Felony Charges For H.S. Hacking

jayrtfm writes "Last year the Kurtztown Area High School approved a program which gave every student an iBook. Now 13 students face felony charges for violating the district's usage policy." From the article: "Shrawder said the secret password '50Trexler,' was widely-known among the student body and distributed early in the school year. It allowed between 80 and 100 students to reconfigure their laptops, he said. The more computer-savvy students began to disable the administrations' ability to spy on the students' computer use. For others, it became a game, trying to outsmart the administration and compete with fellow students who held the secret, Shrawder said."

Comments

Lets get the facts straight

[LogicX]

This news was also reported in the Reading Eagle/Reading Times.

In that article, it was said that the students were accessing porn sites, and HAD infact hacked the administrative network.

However, living in this area, I feel it necessary to point out that the papers around here can't handle technical articles, and and usually get the facts wrong. For all we know, they got the admin pass, and disabled the proxy (which was likely the n2h2 Bess Proxy), and all of this is being blown out of proportion.
Once more facts become clear, maybe we'll learn why the rest of the 80-100 students weren't charged.

I attended and worked IT for Conrad Weiser Area School District which is about 20 minutes away from Kutztown, where we had the BCIU come in to do a lot of work on machines. The BCIU is clueless, and security is their lowest priority. It wouldn't surprise me at all if the BCIU worked with Kutztown High to setup this network, making it all the easier for these kids.
Also, here are the nyud mirrors of the links:
FAQ
Kutztown Area Patriot Article
Laptop Initiative

Re:Lets get the facts straight

[Grym]

Altering the OS of your school provided laptop is probably not illegal, depending on what exactly you do. Unless you're unleashing a virus or destroying hardware, I really doubt anything will stick. I'm guessing this is the kind of thing the ACLU would help you with if you actually got in trouble.

Exactly. Unless you actually stole/damaged things--they'd be hard-pressed actually go through the trouble of ruining your life. It's this very fact that saved me back in the day.

Back when I was a senior in highschool (Class of '02), there was a computer-geek rebellion which I, by some strange twist of fate, found myself leading. It all started when the county bought some really nice computers for the fiber optic computer lab. Some of us got the bright idea to bring in cracked copies of Quake 2, Tribes 2, Unreal Tournament, and a bunch of other games to play during lulls in the classes. Most of the teachers didn't care. In fact, one of them even used "game time" as an incentive to get his lackadaisical senior students to do their assignments--with a lot of success I might add.

Then one of the hard-nosed teachers found out and made a habit of deleting the games. Of course, this was easily overcome by making copies of the game files locally and adding a few ifexist lines to the autoexec.bat of every machine to recreate the game should it be deleted. This worked for awhile until the county computer techs were called in to "See what was wrong."

Hoping to keep games off the computers, the county bought Clean Slate, a program used to lock down pre-XP computers. On the surface, the program seemed pretty tough. *All* changes/files created were removed every time the computer was restarted and only authorized programs were allowed to run. Of course, the BIOS was set as HD first to prevent bootdisking. The program was a huge hassle to both students and teachers alike.

This was first overcome by: 1) corrupting/resetting the BIOS 2)bootdisking in 3) REMing out the relevant lines in the autoexec and windows startup files. This entire process took approximately 20 seconds once you got good at it. And we did get good at it--there were over 300 computers in the school and every computer was unlocked (oftentimes the same day it was locked down). Unlocked computers were set with a blue background to indicate that they were fixed.

Eventually we wised up and just installed a keylogger on one of the computers scheduled to be locked down. Sure enough, you had to type in the password every time you installed the software. With the password (which worked throughout the school), many people actually used Clean Slate to protect the games from being deleted--which was just beautiful.

Figuring out what we were doing, they started to Norton Ghost the computers so that a direct install and password entry was not required. They also correctly configured Clean Slate so the BIOS couldn't be so easily corrupted. This too was eventually circumvented when we found out that Clean Slate is unable to apply its file protections to Novell Netware shared drives. If worse came to worse, and you had enough alone-time with the computer, you could always remove the case and reset the BIOS password with the pin.

Throughout this whole process, there was one rule among those involved: DO NOT DAMAGE THE COMPUTERS. Do not delete the Clean Slate files--only disable them. Do not put porn, ect. on the computers.

