High School Responds To Student's Prank By Asking Local Law Enforcement To Step In And Investigate

from the now-who's-acting-like-a-child? dept

I see we're still handling things stupidly when it comes to school disciplinary problems. For years now, many schools have been steadily abdicating their responsibilities, allowing in-school law enforcement (commonly called "School Resource Officers") to hand out discipline that school administrators used to handle themselves.

This hasn't worked out well for students. It has turned standard discipline problems into police matters and given students a head start on having their futures ruined for juvenile (in all senses of the word) mistakes.

Recently, a high school in Glastonbury, Connecticut was horrified to find it had been pranked. The Hartford Courant's first pass at the breaking news opened with this:

An inappropriate quote has halted distribution of Glastonbury High School’s 2021 yearbooks and police have been called to investigate, the principal confirmed Monday.

How does an "inappropriate quote" become the subject of a police investigation? The rest of the reporting didn't explain. Neither did school administrators. But they did hint it had something to do with bullying.

A student using a false name submitted the quote printed in the yearbook, which was being distributed, Principal Nancy Bean wrote to students and parents on Friday.

Bean would not describe the quote, but she wrote, “We are saddened and distressed by what happened. Acts of bias, bullying and cruelty are not acceptable at our school. We are committed to ensuring all Glastonbury High School students feel safe and supported.”

While it may have been possible some sort of stalking or harassment was taking place that might have merited a law enforcement response, the principal's explanation that the quote had been "submitted" by a student using a fake name suggested nothing more than a bored student taking the high school for a ride.

Later reporting filled in more details. But it still didn't explain why the school felt compelled to involve the police. Nor did it explain why the police felt compelled to remain involved.

A quote by Adolf Hitler inserted into Glastonbury High School’s 2021 yearbooks has halted distribution of the yearbook and police have been called to investigate.

A student using a false name submitted the quote printed in the yearbook, which was being distributed, Principal Nancy Bean wrote to students and parents on Friday. The quote under a student’s photo was attributed to George Floyd, the Black man killed by police one year ago in Minnesota, a photo of the yearbook entry sent to The Courant Monday afternoon showed.

That it involved George Floyd's name and Adolph Hitler's words still doesn't make it a crime. And, again, the principal said a student "submitted" the quote. Those vetting the yearbook before publication failed to catch it. A prank isn't a crime, no matter how terrible it made administrators feel once they realized they'd been tricked into publishing (and distributing) a Hitler quote.

Since the original reporting, a few more details have come to light. And there's still nothing that suggests a criminal act has occurred. It only suggests the school needs better editors and/or a more tightly-controlled submission system.

In an email to the school community, Glastonbury High School’s principal and the district’s superintendent said the quote — which appeared under a student’s photo — was submitted by a different student using a false name. They said they also uncovered an offensive quote glorifying war and an entry, which referenced the “Boston Bomber.” The district’s priority is supporting the students, who were victimized by this act.

Fast forward to a couple of days past the point of the original reporting and a new narrative is being developed, possibly to justify the involvement of law enforcement.

A letter released by the Glastonbury school superintendent said the student gained access to a computer system and submitted a quote from Adolf Hitler, but falsely attributed the message to George Floyd.

"Gained access." That's incredibly vague. If a student had hacked a secure system or accessed administrative systems they had no authority to access, it might be a crime. But only "might." And only if prosecutors are willing to abuse badly-written laws to convert a prank into criminal charges.

The Glastonbury Police were a little more direct in the statement given to Newsweek:

"Although we find the quote to be disturbing, our criminal investigation is not focused on the content of the quote itself, but instead we are focused on investigating the unauthorized access of a computer system through which students submitted their quotes to be published in the yearbook."

This still doesn't explain anything. The official statement from the school superintendent makes no mention of unauthorized access. It also notes the student has already been punished by the school for this prank. All the letter says is the student used a fake name to submit fake quotes. That's not illegal, no matter how embarrassed school officials feel. And this never would have been the end result if schools hadn't become increasingly comfortable outsourcing their disciplinary problems.

