Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
Wireless Networking Hardware

WiFi Exposes Sensitive Student Data 350

Posted by simoniker from the a-great-thing-if-implemented-carefully dept.
cfarivar writes "'Like leaving a vault open, the Palo Alto Unified School District failed to place a number of highly sensitive computer files containing student information in a locked location on its network. Using a laptop with a wireless card outside the district's main office, the Palo Alto Weekly gained access to such data as grades, home phone numbers and addresses, emergency medical information complete with full-color photos of students and a psychological evaluation."
This discussion has been archived. No new comments can be posted.

WiFi Exposes Sensitive Student Data More

WiFi Exposes Sensitive Student Data

Comments Filter:

  • California's new notification provisions: July 1 (Score:5, Informative)

    by NumberField ( 670182 ) * on Wednesday June 25, 2003 @06:53PM (#6298461)
    They just squeaked by on the calendar. Under the new California Law [siliconvalley.com] that goes into effect on July 1, they would have to notify each of the potentially-affected students after a breach like this.

    Should be fascinating to see how people react as they start to find out how often security problems actually occur...

    • Re:California's new notification provisions: July (Score:5, Insightful)

      by lommer ( 566164 ) on Wednesday June 25, 2003 @06:59PM (#6298506)
      Well, given that it's a newspaper that found this, I can't see that there'll be a big problem as far as non-disclosure on this one. Not to mention the fact that it's been posted to slashdot of course :-)

      On a side note, could the newspaper be held liable for this, given that they were intruding on the network without permission? If the newspaper gets screwed over this, it could generate some much-needed publicity and the following public backlash over this BIG problem in the current internet legal scene (namely that if someone finds an insecure network, they usually can't disclose it without getting whacked. Sometimes even if they only tell the company concerned, the company fixes it and then whacks them).

      • Re:California's new notification provisions: July (Score:5, Interesting)

        by mcdrewski42 ( 623680 ) on Wednesday June 25, 2003 @07:22PM (#6298660)
        Did the newspaper bypass security and illegally access copyrighted material?

        If so, didn't they violate the DMCA - no matter what their intent?

        After all, if the US constitutional right to 'fair use' is not a loophole, why would journalistic investigation be?

      • I think (IANAL whee) that it they are not possibly liable unless they actually circumvented some security measures somehow. If the files were simply open, then they didn't do anything wrong unless they tampered with files.
      • Hmmm, IANAL, but in most areas, isn't doesn't this fall somewhere under electronic tresspass, or electronic wiretap. Like, accessing a computer system that isn't yours and that you weren't authorized to access? Sounds like not only an admission of guilt, but them bragging about it..

        Of course, press like this is rarely very good. It's enough to scare lots of people away from new technologies.. I'd be surprised if someone doesn't make a push to bring them back down to paper files for everything.

        • I'm not sure how this would qualify on electronic tresspass. It's one thing to physicaly or electronicly attempt entry, but when the radio waves are not encrypted and pass through you body?

          I mean... if for example I had a WiFI card and I was on campus, which I would consider perfectly out of the ordinary, and I tripped upon a network connection, I would think "oh neet public WiFi". Just like if I was walking down the street and saw a path to a lake, "Oh neet a public lake".

          My point is without notice, ho

          • Well, logically, ya, you should be able to listen to anything being broadcast at you.. But, look at what they do if you descramble satellite feeds without paying..

            But, I don't think they accidently picked up the signal. They said they were sitting just outside of the school's office, with the proper equipment (ya, laptop and wifi card, big deal), but that's intent. Not only that, but sitting outside that office ("Using a laptop with a wireless card outside the district's main office") they sent data to retrieve data ("the Weekly gained access to such data as ...") . They were trespassing, just as much as if they reached in the window to pick up files sitting there. It could be arguable if they happened to walk past with their laptop in hand, and made a connection but did nothing on it, that they were simply receiving passive communications, but the reporters went as far as to connect, and dig through the confidential files of the students. Being that they were students, and not only were there contained school records, but medical records ("emergency medical information complete with full-color photos of students and a psychological evaluation")

            Ahhhh, and here we go with the law (I've been busy with work, not much time to play). The summary of this is, yes, they broke the law, and it's punishable by $2,500 and/or 1 year in jail on the first offense, and $10,000 and/or 1 year in jail on the second offense.

            [ca.gov]
            PENAL CODE
            SECTION 630-637.9


            631. (a) Any person who, by means of any machine, instrument, or
            contrivance, or in any other manner, intentionally taps, or makes any
            unauthorized connection, whether physically, electrically,
            acoustically, inductively, or otherwise, with any telegraph or
            telephone wire, line, cable, or instrument, including the wire, line,
            cable, or instrument of any internal telephonic communication
            system, or who willfully and without the consent of all parties to
            the communication, or in any unauthorized manner, reads, or attempts
            to read, or to learn the contents or meaning of any message, report,
            or communication while the same is in transit or passing over any
            wire, line, or cable, or is being sent from, or received at any place
            within this state; or who uses, or attempts to use, in any manner,
            or for any purpose, or to communicate in any way, any information so
            obtained, or who aids, agrees with, employs, or conspires with any
            person or persons to unlawfully do, or permit, or cause to be done
            any of the acts or things mentioned above in this section, is
            punishable by a fine not exceeding two thousand five hundred dollars
            ($2,500), or by imprisonment in the county jail not exceeding one
            year, or by imprisonment in the state prison, or by both a fine and
            imprisonment in the county jail or in the state prison. If the
            person has previously been convicted of a violation of this section
            or Section 632, 632.5, 632.6, 632.7, or 636, he or she is punishable
            by a fine not exceeding ten thousand dollars ($10,000), or by
            imprisonment in the county jail not exceeding one year, or by
            imprisonment in the state prison, or by both a fine and imprisonment
            in the county jail or in the state prison.

