting even MORE of the taxpayers dollars for something dumb.

Discipline them in-house (like they did to us in high-school - made us sit in the hot school all summer doing NOTHING - it's worse than paying a fine and doing community service)

Re:In-house punishments please!

[garcia]

You probably aren't in school anymore. Most usage policies that I've seen explicitly state something along the lines of 'criminal computer damage' or 'charges may be filed'.

You apparently didn't read the District's Usage Policy. In fact, I know you didn't or you wouldn't have questioned me. Let me help you:

From their FAQ which was linked in the Slashdot blurb.

Will students be able to install software on the laptop?
No, students installing software on school owned computers is a direct violation of the KASD Computer Policy. Students who violate the policy will be disciplined. All of the software necessary to integrate the laptop technology into the curriculum will be installed when the laptop is issued to the student. Security monitoring software will be used on all of the computers to assure that software is not loaded on the laptops. See the "Software" webpage in regards to the software installed on each laptop.

Will students be able to email, chat, and play games on their laptops?
Chat, IM, games, and email software will be removed from all computers. Student use of email, chatting, IM, and game playing is a direct violation of the KASD computer policy. Students who violate the computer policy will be disciplined.

What will the school do to help prevent students from going to inappropriate sites?
The KASD has a software/hardware product which is designed to help monitor all Internet sites that students attempt to access. This software/hardware blocks inappropriate sites and also logs a history of every site that each user opens. Students who attempt to find inappropriate sites will be disciplined. The current KASD content filter meets CIPA guidelines.

Just to be sure that I didn't miss anything I read it twice. Nothing in there about filing criminal charges.

Obviously I don't need to be in school anymore as I can read *and* comprehend.

Re:In-house punishments please!

[PerlDudeXL]

With those rules, I wouldn't want to use such an laptop. Just for my own and their protection. I react allergic to rules. Especially in schools :)

I would say that too-tight computer rules will end up in hardware/software being manipulated by a skilled student to gain a bit more freedom with the provided hardware.

password

[bnitsua]

I hope they had the sense to change their password...

As I read the article...

[notsoanonymouscoward]

I just kept thinking "Enders Game" !!!

Re:Inept school officials

[Pxtl]

I know. The school could have had just as good an effect by suspending those involved briefly and billing their parents for the board tech's time required to re-image the ibooks. Instead, they decide to jump on the "Cybercrime is teh evil!" bandwagon and go apeshit.

Aha!

[AEton]

Skavinsky consulted with the Berks County District Attorney's office and recommended charges of "Computer Trespass," in violation of PA criminal code section 7615, which carries a third degree felony charge.

The best way to get poor laws changed is to enforce them strictly.

Now everybody knows my password.

[rminsk]

Thank you for posting my password. I guess I will have to change it now.

Barely even hacking?

[Primotech]

Some friend of mine installed Firefox on his network drive at school and caught a great deal of flack for it. Because we know what a great risk a proven, secure web browser poses...

Locked down laptops...

[LostCluster]

From the FAQ... Will students be able to email, chat, and play games on their laptops? Chat, IM, games, and email software will be removed from all computers. Student use of email, chatting, IM, and game playing is a direct violation of the KASD computer policy. Students who violate the computer policy will be disciplined. These were school-owned laptops for approved uses only, and with a pretty tight leash on what could be installed.

Re:Locked down laptops...

[Pxtl]

Unfortunately, said leash was made of paper. Nobody's arguing that the kids were in violation of school rules when they hacked their own laptops - what we're arguing against is that a) the school is filing felony charges for a discipline issue b) the school is charging the students instead of their security people, and c) there exists felony charges that can be applied to such a minor crime.

Re:Locked down laptops...

[Anonymous Coward]

That's like calling the police because a student is going to the bathroom without a hall pass. Sure, it could technically be considered trespassing -- but every school I ever went to would just give me a detention instead of filing charges.

dom

Re:Inept school officials

[NoImNotNineVolt]

destroyed? i've been charged with a felony as a minor and now i'm working for nasa :P

Stupid

[Bones3D_mac]

Why are they giving these children felony charges for being intelligent enough to see through such pathetically weak security? At the very least, the school should have assigned each machine a separate password based on serial number.

In all seriousness, if they really wanted to ensure security on these systems, they shouldn't have allowed the students to take them out of the school.

Idiots.

[FireballX301]

I don't agree that it's a felony level offense, but...

I'm a student computer tech at my high school, since the school is too cheap to hire a full time technical staff. You wouldn't believe the amount of times I was asked for the local administrator passwords to the campus computers, just from people who wanted to 'mess around'.

The main problem is twofold: first, that the school doesn't want to be held liable for any 'bad' content (the obvious part), and that IT MAKES MORE WORK FOR ME. The admin password was leaked many times, and you wouldn't believe how many times I've had to either reformat computers or wipe Kazaa/Steam/random emulators from computers where students wanted to mess around. The worst part, when some of them tried to remove SynchronEyes (our 'spy' program), they were so incompetent with what they were doing that they ended up fuxxing the domain privileges and rendering the computer inoperable on the network. We rarely, if ever, monitor student activity, since we don't have enough staff.

If you want to mess around or do anything 'cool' with a computer, DO IT AT HOME. If you're at school, use the computers for school work. It's not a game as to how much work you can cause for the local techs and admin, the computers are always for WORK. If you go ahead and make it a game, we get VERY pissed at having to clean yet another computer.

Or better yet, do what I did and join the tech support staff.

Re:Idiots.

[LihTox]

Sounds like a good "punishment": put the offenders on the tech support staff and put them to work policing the network and cleaning up after the clueless and the pranksters. Is that onerous enough? It might channel their m4d 5k1llz in a more marketable direction. Then again, I'm no sysadmin, so what do I know?

Re:Idiots.