Filed Under: cfaa, connecticut, glastonbury, hacking, kids, police, pranks, school resource officers, schools, students, unauthorized access

Did A Former National Parks Employee Violate The CFAA By Tweeting About Climate Change?

from the the-tweets-heard-round-the-world dept

As you may have heard, over the past few days, there's been a lot of talk about various US government Twitter feeds "going rogue" in what many believe is an attempt at a bit of civil disobedience following gag orders being sent from the White House to various federal departments and agencies, with a particular ban on social media. Soon after that came out, the Twitter feed of the famed Badlands National Park in South Dakota, started tweeting about climate change:

Those tweets have since been deleted, but they certainly caused quite a stir, and there's even what claims to be a private rogue National Parks Service twitter feed that won't be silenced at @AltNatPartSer. That's apparently inspired other government employees to set up similar "rogue" Twitter accounts. As I write this, there are about two dozen such accounts on this list, with some personal favorites being the @Alt_FDA, the @RogueNASA and @AltFedCyberz. Now, it's important to state that there's no direct proof that these are actually run by federal employees, but the whole thing is fascinating to watch.

But, that alone doesn't necessarily make it worthy of a Techdirt post (yes, there's a possible Streisand Effect angle on all of this, but it remains to be seen how strong that really is). What caught my eye, however, was how the National Park Service eventually explained those original Badlands tweets, telling BuzzFeed that they were done by an ex-employee who had retained his password, but wasn't authorized to tweet from the account:

Now, the exact wording of that statement also made my ears perk up, because "not currently authorized to use the park's account" could have pretty serious legal consequences. As reporter Matt Pearce unfortunately, but correctly, points out, this could be interpreted, by some, to be a violation fo the CFAA.

You remember the CFAA, of course. That's the "anti-hacking" Computer Fraud and Abuse Act, that has an unfortunately long history of being twisted and questionably interpreted to mean that just about anything people don't like that you do on a computer is potentially a violation. In particular, many cases have focused specifically on what constitutes "without authorization" or "exceeds authorized access" under the law. The fact that the NPS directly claims that this person was "not currently authorized" certainly could be seen to trip the "without authorization" or "exceeds authorized access" lines.

Of course, the CFAA has different sections -- and most of the cases we talk about tend to focus on 1030(a)(4) which covers accessing information whose value is over $5,000. It's difficult to see how one could twist the Badlands tweets as being about accessing information valued at more than $5,000, but there is also 1030(a)(3), which one would hope also would not apply... but where you could see an overzealous DOJ try to make it stick. That's the section that says it's a violation of the CFAA to access a computer that "is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States."

Now, it's pretty clear that the intent here is to go after someone who hacks into a system and somehow interferes with the government making use of that computer (and, remember, the entire reason we have a CFAA is because some clueless politicians -- including Ronald Reagan -- freaked out about the very, very fictional movie War Games). But, given how the DOJ has stretched the interpretation of the CFAA in the past, would it be possible for them to try to claim that by making unauthorized access to a Twitter account, and tweeting those tweets, it was using a computer that "is used by the Government" and the "conduct affects that use by or for the Government of the United States" and that the access was "without authorization"? It... seems unfortunately possible.

So far, the administration doesn't seem too concerned about this... but just the fact that this is even possible is yet another reminder of just how ridiculous the CFAA is, and how it is in desperate need of serious reform.

Filed Under: cfaa, climate change, donald trump, former employee, national park service, tweets, unauthorized access

Unfortunate Ruling Says Changing Your IP Address Can Be 'Unauthorized Access' To A Public Website

from the really-now? dept

We've covered for a while why we think Craigslist made a mistake in suing 3taps and Padmapper over scraping of Craigslist data. Of particular concern were the very bad legal precedents this may set, which tend to be completely contrary to Craig Newmark's own stance on internet freedom (of which he's been a strong supporter). Indeed, the legal arguments made by Craigslist are insulting to those who believe in internet freedom and really put Craigslist in a poor light. 3taps and Padmapper were driving more traffic to Craigslist and enhancing the service -- something that lots of sites on the internet do all the time. And yet they're facing very harsh penalties.

While an initial court ruling found that some of Craigslist's wackier theories didn't apply (e.g. violating the terms of service isn't a CFAA violation and the copyright claims concerning Craigslist posts failed), the latest ruling, unfortunately, finds that the combination of a cease-and-desist letter and merely changing your IP address creates unauthorized access to a public website. That's troubling on a variety of levels, mostly because changing an IP address isn't any form of "hacking." It's incredibly easy to do, and in many cases happens automatically without any input from users, if they have a dynamic IP address.

The EFF points out how dangerous a ruling this is:

Changing your IP address is simply not hacking. That's because masking your IP address is an easy, common thing to do. And there's plenty of legitimate reasons to do so, whether its to protect your privacy, preserve innovation or avoid price discrimination....