            I won't say that the school didn't fuck up, because honestly they did.. But, as any stumbler/wardriver knows, they're not the only ones. It doesn't take a computer expert to get into most networks. They should have done a better job, but failed. This is barely news, it's just a reporter bragging how they broke the law, invaded the privacy of thousands, criminally trespassed, and are flaunting it as news. It's as criminal as if they broke into a bank and took out cash, even if handing it back in the morning, to prove that it could be done.

            With that said, ya, my laptop is set up for stumbling too. :)

            • Re:California's new notification provisions: July (Score:4, Informative)

              by zakezuke ( 229119 ) on Thursday June 26, 2003 @01:03AM (#6300306)
              But, look at what they do if you descramble satellite feeds without paying.

              Ahh, that's activly *descrambling* the data. That's going above and beyond, theft of services and all that. You need to buy a key of sorts to gain access to these services, unless you are in canada ofcorse.

              intentionally taps, or makes any
              unauthorized connection, whether physically, electrically,
              acoustically, inductively

              I do not claim to be a lawyer, but largly based on what i've observed tap, as in wire tap, only applies to audio tapping. As in, it might very well be legal to pop in a security camera so long as it doesn't pickup audio.

              Further more, even the law you quoted implies *authorized access*. I would argue strongly that without basic security mesures that all people *are authorized* to access this material. It would be no diffrent, in my minds anyway, if they put up private information on a public web server, esp if google picks it up seeing no robots file in place.

              I would further submit the fact that the service of WiFi netaccess is very much common place. For example, my local starbucks coffee offers WiFi access for a fee, and I know of one CAFE that offers public free WiFi access.

              Given that this is a service offered in some establishments, a stumbler who accidently comes across access might reasonably assume that this is a service, given there was no security and *authorized access* is granted to everyone by the WiFi router based on a configeration choice by the system admin. My argument, which may or may not stand up in court, would be that because the system authorizes you that no law was broken, even if access to propriority data was made publicly available to anyone who requested access.

              We can clearly agree the school fucked up, but I'd argue that they should be held criminaly liable because their WiFi network specificly grants *authorized access* to anyone. Just because it's an automated authorization system is no excuse in my minds eye, no diffrent then asking for propriority records and getting them by fax from an office worker that wasn't told better.

              If it was me personaly, i'd say, "oh cool, public WiFi network, I can check my e-mail from here".

          • BTW, here's a nice little list of some of the state laws, just regarding the wiretap portion.

            http://www.ncsl.org/programs/lis/CIP/surveillance. htm [ncsl.org]

    • In time the it will get past the embarassment and all will be well again. Nothing more volitile than blushing data,
    • I was involved in a similar situation about 2 years ago. Huge amounts of school information were exposed to the world, and it was all quietly swept under the rug. I was told to keep quiet and to say nothing more of it. I was threatened with termination if I disobeyed. Since I no longer work there, I'm pretty free in saying that their "security system" has a bigger hole than the goatse man. School districts that buy "consultants", which are little more than revolving-door Microsoft salesmen with MCSE's,

  • Upside (Score:5, Funny)

    by The_Rippa ( 181699 ) * on Wednesday June 25, 2003 @06:54PM (#6298466)
    I guess Match.com and Yahoo Personals will have plenty of photos of young nubile girls to fill the fake ads on their service with.

  • Security is still sub-par with wifi (Score:5, Informative)

    by mao che minh ( 611166 ) * on Wednesday June 25, 2003 @06:54PM (#6298471) Journal

    WEP (Wired Equivalency Protection) uses RC4 encryption which is not very strong. Due to the design of RC4 (it was intended to be used over a synchronous stream), WEP designers had to make the key change with each packet. This means that the keys are quickly reused, and thus a sinffer can eventually - and usually rather quickly in large networks - determine the key loop. The SSID (Service Set ID) is sent over the wire either unencrypted or encrypted using weak algorithims.

    WTLS (Wireless Transport Layer Security) was designed poorly as well. It's design limits the effectiveness that a certificate authority like Verisign can have when using WTLS.

    Attacks against the WAP WTLS protocol (PDF): Source one [cc.jyu.fi], Source two [securityfocus.com]

    Security+ primer (lots of basic WEP, WAP, WTLS): Alpha Geek [alphageekproductions.com]

    • From reading the article, it looks like they didn't even bother using WEP. It's sad that even with large amount of out of job IT workers, the district can't find someone with network security experience.
      • From reading the article, it looks like they didn't even bother using WEP

        Aside from the fact that WEP is breakable and thus useless, if they had used WEP (and it wasn't broken) the data still would have been accessible to the legitimate wifi users (unless this was a special AP for people who need to see this data). They said the data was accessible to unauthorized users inside the network, too. And they fixed it by turning off the AP?

