Slashdot Mirror
Kutztown Students get Felony Charges
gone6713 writes "The 13 students from Pennsylvania who were accused of hacking the iBooks provided to them by the school (Slashdot had a previous story on them back in June) have offically been charged. It seems that the admin passwords were taped to the back of the iBooks!"
You know, I'm really not surprised to hear this. Despite all the precautions companies/ institutions take, it's typically human negligence or social engineering that leads to many compromises. While doing a spot check of security at work, I was surprised to find many employees had taped their passwords to the bottom of their keyboard or mouse.
Rule#1 make sure your users (employees, admins, etc) understand the importance of confidentiality.
"Simplify, simplify, simplify!" Thoreau
While the students should face some kind of consequences, in my opinion, the sheer stupidity puts this at the fault of those "victims" rather than the students.
The Computations of AdamR
http://www.adamreyher.com
See? This label of "hacker" to students who can read the back of a book is what is going to get them convicted of something. This is just all-around completely absurd. It's like if I were to always leave my keys in the ignition of my car: plain stupid.
Make sure to slap the hungry monkey's wrist that sees a stick next to an ant hill. Does wonders for intellectual development on a macro- and microscale.
Really, can't we get the media to stop using the work Hack in this way? Finding a password taped onto a notebook isn't hacking.
Sure, they may have used the computers in way which they shouldn't but, they didn't have to hack them.
I know, I know... the average Joe couldn't tell the difference between anything remotely technical but the media shouldn't be encourage it.
I think I'll go let Windows Hack into my neighbor's unsecured wireless access point.
I think I think, therefore I think I am.
First, I will agree that felony charges here is rather extreme, and someone isn't thinking. A few days of detention (for both the students and the security administrator) would be more appropriate.
But the fact that the passwords were on the back of the iBooks does not mean everyone was free to use them at will.
I can tape the key to my house on to the front door of my house, and while that is extreme stupidity on my part, that does not give you permission to unlock the door and come inside.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
From the article:
Now that's not the only thing that the kids are accused of doing, they also turned off the monitoring software (Apple Remote Desktop?) and even used it to monitor the admins. In addition, they're accused of using hacking tools to find the new admin password when it was changed from the password that was taped on the back of the machines.
Also, if you click on the little update link at the bottom of the story, you'll see that the kids were also found to be downloading pornography. Might sound innocent to some of you, but adults / the school can get in trouble for "allowing" them access to X-rated material.
Now, a third degree felony sounds harsh, but they still need some punishment. If they had stopped at using the password taped onto the back of the computers I'd feel sorry for them, but they were spying on admins and using other means to get the password once it was changed.
Advice for my fellow geeks: before seeking out that threesome you dream of, you might see what a TWOsome is like first.
...that read:
"Acceptance of this laptop may expose your child to FELONY charges"
Would any of the parents allowed their child to have one?
in our increasingly vengence based culture. Some principal or admin got his feathers ruffled that student's would actually use the passwords taped to their computers and is now on a rampage to bring them into submission or destroy their lives. I'm surprised they haven't been labeled terrorists by now. This goes way beyond this school district... witness the proliferation of "no tolerance" policies. Everyone makes mistakes, especially teens... we as a society should be focused on correcting mistakes and giving people the chance to learn from them. It's only those who refuse to recognze they made a mistake or continually fail to learn from them that need to be dragged in front of the courts.
And "looking at what people give you" stop ?
I'd assume they'd WANT me to know the admin password if it was taped to the back of the laptop.
Kids are kids, and are of course going to be curious and try to stuff they know they shouldn't be doing. An admin password taped to the underside of the computer would be tempting for a rational, intelligent adult to use, much less a school-age kid!
Hell, if the admins are taping obvious admin passwords to student computers, how lax is the security on the rest of the school's network, where data like student names, addresses and grades are kept? I think the school district/board/admins/whoever are going after these kids with such zeal to keep the spotlight off what would be, in any other industry, criminally negligent network administration and security.
