Laptops

IT run amok: Pa. school allegedly spied on students via webcams

A federal lawsuit claims that officials from a Pa. high school have been spying on students through the webcams on their school-issued laptops.

Figure A

Earlier this week, I published a TR Dojo episode on using Prey to recover stolen laptops. This free application allows individuals to collect information that can describe a stolen machine's whereabouts, such as the status of the computer, a list of running programs, network and Wi-Fi information, a screenshot of the running desktop, and a picture of the physical surroundings (if the machine has a webcam). It's this last piece of information that can be extremely helpful, but also the most controversial.

On Tuesday, a federal lawsuit was filed against the Lower Merion School District in Ardmore, Pa. accusing school officials of spying on students at Harriton High School through the webcams on school-issued Macbooks. By Wednesday, the story had exploded across the Web and been picked up by local and national media outlets.

According to an Associate Press report published by CBS News:

Lower Merion School District officials can activate the webcams without students' knowledge or permission, the suit said. Plaintiffs Michael and Holly Robbins suspect the cameras captured students and family members as they undressed and in other embarrassing situations, according to the suit.

How did the plaintiffs find out about the school districts ability to remotely activate the webcams? Here's another excerpt from the same AP report:

The Robbinses said they learned of the alleged webcam images when Lindy Matsko, an assistant principal at Harriton High School, told their son that school officials thought he had engaged in improper behavior at home. The behavior was not specified in the suit.

"(Matsko) cited as evidence a photograph from the webcam embedded in minor plaintiff's personal laptop issued by the school district," the suit states.

Matsko later confirmed to Michael Robbins that the school had the ability to activate the webcams remotely...

The Philadelphia Inquirer posted a complete text of the suit (PDF document).

It's important to note that the activities outlined in the lawsuit are still accusations and have not been proven in a court. And although Christopher McGinley, the superintendent of Lower Merion School District, admitted that district personnel could remotely activate the webcams, he asserted that such action was only taken to recover a lost or stolen machine.

In a letter sent to parents and posted on the school district's Web site, McGinley wrote:

Upon a report of a suspected lost, stolen or missing laptop, the feature would be activated by the District's security and technology departments. The security feature's capabilities were limited to taking a still image of the operator and the operator's screen. This feature was only used for the narrow purpose of locating a lost, stolen or missing laptop. The District never activated the security feature for any other purpose or in any other manner whatsoever.

And on Friday, the AP reported that, Doug Young, a spokesman for the Lower Merion School District, said that district personnel "remotely activated webcams 42 times to find missing student laptops, but never did so to spy on students, as a lawsuit claims." Young also told the AP "that only two technology department employees were authorized to activate the cameras — and only to locate missing laptops."

Spying or hardware monitoring?

These were school-issued machines and, according to reports, students and parents signed agreements to use the machines appropriately. According a CNN report:

To receive the laptop, the family had to sign an "acceptable-use" agreement. To take the laptop home, the family also would have to buy insurance for the computer. In an "acceptable-use" agreement, the families are made aware of the school's ability to "monitor" the hardware, [Young] said, but it stops short of explicitly explaining the security feature.

And, I would expect no less. IT departments having been using acceptable-use policies for decades, and I think most end users are aware that their activity on a company/institution-owned computer can be monitored. However, I believe most reasonable people (both IT professionals and end-users alike) would interpret "monitoring" to include scanning files on the hard drive, looking for unauthorized applications, and perhaps logging the Web sites accessed through the machine's browser. I find it nearly impossible to believe a reasonable person would assume "monitoring" meant remotely activating a Web cam and taking pictures inside an individual's home.

Unfortunately, there's still a lot we don't know about this case, and there are direct contradictions in the school district's statements and the claims of the plaintiffs and even other students. Various news outlets have quoted Harriton High School students who claim that their Macbook webcams would turn on at random times and without any action on their part. Furthermore, according to a Gizmodo report, when students reported the webcam activations, district IT personnel said the behavior was a technical glitch.

IT/management run amok?

I've been in IT for nearly 15 years and seen plenty of poor decisions, bad behavior, and even a few cases of true legal violations by IT personnel. But if these allegations are true, this episode takes the cake. And, I can't wait to learn the answers to several important questions.

