6 ms·

Thanks for the response. It seems though, that you haven't really read what I wrote throughout this entire thread. I have always agreed that the password polic

by ux-app 12y ago

Thanks for the response. It seems though, that you haven't really read what I wrote throughout this entire thread. I have always agreed that the password policy was very poor/negligent and that the school should do better in this regard. I have never argued that the student should be punished for all potential havoc he could have wreaked. I stated this multiple times throughout the thread! Once again i'll try to make my argument as simple and clear as possible: 1. The potential for harm when a student takes surreptitious control over a teacher's computer is high 2. It therefore follows that a student actively working to take control (via keylogger or by observing the typed pw) is itself a serious issue. The changing of the desktop background is irrelevant. The unauthorized use of a computer is the main issue from the perspective of the school. The previous commenter with whom I was discussing implied that the actions were a "harmless prank" and reading between the lines implied that the punishment should have been a cheerful ruffling of his hair and saying with a mock voice "now that was a bit naughty wasn't it Johnny? Lets not do that again! hahaha what a silly pranker you are!" The article stated that the student will be facing felony charges. My position is that the actions sat somewhere in the middle of these 2 extremes! Simply accessing a teacher's computer is a serous enough action that the student should suffer some type of reasonable school-based punishment. In my previous post i outlined that these can wildly range in severity from a simple letter right through to expulsion if dealing with a recidivist. It really is hard for me to understand the confusion here. and once again. I'm not defending the school's use of insecure passwords. I'm saying that regardless of their poor choice, a student who is actively working to undermine a teacher's account should face a fair and reasonable punishment that is more than a slap on the wrist and less than a felony charge. I really can't make it clearer than this I think.

zaroth 12y ago
I think I do understand your argument, I just follow your first statement, which I fully accept, with a different conclusion. From potential harm we should not treat an otherwise inconsequential act more seriously. From the potential harm we should plan appropriately and make commensurate investments in proper security. I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. What the student in this case did was effectively provide free pen-testing. They exposed a serious security weakness in the system, and the school should basically thank them for it, and get to work fixing the system. The severity of the crime should rest solely on the intent of the criminal and the extent of damage caused. Isn't that the baseline of our moral code? The flip side is deterrence. My point is we don't actually want to deter students pulling harmless pranks which expose serious security weaknesses. This is a feature, not a bug, and the school should be quietly giving the kid detention while they get their own act together before a more serious breach occurs. Have they even changed passwords for the teachers? Nay, they are likely going to consider possibly working on that one maybe next year.
- ux-app 12y ago
  I agree with almost everything you've said :) > I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. This is incorrect and your reasoning here is faulty. It is diametrically opposed to how the community at large views this issue. If we treat children in this way, and then when the clock strikes 12 and they turn 18 they are suddenly treated in the exact opposite way!! A 180 degree flip. According to your logic, within in the school setting its a harmless prank and the blame squarely lies with the school. However, turn 18 and perform the exact same actions (simple intrusion) on an corporate server. Guess where the (legal) blame will lie?? I took issue with comments that the actions were a harmless prank. As adults, and particularly as teachers our duty is to help shape the next generation of ethical citizenry. Laughing this incident off and applying a token punishment would send the wrong message. In many jurisdictions unauthorized computer access is a crime. If a student gained access to a NSA computer, do you think law enforcement would treat it as a harmless prank? Even if no data was destroyed or tampered with. The act of intrusion is itself a serious matter. The school has a duty to use this as an opportunity to 1. Update their network security (obviously!) 2. Educate students that they can end up in prison (even as minors!) if they break into the wrong computer network. This doesn't mean applying an out of proportion punishment to this student in order to make an example of him. This means applying a fair and proportionate response which, and i'' say it again... sits between the 2 extremes of "harmless prank" and felony offense. The issue I've had all along is with brushing this away as harmless. Unlawful intrusion is a crime. As teachers we would do a poor job preparing our students for the real world by treating it, within the school setting, as a "harmless prank" A harmless prank is throwing a water balloon at someone. Breaking and entering (digital or otherwise) is not in this category. In addition, the law does not treat the flimsiness of the lock as a mitigating circumstance. You can protect your physical property with a $2 lock and, in the eyes of the law anyone circumventing this would be guilty of break and enter, in the same way as if they broke into a far more fortified premises. laughing away the student's actions as a "harmless prank" would be to miss a valuable learning opportunity for everyone involved! > What the student in this case did was effectively provide free pen-testing This was not a noble white-hat! If the student found an exploit and then went straight to the teacher to inform them, do you think this would have ever made front page news? The student had a history of "free pen testing", and they used this particular exploit to attempt malicious access and tampering of a teacher's machine. Imagine if you did the same at your workplace. "Hey boss I have a habit of stealing coworker passwords. Dont worry though, it's just a harmless prank! HAHA"

