Slashdot Mirror
Felony Charges For H.S. Hacking
jayrtfm writes "Last year the Kurtztown Area High School approved a program which gave every student an iBook. Now 13 students face felony charges for violating the district's usage policy." From the article: "Shrawder said the secret password '50Trexler,' was widely-known among the student body and distributed early in the school year. It allowed between 80 and 100 students to reconfigure their laptops, he said. The more computer-savvy students began to disable the administrations' ability to spy on the students' computer use. For others, it became a game, trying to outsmart the administration and compete with fellow students who held the secret, Shrawder said."
This news was also reported in the Reading Eagle/Reading Times.
In that article, it was said that the students were accessing porn sites, and HAD infact hacked the administrative network.
However, living in this area, I feel it necessary to point out that the papers around here can't handle technical articles, and and usually get the facts wrong. For all we know, they got the admin pass, and disabled the proxy (which was likely the n2h2 Bess Proxy), and all of this is being blown out of proportion.
Once more facts become clear, maybe we'll learn why the rest of the 80-100 students weren't charged.
I attended and worked IT for Conrad Weiser Area School District which is about 20 minutes away from Kutztown, where we had the BCIU come in to do a lot of work on machines. The BCIU is clueless, and security is their lowest priority. It wouldn't surprise me at all if the BCIU worked with Kutztown High to setup this network, making it all the easier for these kids.
Also, here are the nyud mirrors of the links:
FAQ
Kutztown Area Patriot Article
Laptop Initiative
May this post be indexed by spiders, and archived for all to see as my Internet epitaph.
"I knew it was against school policy," he said. "But I didn't know it was a felony."
Of course they didn't. You know why? Because, "Students who violate the computer policy will be disciplined" does not imply that criminal charges will be filed. It implies that the students could receive in-school sanction.
This is a bunch of hyped up and unnecessary bullshit. If you're going to give laptops out you better bet that they are going to be used for unintended purposes. By bringing criminal charges you are doing nothing but wasting even MORE of the taxpayers dollars for something dumb.
Discipline them in-house (like they did to us in high-school - made us sit in the hot school all summer doing NOTHING - it's worse than paying a fine and doing community service)
Why are they giving these children felony charges for being intelligent enough to see through such pathetically weak security? At the very least, the school should have assigned each machine a separate password based on serial number.
In all seriousness, if they really wanted to ensure security on these systems, they shouldn't have allowed the students to take them out of the school.
8==8 Bones 8==8
I don't agree that it's a felony level offense, but...
I'm a student computer tech at my high school, since the school is too cheap to hire a full time technical staff. You wouldn't believe the amount of times I was asked for the local administrator passwords to the campus computers, just from people who wanted to 'mess around'.
The main problem is twofold: first, that the school doesn't want to be held liable for any 'bad' content (the obvious part), and that IT MAKES MORE WORK FOR ME. The admin password was leaked many times, and you wouldn't believe how many times I've had to either reformat computers or wipe Kazaa/Steam/random emulators from computers where students wanted to mess around. The worst part, when some of them tried to remove SynchronEyes (our 'spy' program), they were so incompetent with what they were doing that they ended up fuxxing the domain privileges and rendering the computer inoperable on the network. We rarely, if ever, monitor student activity, since we don't have enough staff.
If you want to mess around or do anything 'cool' with a computer, DO IT AT HOME. If you're at school, use the computers for school work. It's not a game as to how much work you can cause for the local techs and admin, the computers are always for WORK. If you go ahead and make it a game, we get VERY pissed at having to clean yet another computer.
Or better yet, do what I did and join the tech support staff.
Am I the only person here that thinks that it is the most flimsy form of chintz that educators use the legal system and literally ruin students futures over something so minor as this...
Wait a minute - the administrators have to show them who's in charge... and having the cops do their enforcement... that'll show them.
-- $G
Should read ... - "For the administrators to monitor the students computer usage and for students that held the secret password to monitor one another. In order to keep the student's privacy safe while using the badly configured laptops the students had to get in and change the password. Upset by the fact they where made to look like noobs the school district are now bringing charges on all students that changed the password. When ask for comment the network admin had to say "I have an MCP, I think I can configure some laptops securely, the students are just messing with stuff using illegal haxor tools that they downloaded off P2P, I have contacted Microsoft, Apple and the MPAA about them!""