[rvalles]

Disabling Orwellian monitoring crap is not evil; it's an heroic act; the use of this kind of crap should be outlawed and no, don't give me this protecting kids crap. Kids shouldn't grow accostumed to surveillance. They should grow up as sovereign individuals who value their freedoms, and question power.

Re:Idiots.

[Volvogga]

While I agree with you that it is on the childish side to download Kazaa and emulators on a school computer (how long could you be on a computer for? 2 or three hours?), I must dissagree with your conclusion on the 'spy' programs.

Having graduated from HS this year, a rather populated school ('A' sports class, I believe) with older computers (PII's and PIII's), and a staff that *did* use the SynchrinEyes program frequently, I can assure you that you would always know when you were being monitored. The computer would suddenly slow to a crawl, the mouse would 'jump' in gaps on the screen, and web pages would take five times longer to load (and our network was already slower than 56K speed on most occasions due to its usage). Even using Word would become a pain.

I don't particularly care how you justify it (not held liable for bad content), anything that makes the computers less usable than a 386 is not a piece of software/equipment that should be used. This is not the only thing that is a problem with it. There is that feeling of annoyance that comes from someone watching you; a feeling which (believe it or not) decreases productivity even more. It is essentaly no different than a person standing over you while you are reading a book, and reading over your shoulder. In my case, I was always worried that the Librarian at my school (real Drac of a lady and the worst of the SynchronEyes monitors) would be monitoring me and look away for a moment, only to look back just as I would encounter a pop-up of questionable material (tig o' bitties!), which has happened to almost eveyone I know at school at least once.

This program is so much of a pain in the ass, that I have had some of the most timmid, straight-arrows of the school approach me asking if I knew how to dissable or even BREAK the stupid thing. It didn't take all that long to find a few ways around it, but it generally was a big risk to shut the thing off, as the monitor could tell if the program was disabled. We got warned the first few times, but then we were getting kicked out of the Library or computer lab and threatened with disiplinary action.

Our charge? Wanting to get our work done. SychronEyes (and I'm assuming most 'spy' programs) is a total piece of shit, which, in the wrong hands, decreases productivity and, overall, totaly fucks up an otherwise useable computer. Afterall, a computer is not truly obsolete until it can no longer due what you require of it.

The District Mission Statement:

[Rafikichi]

"To provide an interactive educational environment which encourages students to acquire the skills, knowledge, and attitudes, necessary to become responsible members of society"

@#$@# Educators!

[salesgeek]

Am I the only person here that thinks that it is the most flimsy form of chintz that educators use the legal system and literally ruin students futures over something so minor as this...

Wait a minute - the administrators have to show them who's in charge... and having the cops do their enforcement... that'll show them.

Re:@#$@# Educators!

[lachlan76]

So you're saying that breaking the rules in high school should mean that a child should have the rest of their life ruined? You really think that getting the admin password is something that should make you lose your right to vote?

Happened at my school too ..

[yrogerg]

In my high school in the late 80's we got a new network and the default password for all students and teachers was "IBM". 5 bonus points to whoever guesses which company set up the network. At the time it wasn't a big deal to mess up the network, it was considered buggy. Now you get lynched.

Unanswered question

[LostCluster]

What did the 13 who got charged do differently that made them stand out from the "80 to 100" students who used the compromized password?

Secret? LMAO!

[Oldest European]

"Shrawder said the secret password '50Trexler,' was widely-known among the student body..."

If it's widely-known, how can it be secret? ;-)

Incorrect Story

[Manip]

Should read ... - "For the administrators to monitor the students computer usage and for students that held the secret password to monitor one another. In order to keep the student's privacy safe while using the badly configured laptops the students had to get in and change the password. Upset by the fact they where made to look like noobs the school district are now bringing charges on all students that changed the password. When ask for comment the network admin had to say "I have an MCP, I think I can configure some laptops securely, the students are just messing with stuff using illegal haxor tools that they downloaded off P2P, I have contacted Microsoft, Apple and the MPAA about them!""

Re:Congrats

[louden obscure]

maybe the students coud end up making something better

yeah, with felony charges they may have the chance to learn how to make license plates...

Wow....

[cato kaze]

As a high school senior in pennsylvania who has done things similar to those being described in the article, I'm worried. Before, my school district basically just slapped a student on the wrist for things like this, but I have the feelings that students in EVERY school district in the state are in trouble if schools start prosecuting because they are too stupid to handle anything technologically with reason. Hell, a kid in my district got 12 days out of school suspension for getting around the BESS Proxy wheres a kid who ripped a hunk of flesh off of another one's chest got 2 days in school suspension. People are fucktards...

Re:Wow....

[chris_eineke]

a hunk of flesh off of another one's chest

Boobies!

Yeah, right

[P0ldy]

TFA:

"I don't know why this is such a big deal," he said. "At no time was the security of the server breached, and I don't know that it has cost the taxpayers any money."

A server breach does seem pretty impossible. Considering the complexity of the password and how few people knew it, it's doubtful they wouldn't know if the server was breached anyway.

Re:Inept school officials

[Transcendent]

Same thing happened to me in HS.

Fortunately, I scared them off with a lawyer and charges were dropped.... so I ended up with a 30 day vacation from school, and still finished my senior year with a 4.5/4.0 GPA along with getting AP credit for Calc (but I didn't get to go to Florida with the FIRST team, ah well). And yes, there was an incompetent administrator of the entire district's (Novel ::shudder::) network... in which her stupidity not only let me do what I did, but further made ME look bad because the unknowing school officials believed her word.

Unfortunately for the kids in thie story, I doubt the school can be scared off at this point.

The same thing..

[CyricZ]

.. the same thing that caused many Americans to lost their marbles after Sept. 11: FEAR caused by a LACK OF UNDERSTANDING. These politicians do not understand technology, hence they fear it with all their might. And the legal response by politicians to fear is to pass fucking moronic laws.