        I salute the newspaper for taking the initive (and, perhaps, the risk) of accessing the data themselves. But I wish they would have spun it more as a "piss poor security" issue than a "wireless security" issue. As far as I can tell, this has hardly anything to do with wireless at all. It's certainly not a reason for schools to not run open networks. They just need to secure their wired networks just like they should have before wireless!
    • The key to understanding WEP is the phrase "Wired Equivalency". The theory is that WEP, although a fairly weak cypher, provides the same level of privacy as unencrypted wired Ethernet. That is, breaking WEP is judged to be approximately as difficult as finding somewhere to jack into a wired Ethernet (i.e. not very). WEP never was intended to take the place of encryption systems such as SSL and IPSec that are conventionally used to secure connections over wired networks. Rather, it brings WiFi security to the level of security inherent in wired Ethernet. Thus, WiFi using WEP is insecure only because of the way it is marketed: users see it as a catch-all encryption system, rather than a replacement for the (fairly weak) security inherent to wired Ethernet's physical-access requirement.

      • Re:Security is still sub-par with wifi (Score:5, Interesting)

        by willtsmith ( 466546 ) on Wednesday June 25, 2003 @08:00PM (#6298912) Journal
        This is BS. Most organization don't have public ethernet jacks sitting curbside like a phone booth.

        The guys who designed WEP just plain fucked up. It was SUPPOSED to be an arduous task to break WEP keys. Instead it's an afternoon of number crunching.

        Beyond that, even if you DID jack in to an ethernet in a school system, you SHOULD NOT be able to access private information like grades and student records. The schools I've subbed at (unemployed programmer) have been pretty lax about securing their workstations but their GRADES etc... are secured on Novell servers.

        There is NO excuse for the failure of this school district. They are required by law to secure this information. They're lucky a hacker didn't get the info, they would have ended up with a SERIOUS law suit.

        PS. I'd bet you money that the paper was tipped off by a teacher who warned the school district ... BUT went unheeded. School districts don't listen to teachers. School administrators are mostly in a world of their own which mainly consists of saving their own asses by kissing the asses of parents (mainly the parents of noisy, disruptive, sociapathic kids (where do you think they get it from)).
      • And of course "Wired Equivalency" is total BS. Someone sitting in a van half a block away (or renting a suite next to yours) can spend as much time as they need to attack your WEP point -- days or weeks, even -- during which time someone physically in your building would (hopefully) have been noticed and challenged.

      • Re:Security is still sub-par with wifi (Score:4, Funny)

        by God! Awful 2 ( 631283 ) on Wednesday June 25, 2003 @11:54PM (#6300059) Journal
        The theory is that WEP, although a fairly weak cypher, provides the same level of privacy as unencrypted wired Ethernet. That is, breaking WEP is judged to be approximately as difficult as finding somewhere to jack into a wired Ethernet (i.e. not very).

        Yeah, I'm sure they made it weak on purpose... They were all set to publish a stronger algorithm, but then someone said "Hey! This isn't wired *equivalent*, this superior to unencrypted Ethernet."

        Unfortunately by that point they were already set on the name. [It was already in all the marketing materials and WEP just has a better ring to it than BWP (Better than Wired Privacy).] So the only solution was to introduce an arcane security flaw.

        Yeah, that's so much more plausible than "They fucked up!"

        -a
    • The SSID (Service Set ID) is sent over the wire
      And all this time I thought the idea was you didn't need wires (hence the term wireless).

  • They did it with p2p... (Score:5, Informative)

    by c0dedude ( 587568 ) on Wednesday June 25, 2003 @06:56PM (#6298476)
    Remember a week ago when at Senate hearings RIAA people said Peer to Peer that it could put inexpierenced users personal information at risk? My guess is there'll be a similar "Ban the Technology" movement against this for government use because of the potential danger. Except in cases where it would logically be needed, like free public internet access points. Of course, I could be wrong, but it's a thought.

    • Re:They did it with p2p... (Score:3, Interesting)

      by Anonymous Coward
      WiFi should be banned. In fact there was talk of a congressional hearing on the sad state of security in WiFI. It is insecure by default and the maximum secuirty you can apply to it is flawed and easily hackable.

      If this does anything, it should make the gov. smack the hell out of all WiFi consortium members by preventing them from selling any more equipment till they actually get it right. (And giving refunds for all faulty equipment already sold)
    • No, there should not be a "ban the technology" movement, but people who don't understand the technology should be banned. I was lucky enough be be born in an age when you needed a lock pick to look at my school records and most people at least understood them even if they didn't know how to use them.

  • Excellent felony! (Score:5, Interesting)

    by Geminus ( 602334 ) * on Wednesday June 25, 2003 @06:56PM (#6298477)
    Hmmm... according to FCC article 15, this newspaper just openly and admittingly committed a felony. Just getting an IP address constitutes committing this felony, but to access files without the network owner's permission is a strict offense. If I'm not mistaken, didn't a San Diego security company get raided by the FBI for doing the same thing?

    • Re:Excellent felony! (Score:5, Insightful)

      by Skyshadow ( 508 ) on Wednesday June 25, 2003 @07:05PM (#6298542) Homepage
      It's only a felony if they get convicted, and no jury in the land is going to convict a newspaper that discovered that a school was spooging out private information of minors to the world. That's why we have juries -- to provide a check on the government.

      Of course, they might just be declared enemy combatants and all this silly due-process thing could be avoided...

    • Re:Excellent felony! (Score:5, Interesting)

      by mjmalone ( 677326 ) on Wednesday June 25, 2003 @07:05PM (#6298548) Homepage
      A friend of mine in the San Diego area got arrested for doing the same thing at a local community college. Of course the police had no idea how to handle it and the charges were eventually dropped, but last I checked they still had his laptop (its been about 8 months).

      • Re:Excellent felony! (Score:3, Insightful)

        by fdawg ( 22521 )
        This is probably offtopic, but how did he get caught? Did they track him down via his MAC? Was he doing something mischievous?