I think we should all take a moment to be thankful the network admins at that school district aren't working anywhere where their incompetence would cause serious trouble, like a financial institution.
Whoever taped those passwords to the back of the computers needs to be fired. Whoever gave that person a job needs to be fired. Whoever has the authority to demand that the people above must be fired immediately but hasn't needs to be fired.
But this isn't happening. Rather than start demanding even a fleeting glimpse of intelligence within the public schools the parents simply get together and whine that the people they voted for have their heads so far up their rectum that you can't distinguish a fart from a whistle don't engage in sphincter-yoga.
Yes, there is the possibility that these parents didn't vote this particular schoolboard (and mayor , who allowed this particular police chief and DA to make such stupid decisions), but I'll hedge my bets and say that either they voted for them or didn't vote at all.
Are they demanding the resignation of the board? No.
Are they demanding the resignation of the DA? No.
Are they even promising to vote for somebody else in the next election? No.
So if they don't care enough to actually DO something about the situation, why should anybody else?
If the g'vt kept the data on you that google does you'd better believe you'd be calling it "doing evil"
It was one thing to essentially commandeer borrowed government property. (It doesn't matter if they negligently made the key available for use or not.) They also went about expanding their control first by blocking the admin's ability to monitor then by breaking into the admin account again... it was not taped to the computer the second time.
Afterward, they went on to monitoring the admin.
This is their defiance of authority and that's the message here.
On one hand, I think it's "harsh" what is being done to the kids -- I really do. But there's a larger picture here that should be acknowledged.
How many times have you been completely and utterly insulted by children who know there's nothing you can do about it. That is, in essence, what has happened here. When it was realized that the kids were breakign rules, they were essentially given the chance to straighten up when they were discovered and their admin passwords changed. The kids responded by being even mroe defiant and even aggressive about it.
We have a cultural mess on our hands. I'm just sick enough of defiant children to endorse the reaction we are seeing here. You can't spank children any more. Somehow it became a crime. You can't even talk "mean" to them -- it's somehow psychological abuse as well. As a culture, we cannot control the children. And it's clear that most parents will not regulate their offspring as well... (at least without fear of criminal problems much of the time)
I have two sons of my own and at the moment, my biggest problem is getting them to tell the truth. I haven't seen evidence of anything worse... not yet anyway. Respect for authority is a critical lesson in life that needs to be learned. If we have to make 13 examples of these kids, then so be it. It could help in changing the path for millions of other kids out there... kids that will one day grow up and lead this world. And if you think I'm over-reacting myself, look around you at the many "adults" out there who are early evidence of the things to come... people who never actually grew up and took responsibility for themselves. Examples are not hard to find.
Respect, in general, should be restored as a key value in our culture and at the core of respect is fear of what might happen if you don't.
You have the implicit right not to have your travel patterns monitored when you rent a car, but a school has the right to watch what students do with PC's ???.
Then again it really shouldnt surprise me that incompetent people in the I.T. field wind up blaming everyone around them for their faults. In this case it seems they managed to get a sympathetic ear out of their local PD. Its sad that, you can have people harbor a child molestor and not be charged with so much as obstruction of justice, but here you have children being charged with unauthorized use of devices placed in their possesion.
IANAL but the fact that the schools handed the PC's to the students, said use them to do their work will probably knock down any charges concerning them. It will be really hard to prove unauthorized access when they were handed the quipment and given access to the network. Taping the password the back of the machine should also throw out any claims that the systems were meant to be secure.
This case shows what happens when legislators make law without understanding what they are trying to legislate or considering the consequences. If this application of the law is held valid it will allow any corporation, organization or group to take revenge on any employee or member that uses its computers and is disliked. To do so, all that would have to be done is change an employee manual or circulate a policy memo in a way that it would either not be read or misunderstood, and then call the police when someone keeps on doing what they had been doing.
