5 ms·

> Anyway, since you're assuming I'm being deliberately obtuse I'll bow out of the conversation here. Thank you for the exchange. If this offended you then

by ux-app 12y ago

> Anyway, since you're assuming I'm being deliberately obtuse I'll bow out of the conversation here. Thank you for the exchange. If this offended you then I apologise. Since the beginning of this thread I have been arguing for a reasonable middle ground between - shrugging shoulders and saying "harmless prank" and - felony charge. To me this is such a reasonable position to hold that it seemed that you were arguing for the sake of it :) From your personal experience it's clear why you feel some solidarity with this student and helps me to understand your position better. As a teacher, the possibility of having my account compromised by any student (malicious or otherwise) poses such a potentially dire threat to my livelihood that simply letting this transgression slide would not be a possibility. As an educator, part of my duty is to prepare young people for the real world. Allowing unauthorised computer access to go unpunished is at odds with what society deems acceptable, particularly in the age of online banking etc. This kind of activity is criminal in the real world. Letting it slide in a school setting is teaching the wrong thing to our students, your own positive experience notwithstanding. Just to clarify, punishment in a school setting is very flexible. For some students simply asking that they write a well reasoned apology is sufficient. For others, maybe repeat offenders, suspension or in extreme cases even expulsion is the correct response. Unlike adult punishment (prison), in a school setting the goal really is rehabilitation and personal growth. Contrary to many 14 year old's view we are not the enemy. Pleasure chatting. All the best, Eli

zaroth 12y ago
Entering the conversation very late, but IMO the potential for catastrophic results puts the onus on the school system and teacher to secure the computer. Administration and IT is absolutely responsible for providing adequate and proportional investment into the security of the computer systems based on the level of risk involved from a compromise. The required level of protection is commensurate with the risk. This is standard operating procedure for any kind of security assessment and deployment, whether it be physical or electronic security. The school system and teacher were both grossly negligent in protecting the computer system, and for example, in the case of a data breach (if the standardized state tests that were on the machine were stolen) I believe the school system and the teacher would both be partial liable for improperly securing the device. When an actual crime occurs, the punishment for the act should be proportional to the actual act. Not the potential for someone else with the same level of access to have done worse. E.g. Someone breaks into a house to steal a loaf of bread because they are starving. There were children sleeping in the house who could have hypothetically been kidnapped. We don't (or at least, shouldn't!) charge the bread burglar with attempted kidnapping or worse because children happened to be present but slept through the entire event. The potential for worse is a clear signal that the school system and the teacher are not doing enough to protect these devices. The problem here isn't the child changing the background image, it's the lax security of the computer systems. Stringing up the child for changing a desktop background is what's missing the forest for the trees. Seriously, thank the child for exposing a clear operational weakness in security controls, fire the current IT department head, and get someone competent to secure the systems. When a criminal act results in actual follow-on damages, then it is appropriate to charge the instigator. If our hypothetical bread burglar broke the lock, stole the bread, and then someone else came in through the open door and kidnapped the children, then absolutely the bread burglar will be charged as an accessory to kidnapping. But there's a clear line, you cannot stray into the hypothetical otherwise, there is literally no limit to the hypothetical damage which can be caused by any otherwise inconsequential act. E.g. Jaywalking could hypothetically cause a 10 car pile-up with major fatalities, but we don't charge jaywalkers with attempted manslaughter or even reckless endangerment unless there are specific confounding factors -- in almost all cases jaywalking remains a misdemeanor. What this kid did was exactly the jaywalking of "exceeding authorized access".
- ux-app 12y ago
  Thanks for the response. It seems though, that you haven't really read what I wrote throughout this entire thread. I have always agreed that the password policy was very poor/negligent and that the school should do better in this regard. I have never argued that the student should be punished for all potential havoc he could have wreaked. I stated this multiple times throughout the thread! Once again i'll try to make my argument as simple and clear as possible: 1. The potential for harm when a student takes surreptitious control over a teacher's computer is high 2. It therefore follows that a student actively working to take control (via keylogger or by observing the typed pw) is itself a serious issue. The changing of the desktop background is irrelevant. The unauthorized use of a computer is the main issue from the perspective of the school. The previous commenter with whom I was discussing implied that the actions were a "harmless prank" and reading between the lines implied that the punishment should have been a cheerful ruffling of his hair and saying with a mock voice "now that was a bit naughty wasn't it Johnny? Lets not do that again! hahaha what a silly pranker you are!" The article stated that the student will be facing felony charges. My position is that the actions sat somewhere in the middle of these 2 extremes! Simply accessing a teacher's computer is a serous enough action that the student should suffer some type of reasonable school-based punishment. In my previous post i outlined that these can wildly range in severity from a simple letter right through to expulsion if dealing with a recidivist. It really is hard for me to understand the confusion here. and once again. I'm not defending the school's use of insecure passwords. I'm saying that regardless of their poor choice, a student who is actively working to undermine a teacher's account should face a fair and reasonable punishment that is more than a slap on the wrist and less than a felony charge. I really can't make it clearer than this I think.
  - zaroth 12y ago
    I think I do understand your argument, I just follow your first statement, which I fully accept, with a different conclusion. From potential harm we should not treat an otherwise inconsequential act more seriously. From the potential harm we should plan appropriately and make commensurate investments in proper security. I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. What the student in this case did was effectively provide free pen-testing. They exposed a serious security weakness in the system, and the school should basically thank them for it, and get to work fixing the system. The severity of the crime should rest solely on the intent of the criminal and the extent of damage caused. Isn't that the baseline of our moral code? The flip side is deterrence. My point is we don't actually want to deter students pulling harmless pranks which expose serious security weaknesses. This is a feature, not a bug, and the school should be quietly giving the kid detention while they get their own act together before a more serious breach occurs. Have they even changed passwords for the teachers? Nay, they are likely going to consider possibly working on that one maybe next year.

