Felony Charges For H.S. Hacking 824
jayrtfm writes "Last year the Kurtztown Area High School approved a program which gave every student an iBook. Now 13 students face felony charges for violating the district's usage policy." From the article: "Shrawder said the secret password '50Trexler,' was widely-known among the student body and distributed early in the school year. It allowed between 80 and 100 students to reconfigure their laptops, he said. The more computer-savvy students began to disable the administrations' ability to spy on the students' computer use. For others, it became a game, trying to outsmart the administration and compete with fellow students who held the secret, Shrawder said."
Lets get the facts straight (Score:5, Insightful)
In that article, it was said that the students were accessing porn sites, and HAD infact hacked the administrative network.
However, living in this area, I feel it necessary to point out that the papers around here can't handle technical articles, and and usually get the facts wrong. For all we know, they got the admin pass, and disabled the proxy (which was likely the n2h2 Bess Proxy [n2h2.com]), and all of this is being blown out of proportion.
Once more facts become clear, maybe we'll learn why the rest of the 80-100 students weren't charged.
I attended and worked IT for Conrad Weiser Area School District [conradweiser.org] which is about 20 minutes away from Kutztown, where we had the BCIU [berksiu.org] come in to do a lot of work on machines. The BCIU is clueless, and security is their lowest priority. It wouldn't surprise me at all if the BCIU worked with Kutztown High to setup this network, making it all the easier for these kids.
Also, here are the nyud mirrors of the links:
FAQ [nyud.net]
Kutztown Area Patriot Article [nyud.net]
Laptop Initiative [nyud.net]
Inept school officials (Score:2, Insightful)
I just don't get it (Score:3, Insightful)
In-house punishments please! (Score:5, Insightful)
Of course they didn't. You know why? Because, "Students who violate the computer policy will be disciplined" does not imply that criminal charges will be filed. It implies that the students could receive in-school sanction.
This is a bunch of hyped up and unnecessary bullshit. If you're going to give laptops out you better bet that they are going to be used for unintended purposes. By bringing criminal charges you are doing nothing but wasting even MORE of the taxpayers dollars for something dumb.
Discipline them in-house (like they did to us in high-school - made us sit in the hot school all summer doing NOTHING - it's worse than paying a fine and doing community service)
As I read the article... (Score:3, Insightful)
Re:Inept school officials (Score:4, Insightful)
Aha! (Score:3, Insightful)
The best way to get poor laws changed is to enforce them strictly.
Stupid (Score:5, Insightful)
In all seriousness, if they really wanted to ensure security on these systems, they shouldn't have allowed the students to take them out of the school.
@#$@# Educators! (Score:5, Insightful)
Wait a minute - the administrators have to show them who's in charge... and having the cops do their enforcement... that'll show them.
Secret? LMAO! (Score:3, Insightful)
If it's widely-known, how can it be secret?
Re:Locked down laptops... (Score:5, Insightful)
Re:Locked down laptops... (Score:2, Insightful)
dom
The same thing.. (Score:5, Insightful)
Re:Lets get the facts straight (Score:5, Insightful)
If you want to bypass any restrictions, find out if the teachers mind. Many times they won't. (I was once asked to send an e-mail from school, and our school filters block all webmail..or at least they think they do.)
If you end up doing something that you think they won't mind but they do, as soon as they say something, apologize, and stop doing that. And it helps to show yourself as a white hat ahead of time, so they know you're not solely trying to break their security.
If you're doing something that you know they mind, reconsider why. Is this something you can't do more safely from home, or from a public library or Internet café?
If you're looking up porn from school, you're a ****ing idiot. Same goes if you're breaking into important stuff for the fun of it.
Re:Idiots. (Score:2, Insightful)
It was an asinine password anyway (Score:5, Insightful)
50 Trexler Ave.
Kutztown, PA 19530
Excellent, nobody would ever think of "50trexler"
Nobody likes looking stupid (Score:3, Insightful)
I think the school staff know exactly how inconsequential the security breaches were. But nobody likes being made to look stupid - especially by kids many years your junior. These students took advantage of security problems that never should have been there in the first place. Certainly the students were wrong in what they did - no question about that. But making this into a felony issue is a defensive move on the part of the school to divert attention away from how badly they did their job.
