Schools Spy on Students

[facon12]

Once I saw this I had to check my work laptop for a webcam (i couldn't remember if it had one or not) just because it made me wonder. I know of stories where criminals have been caught this way before, but this just creeps me out a lot. Seems like the school thought their authority went a bit farther than it really does.
http://www.cnn.com/2010/CRIME/02/19/...uit/index.html

[xor]

Re: Schools Spy on Students

Once I saw this I had to check my work laptop for a webcam (i couldn't remember if it had one or not) just because it made me wonder. I know of stories where criminals have been caught this way before, but this just creeps me out a lot. Seems like the school thought their authority went a bit farther than it really does.
http://www.cnn.com/2010/CRIME/02/19/...uit/index.html

This brings up a interesting legal question for me. If the schools laptop had been configured to only use their vpn, remote gateway and a none split tunnel for Internet access, would this have been legal? Is a vpn tunnel considered the owners network? Also all data on the laptop would be the schools, but does that include images captured by the web cam? A real sticky wicket if you ask me.

xor

Where this happened is a very affluent suburb of Philadelphia. If Philadelphia had been able to keep it's wealthy like New York city does, the Main Line would be considered the Upper East Side. Why does such a wealthy area even need to supply laptops to people that can clearly afford to buy them?

[Deviant Ollam]

Re: Schools Spy on Students

i must say i'm somewhat surprised at the lack of attention this topic has gotten here on the forums. i know that it's a weekend and all, which means less posting in general... but a group of us have been in Europe for a week now and even here the news hit us, generating some significant discussion, not just among us, btw, but also amid some of our hosts here at HackCon.

As often, the USA is viewed as a most remarkable nation with a passionate yet perplexing view on matters of liberty and privacy... where citizens remain committed to their independence and lack of oversight or interference, except where matters "for the children" surface.

i hope that this continues to get coverage so we can see how it all develops. to me, the persons who initially leveraged the technology in this way are indeed somewhere on the spectrum between stupid and sinister, but the real sickening part (in my mind) comes from those who respond to these types of public revelations with immediate rationalizing and explanation as to why it was justified or a good idea, blah blah blah.

just once i'd love to see someone stand right up and say something like...

goddamn... we really screwed the pooch on this one, didn't we? we will immediately disclose who was responsible and the scope of what happened. i take overall responsibility, of course, and will now fall on my sword... unless, of course, you grant me another chance. if you show me this mercy, which it may be determined i do not deserve, i will leverage this awful cock-up as a catalyst for the organization and execution of a series of lectures, lessons, and discussions with the students about increasing threats to privacy, security, and individual rights in our modern technological world.

[Thorn]

Re: Schools Spy on Students

The precedent(s) set by this may be very interesting, depending on what exactly happened, and the wording of the EULA. If these were enterprise laptops, and the users were employees, I've not sure any of it would be an issue.

[bjaming]

Re: Schools Spy on Students

This entire issue hinges on the EULA, maybe I should stop clicking next so fast on those things.

[AgentDarkApple]

Re: Schools Spy on Students

From the article "Young said parents and students were not explicitly told about this built-in security feature."

"In an 'acceptable-use' agreement, the families are made aware of the school's ability to "monitor" the hardware, he said, but it stops short of explicitly explaining the security feature. He termed that a mistake."

OK, several issues here.
1) Did the parents sign the agreement, or did the students? Students under 18 signing the agreement for themselves with no parental reinforcement of any sort of contract cannot be held liable for breach of contract. The laptops obviously can be taken away from them if they abuse laptop privilege, but the underage kids cannot sign away any rights to privacy within their parents' homes.
2) What was the exact language of the EULA? EULAs with language that is too broad or too one-sided can be deemed unconscionable by the court.
3) This incident does seem to violate federal wiretap laws.
4) Correct me if I am wrong, but it seems that PA neither signed UCITA nor enacted anti-UCITA legislation. So basically this is up in the air and could go either way with that respect.
5) The school has the right to know the location of the laptop since they own it. But, for example, how does tapping into the webcam and seeing that the laptop is in a room with pink walls or is located in something that may or may not be a library actually tell them where it REALLY is? Why not use a LoJack or similar tracking device? Flawed logic, no?
6) As with a business-issued laptop, the school can know what activity is performed on the laptop using something like remote access to watch what is done on the screen, checking logs, etc. That is almost expected. However, the school should have also taken measures to block inappropriate use of the laptop. They should not be sitting back watching a webcam hoping to catch some young boy in an unspecified inappropriate activity. No matter what he was doing, they went way too far on that one.

[theprez98]

Re: Schools Spy on Students

When we discussed this case while in Norway, we seemed to agree that the school district would probably put out a scapegoat or "rogue employee" who would ultimately take the blame, and it seems the most recent news is going down that path. Now, the district is saying "only two" employees of the technology dept have ability to access the images, and it's pretty obvious that they're trying to insulate the administrators from any blame or liability.

I don't think it's a matter of who could actually initiate the webcam monitoring, but who knew of this procedure/capability, who approved it, etc.

[shrdlu]

Re: Schools Spy on Students

I personally believe that each and every official person that had access to these computers should be required to register as a sex offender. There is simply no way anyone can say that there was not someone on the other end watching at inappropriate times. I do not understand why there are not parents with pitchforks, tar, and feathers, hammering at the gates of the school.

