Posted on Fri, Feb.

19, 2010

Student claims school spied on him via computer webcam

By Dan Hardy and Bonnie L. Cook
Inquirer Staff Writers
A Lower Merion family has set off a furor among students, parents, and civil liberties groups by alleging
that Harriton High School officials used a webcam on a school-issued laptop to spy on their 15-year-old
son at home.
In a lawsuit filed Tuesday in federal court, the family said the school's assistant principal had confronted
their son, told him he had "engaged in improper behavior in [his] home, and cited as evidence a
photograph from the webcam embedded in [his] personal laptop issued by the school district."
The suit contends the Lower Merion School District, one of the most prosperous and highest-achieving in
the state, had the ability to turn on students' webcams and illegally invade their privacy.
While declining to comment on the specifics of the suit, spokesman Douglas Young said the district was
investigating. "We're taking it very seriously," he said last night.
The district's Apple MacBook laptops have a built-in webcam with a "security feature" that can snap a
picture of the operator and the screen if the computer is reported lost or stolen, Young said.
But he said "the district would never utilize that security feature for any other reason." The district said
that the security system was "deactivated" yesterday, and that it would review when the system had been
used.
Widener University law professor Stephen Henderson said using a laptop camera for home surveillance
would violate wiretap laws, even if done to catch a thief.
A statement on the district Web site said the lawsuit's allegations "are counter to everything that we stand
for as a school and a community."
The suit says that in November, assistant principal Lynn Matsko called in sophomore Blake Robbins and
told him that he had "engaged in improper behavior in his home," and cited as evidence a photograph
from the webcam in his school-issued laptop.
Matsko later told Robbins' father, Michael, that the district "could remotely activate the webcam

contained in a student's personal laptop . . . at any time it chose and to view and capture whatever images
were in front of the webcam" without the knowledge or approval of the laptop's users, the suit says.
It does not say what improper activity Robbins was accused of or what, if any, discipline resulted.
Reached at home yesterday, his mother, Holly, said she could not comment on advice of the family's
lawyers.
Blake Robbins, answering the door at his home, said he, too, could not comment. With a mop of brown
hair and clad in a black T-shirt and jeans, he smiled when told the suit had earned him a Wikipedia page
and other Internet notoriety.
Mark Haltzman, a lawyer with the Trevose firm of Lamm Rubenstone, which represents the Robbins
family, did not return calls seeking comment. Matsko's husband said the assistant principal could not
comment.
Fueled with state grants, the Lower Merion district issued laptops to all 2,300 high school students,
starting last school year at Harriton and later at Lower Merion High, to promote more "engaged and
active learning and enhanced student achievement," Superintendent Christopher W. McGinley said in a
statement.
McGinley and Lower Merion School Board President David Ebby did not respond to requests for
comment.
Families in the 6,900-student district reacted with shock. Parent Candace Chacona said she was
"flabbergasted" by the allegations.
"My first thought was that my daughter has her computer open almost around the clock in her bedroom.
Has she been spied on?"
Victoria Zuzelo, a senior at Harriton, said she and other students had been told about the security feature,
and knew the district had the right to search computer hard drives at school.
Some students had taken to covering webcams in school with paper because they thought they might be
watched, she said. "But . . . they would never think the school would be watching them at home. I'm not
sure who to believe, but I'm hoping it is not true because if it was, it would really be outrageous."
Lillie Coney, associate director of the Electronic Privacy Information Center, a privacy watchdog group
in Washington, said she had not heard of any other case in which school officials were accused of
monitoring student behavior at home via a computer. If the allegations are true, she said, "this is an
outrageous invasion of individual privacy."
Witold J. Walczak, legal director of the American Civil Liberties Union of Pennsylvania, told the
Associated Press: "School officials cannot, any more than police, enter into the home either electronically
or physically without an invitation or a warrant."
Virginia DiMedio, who as the Lower Merion district's technology director until she retired last summer
helped launch the laptop initiative, said yesterday: "If there was a report that a computer was stolen, the
next time a person opened it up, it would take their picture and give us their IP [Internet protocol] address
- the location of where it was coming from."

She said that the feature had been used several times to trace stolen laptops, but that there had been no
discussion of using it to monitor students' behavior. "I can't imagine anyone in the district did anything
other than track stolen computers," she said.
DiMedio said the district did not widely publicize the feature "for obvious reasons. It involved computer
security, and that is all it was being used for."
She added: "People ask you all the time, 'Can you do this? Can you do this?' . . . But you have to be
conscious of students' rights. I would not have walked into that swamp. . . . You want kids to use the
technology. You want them to feel safe, to feel trusted."
The laptop initiative, she said, is "a wonderful program. There were kids in some of the poorer areas that
had none of the resources that the other students had. That was what the initiative was for - to give kids a
chance."
In a published policy statement, the district warns that laptop users "should not expect that files stored on
district resources will be private," and says the network administrator "may review files and
communication to . . . ensure that students are using the system responsibly."

Read the lawsuit at http://go.philly.com/webcam

Read the school district's response at http://go.philly.com/lmsd

Contact staff writer Dan Hardy

at 610-313-8134 or at dhardy@phillynews.com.
Inquirer staff writer Kristin E. Holmes contributed to this article.

Find this article at:

http://www.philly.com/philly/news/homepage/20100219_Student_claims_school_spied_on_him_via_co
mputer_webcam.html

Software maker blasts 'vigilantism' in Pa.

school spying case
Absolute Software will update its LANRev to disable camera feature
Gregg Keizer
February 22, 2010 The company selling the software used by a Pennsylvania school district to
allegedly spy on its students blasted what it called laptop theft-recovery "vigilantism" today.
Absolute Software said it dissuades users of theft-recovery software from acting on their own.
"We discourage any customer from taking theft recovery into their own hands," said Stephen
Midgley, the company's head of marketing, in an interview Monday. "That's best left in the
hands of professionals."
Midgley confirmed that Lower Merion School District of Ardmore, Pa. was running Absolute
Manage, formerly known as LANRev, which Absolute Software acquired last December. The
suburban Philadelphia school district purchased and deployed LANRev prior to Absolute's
acquisition, he said, noting that most school districts buy the software for power management
features that let IT staff remotely power down systems.
Calling LANRev a "legacy" product, Midgley also said that Absolute would ship an update in
the next several weeks that will permanently disable Theft Track, the name of the feature that
lets administrators switch on a laptop's camera to take photographs of a potential thief after the
computer is reported stolen. "It really doesn't serve any purpose," said Midgley of Theft Track.
Last week, Michael and Holly Robbins of Penn Valley, Pa., on behalf of their 16-year-old son
Blake, sued Lower Merion, accusing it of spying on students and students' families using the
iSight webcams in the MacBook laptops issued to each high school student in the district.
According to the original complaint, Blake Robbins was accused by a Harriton High School
assistant principal of "improper behavior in his home" and shown a photograph taken by his
laptop as evidence. In an appearance on CBS's Early Show Saturday Edition Robbins said he
was accused by the assistant principal of selling drugs and taking pills, but he claimed the
pictures taken by his MacBook's camera showed him eating candy.
Since the Robbins family filed their lawsuit last week, Lower Merion has announced it has
disabled the camera activation feature, denied that it turned on the cameras for any reason other
than to track lost or stolen laptops, and promised to cooperate with any law enforcement
investigation.
In a follow-up motion last Friday, the Robbins asked U.S. District Court Judge Jan DuBois to
issue a restraining order blocking the school district from activating the webcams, functionality

the motion labeled "peeping tom technology."

Absolute Software is probably best known for its LoJack for Laptops, a consumer-grade
notebook recovery service, but it also sells the Computrace line to businesses and organizations.
All its theft-recovery software relies on a different model than the former LANRev, said
Midgley. "We give no theft recovery tools to our [LoJack and Computrace] customers," he said.
"The only truly proven model is a managed service model."
To kick off the recovery of a stolen or lost laptop, customers first must file a police report -- not
a requirement of LANRev -- and only then contact Absolute, which in turn tracks the location of
the missing machine via its IP address when the system goes online. Absolute employs a team of
former law enforcement professionals who reach out to local police, provide them with the
location information and then get out of the way. "We take the responsibility out of the hand of
the end user," said Midgley, "and do the work for them."
Absolute claims that it recovers about 75% of all laptops reported stolen.
According to Lower Merion's superintendent, the district has switched on the camera of a lost or
stolen MacBook 42 times thus far this school year, and found 18, for a recovery rate of 43%.
Any other approach to theft recovery is a waste of time and a potential minefield, said Midgley.
"It just gets into potential vigilantism. Even if you are able to locate the laptop on your own,
what do you do then?" he asked. The idea that police would be able, or willing, to follow up on
individuals' reports that they had located their laptop is unsupportable. "Someone says, 'I think
my laptop is here,' but that could just send the police on a wild goose chase."
Lower Merion School District spokesman Doug Young confirmed that the district uses LANRev.
Absolute's Midgley declined to speculate about whether his company might be liable to legal
action for LANRev's part in the alleged spying on students, but put the responsibility solely on
the school district.
"The customer acted on their own to do what they did," he said.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology
breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to
Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com.
http://www.computerworld.com/s/article/9160278/Software_maker_blasts_vigilantism_in_Pa._school
_spying_case?taxonomyId=12

Posted on Thu, Feb. 25, 2010

Web cams have long concerned computer

pros
By Jeff Gelles
INQUIRER STAFF WRITER
In 1993, Silicon Graphics Inc. manufactured a commercial workstation computer with a video
camera built in for teleconferencing. The proto-Web cam had an ingenious technology for
ensuring users would be safe from visual snooping: a lens cap.
Last week, allegations that a school-issue laptop computer had secretly snapped a photo in a
Lower Merion teen's bedroom sparked a furor among many students, parents, and privacy
experts in this region and nationwide.
But there was one group less surprised than others: computer professionals, who have long
worried about increasingly common Web cams and their ability to intrude anywhere laptops go.
Experts in spyware and other malicious software ("malware") say much of the concern is
theoretical, chiefly because there is little money for scammers to make by remotely activating a
Web cam - especially in an era when people voluntarily post intimate videos online.
Benjamin Edelman, a Harvard Business School professor who studies spyware, says he has
never encountered malware that activates a Web cam.
"I can imagine how you'd write it and see how you'd use it, but I haven't stumbled across it," said
Edelman, noting that hackers were more interested in stealing financial data or turning your
computer into a zombie drone to distribute spam e-mails.
There is, however, one niche where snooping software flourishes: among cyberstalkers and
domestic abusers who want to spy on their victims, monitor their behavior, and use what they
find to intimidate or control them.
"We've been seeing camera misuse in victims of domestic violence and stalking for over a
decade," said Cindy Southworth of the National Network to End Domestic Violence. "It began as
soon as the cameras were introduced."

Southworth, director of a safe-technology project called Safety Net, said the earliest cases
typically involved abusive husbands who used tools developed for parents to keep a remote eye
on children.
One victim told Southworth that her ex-husband had wired her entire house with cameras when
they separated in 1994. Another reported that her husband had hidden a camera in a kitchenbased computer behind a fan vent.
"He knew when she had company over and knew when she was alone, and when she was alone
he would call and threaten her," Southworth said.
Things took a disturbing turn as Web cams became common and remote-control software more
sophisticated, several experts said.
Now, the same software that allows help-desk personnel to take over your computer to diagnose
a malfunction can be used, at least in theory, to activate and control your Web cam. And
software to turn a Web cam into a spy camera is available online.
Lauren Weinstein, a California computer consultant and founder of an online privacy forum, said
the Lower Merion controversy reflected just a small corner of concerns about Web cams and
privacy invasion.
In a lawsuit, a Lower Merion family says an administrator confronted the Harriton High School
student with a photo allegedly taken by the laptop camera. District officials have acknowledged
that the Apple laptops the school distributed came with a security feature that could snap pictures
if the computers were reported lost or stolen.
If the family's claims are true, Weinstein said, "by not disclosing that the capability was there,
the school made an enormous mistake." But he said a bigger issue was how such technology
could be used by outsiders.
"With any security software that has this kind of capability, you don't have to worry so much
about legitimate users," such as a help desk. "The problem is that you open it up to manipulation
by untrusted third parties."
It is not clear how well smaller businesses and organizations limit the use of remote-control
software. But large companies are aware of the risks of illegitimate use.
Dell, for instance, strictly limits staffers' capacity to take control of customers' computers
through its Dell Connect service, which spokeswoman Jennifer Davis likened to having a
technician "sitting next to you working on the computer."
Davis said customers must sign up online and agree to the service's terms. Then they are issued a
temporary code to initiate the help session. If the session has not begun within 15 minutes, the
authorization expires, she said. Every session requires a new code - even if a session ends
because a connection is momentarily lost.

Even with all that, there are special restrictions for access to customers' Web cams. "The agent
may not activate the Web camera during a Dell Connect help session unless they are
troubleshooting the Web camera," she said. "The customer must agree, and it has to be
documented in that session," either by a voice or text acknowledgment.
Sophisticated remote-control software is a double-edged sword, spyware experts say.
"The same technology that's used by help desks is used by hackers," said Ari Schwartz, associate
director of the Center for Democracy and Technology. "Basically, once they have control of your
computer, they can do whatever they want with it."
That means a hacker could execute any sort of command or software manipulation on your
computer - including disabling the light that signals your Web cam is on, unless it is hard-wired.
Even if such software is rarely used to activate Web cams, computer experts are well aware of
the risks. And the old Silicon Graphics solution, which bypasses the software, is a favored
approach.
"You go to security conferences," Schwartz said, "and people have a piece of paper taped over
the camera."

Contact staff writer Jeff Gelles at 215-854-2776 or jgelles@phillynews.com.

Find this article at:

http://www.philly.com/philly/business/technology/20100225_Web_cams_have_long_concerned
_computer_pros.html