Second, according to the link Mike G posted, it wasn’t a one-time occurrence; most of the kids noticed the camera light blinking at random times. Nor was it an accidental software glitch. A kid who disabled the camera was threatened with expulsion, but there was no rule against it – then the rules were changed. The laptops were taking pictures at random times, the computer administrator not only knew about it but did some hacking to make it possible, and given that the picture of Robbins somehow reached the principal, the pictures must have been sent over the internet for someone at the school to review.

And some of those pictures must meet the definition of child porn.

1) They claimed the software kind of “came with the systems”. This is false. They specifically chose LANRev, which is by no stretch of the imagination a “standard”.

2) They specifically modified LANRev in ways not intended by the manufacturer to make it possible to surreptitiously take snaps from the webcam without alerting the user, taking control of the laptop otherwise, or activating the anti-theft feature. So any evidence about how or when the anti-theft feature was activated tells us nothing about what pictures may have been taken.

And, IMO worse, now that we know the true facts, it’s clear that the intentional deception in the district’s press release is even more disturbing. There are many examples, most of them consist of equivocating between the theft tracking feature (which could take a picture only once the tracking mode was enabled, and is standard) and the independent snapshot feature (which can take a snapshot at any time and is something their IT department hacked in by themselves).

For example: “2. Why was the remote tracking-security feature installed?

Laptops are a frequent target for theft in schools and off school property. The security feature was installed to help locate a laptop in the event it was reported lost, missing or stolen so that the laptop could be returned to the student.”

Right, but we know know *that* feature was unrelated to the way the pictures were taken. Obviously, the reason for putting that question in there with that answer is to make us think that the remote tracking feature is the only way the laptop can be commanded to take a picture.

Marc Rotenberg wrote: A few thoughts:1. It seems very unlikely that the school’s characterization is correct.
[...]

If this security consultant’s analysis is correct, the school administrators are in very deep dung.

In comments on the earlier thread, I had defended the school district and the administrators. Things had to have been misinterpreted and blown up all out of proportion, right? Well, I guess I was wrong. If this guy’s presentation is anywhere near accurate, those people are going to be in a world of hurt.

Chris Travers: I thought the CFAA was irrelevant because presumably the school had authorization to access computers it owned.

Not over my home network it doesn’t. In order to command the laptop while it’s in the student’s home, they need to send that command over the child’s home network.

The laptop is configured to make a periodic “phone home” call. There is no way for them to connect out to the laptop because they don’t know where it is. So even if they didn’t take any pictures, one can make an argument that this periodic “phone home” was a search (reporting where the laptop was), and one that took place through unauthorized use of the home network.

However, this doesn’t get you much under CFAA for the reasons mentioned in the OP.

So far, it looks bad for the school administrators, but who knows? Maybe they have a memorandum from John Yoo, Jay Bybee and Miguel Estrada declaring that their conduct was lawful under a theory of inherent authority to safeguard the school.

piers: The school district denies that it took any photographic images of the plaintiff–at school or home. If you read the complaint, you’ll see that key facts are missing: when the photo was taken, what it depicts and who took it.

It seems to me that what they are alleging is:

1) The school disciplined the student for “improper” behavior at home (wtf?)
2) When asked, the school stated they could activate the web cam remotely.

Now, this doesn’t necessarily mean that the web cam was used but more likely that this was what the assistance principle may have said regarding the source of the information. However, even accepting the accusation, it could have been a cover for something like another student saying something, a conversation overheard, or something similar.

What I want to know is why the schools are actively engaged in parenting the kids when they are at home.

Holy Prepuce!: Without knowing about the whole remote-activated-webcam aspect, one might legitimately wonder why educational dollars are being used to hand out free laptops to residents of Philadelphia’s Main Line suburbs. Surely the money would be better spent in, say, Kensington or Strawberry Mansion.

Holy Prepuce!:

My sympathy is properly filed under a certain rude s word and syphilis.

5) that information is made available to the registered owner at the remote site
6) appropriate action is taken (or inappropriate action, as the case may be)

Then that is a legal flaw in the package. If it’s stolen it’s not the owners problem (well it is), but rather it’s the long-arm of the law to go and get it. While the owner *might* be permitted to get an “oi! we found it” and nothing more, the appropriate action in item 6 is for the antitheft server holder to call the police, donchathink?

This post was mentioned on Twitter by paulee: Insights by criminal law professor on the Lower Merion laptop spying case. http://bit.ly/aDwHer Interesting, but criminal case looks weak….

Marc Rotenberg: The CFAA allows you to aggregate damages, which could be relevant. The interesting part also of the CFAA claim is that the CFAA penalizes unauthorized intrusion and intrusions that “exceed authorization,” which arguably occurred here.

Who exceeded authorization and who had the right to give such authorization?

I would think that the school retained rights to authorize various forms of access. The issue here isn’t likely to be a winner for the parent. Common law tort issues, OTOH, may well apply.

On the other hand, if the school administration official acted outside the policies governing use of that software, that individual might be liable under the CFAA. However, would it be actionable by a third party? I don’t know. Any takers?

Marc.

On the less intrusive techniques, look here: http://seccure.xtool.com/xtooltracker.aspx “Internet Connection Information is the most commonly used information utilized by “track and trace” products. In most situations, the Local IP and the Public IP information is enough to recover a lost or stolen laptop.”

The company also says “XTool® Laptop Tracker has the ability to detect a camera connected to a laptop and can take a snapshot of the unauthorized user that is then relayed to the XTool® Monitoring Center!”

And then here is something really interesting: “This technique is ONLY installed/activated when the monitored laptop has been reported lost or stolen and with the owner WRITTEN authorization.”

I’ll rest my case that ECPA, and possibly CFAA applies, and see what Prof. Kerr has to say.

Marc.

But with these new revelations, it starts to make sense. Aside from better teachers, newer textbooks, and functioning buildings, what do rich kids in America get that poor kids don’t? Answer: the luxury of attending schools instead of mini-prisons equipped with metal detectors, rent-a-cops, and zero-tolerance policies that result in seventh graders being arrested for writing on their desks.

Obviously this inequality needed to be remedied by equivalently striping Harriton High kids of their dignity and privacy, but in a manner less offensive to Main Line aesthetics. Harriton kids can come to school safe in the knowledge that their gym bags won’t be x-rayed, and that their marker doodling will be remedied with Windex rather than handcuffs. But… Teacher is watching.

I have more to say on this topic here.

ptt: 5) that information is made available to the registered owner at the remote site

To be more clear, that information is made available to the registered owner when they check the remote site

For the record, I live in PA and I think both the PA wiretapping statute as well as the federal statute are archaic and events like this prove just that. The statues seem to exist to simply cover law-enforcement’s actions, and don’t protect or help the citizen much at all.

1) software is loaded on the device (iPhone, laptop, etc.)

2) upon booting or at some interval the software automatically looks up its own status at a remote site hosted by the software company or the manufacturer. This process goes unnoticed and triggers no particular activity until…

3) someone logs onto the remote site and reports the device as missing or stolen

4) the next time the device checks its status and finds that it has been stolen or is missing, a series of actions are triggered on the device itself and the results of those actions are sent to the remote site (photo, screenshot, IP data, etc.)

5) that information is made available to the registered owner at the remote site

6) appropriate action is taken (or inappropriate action, as the case may be)