(Note: I posted this last night, but there's been even more creepy revelations this morning in this ongoing saga)
Holy. Fucking. Shit.
Two days ago, I posted an updated diary on the latest developments in the Lower Merion Webcam Spying Scandal®.
For the most part, the 500+ comments that followed the diary were absolutely appalled at the conduct of the school district, but there were a few brave (???) souls who were still trying to at least partially defend the administrations' actions, claiming that "there doesn't seem to be much "there" there" and so forth, in spite of the school admitting that they:
a) installed the spying software
b) never informed the students or parents about it
c) never checked with any attorneys or legal authorities to see if it was legal to use such software
d) activated it (at least) 42 times 80 times 146 times, in one case even sending the police to the wrong house:
As a prime example, we initially attempted to recover a stolen laptop that reported back to us it's internet address and DNS name. The police went to the house and were befuddled to find out the people we knew had the laptop was not the family that lived there...well, we eventually found out that they were the neighboring house and were borrowing the unsecured WI-FI.
I should also note that the IT director took the fifth during her deposition. Now, that's certainly her right, and it doesn't prove anything, but it also sure as hell doesn't look good.
Well, guess what?
Lower Merion report: Web cams snapped 56,000 images
Lower Merion School District employees activated the web cameras and tracking software on laptops they gave to high school students about 80 times (146 times; see update below) in the past two school years, snapping nearly 56,000 images that included photos of students, pictures inside their homes and copies of the programs or files running on their screens, district investigators have concluded.
...in at least five instances, school employees let the Web cams keep clicking for days or weeks after students found their missing laptops, according to the review. Those computers - programmed to snap a photo and capture a screen shot every 15 minutes when the machine was on - fired nearly 13,000 images back to the school district servers.
Of course, the school--which initially denied that the system existed, then denied using it, and then claimed that it had "only" been used 42 times (although, of course, they never said how long the surveillance was kept running after those activations) now claims that:
"none [of the photos] appeared to show "salacious or inappropriate" images
Oh. Well, I guess he must be telling the truth this time.
About 38,500 images...came from six laptops that were reported missing from the Harriton High School gymnasium in September 2008...The next biggest chunk of images stem from the five or so laptops where employees failed or forgot to turn off the tracking software even after the student recovered the computer.
In a few other cases, Hockeimer said, the team has been unable to recover images or photos stored by the tracking system....And in about 15 activations, investigators have been unable to identify exactly why a student's laptop was being monitored.
Hockeimer said that the investigation found that administrators activated the tracking system for just one student this year who failed to pay the $55 insurance fee.
...
But the requests were loose and disorganized, he said, sometimes amounting to just an brief e-mail.
"The whole situation was riddled with the problem of not having any written policies and procedures in place," Hockeimer said. "And that impacted so much of what happened here."
And this is just what the DISTRICT'S lawyer and investigation are admitting.
I can't begin to fathom what the objective investigation by the FBI and county prosecutors will reveal.
Update: I linked to this guys' blog when I posted about the story back in February, and felt it a good idea to re-post it again; he's an IT security pro who's done a stellar job of analyzing the dirty underbelly of this whole story.
A few choice cuts:
The Spy at Harriton High
The primary piece of evidence, already being reported on by a Fox affiliate, is this amazing promotional webcast for a remote monitoring product named LANRev. In it, Mike Perbix identifies himself as a high school network tech, and then speaks at length about using the track-and-monitor features of LanRev to take surreptitious remote pictures through a high school laptop webcam. A note of particular pride is evident in his voice when he talks about finding a way outside of LANRev to enable "curtain mode", a special remote administration mode that makes remote control of a laptop invisible to the victim.
...
Perbix discusses methods for remotely resetting the firmware lockout used to prevent jailbreaking of student laptops. A jailbreak would have allowed students to monitor their own webcam to determine if administrators were truly taking pictures or if, as the school administration claimed, the blinking webcams were just "a glitch."
...
This script allows for the camera to appear shut down to user applications such as Photo Booth but still function via remote administration: "what this does is prevent internal use of the iSight, but some utilities might still work (for instance an external application using it for Theft tracking"
What's the purpose of shutting down a camera for the user of the laptop but still making it available to network administrators? Ask yourself: if you wanted to convince someone that a webcam blinking was a glitch, would disabling the cameras help make your case?
