Charges Against High School Hackers Dropped

ZosX writes "According to eSchool News Online, the 13 students from Kutztown, PA originally charged with felonies for hacking have been given a deal, dropping charges in exchange for 15 hours of community service. From the article: 'The probation department realizes this is small potatoes,' said William Bispels, an attorney representing nearly half the accused students. This is great news for the students and their families."

Comments

Unfair!

[biryokumaru]

When I got in trouble for hacking my high school network, we all got 50 hours of community sevice!

Lame.

Re:Unfair!

[mwvdlee]

This wasn't really hacking, it was more like typing in the password which was conveniently supplied on a label on the back of the laptops.

Some students did some minor hacking after the passwords were changed, but that still didn't amount to much more than executing "hacks" that were readily available on the internet, more akin to the work of a script kiddie than a hacker.

Re:Unfair!

[boisepunk]

Zero Cool would be proud.

Re:Unfair!

[Sancho]

Some students did some minor hacking after the passwords were changed, but that still didn't amount to much more than executing "hacks" that were readily available on the internet, more akin to the work of a script kiddie than a hacker.

Does this somehow reduce the significance of the crime, or was it just an aside you were adding?

When I first read about this case, I thought the school was justified. When I found out that the passwords were taped to the machines, I changed my mind. When I found out that later, there was indeed "hacking", I changed my mind again. The students broke the law--the very same law that protects you from having to worry about unauthorized computer access.

Re:Unfair!

[nahdude812]

Although I know your response was a joke, I think that what happened here was basically executed perfectly.

The kids repeatedly violated guidelines that were put in place by people with the authority to put those guidelines there. Regardless of whether the measures used to enforce those guidelines were sufficient to deter activity simply by the strength of the restraints or not is unimportant. I can drive my car over the dotted yellow line in the road too if I want, and I can make my car go above the speed limit; that doesn't make it the state's fault when I careen through oncoming traffic at 120 mph.

Obviously the early traditional reprimands failed to make an impact on the students. What they needed was a good scare, and I think this is what they got. Settling on 15 hours of community service each kid doesn't sound like the prosecuting attorney(ies) ever really intended to send these kids to jail, it sounds to me like they wanted to make the kids fully aware that when you choose to violate guidelines, there are consequences (at least when you're caught, especially when you're flagrant in the actions). And I doubt, when faced with the prospect of jail time, that any of these kids failed to get that message.

Further, the message was probably received by more than just the kids involved, it was probably received by many other kids in the same district, and in surrounding districts.

Re:Unfair!

[j-turkey]

Does this somehow reduce the significance of the crime, or was it just an aside you were adding?

Considering that they were charged with a felony for what essentially amounts to youthful mischief, I'd say that the significance of the crime is pretty minor relative to what they were charged with. No person or property was damaged in any way.

When I first read about this case, I thought the school was justified. When I found out that the passwords were taped to the machines, I changed my mind. When I found out that later, there was indeed "hacking", I changed my mind again. The students broke the law--the very same law that protects you from having to worry about unauthorized computer access.

Yeah -- those kids really do deserve punishment. I'd think that 3 weeks of detention, possibly even in-school suspension would be an appropriate action. I'm still baffled by how this all adds up to a felony charge. The students didn't break anything, they didn't access sensitive data, and they didn't disrupt anything. The fact is that this is a mostly harmless crime. I'd want more severe punishment for the kid who uses a sharpie to tag all over my neighborhood. If these kids were convicted of a felony, it would have ruined their lives. Convicted felons don't tend to get jobs, and often resort to crime as its the only way to make a living. Let's save the felony charges for those who are truly harmful and disruptive.

I hope that maybe some day if you or I ever slip up and are caught commiting a minor or victimless crime, neither of us have to experience heavy handed tactics of making an example of someone.