        Things like this bother me. Its getting to the point where if you have a laptop and you're outside or if you're on a cablemodem doing something other than web surfing, you're going to get arrested. The media isnt helping the witch hunt. Uninformed press always make things seem worse than they are just to boost sales and preserve position.

        • Re:Excellent felony! (Score:5, Interesting)

          by mjmalone ( 677326 ) on Wednesday June 25, 2003 @08:06PM (#6298949) Homepage
          He had been at the site before and the admins on the network had noticed him connected. They noted his MAC address and when they saw him connect again called the police. When the police got there the admins came out and took his NIC and read off the MAC address so they knew it was him. They had logs of all the times he had connected and what he had done, etc.

    • Historically (Score:3, Informative)

      by geekoid ( 135745 )
      the press has been held 'above the law' in such cases. Look at Watergate for a prime example.
      That is a good thing, as long as the integrity of the information is held to a high standard. For example, if the published all the information they got, that would eb bad and they would be held accountable. If not by a law enforcement agency, then by a civil court. probably both.

      • Re:Historically (Score:5, Insightful)

        by anthony_dipierro ( 543308 ) on Wednesday June 25, 2003 @07:14PM (#6298616) Journal

        The newspapers never admitted to stealing the Watergate documents. They at least claimed that the documents were stolen by an anonymous informant. This case is different, because the paper admits to committing the felony itself, not through an anonymous informant.

        I see no reason to hold this paper to any different of a standard than Kevin Mitnick. Personally I'd like to see all hackers pardoned, but until then the law is the law.

        • recieving known stolen goods is a crime.

          First because if the press was convicted for this sort of crime, nobody would ever report this sort of crime could happen.

          What they did was nowhere near what Kevin Mitnik did. Kevin committed several different crimes illegally breaking into systems, telephone fraud, and B&E.
          Was his punishment overly severe? absolutly, but don't go comparing him to the press.

    • Re:Excellent felony! (Score:5, Interesting)

      by LionMage ( 318500 ) on Wednesday June 25, 2003 @07:34PM (#6298743) Homepage
      Hmmm... according to FCC article 15, this newspaper just openly and admittingly committed a felony. Just getting an IP address constitutes committing this felony, [snip]

      I'm not familiar with the laws, but which part is the felony exactly? How can "just" getting the IP address constitute a felony? We don't even know whether the newspaper had to crack encryption to get into this network. Maybe the access point was being run wide open, as another poster suggested.

      Certainly, if they had to break in, then it's a felony; on the other hand, if the school ran the access point wide open, then there's more of a gray area.

      I have a particular interest in this. You see, I recently got in trouble with H*neywell for using their WiFi without permission. I do consulting work for a small company, and there's a H*neywell office just down the hall from where I work. Someone at that office installed a WiFi access point, apparently contrary to company policy. That access point stayed up for many months, then recently came down, and I never thought anything of it. The access point was being run entirely without security of any kind -- no WEP, no password, nothing.

      I was only using this to surf the web and download some software updates/patches to my iBook. I didn't go out looking for this access point, but my iBook is configured to find the nearest access point as soon as it wakes up from sleep (or boots up).

      Then about a week after the access point went down, I got a call from my consulting firm. It seems that H*neywell had somehow traced my use of their WiFi access point, and wanted to do something about it. I almost lost my job, but ultimately, a deal was struck whereby I surrendered my laptop to have the hard disk imaged; the laptop was returned to me less than 2 days later, fully intact.

      The official story I got was that H*neywell hired an outside firm to check their network security, and they identified the WiFi access point as a security hole; the employee who set it up was fired. Then the security firm traced all who had used the access point, and found my "digital fingerprint."

      The unofficial story I got from some other folks in-the-know is that I had posted about my discovery in my LiveJournal [livejournal.com], and someone did a Google search and found the entry. Apparently, I forgot to make this a non-public entry. So that's how I was really found out. (That entry has been made friends-only now.) I'm still not 100% sure how Google indexed my journal, since I have my prefs set up to prevent indexing, but not all spiders respect that.

      I know H*neywell is a defense contractor, so I had assumed, when I discovered the access point, that it must be some sort of public access point for the convenience of vendors, put in a DMZ on their network. Surely, I thought, they wouldn't be dumb enough to put a wide-open WiFi access point behind their firewall! As it turns out, the access point was behind their firewall, and I could have accessed a whole bunch of material I wasn't supposed to. Scary thought.

      I think the real reason I got in trouble was that I embarrassed H*neywell. They could have conceivably taken legal action against me personally, but that would have created a weird situation for them, since it would expose them to government scrutiny. And they might lose some favorable government contracts if that happened. Moral of the story: Always check to see what you're connecting to. That hot-spot might not be safe to connect to after all!
      • Hmmm... according to FCC article 15, this newspaper just openly and admittingly committed a felony. Just getting an IP address constitutes committing this felony, [snip]

        Just getting an IPAddress? To get an IPaddress, you have to ask for one. Is it your fault they gave it to you? That's like if you knock honeywell's front door, and ask if you can come in, and they say, "OK, come on in", and as soon as you step foot in their premises, have you arrested for tresspassing. I suppose you could say, you did have
        • What's this you say, the network was wide open?
          :)

          "Was" being the operative word here.

          There's no telling who else had access to their network. They just went after me because I was an easy target, and I gave them a black eye.