There's a serious potential for mischief that is encouraged by this decision, as companies could arbitrarily decide whose authorization to "revoke" and need only write a letter and block an IP address to invoke the power of a felony criminal statute in what is, at best, a civil business dispute.

Similarly, Orin Kerr, who tends to be more sympathetic about these kinds of cases, finds the use of a mere IP address change to be quite problematic:

Judge Breyer sees IP blocking as sufficient. But it’s unfortunate that Breyer doesn’t give the issue more analysis, as I think it’s a really interesting question. The counterargument runs like this. IP addresses are very easily changed, and most people use the Internet from different IP addresses every day. As a result, attempting to block someone based on an IP address doesn’t “block” them except in a very temporary sense. It pauses them for a few seconds more than actually blocks them. It’s a technological barrier in the very short term but not in the long term. Is that enough to constitute a technological barrer?

Judge Breyer’s opinion appears to mix up two different aspects of the CFAA. The first aspect is the prohibition on unauthorized access, and the second is its associated mental state element of intent. The CFAA only prohibits intentional unauthorized access; merely knowingly or recklessly accessing without authorization is not prohibited. So whatever unauthorized access means, the person must be guilty of doing that thing (the act of unauthorized access) intentionally to trigger the statute. Breyer seems to mix up those elements by focusing heavily on the fact that 3taps knew that Craigslist didn’t want 3taps to access its site. According to Judge Breyer, the clear notice meant that the case before him didn’t raise all the notice and vagueness issues that prompted the Ninth Circuit’s decision in Nosal.

I think this analysis is somewhat misdirected. In my view, the fact that 3taps was on notice that Craiglist did not want them to access the Craigslist website is only relevant to show intent. From that perspective, Judge Breyer should have been clearer that the cease-and-desist letter couldn’t make visiting the website an “unauthorized access.” The letter is just a written statement of the owner’s wishes as to who can visit the site, just like Terms of Service. In my view, whether the facts of the 3taps case amount to an unauthorized access hinges on the circumvention of IP blocking. If so, then the cease-and-desist letter shows that the act of unauthorized access was intentional; if not, then the letter does not have any relevance to the CFAA.

That's really the key point here. The cease and desist is no different than the terms of service -- and yet it's already been stated that violating the terms isn't a CFAA violation. So the real issue here is the changing of an IP address. And the idea that a mere changing of an IP address opens you up to criminal liability is insane. This is a horrible precedent and one that Craigslist and Craig Newmark should be ashamed of, having brought it into this world for no good reason.

Filed Under: cfaa, changing ip, hacking, ip address, unauthorized access
Companies: 3taps, craigslist, padmapper

MIT Defends Its 'Neutral' Stance On Aaron Swartz As 'Reasonable' Even As It Failed To Understand Importance Of The Case

from the sometimes-remaining-neutral-is-a-bad-thing dept

It's taken some time, but the report that MIT's President requested from professor Hal Abelson concerning MIT's roles in the prosecution of Aaron Swartz has now been released. It's quite detailed and well worth reading. The "bottom line" is that it argues that MIT did its best to "stay neutral" throughout the entire process, and that this was a perfectly reasonable legal strategy, though, possibly not the best ethical strategy. MIT's President, Rafael Reif, has issued a letter with the report, stating that "I am confident that MIT's decisions were reasonable, appropriate and made in good faith." Taren Stinebrickner-Kauffman quickly hit back, arguing that the claim that MIT was "neutral" is not very convincing:

MIT’s behavior throughout the case was reprehensible, and this report is quite frankly a whitewash.

Here are the facts: This report claims that MIT was “neutral” — but MIT’s lawyers gave prosecutors total access to witnesses and evidence, while refusing access to Aaron’s lawyers to the exact same witnesses and evidence. That’s not neutral. The fact is that all MIT had to do was say publicly, “We don’t want this prosecution to go forward” – and Steve Heymann and Carmen Ortiz would have had no case.

