School Caught Spying In Kids' Bedrooms With Laptops

[RedImperator]

Lower Merion Township's median family income was $115,694 as of 2000, and it's likely risen significantly since then. The school district's rich brat population is legendary. They can afford to issue laptops to every student, though I don't know if they actually give them away for free, assign them for a year like textbooks, sell them at a subsidized rate, or what.

[ShadowDragon8685]

What would you charge them with? In order to be charged with a crime they have to be in violation of an existing criminal statute. It is possible that they aren't in violation of any criminal statute.

Actually, the brief filed by the plaintiff's attourney alleges violations of 18USC; 2511, 2520, 1030, and 2701; 42USC; 1983; 18 Pa.CSA 5701; and the Fourth Ammendment of the United States Constitution.

Title 18 of the United States Code, by the way, is Crimes and Criminal Proceedure. So they're alleging violation of Federal law. They're also alleging violation of Pa. state law (the Pennsylvania Wiretpaping and Electronic Surveilance Act).

IANAL, but I'd still say that allegations of violations of the aforementioned statuettes are almost certainly criminally actionable offenses. I'm inclined to take the brief's word when it declares 'this court' (being the court they filed in) has jurisdiction over the plaintiffs' and class' federal law allegations as per 28USC 1131 and 1137 and the state law claims pursuant to 28USC 1367.

Unfortunately, the brief doesn't go into chapter and verse as to which heading of the many codes of jurisprudance it alleges violations of, or I'd go into chapter and verse about why they seem to have a damn good case. However, I will say that The Brief (PDF) is well, well worth the read.

I only checked a few of those, and some are criminal and others are civil. The criminal codes violated are 18usc1030, and 18usc2701. I couldn't locate 18 Pa.CSA 5701 (i didn't look too hard either).

FYI - Do you know how you can tell if something is a criminal code? You'll see a criminal penalty section which outlines what the possible penalties are and they will always include optional jail time or the degree (misdemeanor, felony).

So, your point is that...

Under 18USC 1030, "Fraud and False Statements," the culpable parties may be liable for a fine, a stretch of time as many as twenty years, and possible investigation by the FBI or, USSS,

and

Under 18USC 2701, "Stored Wire and Electronic Communications and Transactional Records Access," the culpable parties may be liable for a fine and up to a year in the big house (or 5, if they decide to count individual laptops as individual, consecutive violations).


Which... is to say that, yes, they are quite probably in violation of criminal statues as you originally asked.

@Bakustra: I can't find the section you cited as stating that civil proceedings take precedent over criminal ones. Can you point it out to me from 18USC 2511?

[Bakustra]

Update: Title 18, Section 1030 only applies to certain actions taken with unauthorized access, most referring to the US government or financial institutions, and none apply to private computers or state schools as far as I can tell. I am curious as to how this will play into the plaintiff's arguments.

Meanwhile, Section 2701 is unclear as to whether the material in question applies. If the school remotely accessed the webcam, and caught him "in flagrante delicto", so to speak, then the material does not count as stored under the act when it comes to the plaintiff. However, if the webcam was set to record automatically and save the materials for later access, then it would fall under 2701 for sure, but that seems incredibly unlikely, unless the plaintiff is computer-illiterate.

Lower Merion Township's median family income was $115,694 as of 2000, and it's likely risen significantly since then. The school district's rich brat population is legendary. They can afford to issue laptops to every student, though I don't know if they actually give them away for free, assign them for a year like textbooks, sell them at a subsidized rate, or what.

Ah. In the case of my school, the proposal was to assign laptops yearly, but then again, our rich brat population was practically nonexistent, being on the less flash side of Metro Detroit.

@ShadowDragon
My pardons, I misspoke. There are no criminal penalties under section 2520, which would apply to the crimes in section 2511. 2511's crimes are civil infractions rather than felonies or misdemeanors, presumably, much like a driving citation. Sec 2520 concerns itself primarily with guidelines for damages, as far as I can tell. When I wrote that I was only partway into the code and so naively assumed that there would be criminal sentencing guidelines within the section. Mea culpa.