...
In a strange twist, the makers of LANRev have come out with a statement saying that school network techs should never have used their software to engage in theft recovery:
"We discourage any customer from taking theft recovery into their own hands," said Stephen Midgley, the company's head of marketing, in an interview Monday. "That's best left in the hands of professionals."
Here's the actual webcast that Mike Perbix, the Lower Merion IT guy who installed and administered the whole surveillance system, made in which he openly bragged about his capabilities:
And here's an excerpt from PBS's "Digital Nation" in which an unrelated school administrator does a live demonstration of how this sort of software works:
Tuesday Morning Update: The number of times that the school district admits that the webcams were activated has somehow magically increased from "42 times" (February) to "80 times" (yesterday) to "about 146 times" as of this morning.
"In 48 of those activations, images were recovered; 68 showed only the computer's Internet address. The rest showed nothing or could not be recovered.
The images included photos of students, pictures inside their homes, and copies of the programs or files on their screens, the investigators said."
Update x3: I also read something about the school districts' insurance company requesting to be relieved of financial responsibility under the circumstances; Adam B. was kind enough to find a source for this. Neither of us can vouch for the reliability of the claim, but it sure as hell sounds reasonable to me:
Even More Troubles for the Lower Merion School District
Then, late Friday afternoon, the school district and district officials were sued again in Federal Court in Philadelphia, this time the complaint being filed by Graphic Arts Mutual Insurance Company, an insurer of Lower Merion School District seeking a declaratory judgment that due to the nature of the underlying controversy it had no duty or obligation to defend or indemnify the district with regard to the underlying action filed by Robbins in February.
This would seem to be backed up by "Courthouse News Service", although they might have just used the above link as their source:
Despite the Lower Merion School District's $1 million policy, Graphic Arts Mutual Insurance claims it has no obligation to defend the district from a lawsuit accusing it of spying on students and families through Webcams in students' school-issued computers, in Philadelphia Federal Court.
Update x4: I should also note, as Dirk McQuigley mentions in the comments, that another disturbing part of this mess is the "kill the messenger/blame the victim" angle that much of the press and a lot of the parents of the district seem to have about the Robbins' family (the ones who filed the lawsuit in the first place). Apparently the kid is a poor student and the family has been involved in other lawsuits; their detractors are trying very hard to make them out to be grifters, out for a quick buck, bla bla bla.
All of which may (or may not) very well be true, but even if it is...what of it? They're making this kid out to be John Bender from The Breakfast Club, and perhaps he is--but that still doesn't give the school the right to spy on his bedroom.
Hell, if the Palin family--the ultimate grifters--was the one filing the lawsuit, the school district would still be in deep, deep shit if the allegations were true, which, in this case, many of them (if not all) clearly are.
Even if the entire district hates this family's guts, the moment that a photo of one of THEIR daughters in her bathrobe/towel/underwear shows up, you watch and see how quickly the "troublemaker family" attacks dry up.
Update x5: Two more items to add. Thanks to BlueSue in the comments who pointed out this quote from the AP story last night:
Other times, the district captured screen shots of instant messages or video chats the Harriton High School sophomore had with friends, he said.
"Not only was Blake Robbins being spied upon, but every one of the people he was IM chatting with were spied upon," said Haltzman, whose lawsuit alleges wiretap and privacy violations. "They captured pictures of people that have nothing to do with Harriton. It could be his cousin from Connecticut."
Secondly, it occurs to me that there's ANOTHER party which may very well have the basis for some sort of defamation of character lawsuit: Apple. Their name is being dragged through the mud here as well, because even though webcams are ubiquitous in just about every laptop these days, and remote surveillance software is widely available for Windows/Linux systems as well as Macs, the fact remains that in this particular case, every laptop was a Mac, and there's a LOT of people out there who can't distinguish between the hardware, the OS, the software and the network that it's on.
In other words, there's gonna be a certain segment of people who are gonna be less likely to buy a Mac because "that's the one that they spied on the kids with" even though it had nothing to do with Apple. Perhaps a lawyer can speak to this possibility below?