First, were the webcams EVER activated outside the 42 instances of lost/stolen laptops mentioned by Young? The Lower Merion School District seems to be saying no, while, according to students, district IT personnel have said the camera could be activated due to a technical glitch. Which is it?

Second, was an image taken from a webcam used as evidence as described in the lawsuit. If so, what was the justification for taking such a photo? Had the laptop been reported lost or stolen?

Third, if the cameras were being activated, who was doing the activating and why? Were IT personnel secretly spying on students? Were administrators instructing IT personnel to activate the Webcams when they suspected students were involved in "inappropriate behavior?"

Lastly, did anyone involved in the decision making process which led to the installation of the monitoring software think this was a bad idea? Didn't anyone think parents and students should be told they might be photographed without their knowledge--even if it was by accident?

Watching this play out in the courts

As of this posting, the Lower Merion School District has said it is immediately disabled the tracking system, performing a "thorough review of the existing policies for student laptop use" and reviewing "security procedures to help safeguard the protection of privacy, including a review of the instances in which the security software was activated."

Will this be enough to satisfy parents and students? Would it satisfy you?

About

Bill Detwiler is Managing Editor of TechRepublic and Tech Pro Research and the host of Cracking Open, CNET and TechRepublic's popular online show. Prior to joining TechRepublic in 2000, Bill was an IT manager, database administrator, and desktop supp...

221 comments
seanferd
seanferd

http://www.techdirt.com/articles/20100504/1656459301.shtml Nice, the district gets to hire its own lawyers to perform the investigation. The lawyers say school administration wasn't involved in any wrongdoing (just those pesky IT guys) despite all the evidence they came up with that administrators found playing with the system to be amusing.

HAL 9000
HAL 9000

Apparently not only did the school request that students be tracked for a variety or stated reasons but apparently it appears that Web Cams where not only activated but left running for days at a time capturing pictures from their Web Cams every 15 minutes according to this Article http://www.infopackets.com/news/security/2010/20100426_school_issued_laptops_spy_on_students_capture_56000_images.htm Now maybe 1 picture of a kid sleeping in it's bedroom is acceptable [b]maybe[/b] but having photos taken every 15 minutes for even a few hours let alone days at a time certainly is not acceptable in my books and very much sounds as if there is [b]Sexual Abuse of Children Involved[/b] by those responsible at the school. From my reading of this article apparently there where only 2 employees who could turn the Web Cams on or off but anyone could make this request to get the Web Cams turned on and then the list of people who could view the pictures seems to be unlimited within the School Staff. This is highly suspicious activity to me at least I'm wondering what otters think. Col

donstrayer
donstrayer

The Richmond Times-Dispatch recently reported that the Henrico County school system also does this, but with a big difference. Henrico issues a laptop to each elementary school student. Students are not permitted to take their laptops home (Maybe they should rethink that one). Cameras are administratively disabled and cannot be reactivated by the student, but the sys admin can do it remotely. They use this feature only to attempt to find missing laptops, and only when there is an on-going, documented criminal investigation. This seems like a reasonable and legal approach, not an invasion of privacy.

krampus
krampus

What I'd like to see is a hardware on/off switch for the built in web cams. Many laptops have wireless on/off switches already. I have a small smiley face sticker on mine until I need it.

Greenthinks
Greenthinks

what about the guy at some university that was so helpful in fixing young co eds computer problems and was recently dicovered to have installed some east europeans web cam spy program ? whereupon they were recording the young womens bedroom activities for porn site use. Anybody involved with this school situation should be federaly charged under the child porn statues! george orwell

DadsPad
DadsPad

Government entities are dealing with adults who are expected to be responsible as adults. Public schools are for the benefit of minors. This was done for a high school. Several points: 1. Having a laptop to bring home is a good thing, not bad. My assumption is that they brought the laptop to school every day and back home, able to do homework and assignment, talk to teacher, etc, all on line. Why is that not a good thing? 2. The great majority of school employees are dedicated and responsible people. I know of no school that has a large percentage abusive to minors, only exceptions. 3. Zero tolerance policies. Originally applied to weapons, violence and drugs have, in places, expanded to cover other things, like bullying and yelling at teachers. I wonder if this was evolved? Maybe some people that live near Harriton High School, can tell us more about it. 4. We need to apply innocent until proven guilty to any legal argument. We do not know all circumstances involved. That said, I believe strongly in privacy in the home, both with government and private industry. The exception being military, you give up a lot of rights when you join. 5. Many high schools use bright students in their IT department, sometimes they are overseen by a technology teacher, other times the students are trusted. A good place to find passwords, change grades, etc., lots of temptation when minors often do not see the consequences to their actions. 6. We are IT people, knowing how computers are broken into, information stolen, etc.; most of the parents do not. The kids are more into technology and how to use it. The article said the kids reported how many times their cameras are activated without them using it, could their parents? Parents are very protective of their children, as we should be. That is one of the reasons this is given such heated debate. If the child takes the computer back to school each day, that is where information can be gathered when plugged into the network, in the background. If the student did not bring in the laptop, it can then be located to see if stolen. No need to turn on a camera.

