Students get around school's IT restrictions.

[GrandMasterTerwynn]

And are charged with felonies

Students Charged With Computer Trespass
By Michael Rubinkam
Associated Press
posted: 10 August 2005
02:40 pm ET


KUTZTOWN, Pa. (AP) -- They're being called the Kutztown 13 -- a group of high schoolers charged with felonies for bypassing security with school-issued laptops, downloading forbidden Internet goodies and using monitoring software to spy on district administrators.

The students, their families and outraged supporters say authorities are overreacting, punishing the kids not for any heinous behavior -- no malicious acts are alleged -- but rather because they outsmarted the district's technology workers.

The Kutztown Area School District begs to differ. It says it reported the students to police only after detentions, suspensions and other punishments failed to deter them from breaking school rules governing computer usage.

In Pennsylvania alone, more than a dozen school districts have reported student misuse of computers to police, and in some cases students have been expelled, according to Jeffrey Tucker, a lawyer for the district.

The students "fully knew it was wrong and they kept doing it,'' Tucker said. "Parents thought we should reward them for being creative. We don't accept that.''

A hearing is set for Aug. 24 in Berks County juvenile court, where the 13 have been charged with computer trespass, an offense state law defines as altering computer data, programs or software without permission.

The youths could face a wide range of sanctions, including juvenile detention, probation and community service.

As school districts across the nation struggle to keep networks secure from mischievous students who are often more adept at computers than their elders, technology professionals say the case offers multiple lessons.

School districts often don't secure their computer networks well and students need to be better taught right from wrong on such networks, said Internet expert Jean Armour Polly, author of "Net-mom's Internet Kids & Family Yellow Pages.''

"The kids basically stumbled through an open rabbit hole and found Wonderland,'' Polly, a library technology administrator, said of the Kutztown 13.

The trouble began last fall after the district issued some 600 Apple iBook laptops to every student at the high school about 50 miles northwest of Philadelphia. The computers were loaded with a filtering program that limited Internet access. They also had software that let administrators see what students were viewing on their screens.

But those barriers proved easily surmountable: The administrative password that allowed students to reconfigure computers and obtain unrestricted Internet access was easy to obtain. A shortened version of the school's street address, the password was taped to the backs of the computers.

The password got passed around and students began downloading such forbidden programs as the popular iChat instant-messaging tool.

At least one student viewed pornography. Some students also turned off the remote monitoring function and turned the tables on their elders-- using it to view administrators' own computer screens.

The administrative password on some laptops was subsequently changed but some students got hold of that one, too, and decrypted it with a password-cracking program they found on the Internet.

"This does not surprise me at all,'' said Pradeep Khosla, dean of Carnegie Mellon University's engineering department and director of the school's cybersecurity program.

IT staff at schools are often poorly trained, making it easy for students with even modest computer skills to get around security, he said.

Fifteen-year-old John Shrawder, one of the Kutztown 13, complained that the charges don't fit the offense. He fears a felony conviction could hurt his college and job prospects.

"There are a lot of adults who go 10 miles over the speed limit or don't come to a complete stop at a stop sign. They know it's not right, but they expect a fine'' not a felony offense, he said.

Shrawder's uncle, James Shrawder, has set up a Web site that tells the students' side of the story.

"As parents, we don't want our kid breaking in to the Defense Department or stealing credit card numbers,'' said the elder Shrawder, a businessman. "But downloading iChat and chatting with their friends? They are not hurting anybody. They're just curious.''

The site, www.cutusabreak.org, has been visited tens of thousands of times and sells T-shirts and bumper stickers, including one that says: "Arrest me, I know the password!''

The district isn't backing down, however.

It points out that students and parents were required to sign a code of conduct and acceptable use policy, which contained warnings of legal action.

The 13 students charged violated that policy, said Kutztown Police Chief Theodore Cole, insisting the school district had exhausted all options short of expulsion before seeking the charges. Cole said, however, that there is no evidence the students attacked or disabled the school's computer network, altered grades or did anything else that could be deemed malicious.

An association of professional computer educators, The International Society for Technology in Education, believes in a less restrictive approach to computer usage. The more security barriers a district puts in place, the more students will be tempted to break them down, it believes.

"No matter how many ways you can think to protect something, the truth is that someone can hack their way around it,'' said Leslie Conery, the society's deputy CEO. "The gauntlet is thrown down if you have tighter control.''

I know the school's IT people were pretty stupid for taping the administrator passwords to the backs of their computers, but I feel the students willfully and flagrantly broke the rules in this case, and deserve what's coming to them.

[DrkHelmet]

Now, I would respect the children if they actually had to break through the security in order to get what they wanted. This would show skill, patience, and a willingness to learn. It would also demonstrate that they were, truly, smarter than the School's network security people.

