6 ms·

Suppose I walk into the neighborhood 7-11, and steal the money from the cash drawer when the cashier glances away. I'm only caught once the tapes are reviewed a

Suppose I walk into the neighborhood 7-11, and steal the money from the cash drawer when the cashier glances away. I'm only caught once the tapes are reviewed and they find my license plate. Should my punishment be to give a presentation to the cashier that they should be watching everyone at all times? Obviously the answer is no. Sometimes, catching someone breaking rules/laws after the fact is sufficient - 100% prevention of a crime before it happens shouldn't be the only way crimes are avoided. Did the school make some poor choices with their cybersecurity? Sure. But an open/unlocked door does not give permission to steal or break the law, whether that door is digital or physical.

leothecool 8y ago
Is it a mock 7-11 for educational purposes?
nkrisc 8y ago
Are you suggesting these kids are criminals and committed a crime? Because I don't really see the connection between theft and what this article is about. It sounds like this can be turned into a learning opportunity. Learning seems appropriate for a school setting as opposed to vengeful retribution. If, as you suggested, you commit theft, engagement with the criminal justice system seems appropriate, but maybe not if you rigged a school election.
- kemitche 8y ago
  I'm suggesting the students be punished in the same way as if they had cheated on a paper ballot election. Nothing more, nothing less. I don't think it's a stretch to think that HS students should know better than to cheat - whether that's on a test, or a school-wide election.
  - nkrisc 8y ago
    That's a fair point of view. However I think school should focus less on punishment and more on learning wherever possible. I'm suggesting that instead of punishment this could be opportunity for all to learn.
    - Gpetrium 8y ago
      A punishment can often be used as a form of learning. By punishing the individual, he gets a chance to better understand the costs associated with doing such acts. At the same time, if it becomes public enough (or teachers decide to anonymize and make it a use case), others may get a chance to see an example of what not to do. The case can also be used by the school and other entities to improve security, etc. The biggest loss of all would be to put it under the rug.
      - citrablue 8y ago
        Punishments are effective at teaching people to not get caught. They put the offender on the defensive, which is a hard place to learn the right lessons from.
        isoskeles 8y ago
        Oh okay, so a better way to correct the behavior would be... "Johnny it's really KEWL that you rigged the election, but it also made us sad. Please don't ever do it again."
        rmdashrfstar 8y ago
        Or, treat this student as an individual and a real person, learn to not talk so condescendingly about others, and encourage this person to make constructive and better use of their rare and unique intellectual capabilities and work ethic. You attract more flies with honey than vinegar. Good luck to the society whom discourages young outside-the-box thinkers and bright minds from pursuing intellectual passions within STEM. This is a huge problem in the US and it's culture around education.
        isoskeles 8y ago
        > Treat this student as an individual and a real person Treat everyone else as an individual and real person. If this were not what amounted to a pointless election and therefore a dumb prank, there could be real consequences. Some jackass screwed around with his high school election, sure, I don't think a severe punishment is in order. Suspension? Detention? Sure, whatever. You think that individual's individuality is supposed to somehow put him in front of everyone else affected by his actions? Or is it the fact that someone is interested in STEM, that makes them special? There is sometimes a victim of actions (in this case, other people running, other people voting). You write as if they don't matter or exist.
  - mieseratte 8y ago
    That is the kind of busy-body, authoritarian crap that makes children hate school. Kids are there to learn. Given him a talking to, ask him to give up the goods, and move on. Having been one of them high school hackers, and having been both threatened with jail and simultaneously being given the carrot of "don't do it again, and tell us what you know," the latter is going to produce a better outcome and if the student chooses to pick the former... well you gave them an honest choice. Most kids doing this aren't malicious, but just trying to learn and have some damn fun. If you just jump straight to the stick, you're just going to end up with a bitter kid with some cybersecurity chops. Not the greatest combination.
    - kelnos 8y ago
      I don't think I would characterize "attempting to steal a student election via unauthorized use of other students' accounts to commit voter fraud" as "trying to learn and have some damn fun". This was a malicious, dishonest act. Full stop. I think they're getting off easy: just being disqualified from the election and perhaps losing in-school computer privileges. That doesn't seem like it's going to teach them what they did was wrong. More likely it'll teach them to be better at not getting caught.
      - godelski 8y ago