ITsteve13
ITsteve13

Wow! Talk about an invasion of privacy. This is horrific.

user support
user support

see URL - http://www.auditorgen.state.pa.us/Department/Press/WagnerFaultsDeptEdForAdminDefic.html one of the recommendations is - The (Pa) Department of Education should establish minimum security measures and require districts to comply with those measures. URL for Pa Dept of Education Classrooms of the Future - no security policies found here Here is the technology page for The Pennsylvania Charter Cyber School - http://www.pacyber.org/students/technology.aspx one of the public school competitors to traditional Pa bricks and mortar public schools. If you want control of your pc or laptop, go out and buy your own. As a parent you should still follow some family safe rules for computer usage. If you opt to take the computer or laptop offered by the school paid for by taxes or grants, then you will have to abide by their rules. Not sure how a webcam and associated software "prey" was chosen to monitor laptop. Several years ago, "lojack" for locating stolen cars was also made available for laptops. There are also programs like Safeboot available which is not a monitoring program but can encrypt hard drive and contents from prying eyes.

The_Dragonlaird
The_Dragonlaird

Whilst the article raises some interesting points, the associated survey could be embellished. I suspect many will vote "No" to the vote simply due to the inclusion of the "acceptable use" condition. It would be interesting to see how many people would consider it acceptible if the "acceptable use" expressely stated that webcam monitoring etc was included. Indeed, this could even open up a whole questionaire about such activities to see just how far people will accept monitoring of their equipment, including internet use, installing illicit programs etc.

user support
user support

For the last several years there has been a legislative battle in Pa between the entrenched Pa School Board Assn and Teachers Union as technology has given rise to a number of cyber charter schools. Most younger students in the cyber charter schools get a desktop computer but students in senior high school can get laptops. Gov Rendell proposed to all Pa schools to embrace technology and give all students laptop computers so they can learn at any time. This was several years ago. The bricks and mortar public schools are not as advanced in technology as the cyber schools so they are re-inventing themselves and re-inventing the wheel. Thankfully this is happening to Lower Merion which is an affluent area of Pa. Hopefully the Philadelphia school district will be able to learn and not make the same mistakes when funding for laptops comes their way.

Erich61
Erich61

Hmmm seems to be that the voyeur is going to have fun reading and thinking of this blog for sure lol. A new fun and exciting way for peeping toms to get to play. you bet its going to be or already is hacked lol the possibility's are just to enticing for kids and adults

dwdino
dwdino

First, "Buyer beware". When accepting this laptop, you understand you are using anothers system and resources. Do nothing there on or with that you would not like the original owner or loaner to find out about. A question that I have not heard ask is what guidelines or expectations were communicated? Were these systems only for "homework"? Were they 'OK' for general and convenience use? Second, I am not sure that this is illegal. I believe it was foolish and will have great repercussions. The choice to exercise such capabilities brings with it a great responsibility. But, at the same time, the school expressed a level of control and management should be expected. Our coporate policy is a little stronger. We actually record every activity on our systems along with screen shots. We can visually see what an employee does and replay their activities at any point in time. If you review your bank statement on your work system, so can we. Now, this is not open for on-demand review, a request and justification must be submitted. A lot of this will fall directly on the communication, both oral and written, associated with the receipt of these systems. If all parties agreed to oversight and management, then there is no complaint. If a certain level of "privacy" was communicated, then their may be grounds.

NotSoChiGuy
NotSoChiGuy

...for this to become a case where the school board blames a 'perv in IT' vs. the IT guy saying he was doing as he was told? 1 week?? 1 month?? I'm pretty sure that this isn't going to help the Pennsylvania state budget deficit in any way.