Oops, they are! They can read! Honestly, if you put the administrator password out there and then scream, "Don't use it!", how can you expect that it won't be used? You are only kidding yourself.

Before I continue with this post, anyone know what the statue of limitations is on computer tampering?

[Wicked Pilot]

Who ever said that today's kids were stupid? I'd like to see my parent's generation pull shit like that.

[Arthur_Tuxedo]

I know the school's IT people were pretty stupid for taping the administrator passwords to the backs of their computers, but I feel the students willfully and flagrantly broke the rules in this case, and deserve what's coming to them.

One of the foundations of any fair justice system is that the punishment is supposed to fit the crime. Charging a bunch of high school kids with felonies for getting around inept security to chat and look at dirty pictures is a severe abuse of that system. Just because someone "broke the rules" does not justify any and all punishment.

[Dakarne]

That... and they're young offenders.

I memorize all my passwords personally... and leave it at something noone can guess at.

[GrandMasterTerwynn]

I know the school's IT people were pretty stupid for taping the administrator passwords to the backs of their computers, but I feel the students willfully and flagrantly broke the rules in this case, and deserve what's coming to them.

One of the foundations of any fair justice system is that the punishment is supposed to fit the crime. Charging a bunch of high school kids with felonies for getting around inept security to chat and look at dirty pictures is a severe abuse of that system. Just because someone "broke the rules" does not justify any and all punishment.

It states in the article that the school had exhausted their own internal discipline methods to no avail.

The Kutztown Area School District begs to differ. It says it reported the students to police only after detentions, suspensions and other punishments failed to deter them from breaking school rules governing computer usage.

The article also states that the students were required to sign a code of conduct/acceptable use policy that contined warnings of legal action.

And the charge does apparently fit the crime:

computer trespass, an offense state law defines as altering computer data, programs or software without permission.

So this doesn't look like a case of the punishment being excessive.

[General Zod]

I'm more curious as to the kind of security these networks supposedly had. If it wasn't anything stellar, then the fact that 14 year olds could bypass them should have taught them to stiffen security as opposed to whining that they were being hacked.

[DrkHelmet]

I know the school's IT people were pretty stupid for taping the administrator passwords to the backs of their computers, but I feel the students willfully and flagrantly broke the rules in this case, and deserve what's coming to them.

One of the foundations of any fair justice system is that the punishment is supposed to fit the crime. Charging a bunch of high school kids with felonies for getting around inept security to chat and look at dirty pictures is a severe abuse of that system. Just because someone "broke the rules" does not justify any and all punishment.

It states in the article that the school had exhausted their own internal discipline methods to no avail.

I have a novel idea. How about you, oh, take the computers away from the offenders? The school owns the computers, and they can take em back. Too logical? Oops.

The Kutztown Area School District begs to differ. It says it reported the students to police only after detentions, suspensions and other punishments failed to deter them from breaking school rules governing computer usage.

The article also states that the students were required to sign a code of conduct/acceptable use policy that contined warnings of legal action.

And the charge does apparently fit the crime:

Possibly, but before I answer, I still need to know what the statute of limitations on computer tampering is.

computer trespass, an offense state law defines as altering computer data, programs or software without permission.

So this doesn't look like a case of the punishment being excessive.

I disagree, the school may not realize it, but they had other options.

[SCRawl]

Who ever said that today's kids were stupid? I'd like to see my parent's generation pull shit like that.

I'm not sure if I'm quite in your parent's generation -- I'm 33 -- but when I was a lad of this age group (14, IIRC) I pulled a similar scam. I wrote a program to emulate the login screen, feigned a problem, and had the administrator enter his username/password to try to correct it for me. The program in question sent this information to the network printer (where my accomplice awaited it), and when the login seemed to fail (go figure) I did a quick hard boot to erase the evidence.

Mind you, I only did this to see if I could. No networks or user accounts were harmed in this experiment.

(Just to show my age: this computer network ran on the Lexicon server, using Icon terminals, and the program was running WatCom BASIC, which we were learning at the time.)

[Chmee]

Fifteen-year-old John Shrawder, one of the Kutztown 13, complained that the charges don't fit the offense. He fears a felony conviction could hurt his college and job prospects.

"There are a lot of adults who go 10 miles over the speed limit or don't come to a complete stop at a stop sign. They know it's not right, but they expect a fine'' not a felony offense, he said.

Ahh, the old 'other people do shit that's worse so I shouldn't be punished' defense .... never worked with my parents, either.

This is one of my concerns about the file-sharing generation, their concept that it's not what's legal that matters, but what you can get away with.

