4 ms·

I thought I made my point quite easy to understand. Unauthorized access to anyone's account is not a harmless prank! This goes double for accessing the teacher

by ux-app 12y ago

I thought I made my point quite easy to understand. Unauthorized access to anyone's account is not a harmless prank! This goes double for accessing the teacher's account!! These are the facts that I have been addressing. At no point have I introduced hypotheticals that did not occur. The student accessed the teacher's account by guessing or shoulder surfing for the PW. This is unacceptable and should in no way be treated as a "harmless prank". Allowing this type of access does set a negative precedent which does open up a teacher to unnecessary risk! I'm not sure if you are being deliberately obtuse in regard to this simple point. This is a simple case of unauthorized computer access. In the adult world this is a criminal act. In the juvenile world the response should reflect the seriousness of the act. Your response seems to be "well.... kids will be kids and after all no harm was done". This is not how we educate ethical computer users. let me again! resate what I have already said. I am not saying that the student should be punished for any potential trouble he could have caused. The act of gaining access to another person's account by nefarious (which includes simple guessing of the PW) means is itself a serious issue which warrants a serious response. EDIT: From the article: "A student at a Tampa Bay-area middle school was charged with a felony cyber crime after gaining unauthorized access to a teacher's computer and changing the desktop photo." from Wikipedia http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act It seems rather cut and dried that under US law this teen was committing a federal crime by gaining unauthorized access to a school computer system (state school i'm guessing). Now agree or disagree with the law, it is what it is. I categorically do not agree that this matter should have been made a police issue. This is an unnecessary escalation of matters in my opinion. But your response of "harmless prank" is completely unreasonable and does not address the gravity of the situation.

jacquesm 12y ago
You're turning the whole thing upside-down. You make it as if the unauthorized access was the main theme here but in fact it was just a means-to-an-end in order to pull a harmless prank. Not unlike picking a lock to a classroom in order to make a drawing on the blackboard. Sure, picking locks is bad and in the adult world if you did it and you stole something behind the locked door you would be in real trouble. But for a 17 year old that's just another lightly taken obstacle and for someone in education it is rather surprising that you can't make that leap. It wasn't about the access, it was all about the prank. That the unauthorized access might be a bigger deal than the prank most likely did not enter into the mind of the kid and that's where the role of an educator would come in handy, but none seemed to have been present here. FWIW when I was that age I 'hacked' the school time administration so I could get more computer time (which was limited at something ridiculously low). If I did that today I'd probably go to jail or something like that, whereas the opposite happened to me, the guy that administered the system figured out that I knew the machine (a 'Prime') better than he did and asked me to plug the holes in the time administration system instead. And that was arguably a much more serious offence than what this kid did. Anyway, since you're assuming I'm being deliberately obtuse I'll bow out of the conversation here. Thank you for the exchange.
- ux-app 12y ago
  > Anyway, since you're assuming I'm being deliberately obtuse I'll bow out of the conversation here. Thank you for the exchange. If this offended you then I apologise. Since the beginning of this thread I have been arguing for a reasonable middle ground between - shrugging shoulders and saying "harmless prank" and - felony charge. To me this is such a reasonable position to hold that it seemed that you were arguing for the sake of it :) From your personal experience it's clear why you feel some solidarity with this student and helps me to understand your position better. As a teacher, the possibility of having my account compromised by any student (malicious or otherwise) poses such a potentially dire threat to my livelihood that simply letting this transgression slide would not be a possibility. As an educator, part of my duty is to prepare young people for the real world. Allowing unauthorised computer access to go unpunished is at odds with what society deems acceptable, particularly in the age of online banking etc. This kind of activity is criminal in the real world. Letting it slide in a school setting is teaching the wrong thing to our students, your own positive experience notwithstanding. Just to clarify, punishment in a school setting is very flexible. For some students simply asking that they write a well reasoned apology is sufficient. For others, maybe repeat offenders, suspension or in extreme cases even expulsion is the correct response. Unlike adult punishment (prison), in a school setting the goal really is rehabilitation and personal growth. Contrary to many 14 year old's view we are not the enemy. Pleasure chatting. All the best, Eli
  - zaroth 12y ago
    Entering the conversation very late, but IMO the potential for catastrophic results puts the onus on the school system and teacher to secure the computer. Administration and IT is absolutely responsible for providing adequate and proportional investment into the security of the computer systems based on the level of risk involved from a compromise. The required level of protection is commensurate with the risk. This is standard operating procedure for any kind of security assessment and deployment, whether it be physical or electronic security. The school system and teacher were both grossly negligent in protecting the computer system, and for example, in the case of a data breach (if the standardized state tests that were on the machine were stolen) I believe the school system and the teacher would both be partial liable for improperly securing the device. When an actual crime occurs, the punishment for the act should be proportional to the actual act. Not the potential for someone else with the same level of access to have done worse. E.g. Someone breaks into a house to steal a loaf of bread because they are starving. There were children sleeping in the house who could have hypothetically been kidnapped. We don't (or at least, shouldn't!) charge the bread burglar with attempted kidnapping or worse because children happened to be present but slept through the entire event. The potential for worse is a clear signal that the school system and the teacher are not doing enough to protect these devices. The problem here isn't the child changing the background image, it's the lax security of the computer systems. Stringing up the child for changing a desktop background is what's missing the forest for the trees. Seriously, thank the child for exposing a clear operational weakness in security controls, fire the current IT department head, and get someone competent to secure the systems. When a criminal act results in actual follow-on damages, then it is appropriate to charge the instigator. If our hypothetical bread burglar broke the lock, stole the bread, and then someone else came in through the open door and kidnapped the children, then absolutely the bread burglar will be charged as an accessory to kidnapping. But there's a clear line, you cannot stray into the hypothetical otherwise, there is literally no limit to the hypothetical damage which can be caused by any otherwise inconsequential act. E.g. Jaywalking could hypothetically cause a 10 car pile-up with major fatalities, but we don't charge jaywalkers with attempted manslaughter or even reckless endangerment unless there are specific confounding factors -- in almost all cases jaywalking remains a misdemeanor. What this kid did was exactly the jaywalking of "exceeding authorized access".