On another note - apparently the school had $900,000 to spend on this. Why couldn't they afford a competent IT person to run it?
Re:Inept school officials (Score:3, Insightful)
Especially since the "purpose" of prison is supposed to be to reform the offender. Kind of puts that in perspective.
Nerdy anecdote (Score:5, Insightful)
At the time, Cornell was Mac-dominated (oh, happy memories) and the Upson lab had a network of IIci's just waiting to have their security hacked. I forget the tool that was used, but we figured out that it stored the password in a certain file that we could reach by bypassing the file security with Norton Utilities for Macintosh (haha Mac OS 6 security, bah). We procured a copy of the software, installed it and created a password on my own IIci, then took a copy of that file (with the obfuscated password) and replaced the file on the lab IIci. Instant admin access.
But we didn't stop there. We had such organization that we managed, as a team, to use this trick to install a fun little background process called NetBunny... on ALL the macs in ALL the labs. NetBunny does nothing on its own, but paired with a little utility called StartWabbit that we pointed at any campus AppleTalk network we wished, would begin the chain reaction. What then happened is that the Energizer Bunny would walk across the screen thumping the drum, going literally from screen to screen across the whole lab. It was pretty much a riot, if you were in on the joke, but the admins couldn't figure it out (we had hidden the executable well through obfuscation by renaming it and pasting another icon on it) and after they heard the recognizable "thump, thump, thump" sound would jump up and run around helplessly yelling "It's the bunny!!" We did it a few times with "agents" at each location to witness the mayhem. Good geek times.
I think it's the nature of very talented people, that when The System is not challenging them sufficiently (or when they refuse to take on the offered challenge due to lack of interest or motivation), that they seek out their own challenges, and fun.
I don't think these kids should get punished this harshly. Felony charges? Simply for trying to break the rules? Please. Face it, it takes some effort and talent to break in, it's just misplaced effort and talent. Find a way to redirect it. I mean come on, it probably started with some high-school geek starving for attention who wanted to seem cool.
I am an IT Director in a High School District... (Score:3, Insightful)
I just dealt with some students who abused positions of trust (as tech aides) to install keylogging software on multiple computers. We came down hard on the student who initiated this because he used the information he gathered to access email and grades of the teachers whose passwords he caught. I never considered recommending this to the police, though, because I knew that we could suggest expulsion (which we ended up on a compromise with the student and his parents on) and scare the student into not doing this again. Or, at least, we now know who he is and we can ensure that he won't do the same thing.
The primary downside is that high school computer experiences shouldn't have to be as controlled and locked down as they are in most places. While we absolutely need security surrounding our student information system, grades, attendance and teacher files, I don't like locking down computers and trying to force certain behaviors. Let these kids work normally on the computers and be clear about what is appropriate. Locking them up will only, in the end, produce exactly what these district's saw -- students who do everything possible to break the security.
Oh, and the parent who said, "and I don't know that it has cost the taxpayers any money" is delusional. Everything I do in my job costs the taxpayers money, so if I have to spent dozens or hundreds of hours tracking down the source of a security breach instead of working with students on a multimedia project or with teachers on instructional applications, then it costs money.
Re:Inept school officials (Score:2, Insightful)
Re:Lets get the facts straight (Score:5, Insightful)
And they won't mind either if they don't understand what you want to do. The problem comes when they understand what you told them and it's too late. You'll be the only one who "touched the computer", you're the only one who "knows how it works": you're responsible. I suggest that you ask for some kind of paper signed by a teacher before doing anything. I know I'm too much paranoid but it's always safe when you have a physical proof to show when something bad happens.