  • Well... (Score:5, Funny)

    by Bob Vila's Hammer ( 614758 ) on Wednesday June 25, 2003 @06:57PM (#6298486) Homepage Journal
    The district has known about some aspects of this vulnerability for nearly nine months, but failed to take action until the Weekly informed officials of the situation late last week -- a somewhat ironic development given the school board's recent adoption of a technology-use policy.

    Well when it comes to information security on Palo Alto networks, they get a big F. Fortunately, a low-level net admin was able to change the grade to an A.

  • Liability (Score:5, Insightful)

    by Skyshadow ( 508 ) on Wednesday June 25, 2003 @06:59PM (#6298499) Homepage
    I've said it before, and it's generally gotten a negative (or even angry) response, but let me say again:

    It's time to introduce some level of legal accountibility for institutions which allow sensative data to be stolen.

    The simple truth here is that pointy-hairs and beaurocrats understand one thing: Money. If you threaten to kick them in their budget, they'll respond; otherwise, you'll just keep seeing these articles.

    I mean, this is *negligence* or the sort that could easily result in at least a major violation of privacy, or at worst a stolen identity or blackmail. These institutions with faulty IT -- and it's not as if this was some complex cracking job, this is just carelessness -- need to be taught a serious lesson.

    (shakes head) It kills me that a college can lose piles of cash for buying shoes for one of their basketball players and a business can get fined for having workers like a box that's 5 lbs. too heavy, but when they expose the private, valuable data of their students/customers, there's no sanction whatsoever....

    • Exactly (Score:5, Insightful)

      by Anonymous Coward on Wednesday June 25, 2003 @07:08PM (#6298568)
      Check out what the person in charge at the school said:

      "I don't see this as such a huge news story," Superintendent Mary Frances Callan said the day after the district office abruptly shut down its wireless network and student information program. The real news, she added, was the great progress the district has made to its network plans, thanks to new software purchases, planned employee training sessions and the technology-use policy.

      She has absolutely no sense of responsibility of the damage she could have/has caused. Money is the only thing that will get them to take notice.
      • Except the only thing that will do is either make the school more expensive to go to (tuitions rise) or cause the quality of the education its current students receive to decrease.
        • Your doomsday scenario could only come true if the institutions decided en masse that their money was better spent paying fines than improving their security. Policy makers could affect this decision by adjusting the amount of the fines accordingly.

          What would probably happen is that organizations would spend a relatively small amount of money purchasing a new kind of liability insurance, the terms of which would require them to take at least basic steps to secure their systems (ie, stunning incompetence

      • Re:Exactly (Score:2, Insightful)

        by LoztInSpace ( 593234 )
        This is a good example of a point that book review a few articles ago was trying to make.

        âoeConsequence-Based Thinkingâ in Chapter 2, a concept that promotes decision-making based on desired business results, rather than on the IT problems you face.

        (Unfortunately) most IT isn't about messing around with cool new stuff, it's implementing specific requirements, no matter how mundane. How she thinks the severity of loss of extremely private data can be mitigated with "look at my cool network"

    • Re:Liability (Score:3, Insightful)

      by geekoid ( 135745 )
      the sticl bit is:
      "...allow sensative data to be stolen."

      'not well secured' does not, nor has it ever, mean 'allow'

      If it is negligence, really hard to say based on the info given, then they can, and should, be sued.

      • Re:Liability (Score:3, Informative)

        by 56ker ( 566853 )
        Here in the UK it would be a breach of the Data Protection Act 1998 and possibly the Computer Misuse Act 1990. Oh and the psychological evaluation would fall under the Access to Health Records Act. These carry serious fines (but not jail sentences) if organisations disobey them. The DPA '98 is based on an EC directive and came into effect a few years ago. It's run by the Information Commissioner [dataprotection.gov.uk]. Of course - here you might run up against Crown immunity - which simply put means that the government can't be h
    • I agree. Allowing sensitive information about *children* to be this vulnerable is criminal. If I were a parent in that district, I'd be calling a lawyer and strongly considering my private/homeschooling options.

      ....Bethanie....

    • It's time to introduce some level of legal accountibility for institutions which allow sensative data to be stolen.

      I mean, this is *negligence* or the sort that could easily result in at least a major violation of privacy, or at worst a stolen identity or blackmail.

      Companies are already accountable for negligence. But in order to win a case, you have to show damages. I don't see any damages caused by this particular negligence.

    • Far worse abuses of this data (Score:5, Insightful)

      by coyote-san ( 38515 ) on Wednesday June 25, 2003 @07:34PM (#6298744)
      With pictures and family contact information, e.g., the names of the parents or relatives authorized to pick up the child at school, identity theft is nothing compared to the other abuses that are possible.

      E.g., a pedophile could go "shopping" for a victim, then use the information in the file to convince the kid that a trusted adult sent them to pick them up.

      Or they could be even more aggressive and add an alias to the list of people authorized to pick up the kid at school. Then they show up and breeze past security that would normally extend from classroom to doorstep.

    • Re:Liability (Score:2, Insightful)

      by gizmonic ( 302697 ) *
      First off, let me say that I whole-heartedly agree with you.

      Here is my question though. At what point does an institution move from being a victim of an attack to being responsible for it?

      Don't get me wrong here, from reading the article, I would definitely agree the school was somewhat negligent. I mean, if I leave my keys in my ignition, and the car is stolen, my insurance policy has a clause stating that I am at fault for not securing my vehicle, and they don't have to pay. That makes sense to me. And
    • Would you like a positive response this time?

