The recent break-in and vandalism of an online charter school’s primary eMail program raises questions about the security of instruction delivered via the internet.

A 15-year-old student enrolled in California’s virtual Choice 2000 Charter High School broke into the school’s eMail and administrative software system Sept. 29 and erased two days’ worth of eMail correspondence and student attendance records.

The student “got into our system and basically told our auditing and eMail system to destroy itself,” said Dan King, director of Choice 2000. “It’s important to note that he did not get into our online classes.”

Choice 2000’s classes are held in a teleconference format similar to an internet chat room, where more than 40 students can attend at one time. In this format, teachers may present information, hold discussions, or answer student questions. In addition to teleconferencing, teachers and students communicate regularly through eMail.

The online charter school uses World Group software for eMail communication and attendance auditing. “We use an entirely different software package for the administration of our classes, called Interwise. That system was not harmed,” King said.

The records tampering occurred shortly after the student hacker, a minor, had been suspended from using World Group as punishment for another online infraction.

“He had gotten into a couple of his buddies’ [home] computers and tampered with them, so I suspended him from using World Group, which means no personal eMail for a couple of days. He was not barred from classes; he just had to send the eMails directly to me. But I guess that made him angry,” King said.

The school’s director of technology was able to trace the intrusion to the student, and the administration immediately reported the incident to the authorities, King said.

“We believe he basically gave another student’s account the powers of a system operator and got into the school using that account. Right now, we estimate $18,000 in damages for time spent and equipment replaced,” said Deputy David Cobb, lead investigator on the case with the Riverside Sheriff’s Department.

King places the estimate somewhat higher. “We estimate this has cost about $20,000 so far. That includes the loss of the average daily attendance records for those two days. It has taken a major effort to get back on track,” he said.

California uses average daily attendance (ADA) to determine the amount of funding a school receives. “I don’t think we will actually lose those two days, since this is a special case. The state will probably just look at the ADA for the days before and the days afterward and estimate from there,” King said.

Because of the hacking, Choice 2000 has had to re-enroll all students and account for two days of records that were lost because they had not been backed up. Some students had to redo homework that was lost, and teachers had to regrade tests lost when the eMail server was disabled.

The ease with which one student caused major damage may prompt educators to ask whether the delivery of online learning is just too vulnerable.

Cobb believes online high schools may be more vulnerable to attack than other high schools because “the common profile of a hacker is a juvenile or young adult,” and online high schools tend to be attended by computer-savvy students in that age group.

Not necessarily, counters King. “We are not more vulnerable than other schools in terms of security, because we have password protection, firewalls … But, because we depend entirely on eMail and the internet to deliver learning, it does hit us much harder when the system goes down,” he said.

What precautions could have been taken to prevent the intrusion? “It’s tough to say. Unfortunately, in today’s world, computer security can be a case of trial and error for us all, not just for schools. We all need to learn from our mistakes,” Cobb said.

King said the school is considering changing its whole eMail system.

“It may make us too vulnerable to have a closed system,” he said. “I also think we were overly dependent on [the World Group software] by doing both our eMail and attendance audit on it. We need to divorce the eMail from the audit. It’s the old adage ‘diversify,’ meaning don’t depend on one thing.”

Choice 2000 is in its fifth year as an accredited high school in Perris Union High School District. The school is tuition-free to students who are residents of California’s Riverside, San Bernardino, San Diego, Imperial, or Orange counties.

Choice 2000 Charter School

http://www.choice2000.org