This goes far beyond just overstepping the bounds, and veers right past big brother, and into voyeurism.

Shootin's too good for them. Where's a rope and a good tree?

Yes, I do need more coffee.

[AgentDarkApple]

Re: Schools Spy on Students

shrdlu, I agree. Since those who did activate the webcams ended up with unfettered access to watch what students were doing at home, it is extremely likely that they saw underage kids changing clothes, "posing" to send pics to their boyfriend/girlfriend, engaging in sexual recreation, etc.

[YenTheFirst]

Re: Schools Spy on Students

My take: it seems odd and inefficient to use webcams as a stolen laptop recovery method, compared to other available methods. Then again, I find it believable that a large organization would implement a less-than-optimal solution. ;)

What I find odd, however, is the incident which supposedly brought this all to light: a student being disciplined for "inappropriate behavior in his home", with webcam evidence to back it up. I'm tempted to say even school officials wouldn't be so idiotic as to pull something like that. I'm interested to see how this factually shakes out as the investigation proceeds.

Having remotely activatable webcams, without properly warning parents and students, is bad enough in and of itself. If the school officials think they actually get any say in what a student does at home, though. . . wow.

[sintax_error]

Re: Schools Spy on Students

...Then it would use the built-in security feature to take over the laptop and see whatever was in the webcam's field of vision, potentially allowing it to track down the missing computer...

That's the districts other mistake... Having a spokeshole attempt to defend their position rather than someone from their Technology and Security Department. The above statement alone is so far off base that it takes away what little credibility the District has on this matter.

I am very familiar with the type of software used in this PR trainwreck, and it's intended use is in no way, shape or form to "track down" a stolen laptop. It is intended to be used in conjunction with logs, and IP based tracking software such as lo-jack to provide evidence of an individual's unauthorized possession of a potentially stolen laptop. In that sense, YenTheFirst, you are correct, it is an odd and inefficient means of determining a laptop's location, as most notebook webcams are 1.3 megapixels with no IR backlight. This makes the webcam, for the purposes of identifying the location it's being used in, about as useful as a one-legged man in an ass-kicking contest.

If the district cannot even provide proper disclosure of what the software is intended for, you can be sure they will not give disclosure on what was captured, and who may have viewed what. As far as only two people having the ability to access the images, sure, but those two people have office friends who I'd bet dollars to pesos were privy to any "good stuff" pulled by the 2 in question. And, 'Prez, I agree whole hertedly, the only time any organization says something like that publicly, it's an insulation for their bosses. I foresee two scapegoats getting the axe, while the administration responsible for allowing this to happen remains untouched.

[xor]

Re: Schools Spy on Students

Clearly the the IT Department went against xor's prime directive:

Just because you can doesn't mean you should. This applies to making babies, hacking, and youtube videos.

xor

[facon12]

Re: Schools Spy on Students

I personally believe that each and every official person that had access to these computers should be required to register as a sex offender. There is simply no way anyone can say that there was not someone on the other end watching at inappropriate times. I do not understand why there are not parents with pitchforks, tar, and feathers, hammering at the gates of the school.

I hadn't even thought about the whole sex offender part of this. If the school captured an image of a student under 18 changing or something of the like, would it be child pornography at that point? I realize that this most likely was not the intent here, but legally speaking it seems like they could get charged for it. Anyone can feel free to correct me though as I am no legal guru. The reason I wonder is because if it is, then aren't there criminal charges that should be brought against them? That means more than just getting sued, that can mean jail time. If anyone could clarify the reasoning or legality in this area I would appreciate it.

[xor]

Re: Schools Spy on Students

I hadn't even thought about the whole sex offender part of this. If the school captured an image of a student under 18 changing or something of the like, would it be child pornography at that point? I realize that this most likely was not the intent here, but legally speaking it seems like they could get charged for it. Anyone can feel free to correct me though as I am no legal guru. The reason I wonder is because if it is, then aren't there criminal charges that should be brought against them? That means more than just getting sued, that can mean jail time. If anyone could clarify the reasoning or legality in this area I would appreciate it.

Sexting, minor to minor, is considered child porn. Extrapolate up, and you understand just how serious this is, and can get.

xor

If the school had used this technology to stop cyber bullying, or sexting between students, there might be a very different spin on this story.

[Thorn]

Re: Schools Spy on Students

I hadn't even thought about the whole sex offender part of this. If the school captured an image of a student under 18 changing or something of the like, would it be child pornography at that point? I realize that this most likely was not the intent here, but legally speaking it seems like they could get charged for it. Anyone can feel free to correct me though as I am no legal guru. The reason I wonder is because if it is, then aren't there criminal charges that should be brought against them? That means more than just getting sued, that can mean jail time. If anyone could clarify the reasoning or legality in this area I would appreciate it.

Despite shrdlu's wish, it isn't going to happen unless there are captured images or documented proof of a stream. There also has to be intent that the images were for sexual purposes.

Sexting, minor to minor, is considered child porn. Extrapolate up, and you understand just how serious this is, and can get.

The intent is clear cut in 'sexting', even if is between minors.

If the school had used this technology to stop cyber bullying, or sexting between students, there might be a very different spin on this story.

School authorities attempting to stop sexting might raise more legal issues than letting it happen. They'd have to have legal clearance with the local, state and possibly federal authorities.