Ok, so punish them, sure, but felonies? Do you also favor beheading as punishment for jaywalkers? Their punishment is so ridiculously disproportionate to the "crime" it's galling.
"They were punished multiple times and they still continued to do it."
So a rational adult would simply take the laptop away from them. Either play by the rules or take it away.
To me, this is the equivalent of sending your kid to reform school because he talked back one too many times. Its overreaction and really, its an admission of failure by the school authorities.
Everybody in Kutztown should be ashamed of themselves.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
But of course that logical, sensible solution doesn't jive with today's vengeful, zero-tolerance, conform-or-face-punishment society.
This is the equivalent of writing in a library book, except that re-imaging the hard disk on a laptop is actually easier than removing writing from a library book.
Anyone recall the scene in "Ender's Game" where the kids are virtually encouraged to mess around with their computers, in part so that the school can keep an eye on who's got creativity and daring and who's just a boring by-the-rules follower?
We won't be raising the kind of smart kids we need to be defeating aliens and saving humanity with the Kutztown school district's attitude.
"How many times have you been completely and utterly insulted by children who know there's nothing you can do about it. "
I think you're presented a false set of choice here. The choice isn't "accept lack of respect" or "send them to jail"
Generally, if the administration is in a position where it feels that it can't control the children properly, it's the adults fault. Lets face it; Kutztown isn't exactly "The Blackboard Jungle". These are basically middle class kids who will do either the right thing or wrong thing depending on the situation. Honestly, if you taped the admin password to a laptop you loaned me, I might use it.
Ineffective leadership and ineffective parenting usually happens when parents/leaders lead by refusing to have small consequences and as a result are forced to have large consequences when things finally become unmanageable.
This is a perfect case. When it was discovered the kids had compromised the laptops as a result of the password written on top, the administrators might have (a) Punished the children in a small way... perhaps detention...perhaps removal from all extracuricular activities... parents should have been notified (b) the administration should have reimaged the laptops and changed all the passwords. (c) Warn the children that next time, they would have their laptops taken away and that their parents would be liable for the cost of reimaging all the laptops once again. Put all this in writing and have the parents of the children acknowledge this.
And here's really the key... you have to follow through on every "threat". That is, when it was discovered they'd hacked the laptops again, take their laptops away and send a bill for the cost of reimaging to the parents.
I'm telling you, these administrators almost sound like they heard the phrase "computer hacker" and it frightened them so much they felt they had to teach the kids a lesson.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
This just goes to show you - if the public school system in America really wanted to teach kids to learn, they'd place emphasis on having them learn to think critically for themselves, (a very important concept which seems to be sorely lacking today) rather than trying to churn out students who learn by rote and repetition (I.E. they are churning out cogs for our society/the corporate machine). Learning to think critically for yourself is exactly what many, many schools in America strive to prevent and punish at every opportunity. It seems like these kids are being punished severely for "thinking outside of the box" and for exploring other ways to use their machines - For not being good little citizens and shutting their minds off (maybe they looked at some porn too, but c'mon, what would you expect from teenagers being sent totally mixed messages) Now, I have no idea what these 13 kids actually did that was so bad - but regardless I have a huge problem with technologically illiterate school administrators, small town media, and cops/prosecutors charging high school students with a felony when they (in most cases) truly don't even understand the technology and the terminology around it. I think they are being punished mainly for not conforming and for making the school look stupid. A couple of other posts on here mentioned phrases like "our increasingly vengeance based culture" - and another mentioned that "in American schools the attitude is one of suspicion and enforcement rather than learning" (a problem all across our post 9/11 culture) I think both of these posts are dead on accurate characterizations. If they were changing grades or something then that's a different issue, but that should be handled within the school and even that doesn't warrant charges (especially not felony). If the school was really on the ball and interested in enriching their students maybe they'd give these kids who they've seen are testing their boundaries something fun and truly challenging to do on their computers. (I've made a lot of generalizations in this post, obviously not everything is black and white - I am mainly referring to High Schools and though I generalize, obviously there are the rare exceptions like special teachers or progressive schools, or schools who have IT staff who know how to implement proper security - I guess my point is that this is symptomatic of a lot of our schools these days)
Many products, MS Windows Terminal Services among others, do not allow the admin to access the user account without his password.