Re:Inept school officials

[Frank T. Lofaro Jr.]

Charged but not convicted I'd assume.

Felons are forbidden by law from:

Voting (in many states. In 14, including mine, Nevada, one is forever forbidden from voting. In Florida, another such state, I believe it is case law that a juvenile convicted of a felony loses the right the vote before he or she gains it - he or she is barred by law from ever gaining the right to vote - cruel, unusual and unconstitutional but still considered the law).
Holding office
Working in anyway for the government, local, state or Federal. If you run a company of your own and are a felon - your company is ineligible to bid on any project or supply any goods or services.
Owning a gun - 10 year sentence if one even tries to. 18 USC 922(g) makes it illegal and 18 USC 924(a)(2) sets the penalty.
Being bonded
Getting a good job - anyone that hires a felon can have a judgement for monetary damages against them for "negligent hiring" - the courts will then take possibly all their assets and garishee their wages for life if the judgement is big enough - yeah the person would have to harm someone - but what employer will hire a felon knowing the courts could de facto bankrupt them for life if the person who committed a (possibly minor) (possibly as a juvenile) felony kills or rapes someone.
Keeping a job - "negligent retention" law prescribes the above for failing to fire a felon.
Travel - Canada PROHIBITS felons from entering - and they are supposed to be a reasonable country. Heck, Canada forbids DUI offenders from entering. Heck, George W. Bush, sitting President of the US, is technically barred for that. Not that they'd ever enforce it in his case. (Yes, Bush's was a misdemeanor - but Canada still bars people for it, perhaps Canada was a bad example, perhaps Bush was a bad example because someone might start an off topic Bush sucks/Bush rules flamewar)
In Utah - they are forbidden from working in any operational capacity for a Certificate Authority - this will mean if a felon owns a company it can't be a CA.

I might be wrong - I hope I am - but I fear my list is incomplete, not incorrect.

Set the administration of the school on fire!

[rvalles]

They offer the laptops into such conditions that revolutions are bound to happen. What's this "can only use school's laptop and not your own" shit? and "You take care of the laptop" shit? and this "cannot install programs" shit? and this orwellian monitoring crap?

Death to them. They've done it exactly the wrong way, and it's only natural for students to protest and disobey the dictatorship. Under this conditions, it's alright to set up a resistance armed with AK-47s.

Live CD

[crypto55]

Why not just use a live-on-CD linux bootdisk? I haven't seen that many for Macs, but I'm pretty sure that Yellow Dog has one. That would give the students the ability to run their own OS, although it would be slow because of read speeds. At my school, we run crappy little 900mhz pIII Win98 SEs. Originally, they had almost no security, but now it's building up. I sometimes use Knoppix, without any modification to the system itself.

It sounds to me like this is just a story about a bunch of script kiddies who got caught *gasp* without covering their tracks.

Re:Live CD

[aldragon]

Heh. Reminds me of the face that a few computers at my schools have cd-rom booting disabled... however they set the stupid bios password to "admin" on a good number of the computers.

A friend of mine guessed that bios password first try because he accidently pressed the key to go into the bios and felt that giving a joking guess at the bios password took less effort than pressing the power button. Man, that was funny!

What were the technology adminstrators doing...

[gozar]

The administrative password for the machines was 50Trexler.... Ummm, where did this come from? Why it's the address of the high school!

I'd be nice to know the laws broken

[standards]

It would be nice to know exactly what law was broken here. Remember, "breaking school policy" is not the same as "breaking the law". Only the legislature(s) can make law.

And so to claim a felony, they're claiming that some law was broken. Why can't anyone describe that law?

I heard the kids were reading Slashdot. Waste of time, those poor souls already lost....

Re:I'd be nice to know the laws broken

[zakezuke]

And so to claim a felony, they're claiming that some law was broken. Why can't anyone describe that law?

TFA isn't all that clear and pacode.com is none too helpful. they only stated "Computer Trespass" PA criminal code section 7615, a Third degree felony.

PA Title 18, Chapter 76: Computer Offenses
"Computer Trespass" PA criminal code section 7615, a Third degree felony.

(a) Offense defined.--A person commits the offense of computer trespass if he knowingly and without authority or in excess of given authority uses a computer or computer network with the intent to:

(1) temporarily or permanently remove computer data, computer programs or computer software from a computer or computer network;

(2) cause a computer to malfunction, regardless of the amount of time the malfunction persists;

(3) alter or erase any computer data, computer programs or computer software;

(4) effect the creation or alteration of a financial instrument or of an electronic transfer of funds; or

(5) cause physical injury to the property of another.

(b) Grading.--An offense under this section shall constitute a felony of the third degree
--http://www.wcupa.edu/infoservices/polici es/pa_ti tle_18_chapter_76.htm

Also see " Unlawful Use of Computer"
3933 (a)(1) F3 GRAVITY SCORE 5 PRIOR RECORD POINTS 1
3933 (a)(2)(3) M1 GRAVITY SCORE 3 PRIOR RECORD POINTS m --http://www.pacode.com/secure/data/204/chapter303 /s303.15.html

And as the PAcode site is now slashdoted... I takeit someone else posted this info.

Re:I'd be nice to know the laws broken

[unitron]

They mave have acted "in excess of given authority" but I don't see where they had the intent to do any of 1 through 5 unless you really, really, reach.

Sounds like Officer Skavinsky and the Berks County District Attorney's office don't really know what they are doing and don't understand the law in question or computers in general.

It was an asinine password anyway

[Roofus]

Let's see, the postal address of the district office is.....50 Trexler Ave!

50 Trexler Ave.
Kutztown, PA 19530

Excellent, nobody would ever think of "50trexler"

Re:It was an asinine password anyway

[Dhalka226]

50 Trexler Ave.
Kutztown, PA 19530

I originally read that as "Klutztown." I was laughing at the irony when I realized my mistake. What a let down.