by ux-app 12y ago

zaroth 12y ago

Entering the conversation very late, but IMO the potential for catastrophic results puts the onus on the school system and teacher to secure the computer. Administration and IT is absolutely responsible for providing adequate and proportional investment into the security of the computer systems based on the level of risk involved from a compromise. The required level of protection is commensurate with the risk. This is standard operating procedure for any kind of security assessment and deployment, whether it be physical or electronic security. The school system and teacher were both grossly negligent in protecting the computer system, and for example, in the case of a data breach (if the standardized state tests that were on the machine were stolen) I believe the school system and the teacher would both be partial liable for improperly securing the device. When an actual crime occurs, the punishment for the act should be proportional to the actual act. Not the potential for someone else with the same level of access to have done worse. E.g. Someone breaks into a house to steal a loaf of bread because they are starving. There were children sleeping in the house who could have hypothetically been kidnapped. We don't (or at least, shouldn't!) charge the bread burglar with attempted kidnapping or worse because children happened to be present but slept through the entire event. The potential for worse is a clear signal that the school system and the teacher are not doing enough to protect these devices. The problem here isn't the child changing the background image, it's the lax security of the computer systems. Stringing up the child for changing a desktop background is what's missing the forest for the trees. Seriously, thank the child for exposing a clear operational weakness in security controls, fire the current IT department head, and get someone competent to secure the systems. When a criminal act results in actual follow-on damages, then it is appropriate to charge the instigator. If our hypothetical bread burglar broke the lock, stole the bread, and then someone else came in through the open door and kidnapped the children, then absolutely the bread burglar will be charged as an accessory to kidnapping. But there's a clear line, you cannot stray into the hypothetical otherwise, there is literally no limit to the hypothetical damage which can be caused by any otherwise inconsequential act. E.g. Jaywalking could hypothetically cause a 10 car pile-up with major fatalities, but we don't charge jaywalkers with attempted manslaughter or even reckless endangerment unless there are specific confounding factors -- in almost all cases jaywalking remains a misdemeanor. What this kid did was exactly the jaywalking of "exceeding authorized access".

ux-app 12y ago
Thanks for the response. It seems though, that you haven't really read what I wrote throughout this entire thread. I have always agreed that the password policy was very poor/negligent and that the school should do better in this regard. I have never argued that the student should be punished for all potential havoc he could have wreaked. I stated this multiple times throughout the thread! Once again i'll try to make my argument as simple and clear as possible: 1. The potential for harm when a student takes surreptitious control over a teacher's computer is high 2. It therefore follows that a student actively working to take control (via keylogger or by observing the typed pw) is itself a serious issue. The changing of the desktop background is irrelevant. The unauthorized use of a computer is the main issue from the perspective of the school. The previous commenter with whom I was discussing implied that the actions were a "harmless prank" and reading between the lines implied that the punishment should have been a cheerful ruffling of his hair and saying with a mock voice "now that was a bit naughty wasn't it Johnny? Lets not do that again! hahaha what a silly pranker you are!" The article stated that the student will be facing felony charges. My position is that the actions sat somewhere in the middle of these 2 extremes! Simply accessing a teacher's computer is a serous enough action that the student should suffer some type of reasonable school-based punishment. In my previous post i outlined that these can wildly range in severity from a simple letter right through to expulsion if dealing with a recidivist. It really is hard for me to understand the confusion here. and once again. I'm not defending the school's use of insecure passwords. I'm saying that regardless of their poor choice, a student who is actively working to undermine a teacher's account should face a fair and reasonable punishment that is more than a slap on the wrist and less than a felony charge. I really can't make it clearer than this I think.
- zaroth 12y ago
  I think I do understand your argument, I just follow your first statement, which I fully accept, with a different conclusion. From potential harm we should not treat an otherwise inconsequential act more seriously. From the potential harm we should plan appropriately and make commensurate investments in proper security. I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. What the student in this case did was effectively provide free pen-testing. They exposed a serious security weakness in the system, and the school should basically thank them for it, and get to work fixing the system. The severity of the crime should rest solely on the intent of the criminal and the extent of damage caused. Isn't that the baseline of our moral code? The flip side is deterrence. My point is we don't actually want to deter students pulling harmless pranks which expose serious security weaknesses. This is a feature, not a bug, and the school should be quietly giving the kid detention while they get their own act together before a more serious breach occurs. Have they even changed passwords for the teachers? Nay, they are likely going to consider possibly working on that one maybe next year.