Update x6: Minor update: Thanks to ETF below, who has confirmed the claim that the insurance company is also suing the school; here's a link to the actual Declaratory Judgement request. (PDF)
Update x7: At least one person has taken issue with two of my claims above: One, that the school district initially denied the program even existed; and two, that the school then denied using the program after it was made public.
This is a fair question, so here's my evidence for each:
1. "The school denied that the system existed"
Well, they admitted to never informing the students or parents about its' existence; then, when confronted by multiple students, (including, I believe, members of the student council) who suspected that the webcams were being activated, they were told that the webcam light flickering on & off was "just a software/hardware glitch".
http://strydehax.blogspot.com/...
http://www.saveardmorecoalition.org/...
"My name is Manuel Tebas. I was a student at Harriton High School, in the graduating class of 2009. We were the first year on the one-to-one laptop initiative. [...] I saw your post about removing webcam capability from the Macbook. It is possible - I did it last year. I will preface this by saying that when I did it, I was almost expelled, saved only by the fact that there was, at the time, no rule against doing so."
"I remember that the laptop was a requirement in school for many classes. That may remain so."
" had brought in my own personal computer to work on a project for school one day. I was doing a presentation involving programs not available on the regular computers, only in specific labs. I happened to have a copy of my own. My personal property was confiscated from me in a study hall when I was working on a school assignment because it was against the schools 'code of conduct'."
"Hi, I'm a 2009 Graduate of Harriton Highschool. [...] I and a few of my fellow peers were suspicious of this sort of activity when we first received the laptops. The light next to the web cam would randomly come on, whether we were in class, in study hall or at home minding our own business. We reported it multiple times, each time getting the response: "It's only a malfunction. if you'd like we'll look into it and give you a loaner computer."
"The webcam couldn't be disabled due through tough tough security settings. Occasionally we would notice that the green light was on from time to time but we just figured that it was glitching out as some macbooks do sometimes. Some few covered it up with tape and post its because they thought the IT guys were watching them. I always thought they were crazy and that the district, one of the more respectable ones within the state, would never pull some shit like this. I guess I was wrong."
"I am the father of a 17 y/o Harrington High student. She has had one of these laptops for 2 years. She has noticed the "green light" coming on but was not computer literate enough to know what initiated it"
Now, it's certainly possible that all of these people are lying--perhaps none of them are actual former students/parents from the district, or perhaps they are and they're misrepresenting what happened, but as the first link puts it:
Browse as many web forums as you like, the comments above are highly representative. Students were told green webcam activation lights going off at home were a glitch, were required to use a jailed computer, were threatened with expulsion if they attempted to jailbreak the computer to find the truth, and were not allowed to use computers they controlled.
That, to me, is flat-out denial of the program existing.
2. "The school then denied using the program"
http://www.inyork.com/...
PHILADELPHIA—A suburban Philadelphia school district accused of secretly switching on laptop computer webcams inside students' homes says it never used webcam images to monitor or discipline students and believes one of its administrators has been "unfairly portrayed and unjustly attacked."
They then go on, in the very next paragraph, to admit that it was activated 42 times (no, wait...80; no, wait...146...)
Now, you may quibble about semantics--they said they never used it to "monitor students" but only for theft/loss recovery...but even if they intended to only use it for theft/loss recovery, they couldn't help BUT "monitor" the students in some cases, if only to determine whether the laptop was in the possession of the correct student or not.
You can certainly defend their motives; I, for one, don't think they intended to set up a kiddie porn ring or whatever. However, pure motive or not, my statement still stands.
Update x8: As a follow-up to #7, here's the straight-from-the-horse's mouth quote from Lower Merion's very own FAQ...provided, ironically, by the same person who asked for evidence that the school claimed (at one time) to never have monitored students:
Did an assistant principal at Harriton ever have the ability to remotely monitor a student at home? Did she utilize a photo taken by a school-issued laptop to discipline a student?
No. At no time did any high school administrator have the ability or actually access the security-tracking software. We believe that the administrator at Harriton has been unfairly portrayed and unjustly attacked in connection with her attempts to be supportive of a student and his family. The district never did and never would use such tactics as a basis for disciplinary action.
Again, the semantics here are tricky. Was Mike Perbix or Carol Cafiero considered "high school administrators"?? Well, technically they may be "school district administrators" or "supervisors" or some other title, but that's an awfully thin argument.