Small minds

Mark · Post by **Mark** » Tue Jun 28, 2005 12:17 pm

TMurphy wrote:And before Doc starts--yes, I know it's the law. But it is still up to the school to decide if they want to press charges, right??? If one of your kids figured out your password, and used it to get around web filtering on your computer (which you allow them limited access to), I'm sure you'd appropriately punish him/her. But would you have them charged with a felony???

In most states, felony charges are decided by the state and the victim has no say in the matter. Comparing breaking into your own computer to breaking into computer owned by the school is not valid. The kids are at home and decide to see what's in the closet that dad has told them not to open compared to the kids break into the principal's office on Saturday night.

I am always amazed that so many people want to blow off computer crime as kids goofing off. If their lives are damaged because they have a felony record, that's better than some innocent person's life being ruined becuase some one stole their identity.

Chuck(G) · Post by **Chuck(G)** » Tue Jun 28, 2005 12:52 pm

If I were the school administrator, the first question I'd want answered is "How the heck did the kids get the password in the first place?" And then follow up with some conspiracy and facilitation charges...

Mark · Post by **Mark** » Tue Jun 28, 2005 1:30 pm

Chuck(G) wrote:If I were the school administrator, the first question I'd want answered is "How the heck did the kids get the password in the first place?" And then follow up with some conspiracy and facilitation charges...

Let's see... Username: Admin, Password: Admin. I'll bet you're not surprised that I run into this all the time with my clients. No only are they too lazy to implement a strong password, but they're too lazy to spell out Administrator.

Or even better, they have picked a strong password and because it is so hard to remember, they have put in on a Post-It attached to their monitor.

My first guess for the school is stupidity. The second would be complicity.

TMurphy · Post by **TMurphy** » Tue Jun 28, 2005 1:40 pm

No one is trying to brush off computer crime as "kids goofing off" these kids did wrong, and need to learn their lesson. Charging them with a felony is like cutting someone's hand off for stealing. They've learned their lesson, but was the punishment really justified?

The kids were issued the computers from the school. In my proposed scenerio, they would also be given access to the home computer. There is password protected access restrictions in both cases. In both cases, that is circumvented. If it happens to the school computer, it's a felony, and those dang, rotten kids should go to prison. If it happens at home, why is that not the same thing??? The kids aren't breaking into their own computer, but into their parents computer, which (just like the school's) they have limited access to.

I'm not trying to downplay the seriousness of what those kids did. It was bad, it was wrong, it was foolish, and they should suffer the consequences. The consequences should be reasonable, though. Sending high school freshman and sophomores to jail because they used an administrative password to look at dirty websites not reasonable. It's excessive.

Chuck(G) · Post by **Chuck(G)** » Tue Jun 28, 2005 1:41 pm

Mark wrote:My first guess for the school is stupidity. The second would be complicity.

The password was "50Trexler"--not exactly "Admin". In either case, however, letting/leaking the password should be grounds for discharge under the circumstances.

Rick Denney · Post by **Rick Denney** » Tue Jun 28, 2005 5:57 pm

There is a principle of punishment in the Judeo-Christian ethical structure known as retribution. That's the notion of "an eye for an eye and a tooth for a tooth," and also embodied in the words, "the punishment shall fit the crime." It has nothing to do with revenge, but rather with the ethic of maintaining a sense of proportion.

Retribution is as protective as it is condemning, depending on whose ox is being gored. Say something that someone else (for reasons of their own) have determined is "hateful", and you will receive punishment far in excess of the crime. This is a violation of a retributive punishment structure.

Chuck's example is a case where the punishment does not fit the crime.

Mark, I'm going to disagree with you profoundly. Breaking into someone's house is a threat to their physical security, and that is wholly different from their financial security. Of course, the criminals in question threatened nobody's financial security. What they did do might someday lead to crimes such as identity theft, but my ethics presented above suggest it would be unethical to punish them for crimes that the current crime might lead to but hasn't yet. But even if they had stolen a credit-card number, that's not the same thing as breaking into someone's house, which is a threat to their physical being. Physical threats can be defended against using physical means, including in most states shooting someone who poses such a threat, but you can't shoot someone because they stole your credit-card number, even if they used it to your ruin.