[Soldier of Entropy]

I attend the high school of the neighboring Methacton School District (which does not give out free laptops), and know a few students in the Lower Merion district. I've asked them before about the laptop thing, and they replied that they get it free for the year, but that it goes back afterward. I can also confirm that the district is quite affluent.

Also, though I have not spoken to any of them yet today (and won't till Monday, at the earliest), I had not heard about this before reading it on SDN. It outrages me, obviously.

[Bakustra]

I attend the high school of the neighboring Methacton School District (which does not give out free laptops), and know a few students in the Lower Merion district. I've asked them before about the laptop thing, and they replied that they get it free for the year, but that it goes back afterward. I can also confirm that the district is quite affluent.

Also, though I have not spoken to any of them yet today (and won't till Monday, at the earliest), I had not heard about this before reading it on SDN. It outrages me, obviously.

That eliminates some of the vague openings I could see for criminal proceedings, since the laptop could be easily argued as owned by the school and lent out to the student. Now, this is not an argument that I support, and legally one could argue that students should have a reasonable right to privacy when outside of school grounds (i.e. while schools have jurisdiction beyond the campus, such jurisdiction is limited. They do not have the right to search your house freely like they can your locker.)

[ShadowDragon8685]

@Bakustra: thank you.


So, it looks like there's going to be precious little, if any, in the way of criminal charges filed.


Somehow that strikes me as monumentally wrong, when for reasons of profit or sabotage you can get the FBI booting in your door with submachineguns, but when flagrantly abusing power and authority in manners that horrifically violate the basic human rights of privacy, you don't get anything.

Frankly, I'd love to see the heavy end of the criminal justice system come down on these guys. Leaving it only to civil court seems... Inadequate; especially as, in this case, the defendant is a school district. Even if they get hammered with ten tons of fines, the ultimate victims are the students who now have no money to be educated with.

[Kamakazie Sith]

So, your point is that...

Under 18USC 1030, "Fraud and False Statements," the culpable parties may be liable for a fine, a stretch of time as many as twenty years, and possible investigation by the FBI or, USSS,

and

Under 18USC 2701, "Stored Wire and Electronic Communications and Transactional Records Access," the culpable parties may be liable for a fine and up to a year in the big house (or 5, if they decide to count individual laptops as individual, consecutive violations).


Which... is to say that, yes, they are quite probably in violation of criminal statues as you originally asked.

It seems like you are pointing out something that I had already identified. Which is why I said "The criminal codes violated are 18usc1030, and 18usc2701." in the post that you replied to. Bakustra already covered it, but citing that they are in violation of those codes seems like a substantial stretch without further discovery.

[Bakustra]

@Bakustra: thank you.


So, it looks like there's going to be precious little, if any, in the way of criminal charges filed.


Somehow that strikes me as monumentally wrong, when for reasons of profit or sabotage you can get the FBI booting in your door with submachineguns, but when flagrantly abusing power and authority in manners that horrifically violate the basic human rights of privacy, you don't get anything.

Frankly, I'd love to see the heavy end of the criminal justice system come down on these guys. Leaving it only to civil court seems... Inadequate; especially as, in this case, the defendant is a school district. Even if they get hammered with ten tons of fines, the ultimate victims are the students who now have no money to be educated with.

Remember that they are filing under a violation of the Constitution. That opens the way for a ruling concerning students' rights to electronic privacy outside of school grounds, which is likely to be in favor of the students. Case law can suffice where statutes fear to tread.

So, your point is that...

Under 18USC 1030, "Fraud and False Statements," the culpable parties may be liable for a fine, a stretch of time as many as twenty years, and possible investigation by the FBI or, USSS,

and

Under 18USC 2701, "Stored Wire and Electronic Communications and Transactional Records Access," the culpable parties may be liable for a fine and up to a year in the big house (or 5, if they decide to count individual laptops as individual, consecutive violations).


Which... is to say that, yes, they are quite probably in violation of criminal statues as you originally asked.

It seems like you are pointing out something that I had already identified. Which is why I said "The criminal codes violated are 18usc1030, and 18usc2701." in the post that you replied to. Bakustra already covered it, but citing that they are in violation of those codes seems like a substantial stretch without further discovery.