by ux-app 12y ago

zaroth 12y ago

I think I do understand your argument, I just follow your first statement, which I fully accept, with a different conclusion. From potential harm we should not treat an otherwise inconsequential act more seriously. From the potential harm we should plan appropriately and make commensurate investments in proper security. I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. What the student in this case did was effectively provide free pen-testing. They exposed a serious security weakness in the system, and the school should basically thank them for it, and get to work fixing the system. The severity of the crime should rest solely on the intent of the criminal and the extent of damage caused. Isn't that the baseline of our moral code? The flip side is deterrence. My point is we don't actually want to deter students pulling harmless pranks which expose serious security weaknesses. This is a feature, not a bug, and the school should be quietly giving the kid detention while they get their own act together before a more serious breach occurs. Have they even changed passwords for the teachers? Nay, they are likely going to consider possibly working on that one maybe next year.

ux-app 12y ago
I agree with almost everything you've said :) > I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. This is incorrect and your reasoning here is faulty. It is diametrically opposed to how the community at large views this issue. If we treat children in this way, and then when the clock strikes 12 and they turn 18 they are suddenly treated in the exact opposite way!! A 180 degree flip. According to your logic, within in the school setting its a harmless prank and the blame squarely lies with the school. However, turn 18 and perform the exact same actions (simple intrusion) on an corporate server. Guess where the (legal) blame will lie?? I took issue with comments that the actions were a harmless prank. As adults, and particularly as teachers our duty is to help shape the next generation of ethical citizenry. Laughing this incident off and applying a token punishment would send the wrong message. In many jurisdictions unauthorized computer access is a crime. If a student gained access to a NSA computer, do you think law enforcement would treat it as a harmless prank? Even if no data was destroyed or tampered with. The act of intrusion is itself a serious matter. The school has a duty to use this as an opportunity to 1. Update their network security (obviously!) 2. Educate students that they can end up in prison (even as minors!) if they break into the wrong computer network. This doesn't mean applying an out of proportion punishment to this student in order to make an example of him. This means applying a fair and proportionate response which, and i'' say it again... sits between the 2 extremes of "harmless prank" and felony offense. The issue I've had all along is with brushing this away as harmless. Unlawful intrusion is a crime. As teachers we would do a poor job preparing our students for the real world by treating it, within the school setting, as a "harmless prank" A harmless prank is throwing a water balloon at someone. Breaking and entering (digital or otherwise) is not in this category. In addition, the law does not treat the flimsiness of the lock as a mitigating circumstance. You can protect your physical property with a $2 lock and, in the eyes of the law anyone circumventing this would be guilty of break and enter, in the same way as if they broke into a far more fortified premises. laughing away the student's actions as a "harmless prank" would be to miss a valuable learning opportunity for everyone involved! > What the student in this case did was effectively provide free pen-testing This was not a noble white-hat! If the student found an exploit and then went straight to the teacher to inform them, do you think this would have ever made front page news? The student had a history of "free pen testing", and they used this particular exploit to attempt malicious access and tampering of a teacher's machine. Imagine if you did the same at your workplace. "Hey boss I have a habit of stealing coworker passwords. Dont worry though, it's just a harmless prank! HAHA"