7 ms·

I agree with almost everything you've said :) > I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is t

by ux-app 12y ago

I agree with almost everything you've said :) > I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security. This is incorrect and your reasoning here is faulty. It is diametrically opposed to how the community at large views this issue. If we treat children in this way, and then when the clock strikes 12 and they turn 18 they are suddenly treated in the exact opposite way!! A 180 degree flip. According to your logic, within in the school setting its a harmless prank and the blame squarely lies with the school. However, turn 18 and perform the exact same actions (simple intrusion) on an corporate server. Guess where the (legal) blame will lie?? I took issue with comments that the actions were a harmless prank. As adults, and particularly as teachers our duty is to help shape the next generation of ethical citizenry. Laughing this incident off and applying a token punishment would send the wrong message. In many jurisdictions unauthorized computer access is a crime. If a student gained access to a NSA computer, do you think law enforcement would treat it as a harmless prank? Even if no data was destroyed or tampered with. The act of intrusion is itself a serious matter. The school has a duty to use this as an opportunity to 1. Update their network security (obviously!) 2. Educate students that they can end up in prison (even as minors!) if they break into the wrong computer network. This doesn't mean applying an out of proportion punishment to this student in order to make an example of him. This means applying a fair and proportionate response which, and i'' say it again... sits between the 2 extremes of "harmless prank" and felony offense. The issue I've had all along is with brushing this away as harmless. Unlawful intrusion is a crime. As teachers we would do a poor job preparing our students for the real world by treating it, within the school setting, as a "harmless prank" A harmless prank is throwing a water balloon at someone. Breaking and entering (digital or otherwise) is not in this category. In addition, the law does not treat the flimsiness of the lock as a mitigating circumstance. You can protect your physical property with a $2 lock and, in the eyes of the law anyone circumventing this would be guilty of break and enter, in the same way as if they broke into a far more fortified premises. laughing away the student's actions as a "harmless prank" would be to miss a valuable learning opportunity for everyone involved! > What the student in this case did was effectively provide free pen-testing This was not a noble white-hat! If the student found an exploit and then went straight to the teacher to inform them, do you think this would have ever made front page news? The student had a history of "free pen testing", and they used this particular exploit to attempt malicious access and tampering of a teacher's machine. Imagine if you did the same at your workplace. "Hey boss I have a habit of stealing coworker passwords. Dont worry though, it's just a harmless prank! HAHA"