      If there's a liability exposure, institutions will buy liability insurance, and the insurance companies will be a well-funded central source of motivation and knowledge to improve security.

      Steam boilers used to blow up and kill people. Insurance companies started demanding boiler inspections. After that, fewer boilers exploded.

      The "U" in the UL tag on electrical equipment stands for "Underwriters".

  • Interesting... (Score:5, Funny)

    by Trent Polack ( 622919 ) on Wednesday June 25, 2003 @06:59PM (#6298505) Homepage
    I wish my old high school would've had something like that happen to them. I WANT TO SEE MY PSYCHOLOGICAL EVALUATION!
    • Hell, I've talked to you enough on IRC, I can probably give you one at this point.
    • After you turn 18 you can at any time look into your permament record. Prepared to be shocked though. I was a slight rebel but nothing to serious and my consuler describe me, and I shit you not, as the NEXT HITLER!. Serious, she said: And in this report Nick sounds somewhat like the next Hitler (I wrote a paper saying academic proformence should determe which students got to go to Disneyland.)
    • I WANT TO SEE MY PSYCHOLOGICAL EVALUATION!

      Didn't anyone tell you? If you want to see it, you are crazy.

      Please lie down on the floor. The van will arrive shortly. Don't argue with the officers -- they are just doing their job.

      Thank you.

  • more to learn (Score:5, Insightful)

    by dema ( 103780 ) on Wednesday June 25, 2003 @07:00PM (#6298510) Homepage
    This just goes to show we have a lot more to learn about wirless technology. To a lot of people it may seem like simple common sense to use WEP or some other serious form of protection for sensitive records like that. But getting wiresless is becoming just as easy as getting a cable modem hooked up so more people are doing it at a faster rate and not researching the risks that come with it.

    I read an interesting (all be in short) article [eweek.com] not too long ago about the risks that does a nice job of explaining things.
    • common sense to use WEP or some other serious form of protection for sensitive records like that.


      You do realize that putting WEP on your WLAN is about as effective as putting 6 layers of duct-tape over your lock thinking that nobody with a key can get in now, right?

      WEP is useless unless you want to keep people out that wouldn't spend 30 minutes or less trying to crack the key.

  • WiFI? It was easier at my school; (Score:5, Interesting)

    by metalhed77 ( 250273 ) <andrewvc@@@gmail...com> on Wednesday June 25, 2003 @07:04PM (#6298533) Homepage
    Hell, at my high school, I was a junior admin (most bullshit class ever). Each class had a computer which kept grades for the class. Whatever shitty grade software they used stored the grades in PLAIN TEXT LOCALLY. These were win98 machines, no user permissions, freely used by all students. I discovered this fact when one of my teachers forgot his password to the grading program and after a little browsing opened up the raw text file to show us our grades. This all happened in one of the largest (and most inept) school districts in the country too, not some backwater. Actually, from the articles i've seen, it looks like the small school districts have it together more than the large ones as far as tech goes. Our admin was a former chem teacher who spent near 0 time doing anything useful, letting us junior admins do all the grunt work.

  • School Districts are generally clueless (Score:2, Funny)

    by Anonymous Coward
    when it comes to networks.

    Not only do they expose sensitive information,
    but they run generally insecure servers, and
    they pay mercenary network installation contractors
    1000 cents on the dollar for old crappy network
    hardware.

    And the web pages set up by school districts for
    employess to use are brain dead.

    This one:

    http://www.teachinla.com

    has a link on the NCLB teacher profile logo
    that sends you to a page that will let anybody
    that can get a teachers employee number and
    birthdate change their professional cre

  • Was it just a wide open access point? (Score:5, Insightful)

    by sgarrity ( 262297 ) on Wednesday June 25, 2003 @07:06PM (#6298551) Homepage
    From the article, it almost sounds as though it was a wide open access point (no WEP encryption or MAC filtering). If this is the case, there should be no demonizing WiFi - just a sloppy sysadmin.
    • even if this were a completely physical network not having these files password protected would be just as stupid.

  • So, it's funny... (Score:5, Insightful)

    by thenextpresident ( 559469 ) on Wednesday June 25, 2003 @07:07PM (#6298561) Homepage Journal
    ...that they can "crack" into a school district computer and no one blinks an eye. But the moment a student would try the same thing, he would be expelled.

  • Wireless is not the core issue (Score:5, Insightful)

    by vchoy ( 134429 ) on Wednesday June 25, 2003 @07:09PM (#6298574)
    ...the documents were not password protected.

    The same information was also accessible to individuals using district computers within school sites.

    This case shows who or what department that was incharge had concrete policy with regards to information and IT security.

    Security was fundamentally flawed, little or no security mechanisms in place, even lan connections had access to the files! Wireless connection only exacerbated the situation.

  • This isn't a problem with WiFi (Score:5, Insightful)

    by grahamsz ( 150076 ) on Wednesday June 25, 2003 @07:14PM (#6298620) Homepage Journal
    This is a general network security issue.

    Confidential data needs to have strictly managed flows and storage. It'd worrying enough that this information could be accessed anywhere on campus even without the wireless threat.

    When it comes to something like a psych evaluation I cant see why that information isn't kept 'offline' or on a small secured network. There is *no* justification even for allowing all staff members direct access to this sort of thing - it's ripe for abuse. I also cant see any reason why you'd need access to such a report instantly.

  • Solution: lawsuit? (Score:5, Insightful)

    by Quixote ( 154172 ) on Wednesday June 25, 2003 @07:21PM (#6298656) Homepage Journal
    However much I might hate lawyers (and IANAL, obviously), I think, sadly, things like this can only be fixed by lawsuits filed by the affected students. This is just too stupid on the school's part.

