Kutztown Students get Felony Charges

gone6713 writes "The 13 students from Pennsylvania who were accused of hacking the iBooks provided to them by the school (Slashdot had a previous story on them back in June) have offically been charged. It seems that the admin passwords were taped to the back of the iBooks!"

Re:Human error

[Heian-794]

Visit www.cutusabreak.org

The kids are protesting and even selling T-shirts.

A *felony* for something that, for any non-police-state-oriented mind, should result in reduced computer privileges? Outrageous.

More to this story

[guice]

This story is short and doesn't give the fully story of what happened.

*At first* the passwords were on the laptops (not exactly tapped; they were apart of some tapped data. It didn't say "Password:" if that's what you're thinking).

After the admin changed them all, the kids then used a brute force cracker to break the passwords which they found on the local machines (password file?) and proceeded to install unauthorized software.

They were punished multiple times and they still continued to do it. Calling the cops on them was a last resort the schools were forced to do.

You can read more of the full story here: http://www.cnn.com/2005/TECH/internet/08/09/kutzto wn.hackers.ap/index.html [cnn.com]

More to here than meets the eye

[Anonymous Coward]

I'm posting this because a lot of people are going to be writing about how outraged they are that the students got arrested for using the password on the back of the machine.

If you read the article, you also probably read this:

In addition, they're accused of using hacking tools to find the

new admin password when it was changed from the password that was taped on the back of the machines.

And also:

Now that's not the only thing that the kids are accused of doing, they also turned off the monitoring software (Apple Remote Desktop?) and even used it to

monitor the admins.

So this isn't just a simple case of using the written down the admin password. There's also been a count of computer theft added to the charges, so I don't know what that's all about.

Re:Get me that school's phone number.

[i_should_be_working]

Let's get that phone number, I've got time to remind them that they're responsible to me, the taxpayer.

Even more fun would be if the article had given a link [kasd.org] to the school website. That would learn 'em.

Tell the Cops and DA what you think

[Anonymous Coward]

Theodore Cole Jr.
Chief of Police
Kutztown Burough Police Department
45 Railroad Street
Kutztown, PA 19530
Phone: [phone]
Fax: [phone]
[e-mail]

Mark C. Baldwin, Esquire
  District Attorney
  Berks County Services Center
  633 Court Street, 5th Floor
  Reading, PA 19601
  Mon-Fri, 8 a.m. to 5 p.m.
  610.478.6000
  610.478.6002
  [e-mail]

Call or mail the Kutztown PD

[nxtw]

Police [kutztownpd.org]:
45 Railroad St.
Kutztown, PA 19530
[phone]

Borough of Kutztown [kutztownboro.org]:
45 Railroad St.
Kutztown, PA 19530
[phone]
fax [phone]

Kutztown Area School District [kasd.org]: District Administration
50 Trexler Ave.
Kutztown, PA 19530
[phone]
fax [phone]
more addresses and phone numbers for the District [kasd.org]

I find the quote "We are a country awakened to danger and called to defend freedom." at the bottom of the Borough's webpage inappropriate for this town.

Re:Moan ...

[einhverfr]

No they don't. The locker is the explicit property of the school. The school reserves the right to open, search, change, or restrict use of lockers at any time for any reason or no reason. They can even extend such a policy, to a certain extent, to student-owned vehicles parked in the school parking lot if they have some kind of just cause (impressions of a threat to students or staff, visual drug paraphenalia, etc) to think that a crime is being committed or is eminent.

IANAL, but every case I have read indicates that the administration must have "Reasonable Suspicion" to search a locker. This is a substantially lower standard than the "Probable Cause" normally applicable to searches. "Reasonable Suspicion" also applies to searches of students persons and belongings at school.

In other words, the administration can search your locker if they have reason to believe that such a search may turn up evidence of violation of the policies of the school, or laws such as drug possession. However, to my knowledge, they can't search it because your name turned up on the list of students for random searches today. Again, IANAL, but I would be happy to provide case references.

Re:Additionally

[IgnoramusMaximus]

This policy stipulated that passwords were only to be changed by the MIS department, and that all password requests must go through them.

Under most circumstances that is actually a very wise policy. Many products, MS Windows Terminal Services among others, do not allow the admin to access the user account without his password. That is you can get at the files but not actually log-in as that user to diagnose problems. Some other products require out-of warranty service depot excercise to reset their passwords. Good example would be some "security enabled" laptops. The policy of having MIS dept do all the passwords (while keeping records of them) prevents employees (specially when there is high turnover) from screwing up all of these things.

