Hacker News new | past | comments | ask | show | jobs | submit login
The Spy at Harriton High (strydehax.blogspot.com)
166 points by ryoshu on Feb 22, 2010 | hide | past | favorite | 77 comments



The more I here about this story the scarier it sounds. It's something straight out of 1984 and a complete invasion of privacy. Given that the children were all minors - spying on them secretly outside of school raises all sorts of moral and legal issues. Given that a student was reportedly disciplined based upon these spy photos, presumably the teaching staff (and not just one over-zealous & misguided IT bod) were fully aware of this.

This is the kind of thing the western media perceives as happening in countries like China, not in America, the 'land of the free'


While you've got a point, things like being the 'land of the free' aren't self-enforcing.

We are and will continue to be that because the people responsible for this will:

  Have their lives ruined.

  Be out a *lot* of money.

  Very possibly end up in prison.
Whereas we've recently seen that the PRC's response to people being upset that shoddy school construction resulted in the injury or death of their child (singular, One Child Per Family...) in the recent earthquake is to throw them in jail (or the like).

You're always going to have immoral people in a society who think they're above the law, the critical thing is what you do to correct them and to provide harsh object lessons for others who are tempted.


The PRC is a bad example for that; they're also likely to execute you:

http://www.smh.com.au/news/world/china-executes-corrupt-offi...

Nigeria or even Russia would probably be a better example; at least they're not famous for killing people for corruption.

That said, your main point is completely correct: this is the system working.


I don't know that they're likely to, I get the impression that that is more for show when things get too hot, too obvious. In this case it happened in conjunction with events like the FDA advising us to throw out any PRC made toothpaste. And his appeal was denied because "he was a 'great danger' to the country and its reputation" (http://english.sina.com/china/p/2010/0210/303963.html).

But you're right in part because they feel like they have to keep up appearances and they will upon occasion reach up high, something that hasn't been true in Russia for who knows how long. (Then again, we don't know if Zheng Xiaoyu's real crime was losing a political battle.)

In this case I used the PRC as the counterexample because it was what the parent commentator used. Another good one would be the place that inspired 1984, where ever greater violations of civil liberties, due process and the rule of law as well as privacy are taking place without noticeable push back.

I don't know what would be happening in the U.K. if some school there tried to pull off this sort of nearly literal "1984" (not quite, since the video monitors in Oceania were explicitly there to spy on you, you just didn't know when someone would be paying attention) ... but I wouldn't be sanguine.


I don't know what would be happening in the U.K. if some school there tried to pull off this sort of nearly literal "1984"

With all the video surveillance and things like ASBO laws in the UK, would a story like this even be considered news?


One wonders, but I hope it would still be a stretch from Anti-Social Behaviour ("in a manner that caused or was likely to cause harassment, alarm or distress to one or more persons not of the same household as himself" (http://www.opsi.gov.uk/acts/acts1998/ukpga_19980037_en_2#pt1... )) and cameras in public to a state required camera taking pictures of your disrobed daughter in her bedroom.


I'm pretty sure the administrators thought they were behaving in the best interest of their students. But that's a sad commentary on the state of today's world.

Even if they did have the best of intentions, I think that they should be absolutely ruined. Make the very idea of such intrusions so thoroughly toxic that no one, even the most conniving, dare attempt it for fear of the stakes involved.

After all, turning America into the panopticon is the highest stakes around.


Really? Nobody's done a full forensic recovery of some of the kid's hard-drives? Since it's a pretty good bet that at least one picture of a naked minor was captured, the child porn cops should be all over the entire IT infrastructure of that school and all of the employees involved.


Think about what would happen if I were to donate a pallet of laptops to my niece's school, and then one of the parents accused me of spying on their kids through the camera.

My house would be raided by a SWAT team and everything electronic in it would be taken...TVs hard-drives, computers, computer monitors, networking equipment, routers, servers, camera equipment, everything.

The fact that this isn't happening to the school administrators is hideous. Not only did they admit that what they're being accused of is possible, they demonstrated it!


They also allegedly put in place official policy designed explicitly to prevent students and parent from ensuring their safety and privacy. Disabling the camera was an offense punished by expulsion.

To put that in perspective, I think most school districts punish students this way if they bring a loaded rifle to school.


Can you point to documentation of this?

It definitely sounds like something a school district would do. I am just asking because I have seen this stated in a bunch of hacker news comments, but haven't seen where this information came from.


http://strydehax.blogspot.com/2010/02/spy-at-harrington-high...

I can't find the official school policy from the school. But I haven't found anything disputing this either.


When you think from the institutional point of view, this system of spying and control mirrors system of spying and control the government is using. I don't think there will be a well publicized smackdown, lest other citizens start questioning government's own spying and warrant-less wiretapping.