Reading through the brief, the two statutes are used as supporting arguments, but it is centered around 18-2511, 18-2520, 42-1983, and the Fourth Amendment. Those two are a bit of a stretch, mainly because they are primarily concerned with access to government-owned or financial institution-owned computers, but they are by no means central.

[Edi]

All this case does is highlight the absolute fucked-upness of the US legal system and the cavalier attitude toward information network security, proper data protection and privacy safeguards and a host of other things.

If the relevant laws are all civil in nature and depending on the conditions of the laptops being given out and disclosure of various features related to that, there is nothing that the plaintiffs can accomplish besides kick up a massive media storm of outrage. If they do have a case, they can probably get some compensation of some sort while the school district gets away with just egg on its face.

If some school here did that sort of thing, there would be jail time involved for everyone in the decision making chain and the actions described in the lawsuit would violate half a dozen laws that assess criminal penalties for such actions. But that's neither here nor there.

It'll be interesting to see what else turns up. What the school district did can be easily described as highly unethical, but whether or not it was illegal remains to be seen.

[Kamakazie Sith]

I wonder if the parents were asked to sign some type of agreement for use of the laptops. It would be interesting if they disclosed the surveillance ability of the computers, and stated something to the effect by agreeing to this you waive your right to privacy.

[Edi]

I wouldn't try to use the privacy argument alone too much. The defendants have grounds to contest that in that if the laptop was issued by the school for school and study related activities, they have the right to administer and monitor what it's used for. If it's used for something inappropriate that relates to the school, the plaintiffs are going to get sodomized in court. Just like you cannot expect to be able to use work email for private purposes and have it remain private under all circumstances, same thing applies here.

If you want to do private stuff, do it with privately acquired equipment. If the disciplinary action was for something that had no connection to the school and of no legitimate interest to them, the privacy defense may fly, but by virtue of the laptops being provided by the school, the privacy defense is inherently weak.

There could be more traction if such intrusion through a home internet connection without disclosure can be brought into play, but that will then rest a lot on the other relevant statutes.

[Kamakazie Sith]

All this case does is highlight the absolute fucked-upness of the US legal system and the cavalier attitude toward information network security, proper data protection and privacy safeguards and a host of other things.

If the relevant laws are all civil in nature and depending on the conditions of the laptops being given out and disclosure of various features related to that, there is nothing that the plaintiffs can accomplish besides kick up a massive media storm of outrage. If they do have a case, they can probably get some compensation of some sort while the school district gets away with just egg on its face.

If some school here did that sort of thing, there would be jail time involved for everyone in the decision making chain and the actions described in the lawsuit would violate half a dozen laws that assess criminal penalties for such actions. But that's neither here nor there.

It'll be interesting to see what else turns up. What the school district did can be easily described as highly unethical, but whether or not it was illegal remains to be seen.

I'd like to see those equivalent laws if you can link them or PM them to me. I hear about these types of punishments all the time, but I never get to see the actual documentation.

I think the reason why these types of laws are only civil in nature is because violating them doesn't cause any measurable harm beyond violating the law itself. It seems reasonable that the punishment would be money instead of ruining the lives of those involved.

[Edi]

I'll get back to you tomorrow. G'night.

[Bakustra]

All this case does is highlight the absolute fucked-upness of the US legal system and the cavalier attitude toward information network security, proper data protection and privacy safeguards and a host of other things.

If the relevant laws are all civil in nature and depending on the conditions of the laptops being given out and disclosure of various features related to that, there is nothing that the plaintiffs can accomplish besides kick up a massive media storm of outrage. If they do have a case, they can probably get some compensation of some sort while the school district gets away with just egg on its face.

If some school here did that sort of thing, there would be jail time involved for everyone in the decision making chain and the actions described in the lawsuit would violate half a dozen laws that assess criminal penalties for such actions. But that's neither here nor there.

It'll be interesting to see what else turns up. What the school district did can be easily described as highly unethical, but whether or not it was illegal remains to be seen.

It is almost certainly illegal under the sections (2511, 2520) cited, but it's a civil infraction, not a criminal one. There are criminal penalties, of up to a year to three years of imprisonment available under the other sections (1030, 2701), but those are unusual interpretations of the law, and so that is probably why no charges have been filed. Hopefully, this will become illegal under common law (judicial activism, if you're an angry idiot) with the court's ruling, since it is filed with a federal court.

I wonder if the parents were asked to sign some type of agreement for use of the laptops. It would be interesting if they disclosed the surveillance ability of the computers, and stated something to the effect by agreeing to this you waive your right to privacy.

The brief claims that the defendants did not inform the plaintiffs of the ability of the school to do so, nor the fact that it was being performed, until the November 11 disciplinary action which started this.

When it comes to the privacy argument, I would argue that the ability of the school to remotely access the webcam by its very nature violates privacy in a way that monitoring internet usage logs or file contents does not, one that, if I may be legalistic for a moment here, goes beyond the purview of the school's right to search and seizure, as the contents of the student's bedroom, study, or house in general cannot a priori be assumed to be within the purview of the school's right to search and seizure. After all, the school cannot search your house freely legally (or at all as I understand it), but with the webcam, they are able to do so.

[Qwerty 42]

Lawsuit: PA School District Using School-Issued Laptop Webcams to Spy on Students

February 17, 2010 by Jeff Schreiber
Filed under Featured Commentary

42 Comments

A class action lawsuit filed late yesterday in Federal Court in Philadelphia has shed light on a secret surveillance program targeting Americans, but this particular operation is not being run by the FBI or the NSA. It’s being run by the Lower Merion School District, in the old-money Main Line suburbs of Philadelphia, PA.

The complaint, filed by minor high school student Blake Robbins and his parents, alleges that the school district has been spying on the activities of students and students’ families through the “indiscriminant use of and ability to remotely activate the webcams incorporated into each laptop issued to students,” all without the knowledge or consent of any of the students or parents involved.

Through a one-to-one laptop computer initiative funded by state and federal grants, each of the approximately 1,800 students in the school district’s two high schools, Harriton High School in Rosemont, PA and Lower Merion High School in Ardmore, PA were issued a webcam-equipped personal laptop computer. The initiative, according to remarks by Superintendent—and defendant—Christopher McGinley on the district’s Web site, “enhances opportunities for ongoing collaboration, and ensures that all students have 24/7 access to school based resources and the ability to seamlessly work on projects and research at school and at home.”

What students and parents did not know, however, was that the 24/7 access goes both ways. According to the complaint, nowhere in any of the documentation accompanying the laptops or otherwise disseminated to students and parents was any reference made to the ability of the school district to remotely activate the webcam embedded in each laptop at any time, according to the district’s discretion.

How the capability was discovered should be enough to put any who value civil liberties and privacy on the edge of their seat. From the complaint (emphasis mine):

On November 11, 2009, Plaintiffs were for the first time informed of the above-mentioned capability and practice by the School District when Lindy Matsko, an Assistant Principal at Harriton High School, informed minor Plaintiff that the School District was of the belief that minor Plaintiff was engaged in improper behavior in his home, and cited as evidence a photograph from the webcam embedded in minor Plaintiff’s personal laptop issued by the School District.

It was only then that Blake Robbins’ father, Michael, verified from Assistant Principal Lindy Matsko that the school district did in fact have the capability of remotely activating the cameras embedded in the district-issued laptop computer wherever the computer may be situated and regardless of whether the student is using it, and that the school district could at any time choose “to view and capture whatever images were in front of the webcam, all without the knowledge, permission or authorization of any persons then and there using the laptop computer.”

The school district’s conduct, the plaintiffs allege, runs afoul of not only the Fourth Amendment of the United States Constitution, but also a laundry list of federal and state laws intended to protect the privacy of people and stored information alike. This includes the Electronic Communication Privacy Act, the Computer Fraud Abuse Act, the Stored Communications Act, §1983 of the Civil Rights Act, the Pennsylvania Wiretapping and Electronic Surveillance Act, and Pennsylvania common law as well.

