Remember the school district in suburban Philadelphia involved in a lawsuit over secretly taking webcam images of students? The school initially denied things, and later said that it had only used the feature 42 times to help find lost or stolen laptops. However, a law firm brought on by the school to investigate its use of the LanRev system found 58,000 images were taken. That's led some other students to realize that they might have a beef with the Lower Merion School district as well. A second student has now filed a lawsuit against the school after discovering that the school took 469 secret photographs from his webcam over the course of two months.

What happened was that the student lost his laptop on December 18th. The laptop was found by a teacher and returned to the student on the 21st... but also on the 21st, the school's IT folks turned on LanRev's "TheftTrak" service. Even though the laptop had been returned to the student, the LanRev system was never turned off. It took 469 secret images and captured 543 secret screenshots. It wasn't turned off until that first lawsuit was filed, and someone in the IT department realized there might be an issue there...

What's really scary? If a school administrator hadn't revealed the whole system to the first student by showing him a photo of him at home, this would still be going on and none of the students would know about it. The only reason this lawsuit is being filed is because of the information that came out during the investigation into the first incident.

Jessie Hirsh has a great blog post about the seductive power of surveillance, covering how surveillance systems put in place with limitations and for the best of intentions almost always get abused, as it just becomes too tempting to use them to a much greater level. The example he discusses, of course, is the recent webcam scandal involving a school that used webcam images of a student at home in a disciplinary action. In that case, the "surveillance" was intended for recovering lost or stolen laptops only, but the mandate was allegedly "expanded" when an image taken (supposedly because a "loaner" laptop had been taken off campus) also showed the student eating candy that the school administrators thought were drugs.

Hirsh also points out that, beyond the temptation to just expand what's monitored, being able to watch over someone just has it's own (potentially dangerous) addictive quality as well -- by noting "the intoxication people feel from being the watcher." That also, I believe, is a part of the reason why law enforcement is always so keen on increasing surveillance efforts. It's just incredibly powerful to be able to watch over others.

It's definitely something that needs to be thought about carefully, as we become an increasingly watched society. But how do you deal with it? Hirsh brings up the idea -- proposed many times before -- of being able to watch the watchers or even to open up the surveillance process to the public to have them help out. This horrifies some people, but it's at least something that people need to think about. Greater amounts of surveillance in society aren't likely to go away any time soon -- so recognizing the risks associated with it and coming up with unique and innovative solutions to deal with (or minimize) those risks makes sense.

Following up on this morning's post, new details are emerging about the school spying scandal in which a student was punished for apparently chowing down on Mike&Ike candy (which the school thought were drugs). In our comments, someone named Paul points us to a blog post from a security consultant, who digs much deeper into the story -- focusing on one of the techies who worked at the school and apparently had a noticeable internet presence, having said a few things that could come back to haunt him. Note, that the school itself has said that only two techies on staff had the power to initiate the use of the remote spying tool.

Apparently, in various forums, blog posts and videos, one of the school's techies talked about the technology they were using and how to set it up so that the user would not realize they were being spied on. He also discussed how to prevent a laptop using this software from being "jailbroken," so users couldn't discover that their computers were being used in this manner. Other forum posts from students at the school show that they were told they could not use other computers, could not disable the cameras and could not jailbreak their laptops on the risk of expulsion.

Furthermore, in looking at the software that was being used, the security consultant found serious security problems with it, in some ways similar to the famed Sony BMG rootkit:

With some of my colleagues, I began a reverse engineering effort against LANRev in order to determine the nature of the threat and possible countermeasures. Some of the things we found at first left us aghast as security pros: the spyware "client" (they call it an agent) binds to the server permanently without using authentication or key distribution. Find an unbound agent on your network with Bonjour, click on it, you own it. The server software, with an externally facing Internet port... runs as root. I'm not kidding. For those unfamiliar with the principle of least privilege- this is an indicator of a highly unskilled design. Unfortunately, when we got down to basic forensics, LANRev appears to cover its tracks well.

Things keep looking worse for the school, and school officials have done little to actually explain what happened, if the prevailing story is not actually the case.

The story of the school district that supposedly spied on some students keeps getting odder and odder. While the school district claims that it used the secret remote webcam activation technology 42 times -- and only to track down stolen or lost laptops -- it still hasn't explained why this particular student was punished. He claims his laptop was not stolen and there was no reason to turn it on. The school claims that the assistant principal who supposedly confronted the student with an image from the webcam is being unfairly tarnished.

But here's where it gets even odder. Apparently, the "improper act" that the student was disciplined for was an accusation of either drug use or drug selling. For what? Well, the image showed the student with Mike & Ikes candies, which do have a passing resemblance to pills, but (last we checked) do not appear to be controlled substances.

Now, there certainly could be more to this story, but the school has not done a particularly good job explaining its side of things.

More details are coming out about the case we wrote about yesterday concerning the school district that could (and did) turn on webcams on student laptops. The district is now claiming that, yes, it had the ability to do so, and in fact did so 42 times (though, it never told students or parents it could do this). However, the district claims that it only did so to try to track down lost or stolen laptops. That doesn't explain how this resulted in a student being reprimanded for "improper behavior in his home" though.

Either way, it looks like this is going beyond a civil case of the families suing the school district. The FBI is now investigating the case as well, to see if the district violated either wiretapping or computer-intrusion laws. Now, it's not unheard of to have capabilities like this turned on to find lost or stolen laptops -- so perhaps that is understandable. But the fact that this kid was reprimanded for stuff he did in the privacy of his home while caught on camera definitely seems questionable. No one seems willing to say if this particular laptop was ever reported "lost or stolen," so perhaps the district's argument is that the student had taken the laptop. But if that's the case, you would think they would have come out and said so, rather than the vaguely worded denials put forth already.

A whole bunch of you are sending in this absolutely horrifying story of a school district outside of Philadelphia that apparently gave its students laptops that included hidden software that allowed district officials to secretly turn on the laptops' webcams and monitor student activities, no matter where they were. This all came to light when a student was disciplined for "improper behavior in his home" with the evidence being a photo of the kid from his laptop webcam. The district is now being sued for this. It's rather stunning that anyone thought this was a good idea. Secretly spying on children in their homes when they have a very real expectation of privacy is downright horrifying. It's not hard to see how this could be abused in very dangerous ways.

Update: Yikes. This may be more common than I thought. Julian Sanchez points us to a recent PBS Frontline episode about technology in schools that shows a school official proudly showing off the ability to spy on kids this way (well, using remote desktop emulation, rather than turning on webcams, but many of the kids seem to use webcams a lot). That part of the video starts at 4:37 and even shows him taking a photo of a girl as she does her hair via the camera: The school administrator seems to think it's funny to spy on kids this way. Wow.