This turned out to be our saving grace. Eventually the computer technicians got fed up with our school. The network usage for our school was something like 30 times other schools in the county. Of course, all of this was occurring when the county was assuring the state that its computers would be ready for the new computer-based Standard of Learning (SOLs) tests. Bad timing. Entire meetings of the county school board were apparently based upon the

Re:Lets get the facts straight

[ComputerSlicer23]

Quick lesson in how the law works.

You can't commit a felony by breaking a contract. You can be found in breach of contract in a civil court for breaking a contract. You go to court to have a them help figure out what the restitution for failure to comply with the contract. A lot of the times, the penalites are spelled out in the contract.

So, being charged with a felony has absolutely nothing to do with any type of paperwork you or your parents signed. In order to be charged with a crime, you have to violate a criminal law.

There are so many silly laws about computers, that I won't be shocked to find out that there is some law that could be used against someone who isn't supposed to gains administrative access to a computer.

Kirby

In-house punishments please!

[garcia]

"I knew it was against school policy," he said. "But I didn't know it was a felony."

Of course they didn't. You know why? Because, "Students who violate the computer policy will be disciplined" does not imply that criminal charges will be filed. It implies that the students could receive in-school sanction.

This is a bunch of hyped up and unnecessary bullshit. If you're going to give laptops out you better bet that they are going to be used for unintended purposes. By bringing criminal charges you are doing nothing but wasting even MORE of the taxpayers dollars for something dumb.

Discipline them in-house (like they did to us in high-school - made us sit in the hot school all summer doing NOTHING - it's worse than paying a fine and doing community service)

Re:In-house punishments please!

[garcia]

You probably aren't in school anymore. Most usage policies that I've seen explicitly state something along the lines of 'criminal computer damage' or 'charges may be filed'.

You apparently didn't read the District's Usage Policy. In fact, I know you didn't or you wouldn't have questioned me. Let me help you:

From their FAQ which was linked in the Slashdot blurb.

Will students be able to install software on the laptop?
No, students installing software on school owned computers is a direct violation of the KASD Computer Policy. Students who violate the policy will be disciplined. All of the software necessary to integrate the laptop technology into the curriculum will be installed when the laptop is issued to the student. Security monitoring software will be used on all of the computers to assure that software is not loaded on the laptops. See the "Software" webpage in regards to the software installed on each laptop.

Will students be able to email, chat, and play games on their laptops?
Chat, IM, games, and email software will be removed from all computers. Student use of email, chatting, IM, and game playing is a direct violation of the KASD computer policy. Students who violate the computer policy will be disciplined.

What will the school do to help prevent students from going to inappropriate sites?
The KASD has a software/hardware product which is designed to help monitor all Internet sites that students attempt to access. This software/hardware blocks inappropriate sites and also logs a history of every site that each user opens. Students who attempt to find inappropriate sites will be disciplined. The current KASD content filter meets CIPA guidelines.

Just to be sure that I didn't miss anything I read it twice. Nothing in there about filing criminal charges.

Obviously I don't need to be in school anymore as I can read *and* comprehend.

Idiots.

[FireballX301]

I don't agree that it's a felony level offense, but...

I'm a student computer tech at my high school, since the school is too cheap to hire a full time technical staff. You wouldn't believe the amount of times I was asked for the local administrator passwords to the campus computers, just from people who wanted to 'mess around'.

The main problem is twofold: first, that the school doesn't want to be held liable for any 'bad' content (the obvious part), and that IT MAKES MORE WORK FOR ME. The admin password was leaked many times, and you wouldn't believe how many times I've had to either reformat computers or wipe Kazaa/Steam/random emulators from computers where students wanted to mess around. The worst part, when some of them tried to remove SynchronEyes (our 'spy' program), they were so incompetent with what they were doing that they ended up fuxxing the domain privileges and rendering the computer inoperable on the network. We rarely, if ever, monitor student activity, since we don't have enough staff.

If you want to mess around or do anything 'cool' with a computer, DO IT AT HOME. If you're at school, use the computers for school work. It's not a game as to how much work you can cause for the local techs and admin, the computers are always for WORK. If you go ahead and make it a game, we get VERY pissed at having to clean yet another computer.

Or better yet, do what I did and join the tech support staff.

Wow....

[cato kaze]

As a high school senior in pennsylvania who has done things similar to those being described in the article, I'm worried. Before, my school district basically just slapped a student on the wrist for things like this, but I have the feelings that students in EVERY school district in the state are in trouble if schools start prosecuting because they are too stupid to handle anything technologically with reason. Hell, a kid in my district got 12 days out of school suspension for getting around the BESS Proxy wheres a kid who ripped a hunk of flesh off of another one's chest got 2 days in school suspension. People are fucktards...