If software requires that the admin knows the user's password to do basic administration, then you need to consider alternative technologies.
LedgerSMB: Open source Accounting/ERP
There is a simple way to fix this problem. If you don't want them to use the laptop at home, don't let them take it home.
Exactly.
"Listen up, kids. You will be given a laptop to use on school premises only. The laptops will be handed to you in Homeroom and must be turned in every day at the end of the last period of classes. If you go off campus for lunch, you must either turn your laptop in for safekeeping at the office or keep it securely locked away in your locker.
"Abuse of your laptop will be grounds for losing laptop privileges. You will then have to do your school work that requires use of your laptop in the computer lab up until the end of the year. Abuse of your laptop entails downloading porn, music, non-authorized software, or vandalizing your laptop or the laptops of others. Circumvention of the security systems used on campus (Dan's Guardian, Deep Freeze, etc.) will be grounds for losing laptop privileges.
"Due to security concerns, bringing your own laptop or handheld computer to school is expressly forbidden. Those violating these rules will have their laptop or handheld confiscated and their parents or guardians notified about how to pick up the confiscated property.
"If you break your laptop and it is determined the breakage is accidental or the result of mechanical breakdown or some other intrinsic failure, you will receive a working laptop in exchange for the disabled laptop. If the breakage is determined to be caused by negligence or vandalism, you will lose your laptop privileges.
"With privileges such as these come responsibilities. Don't come crying to us if you break the rules and find yourself without your school-issued laptop, because you knew the rules in the first place. To assure us that you do know the rules, you will be given a paper copy of the rules with a form to fill out. Those of you who need assistance with reading the rules or filling out the form will receive the assistance. Only when we are sure you completely understand these rules will we issue you your laptop."
There. problem solved. Next earth-shaking issue, please...
Knowledge is power. Knowledge shared is power multiplied.
You want to wake up, son. Lets put this in context, shall we? We are talking about a felony, that is entering children into the criminal justice system because the school admins didn't have clue one about how to secure their own systems from... children. The mini emporers in academia need a taste of their own medicine. Honestly speaking, a previous poster pointed out that taping the password to the backs of the computers was tantamount to incitement and solicitation of a minor. I wouldn't just use it as a threat though, I'd go afer the little hitlers until every man jack of them had spent a few months trying out the local prison facilites. Such irresponsible and knee jerk reactionists should under no circumstances be educating children.
Don't get me wrong, I know some kids are wretched creatures that shouldn't be in general education, but in this case I think an example does need to be made. Of the so called teachers.
What he can't kill, he has sex on. Trent.
As a parent, what bothers me is that the administration apparently made no attempt to contact the parents. This past year, my oldest was part of group of 3rd graders who were acting up on the playground during recess. They were threated with suspension if their behavoirs did not imporve as a last resort. No time during the process of being called into the principle's office (3 or 4 times) were my wife and I contacted.
I thought teaching and parenting were a partnership? Screw that. Teachers are underpaid, administrators are over paid. And parents are treated as children. That is the message sent out and the kids see this.
Had this been my kid and the school contacted me after the first inccident, the problem would have been solved to the benefit of child and the school district.
Often the software used to change a password can spot a weak one (sequential numbers/letters, dictionary words, etc.) and prevent a user from setting it. With decent software and configuration, it isn't necessary to have a password "approved" by an actual person.
Not the mention, the more inconvenient it is for a user to change his/her password, the less likely it is that s/he will do it.
Sent from my computer.
Now GET OFF MY LAWN!
I agree that PC's don't need to be in every classroom. There are some classes where they are needed though, for example in a business department to teach typing and the basics of word processing and spreadsheets. They can also be useful in other classes from Civics to Auto Shop to illustrate concepts and demonstrate how to find resources on the internet. But in those cases I believe it is more useful to have one computer with an LCD projector which would simply supplement the blackboard.
I don't see any sense in limiting children to Microsoft products though which is what most school boards are doing. KDE/Gnome and Open Office contain 95% of the same functionality as MS Office but with easier administration and better security. Eliminating the license fees for MS Windows, MS Office, Windows Server, Visual Studio, MS Backoffice, and all the client access licenses to connect to MS server products would allow the district to purchase many more bare-metal commodity PC's within the same capital budget.
And for teaching programming before college, Linux is a dream. There are a plethora of programming tools and compilers for every language under the sun, and most of them are free. Linux has taken the server market by storm and is also becoming the standard for small devices. School administrators should look 5-10 years down the road at when these kids will be college graduates and prepare them now for the Open Source future they will be living and working in.
You could teach photography with a Photoshop component. You could teach a film class and use digital video. You could teach music and at the end of the term have the students compose a work and play it on a synthesizer. Or how about shop class ? They could use a CAD program and a computer controlled lathe. These sorts of things work best when they are used at the end of the term. As a reward for the students' hard work learning the foundations of their subject, they get to use some modern tools that people actually use today. It can be a good incentive to learn.
In Soviet America the banks rob you!
A laptop isn't a device meant to be secured. A basic tenet of computer security is that anyone with physical access to the hardware effectively has admin access. What if the students simply wiped the drive or put a different one in? Would that be "hacking" deserving of a felony charge too? It seems like these children were baited to have their lives ruined. How did the massive amounts of taxpayer dollars help them?
I'd spend some time looking it over, making sure the anti-virus etc was set up correctly and if I found a password taped to the bottom, you can bet I'd try it to see what happened. I cannot fault a child for anything I would do myself. However once I identified what that password was associated with, you can bet I'd be on the phone and raise holy hell with the asshat that was incompetent enough not to memorize the admin password and taped it to each computer.
The only thing it achieves is to make pointy-haired cretin bosses warm and fuzzy and the admin's life miserable. Keyloggers, fancy stealth rootkits etc etc. If a competent admin goes "rouge" watch out. Windows is a system by idiots for idiots and I cringe everytime I have to use the thing in serious environments, alas, I have a little choice. Bill has us all cornered with the deep penetration of the business world combined with unimaginable, self-reinforcing inertia. That and the fact that most users/developers for Windows are idiots to begin with.
I get tired of this /. wanna-be hacker mentality that seems to be if you CAN do something you SHOULD be allowed to, and face no repercussions for it.
I mean look, if someone has physical access to a machine, they can get root, period. Any barriers you put in the way are only superficial and will only slow them down, if anything. We always operate under that assumption at work. We don't try and pretend we have an unhackable system because there's no such then when someone is physically at the computer. Rather we put in place as good a system as possible, and if someone insists on breaking it we take action which can range from having the department head talking to the to calling the police.
So it sounds like these kids were given plenty of chances, but they decided that there was just no real consequences so they'd just keep doing it. That's a very similar mindset to vandals that go around bashing in car windows and so on.
Now if they actually try and lock these kids up till they are 21 or something else, then yes I'll call it an overreation. However I don't think facing criminal charges is unreasonable, and if they get community service and probation, I think that's fine.
I won't give the kids crap for messing with the laptops initally, when the password was on the laptop, I mean even though it's technicly not allowed, it's just too tempting. If I leave my front door hanging open, it's still tresspassing to come inside, but I really can't blame a curious kid that does that.
However when the passwords were changed and the kids not only broke in, but disabled the school's administrative access, well that's another thing entirely. Now we are talking about kids who disable the security system on my windows, come in, and try to mess with my door lock so I can't get in. That's serious.