    This takes the cake: "I don't see this as such a huge news story," Superintendent Mary Frances Callan said ...

    'nough said.

  • I wonder if any of those evaluations concluded that someone would 'violate' someone who invaded their privacy. I know mine would. :)

    Check _this_ privacy policy!

  • yeah, welcome to the red tape. (Score:5, Insightful)

    by c64k ( 16259 ) on Wednesday June 25, 2003 @07:28PM (#6298703) Homepage
    I'm a district over from Palo Alto, and it's not surprising to me that the wifi was open. That SasiXP and server shares were open is frightening. But this is what happens when parents are allowed to come in and run roughshod over the plans of the admins. Or when random parents are your admins. Palo Alto has tech people, they should get in trouble for leaving things unsecure, but the parent group that came in and blew a big hole in the existing security needs a solid slap on the knuckles too.

    The tech staff that school have are usually underpaid and overworked, or contractors who are juggling the detail of 10-15 districts. I'm still cleaning up from the last time parents got involved, getting everyone connected to the internet.

    To every tech minded parent out there: don't give us your used crap, don't come in and 'help,' just stay out of the way. We have a clue (well a lot of us do), but we spend 98% of our time cleaning up the messes left by helpful parents, clueless teachers, and malicious kids. We're trying to get the teachers up to speed, and we're working on making it hard for the kids to purposefully or accidentally fsck things up. But parents are totally deaf to the idea that the help they're offering is really hindering things.

    How do you tell someone who wants to help, no. Or better yet, what's a good project to let parents feel good about helping without damaging my network, or my systems?

    • I agree. I am a student in the PAUSD who happens to run a lot of the computer stuff at one of the high schools. Many times, parents (with what I hope are good intentions) try to give us stuff. Usually, it compleatly fails to work well with what is already in place, although they insist that it is perfect for whatever we want to do with it. What is more, we have so many tech parents that all want to set things up their own way, regardless of what anyone else is doing, because they want to "Help the school" t

  • How about in a hospital (Score:3, Interesting)

    by Anonymous Coward on Wednesday June 25, 2003 @07:33PM (#6298739)
    WiFi is now commonly used throughout hospitals transmitting unencrypted patient information to mobile carts and charting hand helds. Imagine what you could grab just by sitting in the lobby.

  • Tsk, Tsk, Tsk.... (Score:3, Funny)

    by curtlewis ( 662976 ) on Wednesday June 25, 2003 @07:35PM (#6298750)
    Those who can set up networks, do.

    Those who can't, do it anyway.

    It takes 3 seconds to set up an access point and about 2 minutes to set it up and secure it. Even my neighbor (who apparently has wi-fi going on I see) was smart enough to secure their network (so much for the extra bandwidth for those huge game demo downloads, while I play online with no latency or packetloss!)

  • This is the problem... (Score:4, Insightful)

    by Penguinshit ( 591885 ) on Wednesday June 25, 2003 @07:39PM (#6298783) Homepage Journal
    "Andrew Hannah, a network administrator for the district, admitted security was an afterthought when the first open wireless networks were installed at the Jordan and Jane Lathrop Stanford middle schools and the district office between 2000 and 2002."

    This is the problem with DeVry's, et al, ginning millions of Win32-morons out into the world of computer administration. You get a bunch of clownpunchers who know how to press shiny buttons but who don't have a clue about the underlying principles (and responsibilities) of the computer networks they are in charge of administering.

    Mod me troll, but I'm tired of the polluted job market, and absolutely sick to death of cleaning up the puke left behind at countless small companies by these nimrods.

  • The Hilarity (Score:4, Insightful)

    by Emperor Tiberius ( 673354 ) on Wednesday June 25, 2003 @07:52PM (#6298875) Homepage
    In all honesty, we shouldn't have legislation for data leaks and the such. Let's say Joe sysadmin sets up a WiFi network. Joe sysadmin locks down said network, board has difficult time accessing network and "orders" John netadmin to reduce the security and make it more "ease of use-ish." Now in the normal IT world there positions aren't filled with morons. In the educational system where tech jobs are filled @ $5.15 an hour, you have the soccer coach, or the part-time janitor doing IT work. Holes open up, since the net/sysadmin knows nothing of what they're doing, they get by.

    The question is, would the hole have been discovered? Generally the answer is no, people don't always go looking for security exploits. Hehe, if I had WiFi when I was in HS, I'd be happier about that than anything. It makes me ponder if the news didn't try and get in, would someone have?

    I've also worked for the school IT department at my university but quickly quit when I realized the average intelligence around is no higher than a walnut. The one thing I know however, is we don't want the government responsible for private information. Next thing we know is the government pushing DRM and all that other crap.

  • How long until they... (Score:3, Interesting)

    by phillymjs ( 234426 ) <slashdot&stango,org> on Wednesday June 25, 2003 @07:56PM (#6298894) Homepage Journal
    ...shoot the messenger here?

    I bet some legal action will be taken against the reporter who did the "hacking," while nobody will even think about holding any school officials accountable for their stunning negligence. I shudder to think what a pedophile with a WiFi-enabled laptop could have done with access to that kind of info. Cripes, it could have really turned into a serious NAMBLA convention out there.