Separately, she contrasts MIT's behavior with JSTOR's -- the organization which really had the only legitimate (and even then a weak legitimacy) claim to any "harm" from Swartz's actions. JSTOR very publicly made it known that it did not support the prosecution and did not wish to see Swartz prosecuted. MIT took a very different approach. From the summary of the paper:

MIT never requested that a criminal prosecution be brought against Aaron Swartz. Early in the prosecution by the U.S. Attorney’s Office in Boston (the “USAO”), MIT adopted a position of remaining neutral, with limited involvement. MIT hired outside counsel who had experience in criminal law and in the functioning of the Boston U.S. Attorney’s Office; and MIT requested and received subpoenas for the production of documents. Some documents were turned over to the USAO prior to receiving a subpoena, but, for the reasons discussed in this report, this production did not violate federal laws.

In keeping with its stance of neutrality, MIT never issued a public statement about Swartz’s prosecution or advocated publicly on his behalf, even though doing this was urged by Aaron Swartz’s family and legal team and by two members of the faculty. One of the reasons for MIT’s silence was the good-faith belief, based on private conversations with the lead prosecutor, that the Institute’s opinion would have no effect on the prosecution, and that public statements might make circumstances worse for Aaron Swartz. MIT did inform the prosecution that it was not seeking punishment for Swartz, and it did inform the defense that it was not seeking any civil remedy from him.

The report also claims that, basically, no one in "the MIT community" seemed to care about the story until after Swartz's death, which seems like a bit of a cop out. Also, there's this:

MIT took the position that U.S. v. Swartz was simply a lawsuit to which it was not a party, although it did inform the U.S. Attorney’s Office that the prosecution should not be under the impression that MIT wanted jail time for Aaron Swartz. (MIT did not say it was actually opposed to jail time.)

Basically, this policy of "neutrality" may have been legally reasonable, but could still be seen as highly questionable given MIT's role as an institution of higher learning -- one that famously encourages open exploration and sharing of knowledge and information, as well as some element of hacking. I think David Weinberger makes the right point here:

When Pres. Reif writes that MIT’s actions were “reasonable, appropriate and made in good faith” I think we have to ask “Appropriate to what?” To MIT’s interests as a legal entity? Very likely. To MIT as a university? Not in my book.... MIT’s timid “neutrality” wasted an opportunity to stand against the unreasonable and inappropriate tactics of the prosecutors, and to stand for the spirit of inquiry, openness, innovation, and risk-taking that has made MIT one of the world’s great universities.

I understand that MIT wasn’t going to say that it was fine with Aaron’s breaching its contract with JSTOR. But MIT could have stood against prosecutorial overreach, and for the values— if not the exact actions— Aaron embodied.

That's exactly right. Sometimes taking a neutral stance on an issue of great importance is the equivalent of making the wrong choice. MIT missed the boat here.

Separately, Larry Lessig makes an important point: buried in the report is the fact that prosecutors never bothered to ask MIT if Swartz's access was unauthorized, even as they charged him with unauthorized access, and used that as the key to pressing the case:

As far as the Review Panel could determine, MIT was never asked by either the prosecution or the defense whether Aaron Swartz’s access to the MIT network was authorized or unauthorized—nor did MIT ask this of itself. Given that (1) MIT was the alleged victim of counts 9 and 12, (2) the MIT access policy, its Rules of Use, and its own interpretation of those Rules of Use (including the significance or “materiality” of any violation of those terms) were at the heart of the government’s CFAA allegations in counts in both indictments, and (3) this policy and these rules were written, interpreted, and applied by MIT for MIT’s own mission and goals—not those of the Government— the Review Panel wonders why.

As Lessig points out, this makes the tragedy of the situation even worse. Not only did MIT try to take a "neutral stance," nobody either at MIT nor among the prosecutors ever even bothered to figure out if Swartz's access really was unauthorized.

Filed Under: aaron swartz, cfaa, hal abelson, mit, neutral, rafael reif, unauthorized access

RIAA Knows (But Tried To Hide) That Most 'Unpaid' Music Acquisition Comes From Offline Swapping

from the online-piracy-is-a-footnote dept

Lots of people have discussed this in the past, but the RIAA's focus on going after file sharing sites and online cyber lockers seemed to ignore the fact that so much music is actually shared on a person to person basis -- rather than online. But, there weren't any public numbers that showed the relative difference... until now. Torrentfreak got their hands on a "confidential" presentation put together for the RIAA by NPD, which shows pretty clearly that most of the "unpaid" music that people get comes from person to person copying, via hard drive trading and burning/ripping from others. P2P and cyberlockers actually make up a relatively small percentage: To be fair, I've found NPD's numbers to be suspect in the past, but they are one of the RIAA's favorite vendors for this kind of data. So, if even they're showing that online file sharing is relatively small, then that's at least noteworthy. The fact that this information had been kept "confidential" certainly suggests that the RIAA knows this highlights how all of their freaking out over online access to unauthorized content is exaggerated, and that people can and will find plenty of other ways to share.

One hopes that this doesn't presage more attacks on such person to person sharing either, but I wouldn't bet on it. Remember, we're talking about an industry which has regularly sought to plug the analog hole. When we see proposals in Congress that would effectively allow Customs officials to start searching hard drives and MP3 players, you have to wonder if the entertainment industry is really gearing up to go after this kind of sharing as well.

Of course, what would be much nicer (and a hell of a lot more effective) is if they finally woke up to the fact that this is a reality -- and that there are ways to deal with it on the product and business model sides, rather than on the enforcement side. If they put one-tenth the effort into helping out with that as they do for pushing for greater enforcement, the online music landscape would look so incredibly different and would be so much better for everyone.

Filed Under: music, personal sharing, sharing, sneakernet, unauthorized access
Companies: npd, riaa

Facebook Abusing Computer Crime Law To Block Useful Service

from the it's-not-hacking dept

We noted recently that the courts (and plaintiffs in lawsuits) have been stretching computer hacking laws in dangerous ways. The laws that were clearly intended to cover situations of malicious hackers breaking into a computer system they have no right to be in are being twisted around, such that contractual language is being used to make all sorts of access "unauthorized" under the terms of the law. For example, we noted a case where using an employer's computer to access information for personal use... could be seen as "unauthorized access" and, thus, criminal computer hacking.

Last year, we wrote about a bizarre lawsuit where Facebook sued Power.com, a website that tried to aggregate various social networks into a single interface. That could be pretty useful. Facebook didn't like it and sued. But just because Facebook doesn't like something, it doesn't make it illegal. What if users want to access Facebook that way? Facebook tossed out a variety of legal theories, including the idea that this was criminal hacking, because it was unauthorized access. How is it unauthorized? Well, here Facebook got creative. It has, hidden within its terms of service the note that accessing Facebook through "automatic means" is forbidden. Facebook says that Power.com's aggregator is "automatic means" (which seems questionable), and thus accessing Facebook via Power.com is no longer authorized. Since the access is not authorized, then it's... unauthorized access, aka hacking, and a crime under California's computer crime statute.

The EFF has now filed an amicus brief in the case, pointing out that this would be a ridiculous stretch of California's computer crime law:

"California's computer crime law is aimed at penalizing computer trespassers," said EFF Civil Liberties Director Jennifer Granick. "Users who choose to give their usernames and passwords to aggregators like Power Ventures are not trespassing. Under Facebook's theory, millions of Californians who disregard or don't read terms of service on the websites they visit could face criminal liability. Also, any Internet company could use this argument as a hammer to prevent its users from easily leaving the service as well as to shut down innovators and competitors."

Even the simple use of the automatic login feature of most browsers would constitute a violation under Facebook's theory, since those services are "automatic means" for logging in. But the risk for users is even broader. If any violation of terms of use is criminal, users who shave a few years off their age in their profile, claim to be single when they are married, or change jobs or addresses without updating Facebook right away would also have violated the criminal law.

Hopefully, the court agrees...

Filed Under: computer crime, hacking, unauthorized access
Companies: facebook, power.com

BPI Survey Suggests Spotify Hasn't Magically Decreased Desire For Unauthorized Music Access

from the sorry,-spotify dept

There was some buzz earlier this year concerning reports that new streaming apps, like Spotify, somehow decreased unauthorized access to music. And yet, a new study from BPI suggests unauthorized access to music continues to grow, despite the rise of authorized services like Spotify. Now, there are some caveats. BPI isn't exactly known for being entirely accurate with data and these results are from an online survey. While you would think that fewer people would admit to unauthorized access in an online survey (people don't like to fess up), counteracting that is the fact that BPI has incentives to suggest the issue of piracy is a big deal, as it's pushing hard to force ISPs to kick people offline for file sharing. Still, what strikes me as interesting is that BPI still keeps insisting that this is a "problem," without any evidence that this is true. The only real "problem" is the failure of the record labels that BPI represents to adjust their business models. If they did that, there wouldn't be much of a problem at all. But, the labels don't want to do that. They want the government to rescue them and to pretend they can keep doing business they way they always did.

Filed Under: music, piracy, surveys, uk, unauthorized access
Companies: bpi