Re:I just don't get it

[tolkienfan]

Unfortunately, under the law, accessing a computer system without authorization is a very serious crime.

And furthermore, the courts have decided that violating an acceptable use policy amounts to accessing the computer without authorization.

Worse, it is accepted within the courts that an existing "terms of use" or whatever does not have to have been read nor accepted for it to be enforceable.

It is presumed that such a policy exists, and it is the burden of the user to find and read it.

It sucks!
I am not a lawyer, this is not legal advice

Re:Inept school officials

[Frank T. Lofaro Jr.]

Charged but not convicted I'd assume.

Felons are forbidden by law from:

Voting (in many states. In 14, including mine, Nevada, one is forever forbidden from voting. In Florida, another such state, I believe it is case law that a juvenile convicted of a felony loses the right the vote before he or she gains it - he or she is barred by law from ever gaining the right to vote - cruel, unusual and unconstitutional but still considered the law).
Holding office
Working in anyway for the government, local, state or Federal. If you run a company of your own and are a felon - your company is ineligible to bid on any project or supply any goods or services.
Owning a gun - 10 year sentence if one even tries to. 18 USC 922(g) makes it illegal and 18 USC 924(a)(2) sets the penalty.
Being bonded
Getting a good job - anyone that hires a felon can have a judgement for monetary damages against them for "negligent hiring" - the courts will then take possibly all their assets and garishee their wages for life if the judgement is big enough - yeah the person would have to harm someone - but what employer will hire a felon knowing the courts could de facto bankrupt them for life if the person who committed a (possibly minor) (possibly as a juvenile) felony kills or rapes someone.
Keeping a job - "negligent retention" law prescribes the above for failing to fire a felon.
Travel - Canada PROHIBITS felons from entering - and they are supposed to be a reasonable country. Heck, Canada forbids DUI offenders from entering. Heck, George W. Bush, sitting President of the US, is technically barred for that. Not that they'd ever enforce it in his case. (Yes, Bush's was a misdemeanor - but Canada still bars people for it, perhaps Canada was a bad example, perhaps Bush was a bad example because someone might start an off topic Bush sucks/Bush rules flamewar)
In Utah - they are forbidden from working in any operational capacity for a Certificate Authority - this will mean if a felon owns a company it can't be a CA.

I might be wrong - I hope I am - but I fear my list is incomplete, not incorrect.

Thoughts from a parent

[ExTex]

If one of the accused was my kid, I'd have a lawyer at the courthouse Monday morning with all of his knives sharpened. School boards and principals love power and tought talk. The point where the rubber meets the road is when an equal or higher power responds with bigger guns. A well connected and/or wealthy parent on a mission is their worst nightmare. I'm guessing that the accused children have been well chosen based on having parents who will either capitulate or don't have the resources to fight. Still, it won't be long until lawyers start getting involved on behalf of the accused children. The school officials are on thin ice when they start intimating that these students are somehow fellons by running sideways of a "usage policy." School records of children are strongly protected by federal law and by nearly every state law too. By accusing these minors the school is possibly breaching certain areas of student privacy, plus setting themselves up for a slander or libel suit. Minor children can not enter in to a legal contract. Conversely, they can't be in breach of a contract. You just can't be a felon for breaking a school rule of not using a computer in the way you were asked. By the way, committing assault, battery, and other violent acts are not the breaking of school rules. They are breaking established state and sometimes federal criminal laws. The school district needs to remember that they are a public entity that is likely subject to open records and sunshine laws of their state. Wait until the right parent seeks a court order to have a looksee at some of the administrations' machines and records. I have to think that the local prosecutor and police want no part of this game and will turn on the school at the earliest chance.

Nerdy anecdote

[5n3ak3rp1mp]

So it was freshman year in Cornell, 1990, and I had doubly no hope of getting laid, being a freshman and also a geek guy, the one girl on my floor that I had a crush on ended up dating some jock, so I fell in with a group of cool malcontent geeks who liked to play early Mac network games looong before they existed on PC's (all hail Spectre, Bolo, and NetTrek 3!) and got to breaking some rules.