If they were warned and continued with conduct in violation of both the law and the code of conduct they agreed to be bound by, charge 'em with felonies. They're not first-graders, they knew damned well what they were prohibited from doing and did it anyway.

[White Haven]

Been there.
Done that.

Got sent to detention wearing the T-shirt.

My senior year of high school was the pilot year of the Henrico County, Virginia iBook program, and we had the same problems.

Hell, I'll be honest. I WAS the same problem. Now, we didn't quite go as far as legal action...the first year. My contacts back in the school system have told me that that changed within a few years. I'm sure the security was just as pathetic on those systems as it was on ours, as well.

[Wicked Pilot]

I'm not sure if I'm quite in your parent's generation -- I'm 33 -- but when I was a lad of this age group (14, IIRC) I pulled a similar scam.

My parents have a good 25 years on you. Their generation's claim to fame was slightly different. Where my father was from they were smoking pot, listening to the devil's music, and refusing to shower. Fun but not requiring intelligence. Where my mother's from they were fighting to keep blacks and whites from going to school together. No requirement for intelligence there either.

[Darth Wong]

I know the school's IT people were pretty stupid for taping the administrator passwords to the backs of their computers, but I feel the students willfully and flagrantly broke the rules in this case, and deserve what's coming to them.

One of the foundations of any fair justice system is that the punishment is supposed to fit the crime. Charging a bunch of high school kids with felonies for getting around inept security to chat and look at dirty pictures is a severe abuse of that system. Just because someone "broke the rules" does not justify any and all punishment.

It states in the article that the school had exhausted their own internal discipline methods to no avail.

They could have expelled them.

[gizmojumpjet]

From their website:

What we want:

1) To get the word out!

The information we have received indicates that out of the ~300 boys in grades 9 - 12, 80-100 were involved with the "unauthorized access" and 1 out of every 20 boys in grades 9 to 11 was charged with a felony. This reflects a terrible system failure. The administration needs to admit their responsibility in the breakdown of security and discipline during the rollout of this experimental laptop program.

Translation: It's not our fault we violated the rules. It's the administration's responsibility.

2) We want the system fixed!

• Start with a competent, and proven disciplinarian.

• Fix the security lapse on the laptops.

• Educate the kids on what criminal charges are all about. They don’t know, and don’t tell us that ignorance is no excuse; it is the schools responsibility to educate.

Translation: We broke the rules, but it's not our fault; the system is broken! Provide discipline, but don't charge us after we continue to abuse the computers after repeated discipline. Oh, also, High Schools are actually supposed to be law schools, don't ya know?

• Make it a policy that the parents must be pulled in and involved and proof of such to be in the file before the administration can take their computer related problems to the courts in the future. Come on this is an experimental program.

Translation: Put as much red tape as possible between us and our personal responsibility.

3) Make it policy that there is a back up plan other than felony charges for the kids who can not handle the temptations that laptops bring into their lives.

Translation: Whatever you do, don't dare charge us with a crime if we can't control ourselves.

Other schools and most parents know that the suspension of computer privileges is the most effective way to influence behavior. In short, do not force all kids to have to use the computers in order to get their education. There are at least 2 instances of the kids wanting to turn in the laptops and they were forced to take them back. They were eventually charged. This is wrong.

Translation: We're forced to use these computers, so whatever we do with them isn't our fault.

[Darth Wong]

This is one of my concerns about the file-sharing generation, their concept that it's not what's legal that matters, but what you can get away with.

Yeah, they should be more like the yuppie generation, which popularized turnkey divorce and the frivolous lawsuit.

[Chmee]

This is one of my concerns about the file-sharing generation, their concept that it's not what's legal that matters, but what you can get away with.

Yeah, they should be more like the yuppie generation, which popularized turnkey divorce and the frivolous lawsuit.

Fair enough, plenty of these kids learned a casual attitude towards legality from their insider-trading, junk-bond dealing, under-the-table campaign-financed progenitors ... unfair to blame the latest generation inordinately for this slide, so I'll just take the usual liberal course and blame Reagan.

[SyntaxVorlon]

A felony for computer system breaking and entering is one thing. But a felony for getting around the shitty security that schools put on their computers is another. Expelling them is one thing, but charging them with a felony and jailtime for a crime that in all fairness was fueled by curiosity and a security system with all the features of a crossword puzzle.
This is a definite overreation on the part of the schools, it's logically similar to charging a kid who changed the figures on the gradesheet with breaking and entering and fraud.

[Uraniun235]

This is one of my concerns about the file-sharing generation, their concept that it's not what's legal that matters, but what you can get away with.

