Tuesday, 20 April 2010 12:42

School for spies- the Pennsylvania scandal gets bigger

By

Previously, the Lower Merion School District has insisted that they only ever spied on lost or stolen school-owned laptops.  The latest court filings show this is patently false.  School for spies, or spies for school, you decide.

This story first broke a few weeks ago with claims by high school student Blake Robbins and his parents that Blake's school had spied on him at home. 

For those unfamiliar with the original story, Blake's parents were "summoned to the Principal's office" to be informed of some inappropriate behaviour he had undertaken.  The problem was that this behaviour took place in Blake's bedroom and was presented to his parents in the form of a series of still images captured by the web-cam in the school-supplied laptop that happened to be on the desk in his room.

For most readers, that's enough to set off some very loud alarm bells.

It did for Blake's parents Michael and Holly who filed suit in the US District Court alleging all kinds of malfeasance.

Late last week, they filed a revised action which has greatly expanded the range of unreasonable behaviour.

The new filing also puts lie to the claims that the use of remote monitoring systems was confined to lost / stolen computers.  Note that with this in mind, there has been some dispute regarding the status of the Robbins' laptop- there are reports that he had a loan laptop and others have suggested that it should not have been off school grounds as the required insurance cover had not been purchased.

This does not excuse any of the subsequent behaviour.


The laptops were provided to all students complete with remote management software although this fact seems to have not been properly communicated to either students or parents.

The expressed, and supposedly only, purpose for the remote control was to permit the collection of (lets call it) "evidence" to identify the location of a lost or stolen laptop, should it suddenly appear on the Internet.  This evidence obvious could include still images from the in-built webcam.

As reported previously on iTWire, a number of students had made comment that the red light (indicating webcam activity) seemed to turn on unexpectedly - none of those students was in possession of a lost or stolen laptop.

'Discovery' is an important part of the US legal process - essentially it gives each party to a legal action the ability to insist that the other party offer up everything relevant to the case.

Clearly the Robbins had little to offer.

The school however has been forced to reveal a considerably more extensive degree of surveillance than had previously been admitted to.


Firstly, let's look at the specific claims made regarding the viewing of Blake's laptop.

Originally, the school claimed that his laptop had been viewed for only a few hours.  The material released via disclosure showed over 2 weeks of surveillance and included more than 400 screenshots and photos.  In addition, there were recordings of private IM conversations.

Blake Robbins wasn't the only target.

The school was forced to reveal that, in fact, the laptops of a large number of students had been monitored, resulting in thousands of webcam images and screenshots.  None of these students had reported their laptops as lost or stolen.

In addition, the discovery process produced a large number of relevant emails between the school's IT staff.  One exchange for instance has one person describing the webcam images as "a little LMSD [Lower Merion School District] soap opera."  A colleague, Carol Cafiero, responded, "I know, I love it!"

In a statement, the school continues to deny any deliberate wrongdoing.


In the latest statement, David Ebby, the President of the LMSD Board of School Directors writes, "As you know, our outside counsel and a computer forensic/computer security expert have been investigating the circumstances surrounding the use of the LANrev 'tracking' feature.  They will provide us their findings in the next few weeks and we will release them to you.  We will do so regardless of whether or not we resolve the Robbins litigation.

"On April 14, 2010 - two days ago - the Court issued an Order mapping out the events that we hope will lead to a resolution of the litigation.  All parties agreed to the framework set forth in the Court's Order.  Indeed, a meeting among the Robbins' counsel, the proposed interveners' counsel and our counsel is scheduled for this afternoon.

"A Motion filed yesterday by the plaintiffs ostensibly was against Carol Cafiero, but instead appears to be a vehicle to attack the District.  We do not feel it is appropriate for anyone other than the investigators to dictate the timing of the investigation and the release of complete findings.  As we have made clear since day one, we are committed to providing all of the facts - good and bad - at the conclusion of the investigation.  In light of what has been raised by plaintiffs' counsel, however, we feel it is critically important to provide immediate clarification regarding key items.

"A substantial number of webcam photos have been recovered in the investigation.  We have proposed a process to Judge DuBois whereby each family of a student whose image appears in any such photos will be notified and given the opportunity to view such photographs.  Our counsel proposed that Chief Magistrate Judge Thomas Rueter handle that process.  While our counsel has not yet met with Judge Rueter, Judge DuBois has agreed that such a process makes sense.  We hope to start that process shortly.


The statement continues'¦


"During that process the privacy of all students will be strongly protected.

"Also, the plaintiffs' Motion suggests that the LANrev tracking feature may have been used for the purposes of 'spying' on students.  While we deeply regret the mistakes and misguided actions that have led us to this situation, at this late stage of the investigation we are not aware of any evidence that District employees used any LANrev webcam photographs or screenshots for such inappropriate purposes.

"Please also be reminded that we continue to fully cooperate and provide transparency to the United States Attorney's office in its investigation of the matter.  To the extent there is any evidence of inappropriate conduct, it will be disclosed in the findings of the current investigations.

"We are committed to disclosing fully what happened, correcting our mistakes, and making sure that they do not happen again."

These statements raise some very troubling issues.  Not the least of which being that the school district is attempting to subvert the legal process.

Looking closely, Ebby is suggesting that there was no deliberate attempt to spy on the children.  Does this mean that the IT team was free to do as they wished; without the encumbrance of rules and regulations?

This sure looks like an attempt to cut the IT workers loose.  But if that were true, they will still have difficulty explaining the very official actions which started the whole affair.

