Schneier on Security

Clive Robinson • February 24, 2010 10:16 PM

It is difficult to look through the hype and hysteria to see,

1, What was supposed to happen.
2, What actually happened.
3, What may have happened.
4, What could have happened.

With regards (1) The official position appears to be that it was “part of” an anti-theft program.

However that is contradicted by the fact that the school accused a child of taking illegal substances infront of the computer.

So the school cannot maintain “officialy” that it is “only” an anti theft device.

So it appears that at the very least (2) involved an intermitant active feed that was permanatly enabled.

This appears to be confirmed by other children reporting itermitant activation of the camera operating LED. Thus the school would find it hard to argue that it was an “unknown fault”. Likewise the technicians involved would have been aware of the server hard disk filling up and the loss of inbound bandwidth (unless of course they wish to argue they where not doing a basic and expected task).

Further it could be shown that the server and the firewall etc would have to have been specifficaly set up to do this activity and should as it uses publicly funded resources have been subject to appropriate oversight and adminastrative procedures.

The schools legal team could argue (and probably will) that this might be the only oportunity to catch the “theft in progress”. And that for it to have a chance to do this then this could not be reveled to the children or the parents etc etc.

However I would assum that for a complaint to be raised against the child for aleged substance abuse the evidence (ie the picture etc) must have been seen at the more senior levels of school managment. Thus they cannot argue they where in ignorance of how the system was set up to operate.

Thus nor can the senior managment at the school say that the anti theft function had malfunctioned or acted against their specific instructions, because somebody would have had to have been activly looking at the pictures to see the child was consuming something within sight of the camera.

Likewise nor can the schools senior managers say they where not aware of the fact that children where under view in their homes, with a high degree of probability in their bedrooms whilst potentialy in a state of undress.

This is because just about every report on “personal computer” use by children has the computer in the childs bedroom where they can supposadly have the peace and quiet away from the rest of the family to do their home work, further most “environmental behaviour reports” show PC’s are left on.

So with regards (3) what we can guess something like the majority of the schools pupils issued with laptops have been subject to survalence where there is a reasonable probability that they where photographed in a state of being semi dressed and that these photographs where sent across a publicaly accessable network, into the schools network.

Further there was a conspiracy amongst the schools senior managmet to enforce this activity onto the children (as shown by the usage policy). Further it can be shown that the usage policy actually endangered the pupils by requiring them to regularly carry expensive equipment that would make them a target for naredowells (otherwise why have an anti theft system in the first place).

Now the Terms of Use (TOU) and other usage policy probably does not (from what has been said here) directly mandate that the computers should be connected to the internet.

However I think it can also be said it does not preclude the being connected either (otherwise why bother with this anti theft system).

So the question arises of reasonable expectation of connection to the Internet. If a look at the school curiculum and method of posting asignments by teachers and the way students are expected to get at course work and hand in work effectivly mandates the pupil to connect the computer outside of the school premises and time to partake of or compleate the course then a whole host of other issues arise.

One of which is theft by the school. If they effectivly mandate connection of the school issued computer to the Internet and then take control of it or set it up so it automaticaly sends data etc then unless specificaly mentioned in the TOU then it can be argued that the school is deriving benifit without due recognition or recompense (effectivly theft of resources electricity/bandwidth/etc).

Now as the school managment might argue that it is an anti theft device which arguably can only work by remaining secret and thus it could not go in the TOU then they should include something in the TOU to cover it indirectly (look at your cell phone contract to see “network managment” clauses etc).

However if you can show that senior managment where complicit in this system (and I think it likley that you can) and that a the use of it was likly to commit a crime (theft of resources) then you have conspiracy.

But worse for the senior managment with only a little more effort you might be able to go for “malfeasence in public office”. This is a very old piece of English law (over 1000years old) and thus does not have mandatory limits on sentancing.

Thus as the US effectively imported whole sale English law the same may apply.

Thus the senior school managment and board of governers and all others who can be shown to have attended meetings at where this anti-theft system was discussed could be looking at life behind bars.

Further if the parents of all the children who had had a school laptop got together then they could potentialy start a class action.

Now the school has a significant problem here to minimise the damages they would have to show that there was minimal potential for the children their friends or their families to suffer future harm from the schools activities.

Unfortunatly for the school they probably cannot, the chances are the pictures where only encoded not encrypted, and even if encrypted it would most likley have been under a comman key, which in all likleyhood would have been stored as plaintext on the laptops…

Now the issue then arises of what constitutes future harm. Potentialy any of those pictures of students may contain images of a personal or private nature. Thus have the potential to be used for the purposes of coercion either of the individual or others relating to the individual (think blackmail or smear campaigns).

Now the question then arises how could such pictures become available to individuals wishing to do so.

Well there are three easy ways for this.

1, A member of the school staff retains copies of all the pictures.
2, A hard disk or backup tape containing some or all the images gets “lost”
3, Somebody who has copies of some or all of the pictures for their own personal gratification sells them on to others.

Why have I shown 1&3 seperatly, well there is a very reasonable probability that due to the number of machines involved that others may well have become aware of what was going on. Not all of whom would be inside the school. There is a reasonable chance that when known a person will do one of four things ignore it, talk about it, complain about it or take advantage of it for their own personal benifit.

I think it takes little imagination to see the value of images of children of this age range in their bedrooms at times they are compleatly ungaurded.

The magnitude of the potential of this is very large. Unfortunatly from what I here of goings on in the US I think it is likley it will be squashed down from a very senior political level as “not in the public interest” and by simple down and dirty blackmail of failing students of parents who take action, then coercing them into line by holding out the potential to make representation to the board of governors etc for “exceptional circumstances”.