Re:It was an asinine password anyway

[Large Green Mallard]

Back when I was in high school, the school computers were running DOS 5, and PowerMenu .. (1992-1996).. the password was the last 4 digits of the school's phone number.

Actually, most of the computers were Mac Pluses.. *shudder*

Re:Inept school officials

[IdleTime]

All of what you say just underlines the fact tha USA is far from the land of "freedom". I've never heard of such additional lifetime punishments as you outline here. Where I come from, there is no "felony". Crimes are not rated and when you have served your sentence you have paid your dues and are once again a full member of society with all the rights and obligations everyne else have. What a bunch of bullshit this is.

Thoughts from a parent

[ExTex]

If one of the accused was my kid, I'd have a lawyer at the courthouse Monday morning with all of his knives sharpened. School boards and principals love power and tought talk. The point where the rubber meets the road is when an equal or higher power responds with bigger guns. A well connected and/or wealthy parent on a mission is their worst nightmare. I'm guessing that the accused children have been well chosen based on having parents who will either capitulate or don't have the resources to fight. Still, it won't be long until lawyers start getting involved on behalf of the accused children. The school officials are on thin ice when they start intimating that these students are somehow fellons by running sideways of a "usage policy." School records of children are strongly protected by federal law and by nearly every state law too. By accusing these minors the school is possibly breaching certain areas of student privacy, plus setting themselves up for a slander or libel suit. Minor children can not enter in to a legal contract. Conversely, they can't be in breach of a contract. You just can't be a felon for breaking a school rule of not using a computer in the way you were asked. By the way, committing assault, battery, and other violent acts are not the breaking of school rules. They are breaking established state and sometimes federal criminal laws. The school district needs to remember that they are a public entity that is likely subject to open records and sunshine laws of their state. Wait until the right parent seeks a court order to have a looksee at some of the administrations' machines and records. I have to think that the local prosecutor and police want no part of this game and will turn on the school at the earliest chance.

Re:Thoughts from a parent

[ExTex]

I'm unfamiliar with the term "asshat" but I think based on the context of your post I get what you are saying. My hypothetical reaction is based on the absurdity of the situation. Charging a child with a felony for a transgression that would be best punished by at least a detention and possibly a suspension, is a far greater issue. Fighting a felony charge would cost real money and the stakes for the child as well as the family would be sky high. A felony conviction for a minor would be an awful thing to carry for a lifetime. Especially for this type of violation. You are absolutly right that too many kids aren't held accountable for their actions. This is sadly a shocking and extreme case.

Re:Thoughts from a parent

[BackInIraq]

Actually, in addition to a lawyer your two other best friends are going to be media attention and contacting Congresscritters...both state and possibly national. Bring their name into it and suddenly they'll desperately want to side with the team that will lose them the least votes...and the school district that wants to turn kids into felons for what sound like (relatively) minor computer-related infractions probably won't be it.

Re:Thoughts from a parent

[w8300v-2]

This reminds me of something I saw on the local news (Houston, TX) about how things like chewing gum in class are being classified as 'disruption of class', and these kids getting 'tickets' and the parents having to go to court and/or pay fines. I can see a kid getting into 'the system' for something like drugs or bringing a weapon to school, but chewing gum? Talking in class? And of course, it's always the kids whose parents can't afford to fight it that wind up with these kind of 'punishments'. I'm not that old, but 'back in my day' kids got into trouble like that for dealing drugs or trying to burn the school down.

Re:My school used different methods....

[stfvon007]

When someone in my class tried to steal the instructors password to a networking class that used online materials. (Sent a message to the company that provided them forging the e-mail header to look like it was from the teacher, saying "I forgot my password, please send it to address@aol.com")

The next class instead of going to the computer lab we were sent to a classroom instead. Once we were all there, the district network administrator came in, and started giving a lecture on how to track down where an attempted intrusion is coming from, Using a real life case study. It was quite an interesting presentation actually, exept for one student who was watching in HORROR (with a complete look of shock on his face) as they described in great detail exactly how they tracked him down and learned exactly who did it. He was visibly shaking at the end of the lecture. (Before the lecture he had absalutely no idea that anyone else knew about the password theft attempt)
Besides that he got a few days of in school suspension, but that was it.

Nobody likes looking stupid

[idiot900]

I remember being in high school and encountering this sort of thinking. It hasn't changed in several years, apparently.

I think the school staff know exactly how inconsequential the security breaches were. But nobody likes being made to look stupid - especially by kids many years your junior. These students took advantage of security problems that never should have been there in the first place. Certainly the students were wrong in what they did - no question about that. But making this into a felony issue is a defensive move on the part of the school to divert attention away from how badly they did their job.

On another note - apparently the school had $900,000 to spend on this. Why couldn't they afford a competent IT person to run it?

Re:Inept school officials

[Curtman]

"What a bunch of bullshit this is."

Especially since the "purpose" of prison is supposed to be to reform the offender. Kind of puts that in perspective.

Stupid.

[BigZaphod]

I posted the following awhile back on slashdot, but I think in some ways it bears repeating here. Not because it is amazingly unique or insightful, but more because I learned a ton by screwing around with computer--sometimes school-owned ones. And I think I'm the better for it. If I did this kind of stuff now, I'd probably have been in jail at the age of 16 or something. This trend needs to change.

----

There was a lab that I used to hang out in. Being one of the few geeks in the school, I pretty much had run of the place. The teacher who oversaw the lab encouraged creativity and ingenuity. Sometimes he'd get pissed with something I did, but in those cases I just fixed it and moved on. This kind of activity, over a year or so, ended up earning his trust as I would also fix the odd problems with windows/autocad and such that would crop up.