    I know this much, if I were a parent of a kid at that school I'd be raising holy hell about this and calling for the heads of people in the school administration. Starting with Superintendent Mary Frances Callan, who was quoted as saying, "I don't see this as such a huge news story." WHAT??? Bitch, you should be on your knees thanking God that this was uncovered by a reporter and not some scumbag who got a kid's address from that wide-open network of yours and found himself an ideal victim!

    ~Philly

  • Bring on the law suits... (Score:3, Insightful)

    by node159 ( 636992 ) on Wednesday June 25, 2003 @08:14PM (#6298997)
    Breach of security in regards to medical and psychological data under the schools care, which was known about but not acted on for 9 months? Sounds like some parents are going to get rich quick. Bring on the law suits.

    The attitude of the schools staff appalls me; sounds like the poor admin can't even do his job as everything needs to be rubber stamped before it can go in effect. And since when do they think that by securing the perimeter of the network does it make the files any more secure.

  • Students do this too (Score:3, Interesting)

    by kavachameleon ( 637997 ) on Wednesday June 25, 2003 @08:27PM (#6299065)
    My friend and I recently gave a white paper to our school describing all net vulnerabilities. We were able to access attendance and grade records, as well as the faculty folders because they didn't secure one of their servers. Also, there was an "install" folder with copies (serials included!) of all of the install cds for all the programs ever used at our school. Office, Starry Night, the grade program, etc. It was a treasure trove. But, like responsible people, we gave them the white paper. The sysadmin was unaware of any of this.
  • ... complete with full-color photos of students and a psychological evaluation.

    Does this mean they had a psychological evaluation for everyone? Is this common in US schools? It is unthinkable where I come from!

  • I grow tired of seeing WiFi get the blame because someone didn't flip a simple switch on a cheap wireless hub that would had prevented 99.99% of the reporters of the world out there from doing this.

    WEP exists to stop people like this, it won't stop someone determined, but it will stop the sensationalistic 'news at 11' types

  • Identity Theft (Score:3, Insightful)

    by Helmholtz ( 2715 ) on Wednesday June 25, 2003 @10:07PM (#6299611) Homepage
    In this age of identify theft, I think Universities should be held to a high standard of privacy. I know when i attended college, I had a real problem with the University using my social security number as my "Student ID" number. I complained to the Dean of Student Affairs, and was told that it was University policy and there was nothing that could be done about it.

    I remember strolling by empty offices of professors seeing the green printouts of class rosters at the beginning of each semster, and thinking that all it would take is somebody to duck into one of these rooms, lift that list, and poof, you've got hundreds of names and valid social security numbers.

    I realize that many schools are moving away from using the social security number as a form of student identification, but I wonder if this coincides with a shift in the fundamental philosophies of these estabilishments, or if it is simply a method of saving face. I sincerely hope it is the former rather than the latter.

  • I tried to be helpful (Score:5, Interesting)

    by DMDx86 ( 17373 ) on Wednesday June 25, 2003 @11:37PM (#6299980) Journal
    My school distrist, Fort Bend ISD [fortbendisd.com] in Houston, TX, had an IIS webserver that was infected with W32.SadMind. I notified the admin by email who replied with "Uhh.. the server is too slow to run Norton.. so we cant do anything". I laughed and forgot about it for a year.

    Then comes a story on slashdot about infected IIS servers, I post a quip about my dealings with FBISD and a couple of Slashdot posters decided to email the district and the local TV station. THAT got it fixed within a day, however the school district was a bit upset at me.

    After than, some less than ethical FBISD employee decided to attempt to reset my dyndns.org account password. A while later, I get hits from them to my linux box trying to login to my FTP and protected HTTP pages from them. This is the thanks I get for telling them that they're vulnerable.

    As a student, I couldn't really do anything other than publicize what they did on my website and send a few nastygrams back.

  • Not surprised (Score:3, Interesting)

    by Linker3000 ( 626634 ) on Thursday June 26, 2003 @03:42AM (#6300718) Journal
    Stayed in a uni hotel (part of their conference suite) about a month ago and each room had access to the campus network and Internet via a 100BaseT connection. Hooking my laptop to the network revealed dozens of workgroups, numerous student and uni PCs. About 80% of the PCs had guest login disabled, but among the noteworthy that didn't: 1 PC hosting numerous recent movies including the one where there is no spoon (reloaded) 1 PC sharing 'my documents' with tons of party pics (all very pretty but harmless) Numerous MP3s in about 20 shared 'my music's A smattering of pr0n Almost every accessible PC infected with worms that spread via NETBIOS (Norton AV 2003 went frantic every time I browsed a share) Welcome to the real world L3K

  • What about HIPAA? (Score:3, Interesting)

    by SolemnDragon ( 593956 ) <solemndragon@gmai l . c om> on Thursday June 26, 2003 @09:47AM (#6301983) Homepage Journal
    Health Information Privacy Accountability Act... wouldn't the school be in violation for not locking down student's health data? This is a real issue here in the Northeast US, where everybody who has so much as a note from a doctor by a student or employee has to keep it carefully under the regulation-approved locks and deadbolts...

    I'm not sure how this applies to an accidental WiFi transmission (IANAL), but i'm pretty sure that it would be grounds for serious fees and fines if it happened at any other kind of institution. i'm wondering whether the school will be in major trouble on this account alone. Under the rule, only health providers would face penalties for disclosing medical records- but if the school is a healthcare provider, for example, if they have an on-campus medical unit, they might be held liable.

    thoughts, ideas, am i way off base here?

Slashdot Top Deals

You can write a small letter to Grandma in the filename. -- Forbes Burkowski, CS, University of Washington

Close