At the time, Cornell was Mac-dominated (oh, happy memories) and the Upson lab had a network of IIci's just waiting to have their security hacked. I forget the tool that was used, but we figured out that it stored the password in a certain file that we could reach by bypassing the file security with Norton Utilities for Macintosh (haha Mac OS 6 security, bah). We procured a copy of the software, installed it and created a password on my own IIci, then took a copy of that file (with the obfuscated password) and replaced the file on the lab IIci. Instant admin access.

But we didn't stop there. We had such organization that we managed, as a team, to use this trick to install a fun little background process called NetBunny... on ALL the macs in ALL the labs. NetBunny does nothing on its own, but paired with a little utility called StartWabbit that we pointed at any campus AppleTalk network we wished, would begin the chain reaction. What then happened is that the Energizer Bunny would walk across the screen thumping the drum, going literally from screen to screen across the whole lab. It was pretty much a riot, if you were in on the joke, but the admins couldn't figure it out (we had hidden the executable well through obfuscation by renaming it and pasting another icon on it) and after they heard the recognizable "thump, thump, thump" sound would jump up and run around helplessly yelling "It's the bunny!!" We did it a few times with "agents" at each location to witness the mayhem. Good geek times.

I think it's the nature of very talented people, that when The System is not challenging them sufficiently (or when they refuse to take on the offered challenge due to lack of interest or motivation), that they seek out their own challenges, and fun.

I don't think these kids should get punished this harshly. Felony charges? Simply for trying to break the rules? Please. Face it, it takes some effort and talent to break in, it's just misplaced effort and talent. Find a way to redirect it. I mean come on, it probably started with some high-school geek starving for attention who wanted to seem cool.

Re:Inept school officials

[Frank T. Lofaro Jr.]

The scary thing is they can add punishments after one commits the crime!

That is technically an "ex post facto" (adding punishment after the fact) law, which is illegal, but they weasel out of it by saying it isn't punishment, it is just aiding "public safety" by restricting "privileges" of persons with a "felony status", not punishment for a crime.

Just as if the DMV takes your license away in an administrative hearing for DUI even if you are acquitted in criminal court! What about double jeapordy? Well the admin. hearing is not "punishment".

Oh, certain sex offenders are forbidden from living within X number of feet of a school. This restriction was added retroactively. In some cases these sex offender's offenses WOULD NOT BE A CRIME IN CERTAIN OTHER STATES WITH A LOWER AGE OF CONSENT - we aren't talking offenses which are universally considered crimes - i.e. they are being told they can't live somewhere after serving their sentence whereas in certain states they couldn't get in any (legal) trouble whatsoever. People who rape 9 year old girls should be locked up forever and ever and then some - but even then - the rule of law should hold - the rule of law is need to protect us all - make true perverts get life without parole sentences - I'm against the death penalty because I don't trust the government to use it fairly - Texas loves killing people and Nevada loved killing children until the Supreme Court stopped them.

Oh, the above rules don't protect kids - even sickos can take buses, trains, cars, planes, horses or walk to the school.

Also, this sets a precedent that the gov't can say where you live, and not as punishment for a crime - it can be done "ex post facto".

Also this precedent can be extended to any crime.

Think I'm crazy, think I'm paranoid. Well...

Clark County, NV has an "order out corridor" for people convicted of drugs and prostitution!

Clark County Code 12.05.020 (drugs) and 12.08.035 (prostitution). The "Las Vegas" Strip is in Clark County but not in the City of Las Vegas, btw.

Not just for where you can live, but where you can travel to or through!

Have a speeding ticket? Lots of car crashes in your town? How about a public safety rule that says you can't live within one mile of a freeway? Passed after your conviction? Justified by saying it is too tempting to have an opportunity for severe speeding so close by.

Living With a Felony

[bottlerocket]

I thought I'd share my thoughts, since this is a subject near and dear to my heart.

I was convicted of a felony three years ago, and my life was pretty much destroyed. I lost my job, my apartment, my college loans, and got slapped with thousands of dollars in fines to boot. I'm unemployable: I've shown up to different jobs to start my first day, only to be let go after because they got the results of the background check. The real kicker was that I checked "yes" to having a felony conviction on my application, but the managers claimed that "the computer says we can't hire you".

Since I am now unable to finish school and am stuck making six bucks an hour at McDonald's, I've been giving serious consideration to joining the Army. The recruiters say a waiver is no problem and they can wipe the felony from my record. I'd say gambling my life in Iraq beats the hell out of being doomed here in the Land of the Free.