Unfortunately, said leash was made of paper. Nobody's arguing that the kids were in violation of school rules when they hacked their own laptops - what we're arguing against is that a) the school is filing felony charges for a discipline issue b) the school is charging the students instead of their security people, and c) there exists felony charges that can be applied to such a minor crime.
As a high school senior in pennsylvania who has done things similar to those being described in the article, I'm worried. Before, my school district basically just slapped a student on the wrist for things like this, but I have the feelings that students in EVERY school district in the state are in trouble if schools start prosecuting because they are too stupid to handle anything technologically with reason. Hell, a kid in my district got 12 days out of school suspension for getting around the BESS Proxy wheres a kid who ripped a hunk of flesh off of another one's chest got 2 days in school suspension. People are fucktards...
Those who study history are doomed to watch others repeat it.
A server breach does seem pretty impossible. Considering the complexity of the password and how few people knew it, it's doubtful they wouldn't know if the server was breached anyway.
.. the same thing that caused many Americans to lost their marbles after Sept. 11: FEAR caused by a LACK OF UNDERSTANDING. These politicians do not understand technology, hence they fear it with all their might. And the legal response by politicians to fear is to pass fucking moronic laws.
Cyric Zndovzny at your service.
And furthermore, the courts have decided that violating an acceptable use policy amounts to accessing the computer without authorization.
Worse, it is accepted within the courts that an existing "terms of use" or whatever does not have to have been read nor accepted for it to be enforceable.
It is presumed that such a policy exists, and it is the burden of the user to find and read it.
It sucks!
I am not a lawyer, this is not legal advice
Charged but not convicted I'd assume.
Felons are forbidden by law from:
Voting (in many states. In 14, including mine, Nevada, one is forever forbidden from voting. In Florida, another such state, I believe it is case law that a juvenile convicted of a felony loses the right the vote before he or she gains it - he or she is barred by law from ever gaining the right to vote - cruel, unusual and unconstitutional but still considered the law).
Holding office
Working in anyway for the government, local, state or Federal. If you run a company of your own and are a felon - your company is ineligible to bid on any project or supply any goods or services.
Owning a gun - 10 year sentence if one even tries to. 18 USC 922(g) makes it illegal and 18 USC 924(a)(2) sets the penalty.
Being bonded
Getting a good job - anyone that hires a felon can have a judgement for monetary damages against them for "negligent hiring" - the courts will then take possibly all their assets and garishee their wages for life if the judgement is big enough - yeah the person would have to harm someone - but what employer will hire a felon knowing the courts could de facto bankrupt them for life if the person who committed a (possibly minor) (possibly as a juvenile) felony kills or rapes someone.
Keeping a job - "negligent retention" law prescribes the above for failing to fire a felon.
Travel - Canada PROHIBITS felons from entering - and they are supposed to be a reasonable country. Heck, Canada forbids DUI offenders from entering. Heck, George W. Bush, sitting President of the US, is technically barred for that. Not that they'd ever enforce it in his case. (Yes, Bush's was a misdemeanor - but Canada still bars people for it, perhaps Canada was a bad example, perhaps Bush was a bad example because someone might start an off topic Bush sucks/Bush rules flamewar)
In Utah - they are forbidden from working in any operational capacity for a Certificate Authority - this will mean if a felon owns a company it can't be a CA.
I might be wrong - I hope I am - but I fear my list is incomplete, not incorrect.
Just because it CAN be done, doesn't mean it should!
Let's see, the postal address of the district office is.....50 Trexler Ave!
50 Trexler Ave.
Kutztown, PA 19530
Excellent, nobody would ever think of "50trexler"
If one of the accused was my kid, I'd have a lawyer at the courthouse Monday morning with all of his knives sharpened. School boards and principals love power and tought talk. The point where the rubber meets the road is when an equal or higher power responds with bigger guns. A well connected and/or wealthy parent on a mission is their worst nightmare. I'm guessing that the accused children have been well chosen based on having parents who will either capitulate or don't have the resources to fight. Still, it won't be long until lawyers start getting involved on behalf of the accused children. The school officials are on thin ice when they start intimating that these students are somehow fellons by running sideways of a "usage policy." School records of children are strongly protected by federal law and by nearly every state law too. By accusing these minors the school is possibly breaching certain areas of student privacy, plus setting themselves up for a slander or libel suit. Minor children can not enter in to a legal contract. Conversely, they can't be in breach of a contract. You just can't be a felon for breaking a school rule of not using a computer in the way you were asked. By the way, committing assault, battery, and other violent acts are not the breaking of school rules. They are breaking established state and sometimes federal criminal laws. The school district needs to remember that they are a public entity that is likely subject to open records and sunshine laws of their state. Wait until the right parent seeks a court order to have a looksee at some of the administrations' machines and records. I have to think that the local prosecutor and police want no part of this game and will turn on the school at the earliest chance.