PoppaTab
PoppaTab

After looking at the video of how to set up Prey by the author; It seems that intention is totally at fault. BTW, I just saw on CNN about the vice-principal reporting to the child's mother that said child was using drugs. The parent stated it was Mike&Ike candy. News does spread! I believe the Prey has to have the laptop reported as stolen to the online service or have the web page removed that Prey contacts to get the information. An email address has to be provided for the information (cam pic, etc.) to be sent to. Either the laptop has to be reported as stolen or the web page Prey contacts has to be removed (in my understanding of the video). Anyone with access to the given email address would seem to be in a very deep pool of hot water. From what I understand; Prey had to be activated which shows motive. If this software can be used on desktop machines; there will be a veritable orgy in unscrupulous use of Prey. Prey will be a tool of huge use to perverts, untrusting marital partners, and any person that can get the software installed on someone's machine. Prey is going to be a very wanted software for all the wrong reasons. edited for clarity of reading

jck
jck

A school provides hardware and software at taxpayer expense, but has no right to make sure it is not being used inappropriately. A corporation provides a worker with hardware and software, and has any right they want to monitor and paruse it as they wish. There is a discontinuity here. Are we saying that unregulated monitoring by business is okay of their assets, but that monitoring by school-appointed personnel of taxpayer-funded assets is not? Besides, I would not let my child use a "school-issued" computer. I'd buy them their own, and regulate what software is appropriate within *my* home for *my* children.

Ed Woychowsky
Ed Woychowsky

Andy Warhol never guaranteed that your fifteen minutes of fame would be good. You might want to consider practicing the line; "You want fries with that?"

seanferd
seanferd

Let's see how that works out for them.

john.lamb
john.lamb

Interesting/scary! Thought experiment... Go into the business of ripping off notebooks. Break audit trail by doing re-installs. Prey or any other suchlike need to be installed to work.

BruceAnd
BruceAnd

If you have Adobe's flash player on your camera fitted laptop, Adobe and presumably any of Adobe's flash cookie customers can operate your camera anytime they want to. I'm surprised no one has brought this up in the discussion.

HAL 9000
HAL 9000

Apart form the evidence there is no evidence but as usual the scape goats are the ones lowest on the food chain the IT Staff who where told what they had to do. Great to see Free Enterprise getting exactly what it wants and this is how Pedophiles get protected by the system. Col

JohnMcGrew
JohnMcGrew

It was like a window into "a little LMSD soap opera," a staffer is quoted as saying in an e-mail to Carol Cafiero, the administrator running the program. "I know, I love it," she is quoted as having replied. And every day, we give them more rope to hang us with.

AnsuGisalas
AnsuGisalas

...that angle has to be investigated too. I mean, even if it turns out there's just some inane "war on drugs" reason for it, there's still the possibility of someone with access taking advantage of it on their own. But anyway, the whole thing stinks. And really, the police aren't even allowed to pull that kind of crap. They not allowed to use improperly obtained evidence, so this case of a school official giving himself that kind of power under the guise of a signed agreement's vague general wordings, that's just preposterous.

Deadly Ernest
Deadly Ernest

web cam on their home computer - they put a sock on it when not in use.

Ed Woychowsky
Ed Woychowsky

It's more likely that some school districts will treat technology as evil and avoid it altogether. Though some school districts will try a variant of what the Lower Merion School district has done, but they'll give it an innocuous name. Graduates of the first type of school district will be unprepared for the twenty-first century, while those from the second will find their tax dollars paying for the school district?s lawyers.

HAL 9000
HAL 9000

I've yet to find any state on this planet that see's spying on children in the privacy of their bedrooms as acceptable. Well I suppose there could be a state run by Pedophiles who has legislated this as acceptable and there could even be small businesses who do this however I think you'll find that the majority of Business and State's Would find this idea reprehensible and be questioning those who are involved in it as to what their intentions where. As for Business if they where to make their Standard Practices known to the public doing this type of thing they would very quickly not have any customers. Not a good role for Business to admit that they are Child Abusers so that's why only small ones who specalize in this to Select Groups do it. It's also why the Worlds Police Departments try so hard to catch and stop them. It's one thing to want to recover a lost/stolen/misplaced NB it's another thing to be actively spying on Children when they are at home. Here to me at least from what was submitted to the Courts the School is guilty of what is claimed and those involved in Monitoring Students just the same as those involved in Monitoring CCTV Video Feeds from Public Areas who misuse their positions to get their Jollies need to be pursued to the full extent of the LAW. [b]Pedophilia is never acceptable no matter what the claimed Justification of this action was.[/b] Col