by ux-app 12y ago

jacquesm 12y ago

You're turning the whole thing upside-down. You make it as if the unauthorized access was the main theme here but in fact it was just a means-to-an-end in order to pull a harmless prank. Not unlike picking a lock to a classroom in order to make a drawing on the blackboard. Sure, picking locks is bad and in the adult world if you did it and you stole something behind the locked door you would be in real trouble. But for a 17 year old that's just another lightly taken obstacle and for someone in education it is rather surprising that you can't make that leap. It wasn't about the access, it was all about the prank. That the unauthorized access might be a bigger deal than the prank most likely did not enter into the mind of the kid and that's where the role of an educator would come in handy, but none seemed to have been present here. FWIW when I was that age I 'hacked' the school time administration so I could get more computer time (which was limited at something ridiculously low). If I did that today I'd probably go to jail or something like that, whereas the opposite happened to me, the guy that administered the system figured out that I knew the machine (a 'Prime') better than he did and asked me to plug the holes in the time administration system instead. And that was arguably a much more serious offence than what this kid did. Anyway, since you're assuming I'm being deliberately obtuse I'll bow out of the conversation here. Thank you for the exchange.

ux-app 12y ago
> Anyway, since you're assuming I'm being deliberately obtuse I'll bow out of the conversation here. Thank you for the exchange. If this offended you then I apologise. Since the beginning of this thread I have been arguing for a reasonable middle ground between - shrugging shoulders and saying "harmless prank" and - felony charge. To me this is such a reasonable position to hold that it seemed that you were arguing for the sake of it :) From your personal experience it's clear why you feel some solidarity with this student and helps me to understand your position better. As a teacher, the possibility of having my account compromised by any student (malicious or otherwise) poses such a potentially dire threat to my livelihood that simply letting this transgression slide would not be a possibility. As an educator, part of my duty is to prepare young people for the real world. Allowing unauthorised computer access to go unpunished is at odds with what society deems acceptable, particularly in the age of online banking etc. This kind of activity is criminal in the real world. Letting it slide in a school setting is teaching the wrong thing to our students, your own positive experience notwithstanding. Just to clarify, punishment in a school setting is very flexible. For some students simply asking that they write a well reasoned apology is sufficient. For others, maybe repeat offenders, suspension or in extreme cases even expulsion is the correct response. Unlike adult punishment (prison), in a school setting the goal really is rehabilitation and personal growth. Contrary to many 14 year old's view we are not the enemy. Pleasure chatting. All the best, Eli
- zaroth 12y ago
  Entering the conversation very late, but IMO the potential for catastrophic results puts the onus on the school system and teacher to secure the computer. Administration and IT is absolutely responsible for providing adequate and proportional investment into the security of the computer systems based on the level of risk involved from a compromise. The required level of protection is commensurate with the risk. This is standard operating procedure for any kind of security assessment and deployment, whether it be physical or electronic security. The school system and teacher were both grossly negligent in protecting the computer system, and for example, in the case of a data breach (if the standardized state tests that were on the machine were stolen) I believe the school system and the teacher would both be partial liable for improperly securing the device. When an actual crime occurs, the punishment for the act should be proportional to the actual act. Not the potential for someone else with the same level of access to have done worse. E.g. Someone breaks into a house to steal a loaf of bread because they are starving. There were children sleeping in the house who could have hypothetically been kidnapped. We don't (or at least, shouldn't!) charge the bread burglar with attempted kidnapping or worse because children happened to be present but slept through the entire event. The potential for worse is a clear signal that the school system and the teacher are not doing enough to protect these devices. The problem here isn't the child changing the background image, it's the lax security of the computer systems. Stringing up the child for changing a desktop background is what's missing the forest for the trees. Seriously, thank the child for exposing a clear operational weakness in security controls, fire the current IT department head, and get someone competent to secure the systems. When a criminal act results in actual follow-on damages, then it is appropriate to charge the instigator. If our hypothetical bread burglar broke the lock, stole the bread, and then someone else came in through the open door and kidnapped the children, then absolutely the bread burglar will be charged as an accessory to kidnapping. But there's a clear line, you cannot stray into the hypothetical otherwise, there is literally no limit to the hypothetical damage which can be caused by any otherwise inconsequential act. E.g. Jaywalking could hypothetically cause a 10 car pile-up with major fatalities, but we don't charge jaywalkers with attempted manslaughter or even reckless endangerment unless there are specific confounding factors -- in almost all cases jaywalking remains a misdemeanor. What this kid did was exactly the jaywalking of "exceeding authorized access".