Oh, and with regards to your mention of the students breaking the "very same law that protects you from having to worry about unauthorized computer access." It does absolutely nothing of the sort. If I didn't worry about unauthorized computer access, I'd be out of a job. Unreasonably stiff penalties do not make the world a safe place.

Re:Unfair!

[Sancho]

For the sake of discussion, let's turn to cutusabreak.org, a site which proposes to support the students (though I think some of the passages in there actually harm them).

Now all along the computer department was monitoring for these infractions and dozens of students were reprimanded and punished for their curiosity. Detentions and in-school suspensions were handed to kids by their homeroom teachers, often with no face-to-face with the disciplinarians. This was hardly a deterrent, though, as the kids were able to take their laptops and play video games during their "punishment."

They were handing out the sorts of punishments you suggested. Perhaps not for the length of time you suggest, but it's not like they just saw a problem and said, "FELONY!"

Some laptops were temporarily confiscated for long enough to have them cleansed and returned to their original configuration with a new password. Yet the laptops were still not secure. On several occasions the laptops were returned with the old password still intact. And then the kids learned how to turn off and or limit the administration's ability to spy on what they were doing on their laptops.

Here we see that the students must have known that what they were doing was not authorized. The notebooks were confiscated long enough to undo the damage and change the admin password. From this point on, the students who had their laptop's password changed had to actively seek out a way to get admin access again. There is no way they didn't know, at this point, that what they were doing was "wrong".

Now, you suggest that these children, if convicted of felonies, would have their lives totally destroyed. In many states (including Penn.) this is not the case. A person may request that their juvenile record be expunged, under certain situations: ahref=http://www.jlc.org/home/mediacenter/factshee ts/FAQPAJJ.html%23exprel=url2html-4701http://www.j lc.org/home/mediacenter/factsheets/FAQPAJJ.html#ex p>

Now, many people are going to come back and say that the school screwed up, too. They did. I'll even provide a few examples up front.

1) They only targetted 13 kids. I have no idea whether these 13 had cracked the password after it was changed. For the sake of argument, I'm going to assume they did (if they did not, the school was definitely way out of line).

2) They failed to notify the parents, either of the offenses themselves or of the severity of the offenses.

3) They allowed the use of the laptops during detention, and had no contingency for removing a student from the program. I suspect that there is more to the story than "Some kids who had trouble resisting temptation tried to turn in their laptops and were forced by the administration to take them back." but for the sake of argument, we'll take that as accurate.

4) They monitored student activity in the first place. I do think that there is a reasonable level of monitoring that can occur when leasing or loaning out hardware, especially if notification of the monitoring is given up front (which it was, in this case, to the student but not the parent, apparently). But I still don't particularly like it, and there are distinct privacy implications considering these were minors.

5) They didn't secure the computers properly.

The only one of the above which reduces the culpability of the students is #3. If the student was actually trying to get rid of the temptation by getting rid of the program, they should have allowed that. Of course, we don't know if any of the 13 tried to give up the laptops, which would make the point moot.

And for the record, I agree with you on making an example of people. I think it's inappropriate and a mockery of the jusice^Wlegal system. But, rather than not prosecuting any of the kids, they should have prosecuted all of t

At least the tags will be gone...

[Palal]

I mean grafitti... But the real question is: did this bring out the real curiosity in them or will this forever stop them from exploring computers further?

No Registration Required

[Motherfucking Shit]

The case against the "Kutztown 13"--a group of Pennsylvania high school students charged with felonies for tinkering with their school-issued laptop computers--seems to be ending mostly with a whimper.

In meetings with students over the last several days, the Berks County, Pa., juvenile probation office has quietly offered the students a deal in which all charges would be dropped in exchange for 15 hours of community service, a letter of apology, a class on personal responsibility, and a few months of probation.

"The probation department realizes this is small potatoes," said William Bispels, an attorney representing nearly half the accused students.

The 13 initially were charged with computer trespass and computer theft, both felonies, and could have faced a wide range of sanctions, including juvenile detention.

