A Pennsylvania school district accused of secretly switching on laptop computer webcams inside students’ homes is under investigation by federal authorities, a law-enforcement official with knowledge of the case told the Associated Press (AP).
For its part, the district says it never used webcam images to monitor or discipline students and believes one of its administrators has been “unfairly portrayed and unjustly attacked.”
The Federal Bureau of Investigation will look into whether any federal wiretap or computer-intrusion laws were violated by Lower Merion School District officials, the official—who spoke on condition of anonymity—told the AP on Feb. 19.
Days after a student filed suit over the practice, Lower Merion officials acknowledged Feb. 19 that they remotely activated webcams 42 times in the past 14 months, but only to find missing student laptops—which they noted might include “a loaner computer that, against regulations, might be taken off campus.” They insist they never did so to spy on students, as the student’s family claimed in the federal lawsuit.
“Despite some reports to the contrary, be assured that the security-tracking software has been completely disabled,” Superintendent Christopher W. McGinley said in a statement on the district’s web site. Officials vowed a comprehensive review that McGinley said should result in stronger privacy policies.
Families were not informed of the possibility the webcams might be activated in their homes without their permission in the paperwork students sign when they get the computers, district spokesman Doug Young said.
“It’s clear what was in place was insufficient, and that’s unacceptable,” Young said.
The district has suspended the practice amid the lawsuit and the accompanying uproar from students, the community, and privacy advocates. District officials have hired outside counsel to review the past webcam activations and advise the district on related issues, Young said.
Remote-activation software can be used to capture keystrokes, send commands over the internet, or turn computers into listening devices by turning on built-in microphones. People often use it for legitimate purposes—to access computers from remote locations, for example. But hackers can use it to steal passwords, and spouses to track the whereabouts of partners or lovers.
The Pennsylvania case shows how even well-intentioned plans can go awry if officials fail to understand the technology and its potential consequences, privacy experts said. Compromising images from inside a student’s bedroom could fall into the hands of rogue school staff or otherwise be spread across the internet, they said.
“What about the [potential] abuse of power from higher-ups, trying to find out more information about the head of the PTA?” wondered Ari Schwartz, vice president at the Center for Democracy and Technology. “If you don’t think about the privacy and security consequences of using this kind of technology, you run into problems.”
The FBI opened its investigation after news of the suit broke on Feb. 18, the law-enforcement official said. Montgomery County District Attorney Risa Vetri Ferman also might investigate, she said Feb. 19.
Lower Merion, an affluent district in Philadelphia’s suburbs, issues Apple laptops to all 2,300 students at its two high schools. Only two employees in the technology department were authorized to activate the cameras—and only to locate missing laptops, Young said. The remote activations captured images but never recorded sound, he said.
No one had complained before Harriton High School student Blake Robbins and his parents, Michael and Holly Robbins, filed their lawsuit on Feb. 16, he said.
According to the suit, Harriton vice principal Lindy Matsko told Blake on Nov. 11 that the school thought he was “engaged in improper behavior in his home.” She allegedly cited as evidence a photograph “embedded” in his school-issued laptop.
The suit does not say if the boy’s laptop had been reported stolen, and Young said the litigation prevents him from disclosing that fact. He said the district never violated its policy of only using the remote-activation software to find missing laptops. “Infer what you want,” Young said.
The suit accuses the school of turning on Blake’s webcam while the computer was inside his Penn Valley home, allegedly violating wiretap laws and his right to privacy.
Blake Robbins told KYW-TV on Feb. 19 that a school official described him in his room and mistook a piece of candy for a pill.
“She described what I was doing,” he said. “She said she thought I had pills and said she thought that I was selling drugs.”
Robbins said he was holding a Mike and Ike candy, not pills.
Holly Robbins said a school official told her that she had a picture of Blake holding up what she thought were pills.
“It was an invasion of privacy; it was like we had a Peeping Tom in our house,” Holly Robbins told WPVI-TV. “I send my son to school to learn, not to be spied on.”
Neither the family nor their lawyer, Mark Haltzman, returned calls from AP for comments this week.
“We believe that the administrator at Harriton has been unfairly portrayed and unjustly attacked in connection with her attempts to be supportive of a student and his family,” the statement on the Lower Merion School District site said. “The district never did and never would use such tactics as a basis for disciplinary action.”
The district’s web site said 42 activations of the system resulted in the recovery of 18 computers, not 28 as district spokesman Doug Young had said earlier. The statement reiterated that this was done only to locate lost, stolen, or missing laptops.
“While certain rules for laptop use were spelled out … there was no explicit notification that the laptop contained the security software,” McGinley said. “This notice should have been given, and we regret that was not done.”
Even so, the potential for abuse was nearly limitless, especially because many teens keep their computers in their bedrooms, experts said.
“This is an age where kids explore their sexuality, so there’s a lot of that going on in the room,” said Witold Walczak, legal director for the American Civil Liberties Union of Pennsylvania, which is not involved in the Robbins case. “This is fodder for child porn.”
Andy Derrow, father of a Harriton junior, said he does not believe the district was spying on students. He said he has two other sons who graduated from the school and had substantially benefited from the computer program.
“I don’t think there was any ill intent here,” he said “I think we all need to take a breath and wait and see what the facts are.”