Re:Thoughts from a parent (Score:3, Insightful)
Re:Inept school officials (Score:3, Insightful)
So revenge is the goal? Yikes. No wonder your prisons are overflowing.
Re:@#$@# Educators! (Score:3, Insightful)
Re:Lets get the facts straight (Score:1, Insightful)
Re:Lets get the facts straight (Score:5, Insightful)
Altering the OS of your school provided laptop is probably not illegal, depending on what exactly you do. Unless you're unleashing a virus or destroying hardware, I really doubt anything will stick. I'm guessing this is the kind of thing the ACLU would help you with if you actually got in trouble.
Accessing material over the internet by using existing holes in school firewalls/proxies is NOT illegal. Most of us do it all the time at work because our IT departments are insane (but leave port 80 open with a proxy to censor us...may as well just leave them all wide open). Anyway unless you are attacking their network (router, firewall, proxy) in some way, it's not illegal or even immoral.
Now hacking in to their network, changing grades, destroying machines, altering network configurations, that's all illegal, immoral and just plain mean spirited. As with any other crime however, you should absolutely not admit to anyone what you've done without the counsel of a lawyer. This goes for any crime, even a speeding ticket. You have the right to remain silent, use it. Even if they promise to let you off, bring in a lawyer. Never play around with such things, I know some honest people who thought they were doing the right thing and got it handed to them. The right thing is to remain silent.
The more money it costs to enforce idiotic network policies and excess legal entanglements, the less likely anyone is going to want to be involved with it. If it isn't actively hurting someone, then I think after this neo-fascist insanity passes, people will ignore it.
Re:Thoughts from a parent (Score:3, Insightful)
Re:Know what I'd do? (Score:5, Insightful)
I'd hand it right back. "No thanks".
The students had a wonderful opportunity to show what a complete failure such draconian policies can be. But, just like with illegal file sharing, they'd rather push the other way, and end up further behind than when they started.
Re:In-house punishments please! (Score:2, Insightful)
I would say that too-tight computer rules will end up in hardware/software being manipulated by a skilled student to gain a bit more freedom with the provided hardware.
JESUS FUCKING CRIST (Score:4, Insightful)
Re:Lets get the facts straight (Score:5, Insightful)
I call BS. This is the most implausible story I've ever read in all my long years of reading people's stupid made-up stories on Slashdot.
Re:Inept school officials (Score:3, Insightful)
I might be wrong - I hope I am - but I fear my list is incomplete, not incorrect.
All part of the mindlessness of 'getting tough on crime'. All it really means is that in those states, a convicted felon might as well re-offend once they get out since there's little to no chance of them becoming a productive member of society or even of making a legal living. You can't rationally cast someone out of society AND expect them to act as if they are a part of it. Any rational human being in that situation will turn to crime.
A ration al society will do its best to make sure that the penelties are somehow constructive. They should be appropriate to the crime, they should serve a restorative function for the victims of the crime. They should at least attempt to show the offender the value of living within society's laws and force them to reflect upon the harm they have done. Once over, it must be truly over and the offender should be given a chance to put what they have learned into practice by becomming once again a full member of society.
Simple warehousing away from the general population for a time and then designating them as second class citizens is hardly productive. If we truly believed that prisons were in any way corrective, we would feel no need to proactively restrict the rights of a paroled felon. As it stands, the term 'corectional facillity' is a big fat lie. Such things should be a last resort for cases where we cannot get through to a repeat offender. It should also be viewed as a failure on society's part.
Apples of now and yesteryear. (Score:3, Insightful)
50 years or so ago, the analogue (trespass charges from the article) would have been a bunch of schoolkids wandering off and stealing apples from some local orchard/garden. Just a handful, and just as it's 'the rebellious thing to do'.. That stage that many kids go through. And hey, adults do too.
Technically, it may be illegal, but common sense tells you it's a light hearted prank. Someone blowing off steam
You didn't just lump them in with somone who broke in your house and stole all your prized possessions.