The Kutztown Area School District said it reported the students to police only after detentions, suspensions, and other punishments failed to deter them from breaking school rules governing computer usage. (See "Felony charges for computer-abusing kids.")

But the students, their families, and outraged supporters around the nation said that authorities overreacted, punishing the kids not for any horrible behavior but because they outsmarted the district's technology workers.

The trouble began last fall after the school district issued some 600 Apple iBook laptops to every student at the high school, about 50 miles northwest of Philadelphia.

Students easily breached security and began downloading forbidden internet programs, such as the popular iChat instant-messaging tool. Some students also turned off a remote monitoring function that let administrators see what students were viewing on their screens--or used the monitoring function to view administrators' own computer screens.

School district officials and prosecutors did not return phone messages left Aug. 25 and had not been heard from by press time.

In legal terms, the students have been offered an "informal adjustment"--the least severe form of punishment.

Bispels said a few students are thinking about refusing the deal because they don't feel they have broken any laws. "A lot of these parents would like to fight this on principle, but it's hard to put the kids at risk on principle," he said.

Mike Boland, who represents one student, said his client likely will accept the offer. "It doesn't require my client to acknowledge he is guilty of anything," he said.

"It's about as mild as you can go," agreed James Shrawder, whose 15-year-old nephew was among those offered the deal. "It's more of a face-saving measure."

One student who has had prior dealings with the juvenile probation office was not offered a deal. That case is expected to proceed.

Links:

Students' web site
  http://www.cutusabreak.org

Kutztown Area School District's response
  http://www.kasd.org/districtinfo/kasdPressrelease. htm

Re:No Registration Required

[anthony_dipierro]

Please note that using that login constitutes felony computer trespass.

Not merely that it's small potatoes. . .

[kfg]

but that they really don't stand much of a chance of conviction by jury.

Not to mention how silly they look.

KFG

I hope they don't take the deal

[Rogerborg]

I hope that at least one of them fights it out, and makes the state (in all senses) that started this madness either see it out, or drop the charges altogether.

I was asked to hack

[Boomshanka]

When I was in my senior year in high school back in 86 and Apple IIe's were the flavour of the day (wonder if linux will run on it?) the math department had a password protected program for tracking and scoring all the students of the school for that year and guess what.. they forgot the password. I was asked what could I do so I ran the program through a hex dump and looked for unusual words appearing in the hex and found a word "ferret" tried it and got in. So its not all bad to be a computer enthusiast (nerd) at high school. I got no community service for that. I had the chance to up my grades but I of course I didnt.

Small potatoes == felony?

[monstermonster]

You know, what I don't get is this - there is a reason that juvenile offenders are supposed to be treated as juveniles by the law. Their brains aren't done developing. They sometimes do juvenile things because they're, well, juvenile. It's not like they murdered someone. And if the school IT guys are idiots, as they often are (I remember explaining a floppy disk to my totally incompetent 8th grade computers teacher back in the dark ages), I don't see that we should be trying to charge kids with felonies. Especially when it's not as if they hacked into some national defense computer. The only lesson it teaches anyone is that we have overzealous prosecutors.

Give a kid something he's not supposed to get into, and he'll try to get into it. Period. Be stupid about it, and he will get into it.

Corporate IT vs Employees

[Raindeer]

What these kids did sounds like the battle happening between many corporate IT-departments and employees.

Corporate IT departments erect all kinds of barriers for users to use certain applications and generally don't explain why these barriers are there. The most common answer I have gotten was: "Security". ICT-security is in my jobtitle and I know these guys were bullshitting me. Other things you hear are maintence, complexity or my favourite one: "It is our policy" and "The department heads agreed on this".

This is a battle that has gone on ever since we started with computers in the workplace. Invariably the result was that people worked around the ivory tower that controlled IT and got what they wanted some way or another (PC's got bought on office supplies budgets in the early eighties, they were forbidden by the high priests of mainframes) Invariably after prolonged fights the users win.