When someone in my class tried to steal the instructors password to a networking class that used online materials. (Sent a message to the company that provided them forging the e-mail header to look like it was from the teacher, saying "I forgot my password, please send it to address@aol.com")
The next class instead of going to the computer lab we were sent to a classroom instead. Once we were all there, the district network administrator came in, and started giving a lecture on how to track down where an attempted intrusion is coming from, Using a real life case study. It was quite an interesting presentation actually, exept for one student who was watching in HORROR (with a complete look of shock on his face) as they described in great detail exactly how they tracked him down and learned exactly who did it. He was visibly shaking at the end of the lecture. (Before the lecture he had absalutely no idea that anyone else knew about the password theft attempt)
Besides that he got a few days of in school suspension, but that was it.
All misspellings and grammatical errors in the above post are intentional and part of my artistic expression.
So it was freshman year in Cornell, 1990, and I had doubly no hope of getting laid, being a freshman and also a geek guy, the one girl on my floor that I had a crush on ended up dating some jock, so I fell in with a group of cool malcontent geeks who liked to play early Mac network games looong before they existed on PC's (all hail Spectre, Bolo, and NetTrek 3!) and got to breaking some rules.
At the time, Cornell was Mac-dominated (oh, happy memories) and the Upson lab had a network of IIci's just waiting to have their security hacked. I forget the tool that was used, but we figured out that it stored the password in a certain file that we could reach by bypassing the file security with Norton Utilities for Macintosh (haha Mac OS 6 security, bah). We procured a copy of the software, installed it and created a password on my own IIci, then took a copy of that file (with the obfuscated password) and replaced the file on the lab IIci. Instant admin access.
But we didn't stop there. We had such organization that we managed, as a team, to use this trick to install a fun little background process called NetBunny... on ALL the macs in ALL the labs. NetBunny does nothing on its own, but paired with a little utility called StartWabbit that we pointed at any campus AppleTalk network we wished, would begin the chain reaction. What then happened is that the Energizer Bunny would walk across the screen thumping the drum, going literally from screen to screen across the whole lab. It was pretty much a riot, if you were in on the joke, but the admins couldn't figure it out (we had hidden the executable well through obfuscation by renaming it and pasting another icon on it) and after they heard the recognizable "thump, thump, thump" sound would jump up and run around helplessly yelling "It's the bunny!!" We did it a few times with "agents" at each location to witness the mayhem. Good geek times.
I think it's the nature of very talented people, that when The System is not challenging them sufficiently (or when they refuse to take on the offered challenge due to lack of interest or motivation), that they seek out their own challenges, and fun.
I don't think these kids should get punished this harshly. Felony charges? Simply for trying to break the rules? Please. Face it, it takes some effort and talent to break in, it's just misplaced effort and talent. Find a way to redirect it. I mean come on, it probably started with some high-school geek starving for attention who wanted to seem cool.
Just for everyone's information, here's the statute they might be prosecuted under. According to the sentencing provision, a third degree felony carries a maximum penalty of up to 7 years imprisonment (18 Pa.C.S.A. 1103) and a max $15,000 fine (18 Pa.C.S.A. 1101).
(a) Offense defined. A person commits the offense of computer trespass if he knowingly and without authority or in excess of given authority uses a computer or computer network with the intent to:
(1) temporarily or permanently remove computer data, computer programs or computer software from a computer or computer network;
(2) cause a computer to malfunction, regardless of the amount of time the malfunction persists;
(3) alter or erase any computer data, computer programs or computer software;
(4) effect the creation or alteration of a financial instrument or of an electronic transfer of funds; or
(5) cause physical injury to the property of another.
(b) Grading.--An offense under this section shall constitute a felony of the third degree.
The scary thing is they can add punishments after one commits the crime!
That is technically an "ex post facto" (adding punishment after the fact) law, which is illegal, but they weasel out of it by saying it isn't punishment, it is just aiding "public safety" by restricting "privileges" of persons with a "felony status", not punishment for a crime.