I personally don't think taking away the laptops is a severe enough solution. I think it would just reenforce the idea that it's ok to cause trouble on comptuers, since nothing will ever really happen to you.
We encounter those kind of people on campus peridocly, they think they can just break in to other people's systems and it's ok, because it's just computers and no real consequences will result. We had one kid that took out the main library's network several times, trying to get Cain and Able to work right. He was convicted of a crime, by the way. Right now we have someone who's pretty clearly on campus, but smart enough to route through a system outside that is methodicly trying to break in to UNIX systems all over campus, with some success. It's likely to be a rather large sentence when they catch this guy, as it has caused a lot of problems and lots time and the guy just won't quit.
I think tech savvy kinds need to learn that it's not ok to just disregard people's rights to their computers. It's not ok to break in to something just because you have the technical ability. And it's not a case of "Don't do this or we'll make it harder for you by taking away your access" it's "Don't do this because it is wrong, and there are real consequences".
I firmly believe criminals must face justice but I also believe the punishment should fit the crime (and "crime" doesn't really fit in this case). Felonies used to be for the worst crimes... murder, rape, or gunpoint robberies. Now they are about some small town school principal trying to prove that he is still in control.
Disclaimer: I don't know for a fact it's the principal of this school driving this stuff. You get the point, though.
People in power should be given authority because they have already earned the respect of those who they will have authority over. People in power also must continue behave in a manner that remains worthy of respect under scrutiny.
In the case of your police example, if a police department consistently and fairly enforces the law, responds rationally and appropriately to threats, and quickly weeds out any corruption in its ranks, then, when a police officer shows up at my door and informs me that it is an emergency and I must evacuate I will trust and quickly comply with this command.
On the other hand, if a police department is seen as corrupt, unfair, inefficient, or irrational in its response to threats then, when a police officer shows up at my door I will have grounds to be suspicious, ask questions, and possibly not comply with what I am asked to do.
All respect is earned and can be lost.
Looking back on it now, I can see that I deserved *something* for disobeying a direct order... detention perhaps, or losing computer privileges for a week...
No. You deserved no punishment whatsoever for turning up the brightness on a monitor that had the brightness all the way down. Making that sort of adjustment is common sense.
In fact, anyone who would suggest that displaying common sense is a crime, or that military-type jargon such as "disobeying a direct order" is something that we should be using to educate school children, is not thinking correctly.
In fact, the whole idea that public schools should be run like a semi boot-camp type environment, with "direct orders" and "zero tolerance policies" and a complete and utter disdain for individual creative thinking, is just plain wrong.
I was in the military for many years, and I know exactly what military-style training can and can't achieve. It's excellent for turning out people who will do things EXACTLY as ordered, and PRECISELY according to a pre-determined plan. It's really not that great at teaching creative thinking, or instilling a system of personal ethics that aren't imposed by an outside authority. It's great for cranking out infantrymen, and pretty darn awfull for instilling any sort of American democratic and egalitarian ideals.
Heck, if the teacher in charge of that class had bothered to do her jo, and pre-check each machine and each monitor before class to ensure that the basic settings were correct, then the problem wouldn't have arisen in the first place. Oh, but wait, that would require people in positions of petty authority to take RESPONSIBILITY for their own actions.... definatelly a part of the military tradition that school authorities would want to run from like the plague ;) I mean, making KIDS be responsible for their actions is cool, but actually holding teachers and administrators to the same standard? Heh.. it'll never happen.
I've found it possible to talk to those who became conservative by the first two paths, though we have some fundamental differences.
Sadly, Rush and O'Reilly appeal to the last of these groups. And the behavior of the school authorities in this case seem to fit that profile: fearful, arbitrary, disproportionate. Why are they coming down like a ton of bricks on these kids? Because they can, and because administering punishment turns them on.
Get your teeth into a small slice: the cake of liberty