I currently see the following problems around me, where corporate IT erects barries, that people go around. In most cases corporate IT should enable it in such a way it is safe, or explain very well why it is not allowed at the moment, or at all:
- Banning of Instant Messaging
- Filtering of websites beyond porn
- Banning any Palm-like device, except the corporate one.
- disabling USB ports.
- disabling Wifi
- banning alternative browsers and all kinds of utilities.
- limiting the size of mailboxes
- disallowing or crippling desktop search
- disallowing or crippling streaming media
- Creating lengthy processes for getting new software on your desktop

Re:Good news?

[Lumpy]

I hate to break this to you but after school, College has a severe mential handicap, then work, the managers have severe mential handicaps.

you never escape it. I strongly suggest becoming extremely adept at social engineering, it will get you out of many situations. Anyone who is really good with any technology today must be a really good social engineer to disguise the fact or to calm those around you.

and when you potentially run afoul of the law it works great. and officer on his way walking to you to give you crap or possibly arrest you will not do so if the first words out of your mouth are " Officer! I am so glad you are here! can you help me?" if you make the officer think that he is your savoir then he will ignore lots of things to help stroke his ego. Tresspassing? you will be politely told "you know this is a restricted area?" instead of being dragged off screaming by barney fife wanna-be.

Same goes for school admins, college admins and managers and upper managers at work. none of them will EVER understand technology and you are extremely scary because you know technology.

Is this fair? no. but it's life. Ask any minority that is persecuted and they will tell you the same thing. you are frightening to them, they see you as dangerous, and they want to keep you under control.

Lucky fucking kids

[rk87]

You know, this is such absolute bullshit.

Several years ago (I think '99) I was in an optional school activity that fixed computers and made sure the school network worked etc.. There was one particular trouble computer where apparently students snuck on and installed a whole bunch of nasty stuff. One of the other guys that did this with me installed Back Orifice on it to monitor it (remember, those were the days when it was popular). One day he asked me to go on the linux box and check on that computer (I watched him do it plenty of times, so i knew how). At this point, the head of the computer group came around and saw bo2k. Oooh boy was he pissed. Since this was the time of people using bo2k as a virus, he instantly thought it was.

I told him that I was just checking it for the other guy but when he asked him he knew nothing about it and wondered why there was a virus on the linux box. Fuck.

I got kicked off the computer group, got a total of abut 25 hours of detention cleaning desks, and my parents got to pay the equivalent of about $200 in "damages". And no, I did NOT make slashdot with this.

International view.

[Lellor]

Here in Kelowna, British Columbia, a co-worker of mine found out about this via an email sent by his relatives in the US who knew about the case, and we discussed it for quite a while at work.

The general consensus is that the authorities in the US have become too strict, especially with "intellectual property", "the war on drugs", and "computer crimes".

They are basically making themselves a laughing stock internationally - the Canadian public doesn't seem impressed by what the current US adminsitration is doing, or how they are handling these issues.

Things like this would not happen in any other industrial, civilized G7 democracy, like Canada for example.

It's quite shocking that the authorities are punishing students for using passwords - that they were given!

Hmmm....

[Legendof_Pedro]

I'm glad they're dropping the charges, but seriously, shouldn't this be a civil matter, not a felony?

Outrageous

[hooeezit]

The authorities in question had the gall to offer a compromise that included:

15 hours of community service, a letter of apology, a class on personal responsibility, and a few months of probation.

A letter of apology? That I'm sighted, not dumb, and would like to use convenient technology to stay in touch with my friends?

And what is this from one of the defendant attorneys:

Mike Boland, who represents one student, said his client likely will accept the offer. "It doesn't require my client to acknowledge he is guilty of anything," he said.

I'd say a letter of apology counts as acknowledging guilt, at least in my books!
If you keep track of Paul Graham's essays (try http://store.yahoo.com/paulgraham/nerds.html), you will probably recognize this as a glowing example of the holding pen analogy he uses vis-a-vis present day school system. I'm apalled that the most important thing that these bright kids are impressioned with is 'Obey the Thought Police'!

So...they did not have the right to read?

[RAMMS EIN]

Reading the students' story, it sounds almost like The Right to Read.

Student Story:

At a school board meeting ~ a year ago, opponents of the high school's Computer Initiative predicted that the administration would not be able to control the student's access to inappropriate internet sites...

It would allow the computer department to monitor student activity and it limited access to the network and internet. This configuration was protected by an administrative password and, as our administration discovered, the laptop could be easily reconfigured by curious students when the password was not secured...

At least one student figured it out and passed it along until ~ 80 - 100 of the students had access to it...

the Kutztown Police Department notified the parents of 13 high school students that their children were being charged with the crime of Computer Trespass. This offense is graded by the state as a felony of the 3rd degree.

Right to Read:

This put Dan in a dilemma. He had to help her--but if he lent her his computer, she might read his books. Aside from the fact that you could go to prison for many years for letting someone else read your books...

In his software class, Dan had learned that each book had a copyright monitor that reported when and where it was read, and by whom, to Central Licensing...

There were ways, of course, to get around the SPA and Central Licensing. They were themselves illegal. Dan had had a classmate in software, Frank Martucci, who had obtained an illicit debugging tool, and used it to skip over the copyright monitor code when reading books.

Re:sad...

[MichaelSmith]

i recently got the admin password of the local computer taking about 15 minutes

A word of advice from somebody a lot older: save this kind of stuff for your own systems. If you want to get involved with sysadmin stuff then you should start by gaining the trust of the people who run your school systems.

I can see that you are talented, but your admin people are just going to come down on you for it.

Oh, and don't brag about your accomplishments, even as AC. Word gets around. Remember the really smart people keep this kind of information to themselves.

Don't take the deal

[macdaddy]

I've been in nearly this exact same boat (minus the legal charges). I was accused of causing around $14k worth of damages (labor for the outsourced IT company to come down and fix the problem) way back when I was a freshman in HS. It was not possible that neither I nor the other person they accused could have done the dead though because 1) I was home sick on the Saturday that the logs show the first of the damage and I was at the doctor 1+ hours away on Monday when the second round of damage occured, and 2) the other kid was on the basketball court playing in a JV tournament on that Saturday (that I missed because I was sick), and was at home having supper with his family when the second round of damage occured. When pressed with this information the principal even admitted that neither of us could have caused the damage. He needed a scapegoat though. The other kid's parents had the right approach. They told the principal in no uncertain terms to go to hell and that they were through with the matter. My mother was a district teacher though so that wouldn't fly. The principal made me do 120 hours of community service. It was easy to account for though since I filmed all the football games (which he counted) and had worked for the school pro bono for years.

However after all of that came to an end, I was still treated by the school staff as some sort of hacker. Many openly expressed their distrust of me around their computers. Whenever ANYTHING ever went wrong with the computer system I was the first person they blamed. Now I was also the one they always turned to for a fix to their problem. Still I had to put up with all that grief just because my parents elected to take the deal.

Moral of the story, if you're innocent then don't agree to any deal where blame can still be associated with you. If you're innocent then make damned certani everyone knows it.

My letter of apology.

[wubboy]

I'm sorry. I'm very sorry that your network security is a disgrace.
I'm sorry that your network admin staff is completely braindead.
I'm sorry that the ADMIN passwords were taped to the back of the laptops by what must have been the single most stupid person on the planet.
I'm sorry that likely the only thing anyone learned out of this is that 13 kids "broke in to the schools computers".
I'm sorry that noone will ever think to FIRE the dumbass who taped the passwords to the back of the computers.

I'm sorry that I had to write this.