In the complaint, the plaintiffs voice concerns as to any students or family members who could have been caught in “embarrassing and humiliating” situations, noting that “the laptops at issue were routinely used by students and family members while at home,” and that “many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, including, but not limited to, in various stage of dress or undress.”

Blake Robbins and his parents are represented by Mark Haltzman of Lamm Rubenstone LLC. Class members include any students who have been issued webcam-equipped personal laptop computers by the Lower Merion School District. The plainiffs are seeking punitive and other damages stemming from the school district’s invasion of privacy.

Robbins v. Lower Merion School District, case number 2:10cv00665, was filed in the United States District Court for the Eastern District of Pennsylvania on Tuesday, February 16, 2010.

Now, I can partly understand why the school would want to regulate the laptops that they issue. However, the school definitely crosses a line here, and if the plaintiffs want to bring out the big guns, could be looking at child porn charges, based on the article.

e: ah, shit, ignore me.

[General Zod]

All this case does is highlight the absolute fucked-upness of the US legal system and the cavalier attitude toward information network security, proper data protection and privacy safeguards and a host of other things.

If the relevant laws are all civil in nature and depending on the conditions of the laptops being given out and disclosure of various features related to that, there is nothing that the plaintiffs can accomplish besides kick up a massive media storm of outrage. If they do have a case, they can probably get some compensation of some sort while the school district gets away with just egg on its face.

If some school here did that sort of thing, there would be jail time involved for everyone in the decision making chain and the actions described in the lawsuit would violate half a dozen laws that assess criminal penalties for such actions. But that's neither here nor there.

It'll be interesting to see what else turns up. What the school district did can be easily described as highly unethical, but whether or not it was illegal remains to be seen.

I'd like to see those equivalent laws if you can link them or PM them to me. I hear about these types of punishments all the time, but I never get to see the actual documentation.

I think the reason why these types of laws are only civil in nature is because violating them doesn't cause any measurable harm beyond violating the law itself. It seems reasonable that the punishment would be money instead of ruining the lives of those involved.

Using the laptop's cameras to monitor the kids though, makes a very easy slippery slope into the realm of possible kiddy porn. The liability it would put on the school seems pretty massive in that regard.

[Bilbo]

I think the reason why these types of laws are only civil in nature is because violating them doesn't cause any measurable harm beyond violating the law itself. It seems reasonable that the punishment would be money instead of ruining the lives of those involved.

Don't you then run the risk of someone with sufficient financial assets to basically ignore certain civil laws because the fines are so small.

[CaptainChewbacca]

http://bbs.stardestroyer.net/viewtopic. ... 58&start=0

[Bakustra]

I think the reason why these types of laws are only civil in nature is because violating them doesn't cause any measurable harm beyond violating the law itself. It seems reasonable that the punishment would be money instead of ruining the lives of those involved.

Don't you then run the risk of someone with sufficient financial assets to basically ignore certain civil laws because the fines are so small.

In the case of civil suits, there are, beyond reparatory damages, punitive damages to take into account. That is how torts over spilled coffee reach fines of millions of dollars. Of course, that is a concern, and ideally there would be a criminal punishment applied to certain invasions of privacy and implied fraud such as those in this case, but those have problems with individuals being punished out of proportion to the magnitude of their crimes as well.

Congratulations. You have identified a significant flaw in the American judicial system.

[ArmorPierce]

Huh. My mom and aunt went to that high school, and so did my cousin, my grandmother worked there, and so do some of my grad school classmates. For all that, I don't know very much about the district or the administration, so I can't say if something smells funny about this. I'm not particularly surprised some administrator would get the bright idea to use webcams to spy on students at home, but I can't say if LMHS has those kinds of administrators.

As for "improper behavior at home", schools have always had some jurisdiction off their property and outside school hours. A fight between two students on a weekend could result in suspensions if it was related to something that happened in school, for example. There have been cases of students punished for things they wrote on their MySpace pages about teachers or other students. If it ties back to the school somehow, schools can and do get involved. However, there's also been a trend towards schools claiming broader and broader jurisdiction over students, including things which have no real impact during school hours.