If it were reported to the headmaster/headmistress of your school, you'd get a stern talking to, a series of detentions, lines to write, and probably a week kicking your heels in your bedroom.
All of which would say very strongly "It's really not worth the waste of your time to do it!".
An eminently sensible, and time tried solution. Everybody forgets about it in a few weeks, apart from maybe a slightly elevated reluctance on the part of the kids to 'scrump' for apples like that again.
Exactly as it should be.
Now: We get people like the teachers who went screaming to the police department at the first sign that somebody may have done something they didn't like.
Now, a suitable punishment would have been a series of detentions, letters home to the parents who would most likely have grounded the kids. And everyone would have gone on as usual.
Now, instead, you have a set of scared (and intensly angry) kids who if they do it again, are going to be much more careful, and if it looks like they're going to get caught, will likely cause collateral damage to hide their activities in.
And a series of shocked and angry parents who have suddenly lost faith in the ability of teachers to even try and keep some semblance of common sense in and out of the classroom.
Then, of course, the media, who love this, sending word far and wide to a generally disbelieving population, most of who are going to be shaking their heads at how far stupidity and knee jerk reaction has pervaded socicety and become the norm.
One thing's for sure: The image of that school is very badly damaged. I'd hazard a guess that several students will be moving (voluntarily) to another educational establishement.
The intake will likely be down (hey, would you prefer a school that'll give your kids a felony charge for a prank, or one that'll give them a detention and teach them pragmatism?).
The cost in PR and face for this action is incredible.
If the school holds it's current position, it'll likely cut off any possible stream for kids with a prankish side (who often tend to be highly creative; note this isn't just kids who misbehave just to be disruptive. Difference between Ferris Bueler and Bart Simpson) coming into the school.
And most other kids whose parents just don't want to risk it.
If they turn it around, and quash the teacher's wishes so completely, the administration will just never be treated as a joke, and it's authority will be seriously undermined (can you imagine, every small action a kid gets pulled up for, they'll be saying 'what are you going to do? Report it to the police?').
Maybe I'm just getting old, but all this leaves me with is the wish that things would go back to before the politically correct and lawsuit hungry era back to times when common sense was actually held in esteem. When you could actually learn to respect someone for being harsh but fair, rather than having them try to force respect by waving the threat of a lawsuit in your face at every corner.
Criminal stupidity and derelection of duty (Score:3, Insightful)
Rule number 1 of security, if the attacker gains unsupervised physical access to the box, game over. What in the world did they think was going to happen?
You can raise the bar quite high if you use various crypto signature techniques, but ultimately a soldering iron and a flash burner will defeat that. A CPU that can check the BIOS signature in micricode on powerup would raise it much higher still(probably beyond a student's reach, in fact), but could be defeated by a determined attacker with the right laser and microscope.
Despite all of that, the real crime here is school administraters who have forgotten why they are there and who they serve. They are supposed to provide the students with a safe learning environment where they not only learn what's in the books, but how to get along in society. Part of that includes the school modeling society in microcosm. Part of that includes demonstrating that poor choices have unpleasant consequences while protecting them from the worst of those consequences while they are learning. Whenever outside law enforcement is called in, the school has failed in it's primary purpose. When outside law enforcement is unnecessarily brought in, the school has WILLFULLY derelected it's duty to the students, parents, and society.
Schools often claim to be acting in loco parentis [bartleby.com] and so need not recognize a student's 4th ammendment rights amongst others. Courts tend to agree with that. What they have forgotten here is that there are duties and responsabilities that go along with acting in loco parentis. Would any decent parent file felony charges in retribution if their high school aged child hacked their computer to bypass the parental netfilter?
The administraters are embarrassed that the students got the best of them. In their embarrassment, they have rather childishly decided to do as much harm to the students as the law will let them get away with. It sounds like the administraters responsable for this shouldn't be allowed anywhere near responsability for children until they spend some quality time with a qualified psychologist. In addition, given that the administraters have demonstrated an emotional age equal to or lower than that of the students, perhaps they should serve a few weeks of detention as well.