PoppaTab
PoppaTab

Prey FAQ: Quote: "What about my privacy? What do you guys do with my data? Nothing ? trust us. And even if you don?t, you can check the source code and make sure that Prey is doing nothing weird in your computer. The info is gathered and the report gets sent directly to its destination. Now if you?re using the control panel you must know that your device reports are accessible to you and you only. Not even us can access the reports since each device gets its one unique key which only you have access to. You can also safely delete any reports you want from your devices, no evidence left." Unquote This is very bad advertisement because it is a strength that no evidence of the report can be found by deleting. We all know it goes a bit further that simple deletion. These folks are telling the public they have a spy tool that works well and have no retribution as long as you delete the evidence. This is why I said this program should not be available to the public. The anonymous usage of this program is a selling point! edited for clarity

Deadly Ernest
Deadly Ernest

1. the equipment is being loaned to kids, not adults - totally different levels of expectations and responsibilities on both the loaner and borrower. 2. The method of tracking, how it's controlled, and what the borrowers are told. 3. Is something I only found out today. One of the other posts has a link to where a blogger has done a lot more research, and the frightening things is the kids borrowing the laptops are NOT allowed to use their own computers to do the school work, and they are REQUIRED to have the computers to do certain subjects. This is not a voluntary loan, but a forced usage - and that makes a huge difference.

darpoke
darpoke

- in principle. In reality things are rather different, I feel. Firstly, while unfettered corporate control over business hardware in private hands may be morally or ethically justifiable, when performed on students by a school board, it quite clearly is not. Secondly, I would venture the opinion that an adult working for a company is far better able to grasp (a) the concept of a reasonable expectation of privacy and to what this extends, not to mention (b) in what ways this privacy may conceivably be infringed upon through technology pre-existing or installed on the device. It is also less reasonable to expect that a child may be relied upon to restrict use of the device merely to the proscribed situations laid out in any contractual agreement. To expect that they do so, even under parental guidance, feels tantamount to entrapment IMHO. Lastly I'd like to humbly suggest that your home environment may not be something every child has access to. Many parents cannot afford to buy a laptop or computing device for their child - for these households a state-provided laptop is the only opportunity for the child to have access to one, and they ought to be able to trust the safety of using such a device. In the same way not all parents are capable of distinguishing what software is 'appropriate' for their child in the same way that most parents rely on experts to medicate or educate their children. They should not be penalised for depending upon the state-provided service to do so on their behalf, particularly when such a service is funded with their taxes. This is the very purpose of our societal model. It ought to be honoured.

HAL 9000
HAL 9000

Available and these will be used not Prey as it's not for the type of application that Government Departments and Quasi Bureaucrats use. Even replacing the HDD in a case like this will not stop the software from tracking the Stolen NB. But if you want to prove this just go ahead and try it, then see what happens. :D Col

Deadly Ernest
Deadly Ernest

although this sounds like and ideal story for a flasher.

seanferd
seanferd

I'd like to see a court tell them to stuff their investigation, as they occasionally do. Not betting on it, though.

HAL 9000
HAL 9000

And that comment by itself shown just how stupid that these people are doesn't it? To be able to watch something like this and not have alarm bells clanging away needs investigation as well. ;) Col

JCitizen
JCitizen

like video hooks. Or maybe it does? Oh well, that XP thing is going away anyway. Maybe Prevx?

jck
jck

That is sad, the #3 part. If it were private education and it was known upfront I could understand. If this is public school, then I would say that's not right. Besides, I would not do or allow my children to do research-type school work on a public school computer anyways. By law (in most parts of the country here), public property used to design, conceive, create or instantiate other property or substantive process or means becomes property of that body of government. That's why all my college computer homework was done on my home PC, and then uploaded and compiled on the school machine. I wasn't about to let the state have intellectual right to the labors and effort of my creativity and talents for training I paid for to them.