Eventually I became the de-facto admin for that entire lab. During my required study period he would give me a pass to hang out in his lab--sometimes even when other classes were in there. Talk about heaven. I had the run of a computer lab that was networked. It was like being a king. :)

Around my junior year or so, they replaced the computers in the lab (aging 386/486 era machines with DOS, mostly) with shiny new Pentiums running Windows. For a few months they were basically just open and normal Windows machines. I think they even had Internet access. This was, of course, a total disaster. The net was new, then. People didn't have it at home. They downloaded anything and everything. Porn, viruses, music, etc.

The result was an *cough* admin *cough* who ended up being in the room almost everyday for awhile. He would spend his time poking around in control panels and "fixing" the computers. Eventually he must have gotten sick of that because they hired a local consulting company to come in to secure them all. Pretty soon the whole place was all passworded up with all these layers of cheap third party locks, etc.

I broke all of them--with full (unofficial) support of the teacher who taught in the room. They had tried to lock the systems down so much that half his programs wouldn't work right anymore. He had endless problems with students just trying to save their completed CAD drawings. I made a lot of those problems go away by circumventing the security, showing him how, and then giving him pointers to try to minimize the visibility of the hole so that other kids and the admin dude wouldn't find it. Not perfect, but it helped.

After some time of this the teacher pulled me aside one day and tells me in a reasonably loud-so-that-others-near-by-can-hear voice that I need to be careful because Mr. Admin is getting pissed that someone keeps getting into his expensively secured systems and he's going to try for suspension of that person when he is caught. Of course nearly every one of his students knew it was me--but they weren't going to talk. I had helped them all out of computer jams at some point or other. So after doing the semi-public speech, he later pulls me aside in private and says, "Hey, keep doing what you're doing. I'll make sure they don't do anything to you. Those bastards are making my life such a living hell and they won't listen to my needs that I've given up trying to deal with them. You at least make it possible for me to teach my classes."

So of course after the next round of "security upgrades" I was once again on the job. Eventually I figured the way into the system and changed all the screen savers to be the marquee one and had it read, "Ha ha! I got in Mr. Security Guy!" Hoo boy did the shit hit the fan. I was shielded from it, but the teacher just loved it. The admin dude was pissed. The consulting guy was there almost everyday for like 2 weeks. My teacher would just smile and nod. Eventually they locked it down pretty heavily, but by this point I was a senior and I was graduating early and was out of there.

Those were some good times. Seriously, though, I swear that in this

Nerdy anecdote

[5n3ak3rp1mp]

So it was freshman year in Cornell, 1990, and I had doubly no hope of getting laid, being a freshman and also a geek guy, the one girl on my floor that I had a crush on ended up dating some jock, so I fell in with a group of cool malcontent geeks who liked to play early Mac network games looong before they existed on PC's (all hail Spectre, Bolo, and NetTrek 3!) and got to breaking some rules.

At the time, Cornell was Mac-dominated (oh, happy memories) and the Upson lab had a network of IIci's just waiting to have their security hacked. I forget the tool that was used, but we figured out that it stored the password in a certain file that we could reach by bypassing the file security with Norton Utilities for Macintosh (haha Mac OS 6 security, bah). We procured a copy of the software, installed it and created a password on my own IIci, then took a copy of that file (with the obfuscated password) and replaced the file on the lab IIci. Instant admin access.

But we didn't stop there. We had such organization that we managed, as a team, to use this trick to install a fun little background process called NetBunny... on ALL the macs in ALL the labs. NetBunny does nothing on its own, but paired with a little utility called StartWabbit that we pointed at any campus AppleTalk network we wished, would begin the chain reaction. What then happened is that the Energizer Bunny would walk across the screen thumping the drum, going literally from screen to screen across the whole lab. It was pretty much a riot, if you were in on the joke, but the admins couldn't figure it out (we had hidden the executable well through obfuscation by renaming it and pasting another icon on it) and after they heard the recognizable "thump, thump, thump" sound would jump up and run around helplessly yelling "It's the bunny!!" We did it a few times with "agents" at each location to witness the mayhem. Good geek times.

I think it's the nature of very talented people, that when The System is not challenging them sufficiently (or when they refuse to take on the offered challenge due to lack of interest or motivation), that they seek out their own challenges, and fun.

I don't think these kids should get punished this harshly. Felony charges? Simply for trying to break the rules? Please. Face it, it takes some effort and talent to break in, it's just misplaced effort and talent. Find a way to redirect it. I mean come on, it probably started with some high-school geek starving for attention who wanted to seem cool.

I am an IT Director in a High School District...

[xorowo]

...and I think that pursuing felony charges is going too far. It shouldn't be too difficult to figure out how the password was leaked, and the person that leaked it should be punished harshly. I don't have a whole lot of sympathy for student crackers. That said, I imagine that the letter is designed to scare the crap out of the students, more than it is designed to suggest an actual imminent arrest.

I just dealt with some students who abused positions of trust (as tech aides) to install keylogging software on multiple computers. We came down hard on the student who initiated this because he used the information he gathered to access email and grades of the teachers whose passwords he caught. I never considered recommending this to the police, though, because I knew that we could suggest expulsion (which we ended up on a compromise with the student and his parents on) and scare the student into not doing this again. Or, at least, we now know who he is and we can ensure that he won't do the same thing.

The primary downside is that high school computer experiences shouldn't have to be as controlled and locked down as they are in most places. While we absolutely need security surrounding our student information system, grades, attendance and teacher files, I don't like locking down computers and trying to force certain behaviors. Let these kids work normally on the computers and be clear about what is appropriate. Locking them up will only, in the end, produce exactly what these district's saw -- students who do everything possible to break the security.

Oh, and the parent who said, "and I don't know that it has cost the taxpayers any money" is delusional. Everything I do in my job costs the taxpayers money, so if I have to spent dozens or hundreds of hours tracking down the source of a security breach instead of working with students on a multimedia project or with teachers on instructional applications, then it costs money.