Were I one of the parents, I would probably petition for the administraters' immediate dismissal for incompetance.
Re:Idiots. (Score:1, Insightful)
Who cares if they want to play MAME on the school's time? It's alright to use computers recreationally, and for all we know, they could have been working quite hard and needed a break.
Generally, the computers are there so if someone *wants* to work, they can. I don't care if students are playing Quake or UT in my labs, and hey, I'll even join in from time to time if they let me. But if students are waiting in line for a workstation, I promptly and politely ask the gamers to leave - the machines can be used for gaming, but actual work gets priority
Signed
LAN Admin at a large Canadian university
(AC cause boss reads slashdot, too)
Re:Thoughts from a parent (Score:3, Insightful)
Re:Lets get the facts straight (Score:3, Insightful)
If you're looking up porn from school, you're a ****ing idiot. Same goes if you're breaking into important stuff for the fun of it.
Maybe. But I don't think that is the point. Is it reasonable and just to damage a child's future for a minor infraction? After all, children do not have all the rights, responsibilities, and protections of an adult. Childhood is the time for making (and learning from) mistakes. When are we going to get away from this puritanical witch-hunting mindset?!?
Re:Lets get the facts straight (Score:3, Insightful)
If I were a parent in these school districts, I would refuse to allow my kids to have the school computers. And if there was ANY detrimental effect on their grades or education, I'd file a lawsuit. These heavy handed policies endanger the future of students in those districts.
If administators had been this ignorant when I was learning my skills, I wouldn't have worked with computers for the last 20 years. At a tech school I attended we used a system 34. I found out the hard way that you don't name a BASIC program Merge. It resulted in the system being frozen for hours while the history file filled and then printed. We also found that with the menuing tools and a set of manuals, we could get into functions we weren't intended to use. When the admin found out, instead of calling the cops he tightened security and the told us we weren't supposed to be using those functions and that he had locked us out.
When you give a child a learning tool, you don't punish them for exploring. The problem here isn't students hacking computers, it's the adults not properly supervising them. You wouldn't turn a bunch of HS students loose in the wood shop unsupervised.
Re:Living With a Felony (Score:2, Insightful)
> You commited a crime, and now you're paying for it.
> Maybe next time you'll think twice before breaking the law.
Why would he think twice next time? He just said his life is fucked after commiting one felony, having two felonies on his record won't make him any more unemployable than he is now.
It was pretty obvious he wasn't complaining about the actual punishment for the crime, but instead about the scarlet letter effect that took place after the supposed punishment was meted out. Even if you were an advocate of the scarlet letter style blackballing for life of felons, how do you think it'd be a deterrent to future crimes?
I really don't know anything about felonies, and if the parent post was accurate in his statements, but if he was it sounds like branding someone a felon for life would make them *more* likely to commit a crime again, not less.
You guys are missing THE most important facts. (Score:4, Insightful)
I really wish... (Score:2, Insightful)
These stupids should understand that if they do not like kids or school they should simply change job. It is clear that an idiot who wants to charge a kid with computer felony can't even be considered a human being... and for sure not someone that should work in a school.
Re:Lets get the facts straight (Score:3, Insightful)
Porn I can agree should be kept off those computers, and there would probably be some jousting between students and tech support over this, but the draconian lockdowns do NOTHING but taunt the kids into breaking the rules. (Even these kids were operating under self-imposed rules, such as not messing with the server, not deleting any programs, etc.)
It's the arrogance of "educators" that usually gets in the way. Once they start trying to prevent the kids from messing around a little, it can turn into a war (and a source of entertainment for the kids, as well as a distraction from their actual schoolwork), then the teachers/administrators can say "see, I told you so, they only want to fool around and distrupt things, they don't want to learn".
Regardless, I bet those kids learned more constructive skills during that schoolyear from the hacking and yes, from playing computer games (not to mention dealing with the stupidity and arrogance of the people in power), than they were likely to learn in their classes.