As mentioned previously, the latest court filing alleges some very troubling behaviour.


The filing claims that,

Since the filing of the lawsuit, it is now known, as to Blake Robbins:

(a) Blake Robbins' laptop was neither lost nor stolen

(b) the "peeping tom" spying technology was activated for a fifteen day period between October 20th and November 4th 2009.

(c) over 400 screen shots and webcam pictures were taken using the LanRev "peeping tom" technology.

(d) most of the screen shots and webcam pictures were taken while Blake Robbins' computer was in his home.

(e) there were numerous screen shots of private IM communication between Blake and his friends

(f) there were numerous webcam pictures of Blake and other members of his family, including pictures of Blake partially undressed and of Blake sleeping

(g) there are additional webcam images and screen shots taken of Blake Robbins which, to date, have not been recovered because the evidence was purged by the IT department.

Recent testimony under oath has now confirmed that, as to Blake Robbins, the activation of the LanRev "peeping tom" technology to take screen shots and webcam pictures of Blake Robbins in his home was not in accordance with LMSD's own policies.

In addition, discovery to date has now revealed that thousands of webcam pictures and screen shots have been taken of numerous other students in their homes, many of which never reported their laptops lost or missing including activating the technology for:

(a) a student who had a similar name to another student's name who had reported his/her laptop missing, causing webcam pictures and screen shots to be taken of that student, presumably in that student's home, when that student had no knowledge that this was occurring

(b) taking webcam pictures and screen shots of students who failed to immediately return their computer at the end of the calendar year, thereby taking screen shots and webcam pictures of students and their families at home when LMSD knew which student had the computer

(c) taking webcam pictures and screenshots of students who did not pay insurance when this was not in accordance with LMSD's own policies since the only information needed was the I.P. address to show that the laptop was taken home.


Which brings us to Carol Cafiero.


Carol Cafiero, named as Information System Coordinator at Lower Merion School District, seems to be steadily digging a very deep hole for herself.  Not only has she defied a court order, but when finally brought before the court refused to answer any questions on the grounds that the answers may incriminate her in a criminal trial.

Indeed, she is the person who responded "I know, I love it!" to the soap opera comment.

According to an attachment to the latest court filing, Cafiero was compelled to appear to give testimony in relation to the exact use of the LanRev system at LMSD.  She responded with a motion to quash that order, which was denied.

In addition, a request to turn over her home computer to the plaintiffs fort imaging and analysis was ignored, leading to a court order to do so.

The court has determined:

It is hereby ordered that said motion for sanctions for failure to comply with Court Order dated April 1, 2010 (Doc. No. 35) is Granted.

It is further ordered that Carol Cafiero shall permit Plaintiff's access to her home to recover any computers located in her home.  Plaintiffs shall, within 48 hours of taking possession of Cafiero's computer(s), image the hard drive of such computer(s) and return the original computer(s) to Cafiero.

It is further ordered that Cafiero is sanctioned $2,500.00 for her failure to comply with the court's order of April 1, 2010.


This sorry saga seems to grow and grow. 

The School District has promised to protect the privacy of all students who's images have been captured by the LanRev software.  Well, better late than never!

The School District also seems to be distancing itself from the actions of Cafiero and the unnamed other IT professional able to access the LanRev software; but identifying such actions as being not authorized by the school district simply raises separate issues of workplace supervision.

One hopes that Cafiero was not foolish enough to attempt to purge her home computers prior to access by the Plaintiff's experts. 

In addition, it would be expected that every school around the world will be taking a very close look at both their policies and the execution of those policies in relation to school-supplied laptops. 

And purging anything remotely resembling material currently in contention.


Subscribe to ITWIRE UPDATE Newsletter here

Now’s the Time for 400G Migration

The optical fibre community is anxiously awaiting the benefits that 400G capacity per wavelength will bring to existing and future fibre optic networks.

Nearly every business wants to leverage the latest in digital offerings to remain competitive in their respective markets and to provide support for fast and ever-increasing demands for data capacity. 400G is the answer.

Initial challenges are associated with supporting such project and upgrades to fulfil the promise of higher-capacity transport.

The foundation of optical networking infrastructure includes coherent optical transceivers and digital signal processing (DSP), mux/demux, ROADM, and optical amplifiers, all of which must be able to support 400G capacity.

With today’s proprietary power-hungry and high cost transceivers and DSP, how is migration to 400G networks going to be a viable option?

PacketLight's next-generation standardised solutions may be the answer. Click below to read the full article.

CLICK HERE!

WEBINAR PROMOTION ON ITWIRE: It's all about webinars

These days our customers Advertising & Marketing campaigns are mainly focussed on webinars.

If you wish to promote a Webinar we recommend at least a 2 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://www.itwire.com/itwire-update.html and Promotional News & Editorial.

This coupled with the new capabilities 5G brings opens up huge opportunities for both network operators and enterprise organisations.

We have a Webinar Business Booster Pack and other supportive programs.

We look forward to discussing your campaign goals with you.

MORE INFO HERE!

BACK TO HOME PAGE
David Heath

David Heath has had a long and varied career in the IT industry having worked as a Pre-sales Network Engineer (remember Novell NetWare?), General Manager of IT&T for the TV Shopping Network, as a Technical manager in the Biometrics industry, and as a Technical Trainer and Instructional Designer in the industrial control sector. In all aspects, security has been a driving focus. Throughout his career, David has sought to inform and educate people and has done that through his writings and in more formal educational environments.

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments