Spying with Webcams

My oh my oh my. There are times when individuals and groups make poor decisions, and there are times when decisions are made that smack so strongly of incompetence that they make you question your faith in humanity. Reports that broke out yesterday about what happened with school-issued laptops in a suburban Philadelphia school district, if true, certainly bring school administrators into the latter category.

Laptops issued by the school came with webcams. No big deal, right? Oh, did I mention that administrators decided to install software on these laptops that allows them to remotely activate and view those webcams at any time? And that they decided not to tell students about this when they were given the laptops? Yeah, somehow I'm guessing that this might lead to problems. The rationale behind this, at least according to the school district, is that the software is intended to allow them to recover the laptops in the event that they are stolen. More on this later.

So here's the recipe for success:

1. Issue laptops to high school students.
2. Install software that allows someone to remotely view the webcam without knowledge or permission of the computer operator.
3. Allow students to use these as personal computers (read: computers will be open and be used in, say, the students' bedrooms)
4. Activate webcam
5. ????
6. Lawsuit!

Now, this situation all sounds kind of fishy. I'm not sure if I believe the story as reported in the article linked above. I'm not sure if it's because the situation sounds so outrageous, or if I don't trust the student who's raising the big fuss. Allegedly, one day this student gets called into the office to be disciplined for "inappropriate behavior" at his home, and is shown evidence for this behavior in the form of images taken from the laptop webcam. If taken at face value, everyone involved from the taking of the picture to the end of presenting it to the kid is an absolute idiot. You cannot, with any claim to intelligence, think that it is either justifiable or acceptable to take a picture of a kid in his own home and use that picture to discipline that kid at school. There are problems with this on so many levels that I'm not even going to attempt to break it down.

Let's look at the article in more detail:

While declining to comment on the specifics of the suit, spokesman Douglas Young said the district was investigating. "We're taking it very seriously," he said last night.

The district's Apple MacBook laptops have a built-in webcam with a "security feature" that can snap a picture of the operator and the screen if the computer is reported lost or stolen, Young said.

But he said "the district would never utilize that security feature for any other reason."

Riiiiiiiiiight. No one is ever going to abuse this "security feature." Brilliant.

A statement on the district Web site said the lawsuit's allegations "are counter to everything that we stand for as a school and a community."

PR speak for "if we find out who's responsible for this, heads are gonna roll!"

The suit says that in November, assistant principal Lynn Matsko called in sophomore Blake Robbins and told him that he had "engaged in improper behavior in his home," and cited as evidence a photograph from the webcam in his school-issued laptop....

It does not say what improper activity Robbins was accused of or what, if any, discipline resulted.

It's best not to speculate on what "improper behavior" one might observe by viewing the contents of a male teenager's webcam while he thinks he's in the privacy of his own room.

Blake Robbins, answering the door at his home, said he, too, could not comment. With a mop of brown hair and clad in a black T-shirt and jeans, he smiled when told the suit had earned him a Wikipedia page and other Internet notoriety.

The way this is reported makes me wonder whether this is all a stunt to get attention. As if Blake somehow discovered this software and learned what its purpose was, and made up the rest of the story. But since he implicated the principal, you'd think this would be pretty easy to confirm.

Families in the 6,900-student district reacted with shock. Parent Candace Chacona said she was "flabbergasted" by the allegations.

"My first thought was that my daughter has her computer open almost around the clock in her bedroom. Has she been spied on?"

You'd think administrators would have thought about this. If she, or any other student, has been spied on in this manner, wouldn't there be charges about making child pornography? Having videos or images of minors undressed seems to fall under this category.

Virginia DiMedio, who as the Lower Merion district's technology director until she retired last summer helped launch the laptop initiative, said yesterday: "If there was a report that a computer was stolen, the next time a person opened it up, it would take their picture and give us their IP [Internet protocol] address - the location of where it was coming from."

She said that the feature had been used several times to trace stolen laptops, but that there had been no discussion of using it to monitor students' behavior. "I can't imagine anyone in the district did anything other than track stolen computers," she said.

DiMedio said the district did not widely publicize the feature "for obvious reasons. It involved computer security, and that is all it was being used for."

So many things wrong here. First, if you want to get the location of a stolen laptop, why not install a GPS unit that can be remotely activated if the computer is reported stolen? It might not be standard hardware, but it's a little less problematic than relying on a photo and an IP address. It's not like an IP address is a particularly accurate indicator of a location anyways. Second, do they really believe that something like this is not going to be abused? I have another post in the back of my mind about some of the IBM commercials on TV that is related to this, so I'll post more on this idea at a later time. And finally, you have the "security by obscurity" problem. What's the obvious reason for hiding this functionality? If it's only going to be used in the event that a laptop is stolen, wouldn't it be good for the laptop owners to know about this feature? Oh, but then they would know they there's a possibility that they're being spied on at any given moment. That's the only "obvious reason" I can see for not notifying the students' families about this feature.

In a published policy statement, the district warns that laptop users "should not expect that files stored on district resources will be private," and says the network administrator "may review files and communication to . . . ensure that students are using the system responsibly."

This is perfectly reasonable. Chats, files, programs, emails, etc. are all things that the school can monitor to be sure that the laptop is being used appropriately. The problem with taking a picture with the webcam is that the person photographed may not even be using the computer at all! We don't know what the "improper behavior" was, but assuming it wasn't an inappropriate use of the computer, then this policy doesn't apply. For all we know, he was doing something in his room with the computer open, and someone took a picture of it. If he was taking inappropriate pictures of himself with the webcam and the school found them, that would be another story.

So, in conclusion, if this story is true (and I'm not convinced that we know the whole story, so it'll be interesting to see what more comes out of this), then it's absolutely stunning how any group of people could have approved such a program. I'm glad that the FBI is investigating this, because there really should be criminal charges if this story is true.