        I mean Bill Gates phreaked because it was "fun". The people that do this find it fun breaking into systems. You need to understand who you're dealing with. And understanding the motives of preparators helps in how you should discipline them. At least effective discipline.
        mieseratte 8y ago
        > You need to understand who you're dealing with. And that's the point. You're dealing with smart, misguided youth with a literal hacker mindset. You'd hope this wouldn't need explaining on Hacker News, but here we are... Having been in this kid's shoes many beers ago, I technically committed major felonies. The District flipped a lid, mind you I'd been reporting vulnerabilities two years, when I gained access to their server with their financials and PII. Wasn't doing it because I wanted to sell my shit-heel English teacher's identity to Russian cybercriminals... no... I was having fun learning and discovering this fucking awesome world of computers. Those of y'all acting as if this kid if a real piece of work need to check your outlook. That is some real "get off my lawn" stuff. He's a high schooler, and capable enough to pull this crap off. Show him the right path, turn it into a teaching (it's school, y'all) moment, and if he doesn't want to walk the right path then who are we kidding, a detention isn't going to change that outlook anyway.
- ineedasername 8y ago
  Well, they didn't just rig the election. They did it by accessing their (apparently google backed) email accounts. If that happened outside of a school setting, there'd be no question that the person violated the law. So, yeah, they did commit a crime. Maybe it shouldn't be prosecuted, but it's still a crime.
  - hodgesrm 8y ago
    Plus they were dumb as posts to think it wouldn't be noticed. I'm surprised they weren't suspended. Word at Berkeley High is they got 300 "service hours."
- cm2187 8y ago
  It’s not a matter of legality but of honesty. They still committed fraud. It's like cheating at some exam. Might not break a law, but I wouldn’t hire them in a bank.
  - ilikehurdles 8y ago
    If I ran across a resume of someone who hacked a student election and a resume of someone who won it legitimately, I’d consider the hacker to be the more valuable and qualified applicant by a long shot for any STEM position. I am amazed that you have never done an unethical thing when you were a youth, but I know that my entire cs class in high school was finding exploits in the IT security structure and abusing them for fun.
- sfopdxnonstop 8y ago
  Nkrisk admits that their personal ethics allow unauthorized signing into hundreds of computer accounts for the purpose of committing fraud. That's very weak ethics.
radicaldreamer 8y ago
I’m getting deja vu around how Aaron Swartz was treated when he was charged. These are young people, who deserve leniency and opportunities to make mistakes and learn.
- kemitche 8y ago
  I'm being very careful to not proclaim _what_ I think the punishment/learning should be. I'll concede that my 7-11 analogy makes it sound like I'd push for a harsh punishment, though that's not my intent (and indeed, is detracting from my main point, which is that _the student made a large mistake_, on par with cheating on a test or worse, and there is a large amount of blame that belongs on that student's shoulders, regardless of how poor the cybersecurity of the voting mechanism was).
- mieseratte 8y ago
  You're not wrong, and in a just world that Swartz situation would have never even happened because we'd have a reasonable setup for papers. With that said, he was also an adult making a conscious decision to fight the system. TFA is still a minor, in high school.
- kelnos 8y ago
  These two scenarios are nothing alike. Swartz was an adult who decided to do something illegal that he believed was nonetheless moral and the right thing to do. (I agree with his stance, but doubt I would have the balls for such civil disobedience.) This HS student is a child who committed voter fraud in a student election for his own benefit. Nothing noble about that.
- friendlybus 8y ago
  He was given leniency, he didn't take it.
turtlecloud 8y ago
well perhaps the criminal can explain to the judge how society failed him or a rough traumatic childhood caused him to be this way. Also add in the presentation how easy it was for him to get a gun and how the cashier should have been automated. I do think cashiers will be an outdated job in a few yrs. I believe it is fairly simplistic to just say good/bad without understanding the nuances and shades of gray in between.
wongarsu 8y ago
An open door doesn't give permission to steal, but as any insurance will tell you the blame for the theft will fall on both sides: The justice system will find the thief guilty and punish him, and the insurance will find the shop owner guilty and punish him. If the security problem is more subtle than an open door it's not unheard of to consult the criminal, who may be given a lesser sentence or other freedoms for helping make everyone more secure. Of course in this case all of that is kind of moot. The rigging attempt was crude and quickly detected. Everything worked as it should, and while organizing an election brings a high burden of ensuring no manipulation occurs, everything was executed perfectly. The real problem was students not being forced to change their default password, which is akin to an open door, just from a different department.
floatingatoll 8y ago
In this analogy, the 7-11 is a student-run business, and so: Yes, the punishment should be precisely that.