zaroth 12y ago
Your hypothetical of 'what if this happened in the workplace' is a good one. If someone changed their coworker's or manager's background image and ended up getting charged with a felony, I would be equally outraged. Even as grounds for firing it's a stretch, although I suppose the specific content of the image could rise to sexual harassment which could make it more serious -- but that would be based on the coworker's response, and a greater pattern of behavior. If they had to guess a coworker's password in order to do it, then the further reprimand goes to the coworker for having such an insecure password, but the original act of changing the background image is dealt with all the same, namely, a) laughing about it, b) laughing and then saying 'don't do that', or c) an internal reprimand. Under almost no circumstance could I imagine involving the police in any capacity for changing a coworker's background image. In the workplace, again, the far-worse offense is actually the coworker losing control of their password. If an employee came to me complaining their background image was changed to two men kissing, on a machine with proprietary business documents (aka state standardize tests) on it, my first questions would be, not who did it, but where did you leave your machine unlocked and how did someone else gain access? A felony conviction has lasting impact for decades, not to mention the act of prosecuting costs taxpayers thousands of dollars, and a waste of public resources. But even short of a felony charge, IMO it's simply not in the interest of anyone for accessing a computer to change a background image to be anything but an internal / administrative matter. But I shouldn't have to venture into the hypothetical, and dramatically change the scenario to make the point, because in fact kids aren't treated the same as adults, and yes, when the clock strikes 12 and a child becomes an adult under the law, their responsibility and their relationship with the state is fundamentally altered. So the fact this is a child does make the charge even more outrageous. I just fundamentally believe that the police and our criminal justice system are a form of violence to be wielded against the people only in times of absolute need and even then only in the minimum necessary and proportionate response. Changing a background image, to me, is an order of magnitude lower on the violence scale than any police intervention.
- ux-app 12y ago
  please don't take this as a critical or snarky comment (I've enjoyed our discussion), but did you read my responses in this thread? --- Since my very first comment in this thread I have said that the felony charge is a gross overreaction. --- I've hilighted this so that we don't go off on a tangent again. The felony charge was wrong. However, In my view it was more than a "harmless prank". Labelling it as such is to do a disservice to the student who would gain a valuable education in the matter if dealt with in an appropriate manner. The background image in this case is a red herring. It has nothing to do with the felony charges. The felony charges stem from unauthorized computer access. If you'd like to read more about the particular law applicable then please visit: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act > the further reprimand goes to the coworker for having such an insecure password, but the original act of changing the background image Once again you have been tricked by the click-bait nature of the original article title. The background image change is irrelevant and had nothing to do with the felony aspect of the case. In a workplace there is an implicit social contract in place between all workers. As an employee I should be able to go about my business without fear that my fellow workers are actively trying to undermine my network access. This is computer ethics 101. Anyone keylogging, bruteforcing or even simply guessing a coworkers password and then using this to gain access to their account is breaking this important social contract. This breeds distrust and is toxic to a work environment. As a first offence it's possible that you might get off with a stern warning and probation. A repeat offender, in any competent workplace would be summarily dismissed. This is without a doubt breach of contract. If you feel differently then I'd encourage you to read your own workplace contract. Or if you have a large enough workplace why not ask a manager what their take on the matter of taking surreptitious control of a co-workers machine via ill-gotten credentials. I don't think they'd have as relaxed a view as you seem to have. Rather than using hypotheticals. I'll use an actual example from my own work experience. The following scenario occurs at least 4-5 times a month to me personally. As a teacher I am moving from room, to room and logging into various computers throughout the day. It is not uncommon for a colleague of mine to be busy in a lesson, and once the screen saver has turned off their screen they forget to log off their machine. I come in, move the mouse, and see that another user is logged in. I'd like to think that I have a strong moral compass. My action, every time without exception is to immediately log them off. I even go so far as to not let my eyes wander about their desktop. The files and shortcuts they have there could potentially be sensitive and I personally believe that even taking undue note of the filenames would be a minor breach of their privacy. > my first questions would be, not who did it, but where did you leave your machine unlocked and how did someone else gain access? I'd be very surprised if this was truly your first and most pressing concern. It would exhibit a poor understanding of computer security and the wider workplace context. As anyone with even a basic IT background would know. If another party has physical access to your machine (as all co-workers do as a normal side effect of their employment) then security wise all bets are off. If a worker at a company displayed such bad judgement as to actively seek out to find and then use another person's credentials then they have exhibited a gross incompetence and should be dealt with accordingly. This is why a breach of the implicit social contract which states that my co-workers will not attempt to compromise my IT credentials is so vital. In cynical, purely business terms, a breakdown of this fundamental trust would breed mistrust and eventually affect morale and the bottom line. > In the workplace, again, the far-worse offense is actually the coworker losing control of their password No. A truly nefarious employee could simply attach a tiny USB to the back panel (or even inside the case) of your machine which would keylog it. Even a password with 100bits of entropy would not mitigate against this attack. Strong passwords are important of course, but an employee who is actively seeking out to compromise their colleague's credentials is, in the extreme case, a possibly existential threat to the company. Vigorously weeding out any employees with a moral and ethical compass so skewed that they would even consider using another's credentials would be the immediate concern of any competent management team. > Changing a background image, to me, is an order of magnitude lower on the violence scale than any police intervention. Once again you have been misled by clickbait. The background change is immaterial. > I just fundamentally believe that the police and our criminal justice system are a form of violence to be wielded against the people only in times of absolute need and even then only in the minimum necessary and proportionate response. As stated many times already, I 100% agree with you. In the case of a teenager involving the police is a gross overreaction. Labeling the offense of gaining unathorized access to a computer as a "harmless prank" is actively harmful. It portrays the act as without consequence, whereas in the real world it is anything but. In the real world doing this might get you fired or put in prison! A school's duty is to treat the offence with the gravity it deserves.

by ux-app 12y ago

zaroth 12y ago

Your hypothetical of 'what if this happened in the workplace' is a good one. If someone changed their coworker's or manager's background image and ended up getting charged with a felony, I would be equally outraged. Even as grounds for firing it's a stretch, although I suppose the specific content of the image could rise to sexual harassment which could make it more serious -- but that would be based on the coworker's response, and a greater pattern of behavior. If they had to guess a coworker's password in order to do it, then the further reprimand goes to the coworker for having such an insecure password, but the original act of changing the background image is dealt with all the same, namely, a) laughing about it, b) laughing and then saying 'don't do that', or c) an internal reprimand. Under almost no circumstance could I imagine involving the police in any capacity for changing a coworker's background image. In the workplace, again, the far-worse offense is actually the coworker losing control of their password. If an employee came to me complaining their background image was changed to two men kissing, on a machine with proprietary business documents (aka state standardize tests) on it, my first questions would be, not who did it, but where did you leave your machine unlocked and how did someone else gain access? A felony conviction has lasting impact for decades, not to mention the act of prosecuting costs taxpayers thousands of dollars, and a waste of public resources. But even short of a felony charge, IMO it's simply not in the interest of anyone for accessing a computer to change a background image to be anything but an internal / administrative matter. But I shouldn't have to venture into the hypothetical, and dramatically change the scenario to make the point, because in fact kids aren't treated the same as adults, and yes, when the clock strikes 12 and a child becomes an adult under the law, their responsibility and their relationship with the state is fundamentally altered. So the fact this is a child does make the charge even more outrageous. I just fundamentally believe that the police and our criminal justice system are a form of violence to be wielded against the people only in times of absolute need and even then only in the minimum necessary and proportionate response. Changing a background image, to me, is an order of magnitude lower on the violence scale than any police intervention.