jck
jck

I agree with your points somewhat. However, I work for government. If they provide me a laptop to use for situations of working at home, they also have the right to monitor all functions of the hardware use...including the webcam. In principle, I agree children need to be protected from intrusion by rogue or unsavory elements. However, I think that the best solution to the situation would be for the computers to have their camera disconnected electronically. This way, there is no fault for misuse of such a device either by legitimate or rogue means. I also agree that no one should be punished for being poor, but the fact is that legally the laptop *is* state property. Hence, any harm done unto that child can inevitably be held against the state and not the child who was misusing it or the parents who were negligent in not teaching their child responsible/legitmate use. But, I also think that I deserve no less respect of my privacy than a child or an elderly person. If I want to sit at home in my boxers wearing my Burger King paper crown and eating fish sticks while I work, it should be no one else's right to know what I'm wearing. Hence, the private sector should be restrained from invading my privacy just like the state is kept from invading the home privacy of a child and/or their family.

john.lamb
john.lamb

Ahh - very cool. I should have checked this out before making a splash.

ankit22286
ankit22286

i try hard to unisttal DeepFreezeSTDEvaluation but not any icon in my systam to uninsttal it .only one hide condition icon is sowing in task bar and when i restarte my systam one password requriment.for that

NickNielsen
NickNielsen

:-& :-& :-& Did you have to do that?

JohnMcGrew
JohnMcGrew

It is a very disturbing insight into the kind of people entrusted to educating our children. If she is supposed to be the "leadership", one can only guess how bad the rest of the school is.

HAL 9000
HAL 9000

Has been moved from the Naughty to Nice List for this week at least because of this notification. Oh did I mention that I start with everyone on the [b]Naughty List[/b] and their actions denote how soon they go out the Airlock. :^0 :D Col 0:-)

Deadly Ernest
Deadly Ernest

an elevator to the airlock, they just climb in and you run them up and out in the one go - just one zip, and they're gone. Shades of Mortein, quick disposal.

seanferd
seanferd

I thought it wise to bring it to you attentions now, rather than be asked later on why I did not... :^0

HAL 9000
HAL 9000

They didn't even ask my permission to use my image. :( Now there is another person to add to the list to open a Air Lock on. :^0 Actually they get elevated tot he top of the list. :D Col ;)

JCitizen
JCitizen

Whether the evaluation edition would be different, I rather doubt. [b]10. Deep Freeze is installed on my computer. I would like to uninstall it. How is this done?[/b] Disable Deep Freeze before uninstalling it. To disable Deep Freeze: 1. Hold down the shift key and double-click the Deep Freeze icon. Alternatively, you can press CTRL+ALT+SHIFT+F6. 2. Enter your password and click OK. 3. If you have not yet entered a password you should be able to click OK without entering a password. 4. The Boot Options dialog is displayed. Select "Boot Thawed" and click OK. This will disable Deep Freeze on the next reboot. 5. Reboot your computer. After the computer reboots, you are ready to uninstall Deep Freeze. To uninstall: 1. Locate the installation file you used to install Deep Freeze on your computer. By default, the name of this file is called "DF5Std.exe" for versions 5.X and "DF6Std.exe" for versions 6.X. 2. Run the installation file (DF5Std.exe or DF6Std.exe). 3. Select the option to "Uninstall" Deep Freeze is uninstalled and your computer is rebooted. [i]This from the Faronics web site FAQ; I assume it is Windows OS agnostic.[/i] Hope this helps :)

HAL 9000
HAL 9000

The easy answer here is to Wipe and reload. Deep Freeze isn't a piece of software that you can uninstall it makes massive changes to the HDD as it goes on. These changes [b]Can Not[/b][ be undone by a simple uninstall process. Col

JCitizen
JCitizen

I really appreciate that! I took my PC down when this came out!

JCitizen
JCitizen

non-standard emoticons to work like his! I haven't been able to get HTML to work in TR posts for quite a while. Unless TR published a new list, and I missed it. I'm still using the old one maybe? I used to be able to publish gif animations on here, but no dice.

darpoke
darpoke

I flashed the DVD-RW drive in my Mac Pro the other day (it now burns DVD-ROM booktype discs, much more universally compatible). And I'm getting tired of you dragging my good natured act through the mud ;-)

Editor's Picks