leothecool 8y ago

Is it a mock 7-11 for educational purposes?

nkrisc 8y ago

Are you suggesting these kids are criminals and committed a crime? Because I don't really see the connection between theft and what this article is about. It sounds like this can be turned into a learning opportunity. Learning seems appropriate for a school setting as opposed to vengeful retribution. If, as you suggested, you commit theft, engagement with the criminal justice system seems appropriate, but maybe not if you rigged a school election.

kemitche 8y ago
I'm suggesting the students be punished in the same way as if they had cheated on a paper ballot election. Nothing more, nothing less. I don't think it's a stretch to think that HS students should know better than to cheat - whether that's on a test, or a school-wide election.
- nkrisc 8y ago
  That's a fair point of view. However I think school should focus less on punishment and more on learning wherever possible. I'm suggesting that instead of punishment this could be opportunity for all to learn.
  - Gpetrium 8y ago
    A punishment can often be used as a form of learning. By punishing the individual, he gets a chance to better understand the costs associated with doing such acts. At the same time, if it becomes public enough (or teachers decide to anonymize and make it a use case), others may get a chance to see an example of what not to do. The case can also be used by the school and other entities to improve security, etc. The biggest loss of all would be to put it under the rug.
    - citrablue 8y ago
      Punishments are effective at teaching people to not get caught. They put the offender on the defensive, which is a hard place to learn the right lessons from.
      - isoskeles 8y ago
        Oh okay, so a better way to correct the behavior would be... "Johnny it's really KEWL that you rigged the election, but it also made us sad. Please don't ever do it again."
        rmdashrfstar 8y ago
        Or, treat this student as an individual and a real person, learn to not talk so condescendingly about others, and encourage this person to make constructive and better use of their rare and unique intellectual capabilities and work ethic. You attract more flies with honey than vinegar. Good luck to the society whom discourages young outside-the-box thinkers and bright minds from pursuing intellectual passions within STEM. This is a huge problem in the US and it's culture around education.
        isoskeles 8y ago
        > Treat this student as an individual and a real person Treat everyone else as an individual and real person. If this were not what amounted to a pointless election and therefore a dumb prank, there could be real consequences. Some jackass screwed around with his high school election, sure, I don't think a severe punishment is in order. Suspension? Detention? Sure, whatever. You think that individual's individuality is supposed to somehow put him in front of everyone else affected by his actions? Or is it the fact that someone is interested in STEM, that makes them special? There is sometimes a victim of actions (in this case, other people running, other people voting). You write as if they don't matter or exist.
- mieseratte 8y ago
  That is the kind of busy-body, authoritarian crap that makes children hate school. Kids are there to learn. Given him a talking to, ask him to give up the goods, and move on. Having been one of them high school hackers, and having been both threatened with jail and simultaneously being given the carrot of "don't do it again, and tell us what you know," the latter is going to produce a better outcome and if the student chooses to pick the former... well you gave them an honest choice. Most kids doing this aren't malicious, but just trying to learn and have some damn fun. If you just jump straight to the stick, you're just going to end up with a bitter kid with some cybersecurity chops. Not the greatest combination.
  - kelnos 8y ago
    I don't think I would characterize "attempting to steal a student election via unauthorized use of other students' accounts to commit voter fraud" as "trying to learn and have some damn fun". This was a malicious, dishonest act. Full stop. I think they're getting off easy: just being disqualified from the election and perhaps losing in-school computer privileges. That doesn't seem like it's going to teach them what they did was wrong. More likely it'll teach them to be better at not getting caught.
    - godelski 8y ago
      I mean Bill Gates phreaked because it was "fun". The people that do this find it fun breaking into systems. You need to understand who you're dealing with. And understanding the motives of preparators helps in how you should discipline them. At least effective discipline.
      - mieseratte 8y ago
        > You need to understand who you're dealing with. And that's the point. You're dealing with smart, misguided youth with a literal hacker mindset. You'd hope this wouldn't need explaining on Hacker News, but here we are... Having been in this kid's shoes many beers ago, I technically committed major felonies. The District flipped a lid, mind you I'd been reporting vulnerabilities two years, when I gained access to their server with their financials and PII. Wasn't doing it because I wanted to sell my shit-heel English teacher's identity to Russian cybercriminals... no... I was having fun learning and discovering this fucking awesome world of computers. Those of y'all acting as if this kid if a real piece of work need to check your outlook. That is some real "get off my lawn" stuff. He's a high schooler, and capable enough to pull this crap off. Show him the right path, turn it into a teaching (it's school, y'all) moment, and if he doesn't want to walk the right path then who are we kidding, a detention isn't going to change that outlook anyway.
ineedasername 8y ago
Well, they didn't just rig the election. They did it by accessing their (apparently google backed) email accounts. If that happened outside of a school setting, there'd be no question that the person violated the law. So, yeah, they did commit a crime. Maybe it shouldn't be prosecuted, but it's still a crime.
- hodgesrm 8y ago
  Plus they were dumb as posts to think it wouldn't be noticed. I'm surprised they weren't suspended. Word at Berkeley High is they got 300 "service hours."
cm2187 8y ago
It’s not a matter of legality but of honesty. They still committed fraud. It's like cheating at some exam. Might not break a law, but I wouldn’t hire them in a bank.
- ilikehurdles 8y ago
  If I ran across a resume of someone who hacked a student election and a resume of someone who won it legitimately, I’d consider the hacker to be the more valuable and qualified applicant by a long shot for any STEM position. I am amazed that you have never done an unethical thing when you were a youth, but I know that my entire cs class in high school was finding exploits in the IT security structure and abusing them for fun.
sfopdxnonstop 8y ago
Nkrisk admits that their personal ethics allow unauthorized signing into hundreds of computer accounts for the purpose of committing fraud. That's very weak ethics.