Re:Inept school officials

[rilian4]

"The school could have had just as good an effect by suspending those involved briefly"

You obviously haven't spent much time w/ teenagers. I work in a high school doing IT. There are, of course, many kids in high school who would be affected by a suspension but there are more who aren't. Many many teens see a suspension as a vacation. Many times they are left home by working parents and play video games all day during the suspension. Other times, fishing trips and other outings substitute. I speak from experience.

"billing their parents for the board tech's time required to re-image the ibooks"

Now if only school administrations only had the guts to do this. This is a MUCH better idea than a felony charge for these kids. However, I have found very few school administrations willing to follow up on consequences such as this. More than likely, the kids won't end up getting charged w/ a felony but end up w/ some kind of suspension. -rilian

18 Pa.C.S.A. 7615

[danoatvulaw]

Just for everyone's information, here's the statute they might be prosecuted under. According to the sentencing provision, a third degree felony carries a maximum penalty of up to 7 years imprisonment (18 Pa.C.S.A. 1103) and a max $15,000 fine (18 Pa.C.S.A. 1101).

(a) Offense defined. A person commits the offense of computer trespass if he knowingly and without authority or in excess of given authority uses a computer or computer network with the intent to:

(1) temporarily or permanently remove computer data, computer programs or computer software from a computer or computer network;
(2) cause a computer to malfunction, regardless of the amount of time the malfunction persists;
(3) alter or erase any computer data, computer programs or computer software;
(4) effect the creation or alteration of a financial instrument or of an electronic transfer of funds; or
(5) cause physical injury to the property of another.

(b) Grading.--An offense under this section shall constitute a felony of the third degree.

Re:Inept school officials

[Frank T. Lofaro Jr.]

The scary thing is they can add punishments after one commits the crime!

That is technically an "ex post facto" (adding punishment after the fact) law, which is illegal, but they weasel out of it by saying it isn't punishment, it is just aiding "public safety" by restricting "privileges" of persons with a "felony status", not punishment for a crime.

Just as if the DMV takes your license away in an administrative hearing for DUI even if you are acquitted in criminal court! What about double jeapordy? Well the admin. hearing is not "punishment".

Oh, certain sex offenders are forbidden from living within X number of feet of a school. This restriction was added retroactively. In some cases these sex offender's offenses WOULD NOT BE A CRIME IN CERTAIN OTHER STATES WITH A LOWER AGE OF CONSENT - we aren't talking offenses which are universally considered crimes - i.e. they are being told they can't live somewhere after serving their sentence whereas in certain states they couldn't get in any (legal) trouble whatsoever. People who rape 9 year old girls should be locked up forever and ever and then some - but even then - the rule of law should hold - the rule of law is need to protect us all - make true perverts get life without parole sentences - I'm against the death penalty because I don't trust the government to use it fairly - Texas loves killing people and Nevada loved killing children until the Supreme Court stopped them.

Oh, the above rules don't protect kids - even sickos can take buses, trains, cars, planes, horses or walk to the school.

Also, this sets a precedent that the gov't can say where you live, and not as punishment for a crime - it can be done "ex post facto".

Also this precedent can be extended to any crime.

Think I'm crazy, think I'm paranoid. Well...

Clark County, NV has an "order out corridor" for people convicted of drugs and prostitution!

Clark County Code 12.05.020 (drugs) and 12.08.035 (prostitution). The "Las Vegas" Strip is in Clark County but not in the City of Las Vegas, btw.

Not just for where you can live, but where you can travel to or through!

Have a speeding ticket? Lots of car crashes in your town? How about a public safety rule that says you can't live within one mile of a freeway? Passed after your conviction? Justified by saying it is too tempting to have an opportunity for severe speeding so close by.

Re:Inept school officials

[Curtman]

"Not at all. The purpose of prison is punishment. It's getting the criminal out of society and forcing them to pay their debt to society."

So revenge is the goal? Yikes. No wonder your prisons are overflowing.

Re:Inept school officials

[BinaryOpty]

http://en.wikipedia.org/wiki/Surety_bond

Re:Inept school officials

[st0rmshad0w]

That would explain a few things....

YOu have to admit

[einhverfr]

Anyone who thinks it is a good idea to have a password based on the mailing address of the school district demonstrates that at least half of the problem is in the inability to approach security problems intelligently (like, say, actually balancing security and useability).

Analog Mayham

[Tablizer]

I remember the good 'ol days when we would get into simpler trouble by dipping the girl in front's pony tail into the desk ink well. You young wippersnappers get into trouble all the wrong ways. -Fogey

Living With a Felony

[bottlerocket]

I thought I'd share my thoughts, since this is a subject near and dear to my heart.

I was convicted of a felony three years ago, and my life was pretty much destroyed. I lost my job, my apartment, my college loans, and got slapped with thousands of dollars in fines to boot. I'm unemployable: I've shown up to different jobs to start my first day, only to be let go after because they got the results of the background check. The real kicker was that I checked "yes" to having a felony conviction on my application, but the managers claimed that "the computer says we can't hire you".

Since I am now unable to finish school and am stuck making six bucks an hour at McDonald's, I've been giving serious consideration to joining the Army. The recruiters say a waiver is no problem and they can wipe the felony from my record. I'd say gambling my life in Iraq beats the hell out of being doomed here in the Land of the Free.

Re:Living With a Felony

[Anonymous Coward]

> Boohoo!
> You commited a crime, and now you're paying for it.
> Maybe next time you'll think twice before breaking the law.

Why would he think twice next time? He just said his life is fucked after commiting one felony, having two felonies on his record won't make him any more unemployable than he is now.

It was pretty obvious he wasn't complaining about the actual punishment for the crime, but instead about the scarlet letter effect that took place after the supposed punishment was meted out. Even if you were an advocate of the scarlet letter style blackballing for life of felons, how do you think it'd be a deterrent to future crimes?