ux-app 12y ago
please don't take this as a critical or snarky comment (I've enjoyed our discussion), but did you read my responses in this thread? --- Since my very first comment in this thread I have said that the felony charge is a gross overreaction. --- I've hilighted this so that we don't go off on a tangent again. The felony charge was wrong. However, In my view it was more than a "harmless prank". Labelling it as such is to do a disservice to the student who would gain a valuable education in the matter if dealt with in an appropriate manner. The background image in this case is a red herring. It has nothing to do with the felony charges. The felony charges stem from unauthorized computer access. If you'd like to read more about the particular law applicable then please visit: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act > the further reprimand goes to the coworker for having such an insecure password, but the original act of changing the background image Once again you have been tricked by the click-bait nature of the original article title. The background image change is irrelevant and had nothing to do with the felony aspect of the case. In a workplace there is an implicit social contract in place between all workers. As an employee I should be able to go about my business without fear that my fellow workers are actively trying to undermine my network access. This is computer ethics 101. Anyone keylogging, bruteforcing or even simply guessing a coworkers password and then using this to gain access to their account is breaking this important social contract. This breeds distrust and is toxic to a work environment. As a first offence it's possible that you might get off with a stern warning and probation. A repeat offender, in any competent workplace would be summarily dismissed. This is without a doubt breach of contract. If you feel differently then I'd encourage you to read your own workplace contract. Or if you have a large enough workplace why not ask a manager what their take on the matter of taking surreptitious control of a co-workers machine via ill-gotten credentials. I don't think they'd have as relaxed a view as you seem to have. Rather than using hypotheticals. I'll use an actual example from my own work experience. The following scenario occurs at least 4-5 times a month to me personally. As a teacher I am moving from room, to room and logging into various computers throughout the day. It is not uncommon for a colleague of mine to be busy in a lesson, and once the screen saver has turned off their screen they forget to log off their machine. I come in, move the mouse, and see that another user is logged in. I'd like to think that I have a strong moral compass. My action, every time without exception is to immediately log them off. I even go so far as to not let my eyes wander about their desktop. The files and shortcuts they have there could potentially be sensitive and I personally believe that even taking undue note of the filenames would be a minor breach of their privacy. > my first questions would be, not who did it, but where did you leave your machine unlocked and how did someone else gain access? I'd be very surprised if this was truly your first and most pressing concern. It would exhibit a poor understanding of computer security and the wider workplace context. As anyone with even a basic IT background would know. If another party has physical access to your machine (as all co-workers do as a normal side effect of their employment) then security wise all bets are off. If a worker at a company displayed such bad judgement as to actively seek out to find and then use another person's credentials then they have exhibited a gross incompetence and should be dealt with accordingly. This is why a breach of the implicit social contract which states that my co-workers will not attempt to compromise my IT credentials is so vital. In cynical, purely business terms, a breakdown of this fundamental trust would breed mistrust and eventually affect morale and the bottom line. > In the workplace, again, the far-worse offense is actually the coworker losing control of their password No. A truly nefarious employee could simply attach a tiny USB to the back panel (or even inside the case) of your machine which would keylog it. Even a password with 100bits of entropy would not mitigate against this attack. Strong passwords are important of course, but an employee who is actively seeking out to compromise their colleague's credentials is, in the extreme case, a possibly existential threat to the company. Vigorously weeding out any employees with a moral and ethical compass so skewed that they would even consider using another's credentials would be the immediate concern of any competent management team. > Changing a background image, to me, is an order of magnitude lower on the violence scale than any police intervention. Once again you have been misled by clickbait. The background change is immaterial. > I just fundamentally believe that the police and our criminal justice system are a form of violence to be wielded against the people only in times of absolute need and even then only in the minimum necessary and proportionate response. As stated many times already, I 100% agree with you. In the case of a teenager involving the police is a gross overreaction. Labeling the offense of gaining unathorized access to a computer as a "harmless prank" is actively harmful. It portrays the act as without consequence, whereas in the real world it is anything but. In the real world doing this might get you fired or put in prison! A school's duty is to treat the offence with the gravity it deserves.