I'm very interested to hear the school district's response.

Actually I heard just today that a judge ruled in favor of the student for making comments about a teacher at school on the facebook and stated it was protected under freedom of speech. How many judges have ruled in favor of the schools?

[Phil Skayhan]

To the question of any user agreement signed by the parents: even if it stated that the computer could be monitored any any time, I would argue the use of the webcam would not be monitoring the use of the computer but rather the computer user.

And apologies if this was answered before, but the identity as to who actually activated the webcam should be discernible via the security logs. Of course, this assumes that logs were properly kept and archived in the first place. But even if no, a decent forensic examination should reveal necessary details.

[Patrick Degan]

And apologies if this was answered before, but the identity as to who actually activated the webcam should be discernible via the security logs. Of course, this assumes that logs were properly kept and archived in the first place. But even if no, a decent forensic examination should reveal necessary details.

Oh, they have to be, in order to comply with a number of laws regarding the maintenance and preservation of public records, especially ones which might one day be subject to subopena in any future court proceeding.

[Phil Skayhan]

And apologies if this was answered before, but the identity as to who actually activated the webcam should be discernible via the security logs. Of course, this assumes that logs were properly kept and archived in the first place. But even if no, a decent forensic examination should reveal necessary details.

Oh, they have to be, in order to comply with a number of laws regarding the maintenance and preservation of public records, especially ones which might one day be subject to subopena in any future court proceeding.

Pure speculation on my part, but I would not be surprised if they were not configured in compliance but rather pulled out of the box, loaded/imaged with the software the school wanted and handed out and ditto for the servers at the school.

[General Zod]

Huh. My mom and aunt went to that high school, and so did my cousin, my grandmother worked there, and so do some of my grad school classmates. For all that, I don't know very much about the district or the administration, so I can't say if something smells funny about this. I'm not particularly surprised some administrator would get the bright idea to use webcams to spy on students at home, but I can't say if LMHS has those kinds of administrators.

As for "improper behavior at home", schools have always had some jurisdiction off their property and outside school hours. A fight between two students on a weekend could result in suspensions if it was related to something that happened in school, for example. There have been cases of students punished for things they wrote on their MySpace pages about teachers or other students. If it ties back to the school somehow, schools can and do get involved. However, there's also been a trend towards schools claiming broader and broader jurisdiction over students, including things which have no real impact during school hours.

I'm very interested to hear the school district's response.

Actually I heard just today that a judge ruled in favor of the student for making comments about a teacher at school on the facebook and stated it was protected under freedom of speech. How many judges have ruled in favor of the schools?

You mean this lawsuit?

Not every case involving student speech has been as cut-and-dried, though. Students don't have it as easy as those of us who are out of school when it comes to expressing their sometimes controversial views online, in part because anything that's even remotely school-related is usually argued as a disruption. (Add to this the fact that kids are usually not as guarded as Evans apparently was, and usually go further than necessary in expressing their distaste for school officials.)

For example, a federal judge recently ruled that a Pennsylvania school could suspend two eight-graders for creating a fake MySpace profile for their principal depicting him as a pedophile and a sex addict. Even though most of these activities are technically taking place while the students are at home, judges are finding themselves deciding with increasing frequency whether the activities qualify as "on-campus" when they target other students or teachers. At the same time, other judges have moved to protect student speech, such as one case where an Indiana student's online speech against a teacher was ruled constitutional despite being laden with expletives.

[Uraniun235]

And apologies if this was answered before, but the identity as to who actually activated the webcam should be discernible via the security logs. Of course, this assumes that logs were properly kept and archived in the first place. But even if no, a decent forensic examination should reveal necessary details.

Oh, they have to be, in order to comply with a number of laws regarding the maintenance and preservation of public records, especially ones which might one day be subject to subopena in any future court proceeding.

Ahh, which logs and records would these be? Are you guys seriously suggesting that a record needs to be made and preserved every time a school district employee accesses a district-owned computer, remotely or otherwise? Or just when they remotely connect to a webcam?

The latter will probably purely depend on what software they use. The former... doesn't strike me as likely at all, and not because of that district's record to date.