radicaldreamer 8y ago

I’m getting deja vu around how Aaron Swartz was treated when he was charged. These are young people, who deserve leniency and opportunities to make mistakes and learn.

kemitche 8y ago
I'm being very careful to not proclaim _what_ I think the punishment/learning should be. I'll concede that my 7-11 analogy makes it sound like I'd push for a harsh punishment, though that's not my intent (and indeed, is detracting from my main point, which is that _the student made a large mistake_, on par with cheating on a test or worse, and there is a large amount of blame that belongs on that student's shoulders, regardless of how poor the cybersecurity of the voting mechanism was).
mieseratte 8y ago
You're not wrong, and in a just world that Swartz situation would have never even happened because we'd have a reasonable setup for papers. With that said, he was also an adult making a conscious decision to fight the system. TFA is still a minor, in high school.
kelnos 8y ago
These two scenarios are nothing alike. Swartz was an adult who decided to do something illegal that he believed was nonetheless moral and the right thing to do. (I agree with his stance, but doubt I would have the balls for such civil disobedience.) This HS student is a child who committed voter fraud in a student election for his own benefit. Nothing noble about that.
friendlybus 8y ago
He was given leniency, he didn't take it.

turtlecloud 8y ago

well perhaps the criminal can explain to the judge how society failed him or a rough traumatic childhood caused him to be this way. Also add in the presentation how easy it was for him to get a gun and how the cashier should have been automated. I do think cashiers will be an outdated job in a few yrs. I believe it is fairly simplistic to just say good/bad without understanding the nuances and shades of gray in between.

wongarsu 8y ago

An open door doesn't give permission to steal, but as any insurance will tell you the blame for the theft will fall on both sides: The justice system will find the thief guilty and punish him, and the insurance will find the shop owner guilty and punish him. If the security problem is more subtle than an open door it's not unheard of to consult the criminal, who may be given a lesser sentence or other freedoms for helping make everyone more secure. Of course in this case all of that is kind of moot. The rigging attempt was crude and quickly detected. Everything worked as it should, and while organizing an election brings a high burden of ensuring no manipulation occurs, everything was executed perfectly. The real problem was students not being forced to change their default password, which is akin to an open door, just from a different department.

floatingatoll 8y ago

In this analogy, the 7-11 is a student-run business, and so: Yes, the punishment should be precisely that.