I really don't know anything about felonies, and if the parent post was accurate in his statements, but if he was it sounds like branding someone a felon for life would make them *more* likely to commit a crime again, not less.

Re:I am an IT Director in a High School District..

[unitron]

" It shouldn't be too difficult to figure out how the password was leaked..."

It was the school's street address. It wasn't leaked, it was guessed. If it had been leaked, it would have had to have come from someone in the school administration. Leaks come from the inside. (unless there's something in the terms of use that say if you happen to guess our pathetic password you aren't allowed to tell anyone)

Although it might be tempting for the attorney for the defense to claim that none of the students could have guessed the password so one of the school staff must have leaked it in an entrapment attempt. :-)

KNOPPIX!!!

[E8086]

...or the MAC equivalent, as long as you don't modify data on the hdd it should be very close to completely undetectable, just hold C during boot and you're set.

Re:Know what I'd do?

[symbolic]

I'd hand it right back. "No thanks".

The students had a wonderful opportunity to show what a complete failure such draconian policies can be. But, just like with illegal file sharing, they'd rather push the other way, and end up further behind than when they started.

Re:Inept school officials

[ColaMan]

I have no putty for people who comit a crime

You heartless person! Criminals sometimes have to deal with broken windows,just like everyone else. Have some pity and lend them putty.

I got detention for wiping teachers hard drive

[bxbaser]

Of course when i was in school this meant erasing the chalkboard when he was in lunch.

JESUS FUCKING CRIST

[t_allardyce]

FFS never mind this, why the fuck are kids being given laptops in the first place? High school students have NO use for all this equipment, they are going to use it for music, porn and games and very very occasionally write a report on it. Seriously is it that important to waste that much money so some students can do word processing?? what the fuck happened to using the computer room or their home computer or even just writing with a bloody pen? This is just an insane waste of resources for no purpose other than to hype the fact that everyone has laptops. Yeah sure it would be _nice_ to give kids laptops but at the moment it just costs too much, when the price eventually drops to a reasonable level then this will be a viable option. For the price of this project they could probably have afforded smaller class sizes, useful equipment or more one-to-one tutoring. These computers will be useless in a few years - many of them will be broken (they're not designed to last forever), some lost or stolen, and the rest will be nearing the end of their useful life as glorified word-processors with computing power that would have only been found in a Cray a few decades ago. I would sack who-ever is responsible for this and who ever DARED to pass the buck for their mother fucking failure on to kids that are doing what kids do (at least they aren't jacking cars).

Re:Inept school officials

[sjames]

I might be wrong - I hope I am - but I fear my list is incomplete, not incorrect.

All part of the mindlessness of 'getting tough on crime'. All it really means is that in those states, a convicted felon might as well re-offend once they get out since there's little to no chance of them becoming a productive member of society or even of making a legal living. You can't rationally cast someone out of society AND expect them to act as if they are a part of it. Any rational human being in that situation will turn to crime.

A ration al society will do its best to make sure that the penelties are somehow constructive. They should be appropriate to the crime, they should serve a restorative function for the victims of the crime. They should at least attempt to show the offender the value of living within society's laws and force them to reflect upon the harm they have done. Once over, it must be truly over and the offender should be given a chance to put what they have learned into practice by becomming once again a full member of society.

Simple warehousing away from the general population for a time and then designating them as second class citizens is hardly productive. If we truly believed that prisons were in any way corrective, we would feel no need to proactively restrict the rights of a paroled felon. As it stands, the term 'corectional facillity' is a big fat lie. Such things should be a last resort for cases where we cannot get through to a repeat offender. It should also be viewed as a failure on society's part.

Wait... you can hack an iBook?

[ISaidItOmega]

They hacked their iBooks..? What, did they change their desktop wallpaper or something?..

I joke! I joke!!

Apples of now and yesteryear.

[malkavian]

I think this is a dead on comparison on attitudes to day, and in years gone by.
50 years or so ago, the analogue (trespass charges from the article) would have been a bunch of schoolkids wandering off and stealing apples from some local orchard/garden. Just a handful, and just as it's 'the rebellious thing to do'.. That stage that many kids go through. And hey, adults do too.
Technically, it may be illegal, but common sense tells you it's a light hearted prank. Someone blowing off steam
You didn't just lump them in with somone who broke in your house and stole all your prized possessions.

If it were reported to the headmaster/headmistress of your school, you'd get a stern talking to, a series of detentions, lines to write, and probably a week kicking your heels in your bedroom.
All of which would say very strongly "It's really not worth the waste of your time to do it!".

An eminently sensible, and time tried solution. Everybody forgets about it in a few weeks, apart from maybe a slightly elevated reluctance on the part of the kids to 'scrump' for apples like that again.
Exactly as it should be.

Now: We get people like the teachers who went screaming to the police department at the first sign that somebody may have done something they didn't like.
Now, a suitable punishment would have been a series of detentions, letters home to the parents who would most likely have grounded the kids. And everyone would have gone on as usual.

Now, instead, you have a set of scared (and intensly angry) kids who if they do it again, are going to be much more careful, and if it looks like they're going to get caught, will likely cause collateral damage to hide their activities in.
And a series of shocked and angry parents who have suddenly lost faith in the ability of teachers to even try and keep some semblance of common sense in and out of the classroom.
Then, of course, the media, who love this, sending word far and wide to a generally disbelieving population, most of who are going to be shaking their heads at how far stupidity and knee jerk reaction has pervaded socicety and become the norm.
One thing's for sure: The image of that school is very badly damaged. I'd hazard a guess that several students will be moving (voluntarily) to another educational establishement.
The intake will likely be down (hey, would you prefer a school that'll give your kids a felony charge for a prank, or one that'll give them a detention and teach them pragmatism?).
The cost in PR and face for this action is incredible.
If the school holds it's current position, it'll likely cut off any possible stream for kids with a prankish side (who often tend to be highly creative; note this isn't just kids who misbehave just to be disruptive. Difference between Ferris Bueler and Bart Simpson) coming into the school.
And most other kids whose parents just don't want to risk it.
If they turn it around, and quash the teacher's wishes so completely, the administration will just never be treated as a joke, and it's authority will be seriously undermined (can you imagine, every small action a kid gets pulled up for, they'll be saying 'what are you going to do? Report it to the police?').