And leaving the door open or the key in sight is no moral justification for trespassing, but it is a legal defense that nearly always results in a reduced charge or sentence by my observation.

The punishment shall fit the crime. The crime in this case was breaking a school rule, and a poorly worded one at that. One should expect sophomoric activity from...sophomores.

I have a feeling that the DA is going to have trouble with a jury of their peers, and I have a further feeling that after the DA has made his point, the kids will plead guilty to a minor misdemeanor and the felony charges will be dropped. I feel sorry for the parents who will foot the attorneys' bills.

And, yes, I have done worse, including developing an exact imitation of the signon procedure for Texas A&M's computer to be used to harass younger students (and harvest their signon information). The most I could have stolen with that scheme was a little computer time, and I never even did that. It was simply entertaining to watch the students wilt under the harassment. The skills I learned to make that trick work made it possible for me to analyze a large traffic accident database in less than half the time that was estimated. Eventually, I got yelled at, which was a punishment that fit the crime.

Rick "with Chuck on this one and arguing against the notion that it has anything to do with being liberal or conservative" Denney

Tabor · Post by **Tabor** » Wed Jun 29, 2005 3:20 pm

Rick Denney wrote:...Chuck's example is a case where the punishment does not fit the crime....

This is really something.

The kids were smart enough to hack the school. Boo hoo. Maybe the school should pat themselves on the back for creating enlightened users of technology and take the computers away. They've learned enough for now.

The school gave computers to high school kids and then expected them not to learn all of the ways they could use them. That is about as smart as the parents who send their kids to Neverland ranch and expecting nothing weird to happen. It is like giving kids the key to the beer room and telling them not to use it. It is like putting a steak in front of my dog and telling him not to eat it. (he wouldn't eat it if I were watching but the minute I leave the room...)

Having taught in a school where the kids were given laptops, it is a given that they will find ways around every possible security feature. Security needs to be implemented with this given in mind.

Yeah, yeah I know...the kids did the crime so they should do the time. The problem is that a school is supposed to know a little about how kids think...hmm

windshieldbug · Post by **windshieldbug** » Wed Jun 29, 2005 3:25 pm

Certainly it doesn't take very many brain cells to see what's going to happen under these circumstances... can the students claim "entrapment"?

Joe Baker · Post by **Joe Baker** » Wed Jun 29, 2005 4:09 pm

Now, wait just a second. When folks say that a felony conviction is too much, they may well be right. But to say that giving students a tool makes the school complicit in the students' abuse of that tool is going just a bit far! Better not give a student a mouthpiece, he's liable to fling it at the band director. It'd be the BD's fault, too, for giving it to the student. And better not give the kid a scalpel to dissect a frog -- he might stab a classmate. Not his fault, of course -- the teacher should have KNOWN that's what a teenager would do with a pointy instrument! What's next with you guys -- girls who go out in public are just asking to be raped?? Sheesh.

I'm just not buying any of this. By the time a student is in high school, they know what's right and wrong. My kids have been in four different school districts plus a private school, and in EVERY CASE they had to sign an agreement outlining the rules for using the computers.

I do think a lot of people are making the wrong comparison when figuring out what the punishment should be, though. Instead of asking "what if the kid had broken into someone's house" or "... into the school", why not ask "what would happen to an adult who hacked his boss's password? At a minimum, he'd be fired (and it'd be tough getting another job, I might add, with his previous employer saying he's inelligible for rehire). In MANY cases, the employee would be prosecuted. Felony or misdemeanor? I don't know, and I'm not sure I would want the responsibility of deciding.

But this IS a serious thing these kids did, and they need to bear the FULL blame. If someone was careless with a password, he should take the full blame for that, but that's a different offense.

As far as punishment for the kids, if it were up to me I think it'd be significant community service (100 hours or more) and probation, with their records expunged if they can keep their noses clean until age 21.
_____________________________________
Joe Baker, who thinks there are probably a couple thousand students in this school waiting to see how serious the school takes their computer security.