Of course that policy might not be applicable some places, depending on local conditions.

Re:Human error

[monkeydo]

I'm really not surprised that you didn't RTFA, but if you had, you'd see that:

"In addition, they're accused of using hacking tools to find the new admin password when it was changed from the password that was taped on the back of the machines."

district phone numbers

[Anonymous Coward]

better yet, call the people in charge [k12.pa.us] and exercise your freedom of expression!

Re:Human error

[Urchlay]

So if my password was 'omg_this_is_hard_password!' i would write down 'you will never guess this months password, it's hard!' and that would be enough for me to remember

But what would you write down if it were "k%XFl3n]" or something equally impossible to remember? Sometimes they're machine-generated and you don't get a choice...

Re:Funny, isn't this the American Way

[Anonymous Coward]

PART I: Your Aspirin Comments

No, she shouldn't be treated like a drug dealer, however punishment should have been given for the following reasons:

1) You can OD on medicines like Tylenol (which is not the same as aspirin, I admit, but I use it as an example because you can easily Google cases of this) and you would be amazed at what kids today stoop to in order to feel like little drug users. That sounds ridiculous and it should be, but in some schools, drug use has become a culture and part of the social pecking order. Now, high schools are different animals, but in middle schools and elementary schools, some of those teeny boppers use teeny bopper drugs, and Tylenol is among them.

2) There have been cases of students using these things and slipping large amounts of them into things like teachers' coffees or other drinks. The futile attempts to remove them from the classrooms and restrict them to nurse's offices is part of the response to this.

3) As someone who cannot use aspirin and didn't know/understand that as a child, it would make sense to employ a sort of punishment (especially to younger students...with high schoolers, although still a concern, you are starting to get into the "should have known better" range) to make sure that tragedies do not happen where good intentions ("Oh, you have a headache? Take an aspirin") don't turn into a terrible, unexpected situation of a child getting very ill or, forbid dying, because one student was allowed to administer medicine to another student without being aware that these consequences exist. This is why, at the beginning of the year, most schools send home "med cards" for the parents to fill out and sign, so that they can explicitly give permission for which meds they approve of their children receiving (for personal and medical reasons this is important) and, that girl not having the benefit of that card and it not being her place to distribute medicine to another minor, that is why these rules are in place and why you find them enforced. Hopefully reasonably. I also don't know when you graduated high school, but today's high schools have all sorts of drugs being passed around as other drugs. Making even aspirin against the rules helps to temper the chance that a different drug is not given to another student in the guise of the legitimate passing of Tylenol, either as an intentional sharing of drugs, or as one student's horrible, horrible practical joke against another.

4) Parents are too lawsuit happy and if something did happen and it is shown that the school didn't have a formal, enforced policy against medicines (yes, even non prescription ones), then the school would be taking on a lot of liabilty as effective care givers of these in-the-eyes-of-the-law children. They take on a lot of responsibility by having to not only educate but be legally responsible guardians of your child from morning until afternoon and even the small things like that can end poorly; instead of exercising reason and understanding the concept of accidents-will-happen, parents exercise their lawyers.

PART II: The Article -- Accountability
Now, had you read the article, you would see that the administrators changed the passwords after the incident and several of the students searched out the passwords on the machine (your own machine likely has a SAM file that is poorly protected) and others brute forced them. They also disabled software they were explicitly told not to disable. They installed services that they were explicitly told not to install.
Yes, the admins are going apeshit here and out of the realm of reason. No, these kids should NOT be treated as felons. BUT, the page the parents/students have set up presents themselves as victims which is the wrong approach here. Instead of being reasonable and saying "Listen. Mistakes were make. Felony charges are overboard. Lets settle something here," they are honestly calling themselves victims of poor security policies. The a

Re:Human error

[Herkum01]

Because it does not work when you have 10 or 20 different systems that get changed at different times and some you do not use regularly.

There were times I had not accessed a system for over 30 days and then when I need to get in the account was locked.

If you have only one account, no big deal but it is overwhelming when you a number of accounts and you cannot keep up.

A letter from a Mom

[Evets]

This letter was sent to the school administration by a student's mother prior to any charges being filed. The student is of course one of the 13 charged. If my memory of High School is even remotely accurate, this is exactly how my school administrators would have handled things (in absolutely the wrong manner) - however, my school administrators as quirky as they were, never would have filed criminal charges without even trying to get the parents involved.

May 3, 2005

I am writing this letter in response to recent events at the Kutztown
High School concerning the manner in which my son was questioned about
his use of the school laptop computer. My son was removed from an important chemistry review class and taken to an office where he was interrogated for more than thirty minutes by the school principle, assistant principle and laptop program director. During this questioning my son was accused of being involved in criminal activities and told that the Kutztown School District intended to press misdemeanor and/or felony charges against him in court. He was told that if he gave up the names of other students that they (meaning the school employees) would take that information into consideration when they filed the charges. I do not send my son to school to be intimidated, threatened, cajoled or bribed by school administrators under any circumstances. My son was told that he had destroyed school property and was in the same league as the kid who spray paints the exterior of the school buildings. I never heard such total rubbish. How dare any of you equate the abilities of my son with a group of mindless misfits who have nothing better to do than make graffiti? At the time of this meeting on May 2, 2005, none of the accusations being made against my son had any actual evidence to back them up because his laptop had not yet been checked for any current violations. My son was put in that intensely disturbing situation because some other students, who were probably terrified of what would happen to them, said my son had done something wrong.

I, personally, do not know exactly what my son does or does not do on his school computer, but what I do know is that at no time in the past four months was I ever contacted, by phone or by letter, about any problems that would justify the way school officials behaved towards my son during that meeting. If, at any time, I had been contacted by the school concerning inappropriate behavior by my son I would have put a stop to it immediately. Apparently, the administrators at the Kutztown High School seem to adhere to a policy that undermines parental authority. The only evidence I was ever privy to was a paper that was mailed to my home saying he had been given a one hour detention for the installation of something called Acquisition. A one hour detention would not indicate to any parent that there was a serious problem. The irony in that was that his acquisition wound up putting him through an inquisition.

I no longer trust the Kutztown High School administration to behave in a way that is professionally reliable or in the best interests of my child. Therefore I am stating, unequivocally, that there are to be no more meetings of any kind for any reason between my son and any Kutztown High administrator without my consent and/or physical presence at the meeting. If there is any problem at all with my sons conduct while at school I am to be notified immediately before any other action is taken.

I will no longer honor the contract that was signed concerning the use of the school lap top last September. Had I any indication at that time how inefficiently the program would be administered, I would never have agreed to it in the first place. I will not sign any other contract for the use of school computers unless there is an amendment clearly stating that any violations concerning the use of the equipment will be dealt with by the district a

Re:Human error

[bitingduck]

issuing a kid free computer hardware as part of their education, telling them not to screw it up (and not to risk infecting the network that that their fellow students and staff rely upon)

They were iBooks, presumably running OS X (the link is slashdotted). Good luck getting an infection that screws up the network. If they were running 9 then the risk is even lower.

I work in a mixed facilty (PCs, macs, linux, suns) with thousands of people and computers. Most users can pick their own. When there's a new PC virus they announce it on the facility-wide PA system. The mac users then just sit and chuckle.

Way overreaction on the part of the admins.

USC Title 18 : Section 242

[sourcery]

It would appear that a violation of Title 18, Section 242 is now in prgress:

Whoever, under color of any law, statute, ordinance, regulation, or custom, willfully subjects any person in any State, Territory, Commonwealth, Possession, or District to the deprivation of any rights, privileges, or immunities secured or protected by the Constitution or laws of the United States, or to different punishments, pains, or penalties, on account of such person being an alien, or by reason of his color, or race, than are prescribed for the punishment of citizens, shall be fined under this title or imprisoned not more than one year, or both; and if bodily injury results from the acts committed in violation of this section or if such acts include the use, attempted use, or threatened use of a dangerous weapon, explosives, or fire, shall be fined under this title or imprisoned not more than ten years, or both; and if death results from the acts committed in violation of this section or if such acts include kidnapping or an attempt to kidnap, aggravated sexual abuse, or an attempt to commit aggravated sexual abuse, or an attempt to kill, shall be fined under this title, or imprisoned for any term of years or for life, or both, or may be sentenced to death.

Prosecution in this case (where the passwords were taped to the back of the iBooks) is so clearly wrongful, that no reasonable person could deny that the prosecution of the defendants violates their rights under the First, Fourth and Fifth Ammendments.