Maybe I'm just getting old, but all this leaves me with is the wish that things would go back to before the politically correct and lawsuit hungry era back to times when common sense was actually held in esteem. When you could actually learn to respect someone for being harsh but fair, rather than having them try to force respect by waving the threat of a lawsuit in your face at every corner.

Criminal stupidity and derelection of duty

[sjames]

Rule number 1 of security, if the attacker gains unsupervised physical access to the box, game over. What in the world did they think was going to happen?

You can raise the bar quite high if you use various crypto signature techniques, but ultimately a soldering iron and a flash burner will defeat that. A CPU that can check the BIOS signature in micricode on powerup would raise it much higher still(probably beyond a student's reach, in fact), but could be defeated by a determined attacker with the right laser and microscope.

Despite all of that, the real crime here is school administraters who have forgotten why they are there and who they serve. They are supposed to provide the students with a safe learning environment where they not only learn what's in the books, but how to get along in society. Part of that includes the school modeling society in microcosm. Part of that includes demonstrating that poor choices have unpleasant consequences while protecting them from the worst of those consequences while they are learning. Whenever outside law enforcement is called in, the school has failed in it's primary purpose. When outside law enforcement is unnecessarily brought in, the school has WILLFULLY derelected it's duty to the students, parents, and society.

Schools often claim to be acting in loco parentis and so need not recognize a student's 4th ammendment rights amongst others. Courts tend to agree with that. What they have forgotten here is that there are duties and responsabilities that go along with acting in loco parentis. Would any decent parent file felony charges in retribution if their high school aged child hacked their computer to bypass the parental netfilter?

The administraters are embarrassed that the students got the best of them. In their embarrassment, they have rather childishly decided to do as much harm to the students as the law will let them get away with. It sounds like the administraters responsable for this shouldn't be allowed anywhere near responsability for children until they spend some quality time with a qualified psychologist. In addition, given that the administraters have demonstrated an emotional age equal to or lower than that of the students, perhaps they should serve a few weeks of detention as well.

Were I one of the parents, I would probably petition for the administraters' immediate dismissal for incompetance.

"Kutztown" - not "Kurtztown"

[ibennetch]

Er, that should be "Kutztown" in the article title. Located in beautiful east-central Pennsylvania.

Death Penalty

[Anonymous Coward]

I think they should go for the death penalty. It is important to send a message to teens across the US that surfing the Internet is not to be tolerated and will be quickly and decisively punished. Not allowances for the, we didn't know defense. They need to learn early and now, that their actions contitute a grave threat against this country and that grave actions will be meet with grave concequenses.

So, please, everyone rise up with me and insist that the death penalty be employed to send the right message, to help protect our children.

This crap is nothing new

[ScrewMaster]

Sometime around 1977 my father stood in front of my state's legislature and gave testimony regarding a computer crime bill that was up for consideration. He pointed out that this bill would not only have little or no effect upon it's intended targets (white collar criminals), but would instantly felonize the bulk of the state's computer science and engineering students. It was a really stupid law, created with the usual "we have to appear to be doing something so let's do something in a hurry without out thinking it through" mentality.

They hadn't thought of that.

That bill didn't pass (only because an intelligent, well-spoken engineer gave the politicians some facts they chose not to ignore), but there always those that feel the need to increase the crime/punishment ratio to insane levels. Oh I know ... the teachers and administrators in this case probably feel the need to "send a message" to the student body. They think that message is "respect the law!", when the actual message is "the law doesn't respect you, so why should you respect the law?" All this kind of treatment will do is create more Kevin Mitnicks.

Re:Know what I'd do?

[jaybee2001]

I did just that to our internet use policy back in high school. My father is a lawyer, so I had him look over the paper before I signed it. He took one look at it and informed me that I would be stupid to sign.

The policy did not have a list of offenses or punishments. It just stated, basically, that "if we don't agree with what you are doing, we can do whatever we want to you."

You can imagine the look of the secretary's face when I returned it unsigned "on advice from my lawyer." I had internet access at home, so I didn't really care.

You guys are missing THE most important facts.

[Zyxwv88]

I'm surprised that no one has noticed this. The school district REQUIRED students to use the school laptops, even if they had a laptop at home that they could have brought in and used. The school district also REQUIRES teachers to implement the laptops into the curriculum so they are used. The school district has monitoring software so that they can spy on the students. Basically they are providing themselves with tools that they can spy on students, requiring students to carry those tools, and if students disable the spy software, they get charged with felonies. Am I the only one that sees a problem with this? If my kid was in that school district, I'd be visiting with a lawyer and/or other organizations to get some changes made around there. This is a total invasion of privacy, but it's been glossed over as a "free" laptop, so people have looked at it as a good thing instead of the invasion of privacy that it also is.

I really wish...

[lucat]

...to meet the underdeveloped idiot who thinks that it is a good idea to charge these kids with computer felony. When will these imbeciles understand that the school is a place where kids LEARN (and this is *exactly* what these kids did) and not jails?
These stupids should understand that if they do not like kids or school they should simply change job. It is clear that an idiot who wants to charge a kid with computer felony can't even be considered a human being... and for sure not someone that should work in a school.

Re:How'd they track it down?

[stfvon007]

Actually they matched the record of who had logged into the online class materials during the same class time from that machine. (the computers didnt require a login, but the online class materials did)