First, why should it be what's legal that matters? One can quite legally destroy someone, if one has the power and the inclination; see McCarthy's communist witchhunt, or any number of frivolous lawsuits. Furthermore, adherance to unjust or unethical laws is itself unjust and/or unethical; see the segregation laws of the South.

Second, I'm pretty sure that "what you can get away with" has been around for a long time; the S&L scandals and the Watergate break-in seem decent evidence of that. I don't see anything new at all with the immoral conduct of the 21st century.

In the end it seems yours is just yet another "the youth will be the death of us" lament, one that has been sounded for over a thousand years and yet we still seem to be chugging along.

[Arthur_Tuxedo]

One of the foundations of any fair justice system is that the punishment is supposed to fit the crime. Charging a bunch of high school kids with felonies for getting around inept security to chat and look at dirty pictures is a severe abuse of that system. Just because someone "broke the rules" does not justify any and all punishment.

It states in the article that the school had exhausted their own internal discipline methods to no avail.

They most certainly did not, and even if they had, so what? Nobody said that you have to keep escalating punishment for minor offences if the current ones aren't a deterrant. You don't throw someone in jail for jaywalking no matter how many times he's done it.

The Kutztown Area School District begs to differ. It says it reported the students to police only after detentions, suspensions and other punishments failed to deter them from breaking school rules governing computer usage.

The article also states that the students were required to sign a code of conduct/acceptable use policy that contined warnings of legal action.

So what? The fact that underage kids signed something that says they can be legally prosecuted doesn't mean that the district should always prosecute for any of the listed offenses.

And the charge does apparently fit the crime:

computer trespass, an offense state law defines as altering computer data, programs or software without permission.

So this doesn't look like a case of the punishment being excessive.

You're trying to refute a criticism of an over-zealous application of a law by quoting the law.

Charging a person with a felony for installing chat programs and looking at dirty pictures when they weren't supposed to is ridiculous and excessive. The wording of the law doesn't change that, the number of times they were warned doesn't change that, and the fact that they signed a contract doesn't change that. The punishment does not fit the crime. Period.

[Xon]

So what? The fact that underage kids signed something that says they can be legally prosecuted doesn't mean that the district should always prosecute for any of the listed offenses.

A child can not enter any legally binding contracts, at all.

[Kamakazie Sith]

Possibly, but before I answer, I still need to know what the statute of limitations on computer tampering is.

Since it's a felony I'd imagine it being four years from the date it was reported to law enforcement.

[DrkHelmet]

Possibly, but before I answer, I still need to know what the statute of limitations on computer tampering is.

Since it's a felony I'd imagine it being four years from the date it was reported to law enforcement.

And if it was never reported?

[Kamakazie Sith]

You're trying to refute a criticism of an over-zealous application of a law by quoting the law.

Charging a person with a felony for installing chat programs and looking at dirty pictures when they weren't supposed to is ridiculous and excessive. The wording of the law doesn't change that, the number of times they were warned doesn't change that, and the fact that they signed a contract doesn't change that. The punishment does not fit the crime. Period.

They're being called the Kutztown 13 -- a group of high schoolers charged with felonies for bypassing security with school-issued laptops, downloading forbidden Internet goodies and using monitoring software to spy on district administrators

If they were just installing chat programs and looking at dirty pictures then I'd agree with you. However, they were spying on admins.

[Kamakazie Sith]

Possibly, but before I answer, I still need to know what the statute of limitations on computer tampering is.

Since it's a felony I'd imagine it being four years from the date it was reported to law enforcement.

And if it was never reported?

Then the clock isn't started.

Keep in mind some crimes don't have a statute of limitations, most of your violent crimes.

Also, as usual this can differ from state to state.

[sketerpot]

I see another issue here: the school's computer administrators are apparently incompetent, and make rules to compensate for their incompetence.

The first mistake is that the adminstrator password was taped to the computer. Students having the admin password is a bad idea. One of my friends in high school got all his files on the school's server deleted by some jackass student who got the admin password. One of those files was an assignment for a class which was due the next day. He wasn't the only one hit, either. As I said, students + admin passwords = looming disaster.

The second mistake is the sysadmins' inability to block ports other than common ones like 53 and 80 (DNS and HTTP, respectively). That would have made iChat useless.

Really, the people who should be feeling the heat here are the school's IT staff. The students deserve a slap on the wrist. I noticed something similar at my high school: when people started sending popup messages via Windows 2000's NET SEND command, the computer administrator passed a new (and very hard to enforce) rule: no more NET SEND use. The simple answer would be to turn off the messenger service on the machines, and this would have ended the problem. But instead, rather than looking to fix the problem, he passed a rule to cover for his incompetence, which other teachers had to enforce.