Chuck(G) · Post by **Chuck(G)** » Wed Jun 29, 2005 4:48 pm

Joe Baker wrote:why not ask "what would happen to an adult who hacked his boss's password?

Hmmm, I used to get paid for doing things like hacking passwords. I even helped develop a forensics course where one of the problems on the final exam was to hack a password...

I guess context is everything.

Chuck "IACIS LIfe Member"(G)

Joe Baker · Post by **Joe Baker** » Wed Jun 29, 2005 5:24 pm

Chuck(G) wrote:
Joe Baker wrote:why not ask "what would happen to an adult who hacked his boss's password?
Hmmm, I used to get paid for doing things like hacking passwords. I even helped develop a forensics course where one of the problems on the final exam was to hack a password...

I guess context is everything.

Chuck "IACIS LIfe Member"(G)

Ah, but the key here is "the boss's password"! I could be wrong, but I'll bet that would have been an entirely different matter!
________________________________
Joe Baker, who notes that the police get paid to put people in jail, too, but (usually) not their bosses!

Chuck(G) · Post by **Chuck(G)** » Wed Jun 29, 2005 5:29 pm

Joe Baker wrote:Ah, but the key here is "the boss's password"! I could be wrong, but I'll bet that would have been an entirely different matter!

You know, there are some days when I think I'd need that service, but generally I can remember my own passwords...

Joe Baker · Post by **Joe Baker** » Wed Jun 29, 2005 5:40 pm

Chuck(G) wrote:
Joe Baker wrote:Ah, but the key here is "the boss's password"! I could be wrong, but I'll bet that would have been an entirely different matter!
You know, there are some days when I think I'd need that service, but generally I can remember my own passwords...

Okay, boss... you win!!

_____________________________
Joe Baker, who's going home now...

TexTuba · Post by **TexTuba** » Wed Jun 29, 2005 5:47 pm

Joe Baker wrote:By the time a student is in high school, they know what's right and wrong.What would happen to an adult who hacked his boss's password?

I agree with you that kids in high school are conscious of what is right and wrong. And yes, they should be punished for what they have done.
But I believe it is different with an adult. If a student knows right or wrong, then an adult sure as hell should know what's right or wrong!!

It also depends on where the adult works. If we're talking a place of business like where I work then at best a misdemeanor. But if we're talking a corporation that has not only co-workers' info. but customers' info. then that's a felony in my opinion.

Ralph

Rick Denney · Post by **Rick Denney** » Wed Jun 29, 2005 6:10 pm

Joe Baker wrote:Now, wait just a second. When folks say that a felony conviction is too much, they may well be right. But to say that giving students a tool makes the school complicit in the students' abuse of that tool is going just a bit far!

I agree. I think they should be punished--appropriately.

But there is a matter of degree, and the response of the school district (and DA) smacks of the sorts of zero-tolerance distortions that put a kid up on charges for bringing an Aspirin to school. That's why the retributive approach is ethical, it minimizes those distortions. We conservatives often get on our law-and-order high horse and push for harsher and harsher penalties, and we often do that because so many criminals are coddled. But inappropriate punishment to either extreme is wrong, and that's why our system was based on the concept of just retribution.

Again, there is a matter of degree. The students did not hack into the school's computer system. They did not gain access to grades, administrative information, financial information, or anything like that. All they did was bypass software designed to restrict access during web use. Yes, that's a punishable offense, but it is not stealing as so many seem to be saying. I can see no instance of theft or even trespass in this story. To me, it's about the same as being caught with a Playboy magazine at school. Yes, they know better, and yes, they should be punished.

The problem with an excessive response is that it will cause a hew and cry, with the result that those who do hack into personal information and do steal and otherwise misuse that information will not be distinguished from those who are trying to sneak a peak at a web site where they don't belong. Excessive punishment for minor crimes undermines the authority for appropriate punishment for major crimes, it seems to me.

Rick "who thinks schools have lost their ability and authority to use plain common sense" Denney