Just so we don't forget, Obama voted to give telecoms, which handed our privacy to anyone who asked for it, immunity.

  http://www.alternet.org/module/printversion/90990
Why are we so surprised when a school takes a cue from its "big brother" and starts spying on its students so blatantly? Obama "protects" us from "terrorism" by spying on us, and the school has to "protect" the students from "thieves" by spying on them, makes sense right?


It's also a good bet that billions of BOFH's sperm died horrible deaths in wads of kleenex while he was looking at them. Ugh. I can't believe how much balance they put in this article when there's no balance to be found. EDIT: not in the blog post but in one of the news articles it links.


That's a pretty nasty accusation to make without evidence.


"It's a good bet" is not the same as an accusation. I wouldn't vote to convict him yet if I were on a jury and all I knew was what has been in the media, but if I had to bet $100 I know which bet has a higher expected value. Would you really bet the other way? The guy was surreptitiously taking pictures of teens in their bedrooms FFS.

There's one thing we agree on - that's pretty nasty.


I'm just waiting for the inevitable "creeper in the IT department used spyware-laden laptops to take pictures of kids in their bedrooms".

Parents seem to have weird privacy expectations of their kids but you can be sure they will scream bloody murder over a peeping tom.


I think by now its pretty obvious that every time there was a "glitch" and the green light on the camera flashed, a picture was sent in. I've had macbooks for years and I've never seen the camera light blink like described.

Someone in that IT dept was collecting pictures of students. My moneys on Mr. Perbix, thanks to his overly smug god of IT attitude. This story is going to get much worse before we see its end.


See also this good guess at what actually happened, it even helps make sense of the school's current claims: http://yro.slashdot.org/comments.pl?sid=1559200&cid=3123...


That's insane. Although I find myself a little annoyed at the "can't disable the camera" part.

A little electrical tape will fix that. Sometimes the simple solutions are the best.


Presumably, doing something like that could be considered grounds for punishment, based on the school's track record.


"... A little electrical tape will fix that. Sometimes the simple solutions are the best. ..."

Smearing the lens with oil or butter is deniable. Make sure you tape over the microphone port.


Please, punish me for putting tape on my laptop at home. Please. Pretty please.


Are the laptops school property? I'm sure they could do something if they were.


Yeah, but how would they know? They would have to admit to the spying.


I don't think they would. It's like the game that motorcycle cops play where they bet each other that they can find something to write a ticket for on any random car. If they tried to turn on the camera and nothing came through, they could ask to inspect the laptop because of "a glitch they noticed", at which point they could probably find at least 1 thing that broke the rules -- "This is no good, the tape residue has damaged the internal gyro sprocket, and now the whole laptop must be replaced."


And hence the motivation for my "pretty please."


because they're so very shy about that.


Ha! Good point.


A section cut from a Post-It note, then.


Sorry I had to downvote, not because I don't like the ingenuity of your idea (that's what I would have done if I was in that high-school and 20 years younger), but I think we should be hacking the law and the media's response in this case, instead of sticking tape on laptops' cameras.

There should be more shock and anger about this, and if there isn't that fact should also be a reason for shock and anger.


Obviously I didn't mean it as a permanent solution.


I am thinking that a custom OpenBSD firewall with some good logging and some counter measures for specific monitoring software might not be a bad idea.

This story is just getting more wrong with each article.


And tcpdump, too.

Anyway, if you're looking to build that custom OpenBSD firewall / gateway, might I recommend the Alix 2d3 board. It is so choice:

http://www.pcengines.ch/alix2d3.htm


A good idea if the state ever hands you a laptop you must use. Then again, this was really in the students' faces, thanks to Apple wiring the camera and its LED together.


If I was Apple PR, I would be pretty pissed some school said the blinking light was a "glitch" in the macbook.


I think that if a state ever starts mandating laptops, they'll probably be mandating firewalls too.


I don't think they can (in the US, at least, at least for now) mandate "no firewalls" at your home. Ignoring that the state of the art as deployed (Windows) makes that impractical.

I don't think we're even close to "only government approved firewalls at your home".


I grew up one township over from Lower Merion and am frankly shocked to hear about all this going down (part of my home township is split between Lower Merion and my school district)

It's the kind of absurdity that I wouldn't expect - it's a fairly wealthy school district and I'm not surprised at the giving of laptops to students. What I'm shocked at is that they seem to have completely failed to a) Hire competent and reliable IT staff b) Internalized and understood the security and liability issues at an administrative level.


No, what's frightening is that they did hire competent staff, and they did understand the liability issues. Then they did this anyway.


UDSD? I can tell you that if they had the technical knowledge to implement something like this, they certainly would have.


Presumably you mean Upper Darby, in which case no, I was at Haverford.

I was out before Haverford started really implementing computers (at the time they didn't even have computers for the teachers) but I suspect you're right - if they could have done something like this they would have. I can recall a very particular mentality among the administration there which was much along the lines of 'protect the students from themselves at all costs'.

A shame, though.


I haven't seen anything to demonstrate incompetent IT staff. It's not like a server leaked with tons of pictures of kids at home.

It just seems like not only the competent IT staff, but also the school and district administration, felt it was OK to randomly activate and get pictures and screenshots of all of the students.


I wish I had one of those in high school. It would have been fun to crack it :)

Actually I probably would have gone after the remote administration server too.


Until you avoid expulsion only because there wasn't (yet) a policy saying you couldn't jailbreak it, according to someone claiming to be a former student: http://www.saveardmorecoalition.org/node/4216

(Of course I'm wondering about the physical security on the hard drive (e.g. an unrepairable seal); an obvious thing to do is to image the drive and proceed from there. Although I'm sure that's explicitly against policy and that they're looking for tool marks and so on.)


I haven't been keeping up on this much, but they were Mac laptops, right? Boot it holding apple+T (I think), and it acts just like a normal firewire hard drive. No physical damage required.


I think this was disabled with the EFI security password.


The hard drive on a MacBook is strictly trivial to remove.


But can you put a seal somewhere so that removal will be obvious after the fact?


Anonymous is going to have fun with this chap.


When did 4chan become the Batman of the Internet?


They have a very long history of this behavior - probably as long as their existence (anonymous's existence not 4chan's).


They have a very long history of being pranksters -- when did we start to think of them as avenging antiheroes?


My two 16 year old cousins go to Harriton. They were thrilled that they got free laptops for use at school. I've frequently seen them or their friends post videos to Facebook which makes me think that they know that if the light is on, the webcam is working. I'm going to give my uncle a call tonight, I'm sure that hes furious about this.


I would just stick a piece of tape over the lens. Try writing software to counter that.

(And the administration complains, their "evidence" is "I was trying to take a picture of you getting undressed, but I got a piece of tape instead." Nobody is going to say that, and so nobody is going to "call you" on your tape-sticking.)


I wouldn't be surprised if there was a zero tolerance (zero thought) policy against "defacement", including putting "stickers" on the laptops. They wouldn't say really why you had to remove the tape, just that their policy said so.

The plausibly deniable "oil or butter" on the lens suggested by bootload in this topic sounds better to me, only problem there is that you wouldn't know it was enough.

Maybe just rigorous do the tape while it's at home and you have to use it (for classes where it's required).


Well tape especially something not as adhesive such as electrical tape can be easily removed without defacing the computer, even half a post it note would work as intended.


A post-it note is what I had in mind originally.

If my kid got expelled from school for putting a post-it note over the spycam, I would not hesitate to use my savings to sue the *&$# out of the school district.


Business opportunity: ant-spycam stickers with Post-It Note (TM) type adhesive that have relevant for the environment graphics. I.e. I'm thinking of the before my time IBM "Think", something small enough to fit the form factor and that should be unobjectionable in a school setting.

Any zero tolerance policy for "stickers" ought to fail in the aftermath of this Charlie Foxtrot, especially as the nasty details come out or are blatantly suppressed.


I think we are missing the point. We should be hacking the law not the technology. This should not be about smearing butter on your camera, but rather about suing their asses into oblivion, firing them, getting this on the news.

How about some smacking them with some "zero tolerance policy" -- a taste of their own medicine.


Of course you would know it was enough, as far as I understand the spyware's use of the webcam is short enough for them to explain it as "glitches".

In other words, just use any normal program that can acquire images from the camera to see how much (or little) you've managed to obscure the view.


Ah, but the set up was such that the students couldn't use the spycams for any purpose (or disable them) without jailbreaking the laptop.


This is really horrible.

But it's largely getting this level of attention because of the shock value (ooh, pictures!). In fact, this is just one more predictable step in the entrenchment of the police state that compulsory school by its nature is.


Where's the Fox News at 11 story "Is your school taking pictures of your children?"

... after all, they did cover pleaserobme.com


If this is what school administrators do in the suburbs outside Philadelphia -- birthplace of the constitution! home of the Liberty Bell! -- imagine what countries like Libya or Nicaragua will try to do via their OLPC units.


> birthplace of the constition! home of the Liberty Bell! -- imagine what countries like Libya or Nicaragua will try to do

One of the major reasons countries like Nicaragua are what they are is because the country born in the "suburbs outside Philadelphia -- birthplace of constitution" has been sponsoring corrupt dictators there under the disguise of some "war on drugs" or "war on communism". No this is not a diversion of topic. The illusion (I think delusion) of liberty, equality, rule of law is just that -- an illusion. Police, NSA, CIA have long had the ability to spy on US citizen without any warrants. Our beloved President personally voted to provide immunity to the telecom companies that just handed our privacy on a silver platter to NSA, CIA and anyone who asked for it (Choicepoint & friends). Then we turn around and are just "shocked" that a school would pick up the cue from its big brother and run with it.

They are probably thinking: if the government is going to "protect" its citizens by spying on them, we will "protect" our children even more by spying on them harder!


So I don't understand why this guy specifically is targeted. He posted some scripts to disable the webcam for normal users, he talked about using the software to do what it was intended to do. I'm not convinced that because he didn't mention "theft recovery" until the middle of the podcast (granted, I did not listen to the podcast), he must have been remotely controlling users' computers. I don't see any evidence that incriminates Mr. Pibrix as anything more than IT guy taking orders, and I think it's irresponsible to post information like this without due process or at least offering Pibrix a chance to respond.


"I was just following orders" to set up a system that would inevitably create child porn does not sound like a sufficient defense to me.

The software in question would phone home whenever the laptop was connected from other than the school's LAN and start making pictures; at that point, the only thing the system could do would be to allow retention of them or not.


His rational superiors should obviously start scapegoating him by now to divert attention and blame. Their strategy at this point should be to paint this guy as a deranged, power hungry nerd who took matters into his own hands. They should fire him immediately.

(I am not saying whether it is his fault or someone above him ordered it, but I am assuming his superiors are soulless bastards who can hire expensive attorneys. He might be just as bad, but he cannot hire lawyers and PR firms).


I was just talking about this with a friend of mine. He seems like the ideal candidate to be thrown to the wolves.

I think the vice principal, and any other staff with knowledge of the spying capabilities should not be allowed to shove the blame onto the tech staff. Everyone involved should be punished to the full extent of the law.


Well, I think there may have been a plausible justification. Not that they could up with one that actually makes this acceptable, but they might be able to come up with one that, while still undesirable, isn't quite as blatant as "this system will inevitably create child porn".

IT people are often put in situations where they have to implement the will of the less-technically-enlightened who sign their paychecks, even when it violates the privacy standards that the IT staff would prefer. For instance, invasive filtering at work that logs all of one's activity by default and attempts to prevent external HTTPS or proxy usage is against the ideals of most who have to implement and maintain such a system, but thousands have to do it every day.

There are many, many alternatives to the malicious "inevitable child porn" point-of-view. Maybe Pibrix thought that "stolen mode" wasn't activated until someone reported it, because someone higher-up than him had set all of the computers to report back anytime they are outside of the school's network. He's just one high school network tech, he's not necessarily the end-all here. We don't know how the rules for "stolen mode" were determined; perhaps they could be updated when students connected to the school's network. Therefore, when normal students complained of spontaneous light-blinking at home, when their laptops weren't even reported stolen, Pibrix could have sincerely believed it was a glitch.

We just don't know, so let's not target potentially-innocent people here, ok?

We should at least let this thing flesh out a bit more before we start with the marking of public enemies, right? This should scare anyone whose employer may potentially incriminate their employees in the employer's shady dealings.

I mean, I don't know, maybe he was guilty, maybe he did push for this system so he could watch the kids in compromising or private positions and get his kicks off of that, maybe he was saving all of the incidental nudes and posting them to 4chan. We don't know, and I'm not saying that the guy did or didn't. I just think it's a little early to incriminate this one guy just because he talked about how the software they use works and how to make it so non-privileged users can't use the webcam.


I think we're pretty sure he's the top dog for this IT, he certainly talked at length about this feature and how great it was (http://yro.slashdot.org/comments.pl?sid=1559200&cid=3123...).

The only question here is that did he realize the laptops have to always be in phone home mode for this to work? The anti-theft feature obviously doesn't work if the laptop doesn't make contact a server after the former is stolen.

Plus there's the blink of the green spycam light; school IT knew about it, we won't know until discovery or its criminal equivalent if they realized that it was due the actions of their spyware.

But I insist on saying "this system will inevitably create child porn" and that his not realizing that is no excuse. The child porn laws do not care about mens rea (http://en.wikipedia.org/wiki/Mens_rea).


I have a netbook with a camera (my laptop is 95 percent closed) and it sometimes creeps me out that it's watching me all the time (even though I'm the only person who's ever used it.) If I had a school-issued computer, spying is the first thing I would have thought of.


I loved the mechanical latches old Macbook Pro's had for this reason. Creepy story and great reporting!


Huh? These laptops don't open themselves up at the command of their BOFH tech guy. The mechanical latch would do nothing to prevent this. You still have to open up the laptop to use it, and the computer still has to detect that it's open so that it can 'wake' from 'sleep.'


I meant the latches to close built-in iSight. Come on now, how can HN have such a clueless member to think that the lid opens itself up:-)


i have the original MacBook Pro, bought two weeks after the the line was introduced in 2006. It has no latch to close the isight camera. You sure you're not thinking of a different model? I don't think the older Powerbooks had them either although I could be wrong.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: