Does Hacking Grades Warrant 20 Years in Jail?

While there have been many students who decided they would rather change their grades than come by them the usual way, the punishments for the most part have been pretty reasonable. However, the latest chapter in this type of behavior finds two culprits facing a $250,000 fine and 20 years in jail based on the number of charges leveled against them. "The guys have been charged with "unauthorized computer access, identity theft, conspiracy, and wire fraud." Obviously, these guys did a bad thing, but it's hard to see how the possible sentence matches with the crime. Of course, it seems unlikely that any judge would give them the maximum sentence, but even hearing that it's possible just for changing your grades seems ridiculous."

Comments

Confusing The Issue

[gbulmash]

TFA and the post author confuse the issue by saying that these guys are getting punished for the end result (changing their grades), rather than the method (hacking an admin account, using that access to hack other accounts, stealing privileged information, AND taking cash to change someone's grades).

Imagine some jerkwad walked into a 7-11, got a Slurpee, tried to walk out without paying for it, then shot the clerk when the clerk confronted him. Then imagine the Slashdot article saying "this guy could get the death penalty just for stealing a Slurpee."

That's an extreme example, but it gets my message across. They're being prosecuted not only for what they did, but how they did it.

Also, if you read the original press release from the DOJ, it states: "The charged counts carry a maximum punishment of 20 years in prison and/or a $250,000 fine. However, the actual sentence will be determined at the discretion of the court after consideration of the Federal Sentencing Guidelines, which take into account a number of variables, and any applicable statutory sentencing factors."

So even the Feds, while stating the maximum possible sentence (probably for the deterrence value), are admitting that the actual sentence depends on a lot of factors and probably won't be the maximum. Although giving these guys double-dimes in the pen would send a message.

Re:Confusing The Issue

[Anonymous Coward]

For a better analogy, picture, "Hey John, I'll give you $5 if you steal Mrs. Smith's gradebook, change my grade in it, and put it back." This sounds identical to the list of crimes you made, only committed with a pencil rather than a computer. The problem here is that old lawmakers are more afraid of computers (because they don't know how they work), and thus are making equivalent crimes more severe if they involve a computer instead of a pencil.

Now ask yourself if getting paid $5 to steal Mrs. Smith's gradebook and change a grade is worth 20 years in jail. Does it become worth a longer sentence if you have to be smarter to accomplish the same task?

Re:Confusing The Issue

[elrous0]

Actually, if the 80's taught me nothing else it was that hacking grades was a slippery slope to international espionage. One day you're changing your grades, the next you're starting a global thermonuclear war and getting yelled at by Dabney Coleman.

Re:Confusing The Issue

[gbulmash]

"A better analogy would be stealing the key to the secretary's office, and then loaning it out for a fee."

So you don't think that the unauthorized access to the secretary's office with a stolen key would be charged as breaking and entering? That the stealing the key for the purpose of loaning it out for a fee wouldn't add additional counts of accessory to burglary, aiding and abetting, etc. They wouldn't tack on conspiracy, vandalism, fraud, and whatever else they thought they could make stick?

And when you tallied up all the maximum sentences for all those crimes, wouldn't they be in the neightborhood of 20 years?

Hmmm?

Re:Confusing The Issue

[Akaihiryuu]

I actually thought most of that movie was ridiculous when I saw it (especially graphics over a modem that would've been at max 50bps). However, the "grade hacking" is one of the most realistic "hacks" I have ever seen in a movie. For that part anyway, whoever made the movie did a little research. He didn't "hack" anything to change the grades, he used social engineering (getting sent to the principal's office, then creating a distraction so he could look at the password that was hidden in the office). At that point, he had the password, all he had to do is log in and change grades. That was ingenious, and it's sad that most "hacking" these days in movies is portrayed with fancy 3D graphics rather than how it's really done. There was the use of nmap in Matrix Reloaded, but social engineering will usually get people further than any hacking tools, even real ones like nmap.

Re:Confusing The Issue

[i7dude]

Now ask yourself if getting paid $5 to steal Mrs. Smith's gradebook and change a grade is worth 20 years in jail. Does it become worth a longer sentence if you have to be smarter to accomplish the same task?

As others have stated before me, its really not the act of changing the grades thats so bad. Its the methods employed in doing so.

Manually changing a grade in a gradebook with a pencil is not a criminal offense, but what if that gradebook was located in the teachers car, or home, or even in the school? The students could possibly have to break into any one of those locations. If they were caught, they would not be in court for changing grades, it would be for breaking and entering and possibly theft of personal property. Few people would be hard pressed to disagree with those offenses.

I'm not here to argue what should be deemed a reasonable sentence for computer crimes, but the information/data they were acessing really is secondary when considering the actions required to obtain it.

dude.

Re:Confusing The Issue

[FLEB]

It's not so much fear as computers as covering all the bases, at least in the matter of having the law on the books. Okay, these folks were only using the computer cracking to change grades, but computer cracking can also be used for much more damaging ends. Given that intents and damages of those intents can span a wide range and be uncodifiably fuzzy, it make sense to have a law as given, that maxes out at a punishment fit for the more serious instances of that crime, but allows judicial discretion to allow for lesser offenses. Having a hundred degrees of "Computer cracking with intent to..." laws would just cause confusion, possible loopholes, and would likely still leave just as much judicial/prosecutorial discretion as far as which specific charge to select.

There might be something to be said later, if the judge slaps down the max, but that's an issue to take up once facts are in. At the moment, the article is really nothing but FUD and fumes.

Re:Confusing The Issue

[kurzweilfreak]

For $5, I'll change your English grades....

Re:Confusing The Issue

[ajs]

Now ask yourself if getting paid $5 to steal Mrs. Smith's gradebook and change a grade is worth 20 years in jail. Does it become worth a longer sentence if you have to be smarter to accomplish the same task?

As others have stated before me, its really not the act of changing the grades thats so bad. Its the methods employed in doing so. Yes, and the methods employed involved breaking into the school's computer. It's no different from picking the lock on the school teacher's desk drawer, and I can't see anyone getting out the pitchforks and torches over that either. Sure, it's a crime. Sure, you make an example of the kids because they tried to make money off of this. No, you do not trash their lives over the mistake.

Crime + computer != worse crime

Re:Confusing The Issue

[morgan_greywolf]

You're right. The grandparent might be wondering what happened to his brilliant legal career, but I'm not.

Bottom line -- it doesn't matter why he did it, it only matters what he did. We don't go easier on defendants who murder someone because they were only trying to keep everyone from finding out about their secret extramarital love affair.

OTOH, we do go easier on defendants who steal a $100,000 car to go joyriding. Technically, they could be charged with grand theft auto, but because joyriders generally return the car from whence it came, we call it a misdemeanor and give them a little community service instead of 15 years in prison.

There are complex legal issues that need to be sorted out and dealt with when it comes to computer criminal statues, especially becuause they are so new. On one hand, kids who break into a system just to prove they can should get an easier sentence, just like the joyriders, IMHO. OTOH, changing grades, while juvenile, is breaking into a system for purposes of committing fraud. It's technically no different than the guy who breaks into a computer system to produce a fake id or to alter financial records.

Public policy on criminal penalties usually boils down to legislatures and jurists deciding severity based on the amount of damage to society.

The real question is -- is the kid who changed grades damaging society as much as the guy who breaks in to the bank computer to transfer $1 million into his personal account, a few cents at a time over the next 10 years?

Re:Confusing The Issue

[hairyfeet]

The reason I think it is worse is because, unlike stealing from the teachers desk, they will have to treat everything on the computers they hacked as suspect. If they do the smart thing and perform a full audit, you are talking hundreds or even thousands of man hours (depending on the amount of data on these machines) which could have been put to better use taking care of the users. There is also no telling how much the full audit will end up costing the school, and since costs are passed on to students, these two bozos could have raised the price of an education for everyone that goes there. I think the price of a full audit should be figured into the damages, just as you would figure vandalism in the commission of a crime in regards to the sentencing.

Re:Confusing The Issue

[NiceGeek]

"Bottom line -- it doesn't matter why he did it, it only matters what he did. We don't go easier on defendants who murder someone because they were only trying to keep everyone from finding out about their secret extramarital love affair."

Incorrect. Motive and mental state are often used to determine punishment. Manslaughter, 1st degree murder, 2nd degree murder, etc.

Re:Confusing The Issue

[moronoxyd]

Being smart isn't so much of an evolutionary advantage now, is it?

If they had been smart, they wouldn't haven been caught.
If they had been smarter, they wouldn't have done something that stupid.
If they had been really smart, they wouldn't have had the need to change grades...

It's not only what you are able to do, but being able to choose wisly when to use your talents.

Re:Confusing The Issue

[GooberToo]

And let's not forget there is a lot to win here. The right grades from the right school make the difference between a five digit and a six digit starting salary. Since they took money, seems like serious punishments should be considered. This obviously was not just a curious, dumb, teenager.

Having said that, 20 years is by far too much for something like this. Some murders don't do this. People often forget just how harsh prisons are. Even a year in prison, plus a criminal record as a lifetime punishment, really is a significant penalty to pay. A criminal conviction can easily place an upper limit on their yearly legal income. Let's not forgot that simply being convicted, for a white collar criminal, means punishment for the rest of their life, by means of where they can likely be hired.

Re:Confusing The Issue

[Anonymous Coward]

(Posting as AC for obvious reasons..)

It does sound like such a tiny thing to go to prison for.. so you have the password to a server that tracks school grades so what? But because such a staggering amount of America's financial security is invested in insecure computer networks, they have to have extreme max penalties for hacking law violations- there have been hackers who caused millions in damages, and that's why the max penalties are so high- but the actual penalties are lower.. this 15 year old kid hacked the department of defense in 1999 and only recieved 6 months in prision (because he violated his house-arrest parole). Of course the system does sometimes fail but for the most part things are in place to allow a fair judge to hand down a fair sentence.

On to the part that I'm posting AC for, and why I'm replying to this particular parent.. when I was 17 I successfully got the highest-level access on my whole university's network (though I didn't even know it at the time). My friends ratted me out and I faced these charges and their terrifying max sentences.. but when the investigators found out that I hadn't actually done anything at all with it, and that in fact it was just on a disk forgotten under my bed for 3 weeks before they found me, they didn't even press charges! It was truly a case of:

kids who break into a system just to prove they can

as you said.. other areas of law like copyright law and intellectual property need to be rewritten for the internet age but I think they've done a pretty good job setting things up for hacking legislation.

Re:Confusing The Issue

[GreyPoopon]

Having said that, 20 years is by far too much for something like this. Some murders don't do this.

And most likely the final sentence (as was already stated) will not be twenty years. If you want to compare to murder, since we only have the maximum sentence for these crimes, we'll have to compare to the maximum sentence for murder. Speaking from the experience of a member of my family who was shot in their home by a thief trying to pay for their drug habit, the list of charges were (roughly): breaking and entering, illegal possession of a concealed weapon without license, possession controlled substances, theft, and felony murder. The perpetrator received a life sentence, and was released from prison on parole after less than ten years. I would imagine that even if the maximum sentence is given, the perpetrators will be eligible for parole in five years or less.

Stupid link to another blog

[ackthpt]

Here's the article at InforWorld.

Where I once worked we had a couple of student workers change their own grades, one caught after she had been accepted at University of Michigan, for which she was undoubtably given a right boot in the arse from them after we notified them she had changed her grade. She may well have displaced the next student in line, who was now elsewhere or changed majors as a result of not being accepted. Certain schools only take so many into a programme each year.

The consequences of changing grades can be dire. How about someone receiveing an engineering degree who doesn't really have the solid math background required, but had a friend who worked in the college records office.

We also sacked a student who changed her grades so she could continue to receive financial aid. Hurts nobody, right? Wrong. How about the student who deserved it but all the money in the scholarship fund was given to others, including the one who falsified records.

I, too, doubt the judge would make an example of them. It will probably be a fine and some community service, along with the stain on their records for being convicted of a crime, which would doubtfully make a positive impression upon prospective employers, unless Enron and Arthur Anderson were still in business.

As to this article, Seems a bit of a "slow news day" post. Why not something about how Martial Law in Pakistan has resulted in severed internet connections and how people might be coping.

Times have changed.

[iknownuttin]

Remember when hacking into the school's computer system to change grades was considered to be a prank that resulted in maybe at most a suspension. Now, it's literally a Federal Crime. What, in a few years, you'll get the death penalty for hacking grades?

Re:Times have changed.

[habig]

Yes, times have changed - people used to use their SSN's in public all over the place. Now, we know that this is like handing out keys to your bank accounts. Privacy about personal information is suddenly a (rightfully) important topic.

If TFA had been about someone at the school who let his laptop get stolen with all that sensitive information on it, slashdot would be full of people calling for his head. These guys break in, sell their access, and are suddenly martyrs because they got caught quickly, limiting the damage to changed grades? Bogus.

Also, beware the hyperbole. The court's job is to make sure that the sentence fits the crime, the listed penalties are maximums.

Fairer

[Austerity Empowers]

You are sentenced to school until such time as you earn the grade you created by hacking.

Old laws and new crimes

[ArchieBunker]

The old laws simply need updated to reflect todays technology. Unfortunately the govt is too busy worrying about how many ounces of breast milk you can carry on plane to investigate this matter. At this point the accused party might as well have beat up some cops and then raped their wives to get 20 years.

The Rub is the Sentencing Guidelines...

[tjstork]

Sentencing guidelines are a mistake, and that's the whole problem. What sentencing guidelines do is move the judiciary power into the federal power, and as a result, you have a race to ever more ridiculous sentences for political reasons. What we really need is to have judges doing the sentencing based on the facts of the case and the real severity of the crime, not a congress in a race to imprison people to seem tough on crime.

Sure, one can say that there was identity theft involved, but, what -really- happened? If the students used a password cracker to try and break in, then technically, yes, there was an identity theft because they logged in as someone else. However, this sort of an attack doesn't really constitute an identity theft in the sense we would reasonably define it - which is, using someone's personal information to destroy their life. Like, they weren't breaking into accounts to steal visa numbers and go on a spending spree. Yet, they are going to be charged with the crime, and the government is using a technicality to smear them in the public.

Such actions by the government will only undermine people's faith in it. As Princess Leia once said, "the more you tighten your grip, the more star systems will slip through your fingers."

Re:The Rub is the Sentencing Guidelines...

[The Only Druid]

This is nothing but shibboleth.

Sentencing guidelines - which, by the way, are not mandatory - do nothing to erode the power of the judiciary. Defining the possible range of sentences for an offense is not distinct from defining the offense itself. The notion of a "crime" includes both the proscribed act and the related punishment. It is philosophically unsound to pretend that the idea of a judiciary includes sole control over sentencing, unless you're willing to embrace judges choosing to impose incredible sentences (e.g. death, for theft) when they believe it fair.

All legislation is the Legislature imposing its will upon the Judiciary; without Congress telling the American Judiciary what is legal or illegal, the Judiciary would have nothing to do.

Like it says, the maximum penalty is unlikely

[Anonymous Coward]

Complaining about the maximum sentence shows lack of experience with matters of law. There are many, many laws in various countries that carry a substantial maximum penalty for a crime because the crime _can_ be severe but it can also be ridiculously petty.

For example, most countries carry the crime "theft" on the books and if that country only has one statute for any sort of theft, the maximum penalty will look harsh if it would be applied to someone stealing a candy bar. However, one has to consider that the same statute also covers stealing millions from a bank in which case a sentence closer to the maximum could be justified.

That's why we have HUMAN judges, with all their faults, instead of just a computer that checks if all the conditions for the crime is met and just prints a "default" sentence, because not every case is the same even if they are punishable under the same law.

Standard MO

[Steve Baker]

It's the standard MO of DA's these days. Pile on charge after charge until someone is looking down the barrel of 50 years for jay-walking, until they're very willing to take the plea-bargan slap on the wrist. Essentially torturing someone until they admit guilt. This way the DA doesn't have to actually work to convict someone while padding their resume with lots of convictions. Who wants to risk going before a capricious and tough on crime public, or worse, a tough on crime judge, to plead their innocence when they're looking at that much time? After all, if you were innocent you wouldn't have been arrested, right?

It seems...

[koan]

It seems that the punishment for computer crimes has become more harsh, almost as though hiring competent admins and securing the network is more work than changing a law...a law being passed by people that refer to the Inet as "tubes" that get clogged, and haven't the slightest idea of what the internet is all about.

Troubling.

They've got bigger problems than this...

[penguin_dance]

They're 29 and 28 years old and STILL in college!

Link to the full story

Re:Simple Solution

[CortoMaltese]

This reminds me of a joke with another simple solution:

A student comes to a young professor's office. She glances down the hall, closes his door, kneels pleadingly.

"I would do anything to pass this exam."

She leans closer to him, flips back her hair, gazes meaningfully into his eyes. "I mean..." she whispers, "I would do... anything."

He returns her gaze. "Anything?"

"Anything."

His voice softens. "Anything?"

"Anything."

His voice turns to a whisper. "Would you... study?"

Re:what should happen

[mu51c10rd]

next step: we arrest anyone that likes shop class or chemistry ... they could be supporting the terrorists in the future.

Already a step ahead of you...

Adding the charges is unreasonable...

[gweihir]

Quite frankly, it is enough to punish the most severe charge and not adding the others. Or to let people serve the penalties in paralell. 20 years for this is not reasonable at all. There is no relation to the damage done. For some reason the US system still does this "damned forever" punishmenst, and increasingly for for non-violent crimes dtat did not cause a lot of damage. From Europe is looks a bit like the prison industry is behind this, as they need as many long-term convicts as they can get. All in all my impression is that the US is the "free' country with the longest prison terms and the least effect of the penalties on the crime rate. Don't you people want to rehabilitate your criminals and change them into non-criminals? Does not look that way to me.

Jail populations and the symptoms of a society

[Midnight Thunder]

The US justice and social system needs some serious work. If you have 1 in 142 US residents in jail you have a problem. This equates to just under 2 million inmates and this is only based on 2002 figures, so I'd hate to see the current status.

This inmate population is enough to populate any of the 13 least populated states in the USA.

I am not saying what these people did isn't wrong, but the crime sounds more like revenge that punishment. This kids will be in debt and slaves to the system by the time the get out. Any time they would have had to think about what they did will be marred by the excessiveness of the punishment. Maybe the American society is just looking to continue slavery, but using other means to do it?

Re:Simple Solution

[felipekk]

Although this is a funny comment, that is exactly why I don't want to be a professor.
I mean, I can be kinda weak sometimes...

Ironically...

[DaedalusHKX]

It is a PUBLIC USE COMPUTER... the entire faculty and staff has access to it via one format or another. This leaves lots of avenues of access so ALL DATA ON SUCH A SYSTEM IS SUSPECT!

Especially in an educational facility, I've been on both ends of this argument the hacker and the hacked, so trust me on this or don't, but data on government and facility wide access machines, is NOT secure and is ALWAYS suspect.

Of course, as far as I'm concerned, this is yet another reason NOT to worry about school, IMHO.

I did most of my learning as an "extra curricular" activity. It paid off dividends, while schoolwork and college work have yet to pay me a penny. In fact, most of my non "vocational" education has cost me dozens of thousands of dollars and haven't paid me back even a fraction of the cost involved. So IMHO, hacking grades is pointless, because neither straight A's nor straight F's will get you a job, or get you well paid, or anything. At best, you can slave away for straight A's so you can end up a boring, lifeless, possibly low paid, and certainly easy to fire cubicle monkey for the jock who learned how to run a business, or the geek who never showed up for class on time and barely passed gym or shop when he was in school.

Look around, history's brightest people, inventors, discoverers, all were either failures in school or not particularly shining examples of "classwork drones". Why? Simple, their attention was diverted to this thing called "life". And while you were trying to get ready to live your life one week of vacation per year of work at a time, they were living theirs... (and if they didn't get stupid with their investments, they probably continued to do so well past the time where you had a kid or three, a mortgage and car payment, none of which you couldn't afford... which in the end is the reason so many of us "geek" types end up broke... poor investments, of both time and money.)

Re:Simple Solution

[Anonymous Coward]

To each his own. I mean, I would do anything to be a professor. Anything.