Just as if the DMV takes your license away in an administrative hearing for DUI even if you are acquitted in criminal court! What about double jeapordy? Well the admin. hearing is not "punishment".
Oh, certain sex offenders are forbidden from living within X number of feet of a school. This restriction was added retroactively. In some cases these sex offender's offenses WOULD NOT BE A CRIME IN CERTAIN OTHER STATES WITH A LOWER AGE OF CONSENT - we aren't talking offenses which are universally considered crimes - i.e. they are being told they can't live somewhere after serving their sentence whereas in certain states they couldn't get in any (legal) trouble whatsoever. People who rape 9 year old girls should be locked up forever and ever and then some - but even then - the rule of law should hold - the rule of law is need to protect us all - make true perverts get life without parole sentences - I'm against the death penalty because I don't trust the government to use it fairly - Texas loves killing people and Nevada loved killing children until the Supreme Court stopped them.
Oh, the above rules don't protect kids - even sickos can take buses, trains, cars, planes, horses or walk to the school.
Also, this sets a precedent that the gov't can say where you live, and not as punishment for a crime - it can be done "ex post facto".
Also this precedent can be extended to any crime.
Think I'm crazy, think I'm paranoid. Well...
Clark County, NV has an "order out corridor" for people convicted of drugs and prostitution!
Clark County Code 12.05.020 (drugs) and 12.08.035 (prostitution). The "Las Vegas" Strip is in Clark County but not in the City of Las Vegas, btw.
Not just for where you can live, but where you can travel to or through!
Have a speeding ticket? Lots of car crashes in your town? How about a public safety rule that says you can't live within one mile of a freeway? Passed after your conviction? Justified by saying it is too tempting to have an opportunity for severe speeding so close by.
Just because it CAN be done, doesn't mean it should!
I thought I'd share my thoughts, since this is a subject near and dear to my heart.
I was convicted of a felony three years ago, and my life was pretty much destroyed. I lost my job, my apartment, my college loans, and got slapped with thousands of dollars in fines to boot. I'm unemployable: I've shown up to different jobs to start my first day, only to be let go after because they got the results of the background check. The real kicker was that I checked "yes" to having a felony conviction on my application, but the managers claimed that "the computer says we can't hire you".
Since I am now unable to finish school and am stuck making six bucks an hour at McDonald's, I've been giving serious consideration to joining the Army. The recruiters say a waiver is no problem and they can wipe the felony from my record. I'd say gambling my life in Iraq beats the hell out of being doomed here in the Land of the Free.
where the comment ends and sig begins
I'd hand it right back. "No thanks".
The students had a wonderful opportunity to show what a complete failure such draconian policies can be. But, just like with illegal file sharing, they'd rather push the other way, and end up further behind than when they started.
Sometime around 1977 my father stood in front of my state's legislature and gave testimony regarding a computer crime bill that was up for consideration. He pointed out that this bill would not only have little or no effect upon it's intended targets (white collar criminals), but would instantly felonize the bulk of the state's computer science and engineering students. It was a really stupid law, created with the usual "we have to appear to be doing something so let's do something in a hurry without out thinking it through" mentality.
... the teachers and administrators in this case probably feel the need to "send a message" to the student body. They think that message is "respect the law!", when the actual message is "the law doesn't respect you, so why should you respect the law?" All this kind of treatment will do is create more Kevin Mitnicks.
They hadn't thought of that.
That bill didn't pass (only because an intelligent, well-spoken engineer gave the politicians some facts they chose not to ignore), but there always those that feel the need to increase the crime/punishment ratio to insane levels. Oh I know
The higher the technology, the sharper that two-edged sword.
I'm surprised that no one has noticed this. The school district REQUIRED students to use the school laptops, even if they had a laptop at home that they could have brought in and used. The school district also REQUIRES teachers to implement the laptops into the curriculum so they are used. The school district has monitoring software so that they can spy on the students. Basically they are providing themselves with tools that they can spy on students, requiring students to carry those tools, and if students disable the spy software, they get charged with felonies. Am I the only one that sees a problem with this? If my kid was in that school district, I'd be visiting with a lawyer and/or other organizations to get some changes made around there. This is a total invasion of privacy, but it's been glossed over as a "free" laptop, so people have looked at it as a good thing instead of the invasion of privacy that it also is.