[Home] [Headlines] [Latest Articles] [Latest Comments] [Post] [Mail] [Sign-in] [Setup] [Help] [Register]
Status: Not Logged In; Sign In
Education Title: They Hacked Their School District When They Were 12. The Adults Are Still Trying to Catch Up. Rochester Hills, Mich. The hack started small, in 7th grade, when they bypassed their middle schools internet filters to watch YouTube during lunch. But by the time Jeremy Currier and Seth Stephens were caught, more than two years later, their exploits had given them extraordinary reign over the computer network of the Rochester Community Schools, a well-to-do suburban district about 45 minutes outside Detroit. The teens had access to the logins, passwords, phone numbers, locker combinations, lunch balances, and grades of all 15,000 of their classmates. They could view teachers tests, answer keys, and email messages. They could control the districts security cameras and remotely operate its desktop computers via their phones. The boys were even using district servers to mine for cryptocurrency. It wasnt anything malicious, said Jeremy, now 15. I mostly just wanted to figure out what else I could do. Thats not how Rochester school officials saw it. Though theres no evidence to date that Jeremy and Seth directly threatened anyone, the district expelled both boys, then referred them to the county sheriffs office. Now, the case is raising a number of big questions. Chief among them: How can schools better develop the potential of children with advanced computing skills and a penchant for probing boundariesbefore things go bad? With the nation facing mounting cyber threats and a severe shortage of qualified cybersecurity workers, the K-12 sector is under considerable pressure to make that a priority. But the reality is that many school districts are still struggling to protect their own networks, let alone prepare the high-tech workforce of tomorrow. Thats why Jeremy and Seth are the latest students to be featured for Education Weeks Faces of the Future series. Instead of finding themselves on track for advanced degrees and lucrative careers, the boys are at the center of a possible criminal investigation. I cant begin to fathom what they did or didnt know, said Michele Stephens, Seths mom. They were far more knowledgeable than we could ever keep up with. Having a young computer whiz in the family can be a mixed blessing. Just ask Jeremys grandmother. On a gray October afternoon, Jeremy perched on the edge of her sofa, hands wrapped around his knees in a vain attempt to keep from fidgeting. He sped through the process of helping the 82-year-old set up a new iPad, tossing out mile-a-minute explanations of how to set account preferences and send text messages via Siri. Do they have a language on here called Jeremy Speak? his grandmother asked. Now a lanky teen with a wispy mustache, Jeremy started taking computers apart when he was 9. He built his first machine from scratch when he was 11. Before long, he was trying to build computing rigs with enough processing power to mine encrypted digital currencies. After seeing what Jeremy had learned on his own via Reddit, an IT contractor offered him a job on the spot. I just love figuring out problems, Jeremy said. People turn on their computer and think its magic. But theres actually way more to it than that. Unfortunately, said Jeremys mother, Janet Currier, the local public schools didnt really tap into that passion for hands-on problem-solving. Teachers and counselors didnt seem to know what to do with him. The STEM classes offered in middle school felt far beneath Jeremys abilities. Potentially exciting computer science classes werent available until junior or senior year. Jeremy, focused intently on what he could accomplish right now, started bristling at the Rochester districts heavy emphasis on college prep. I never wanted to go to school in the morning, he said. Building stuff at home was my only interest. Making things more complicated, Jeremy had few friends. One of the few peers who shared his passions was Seth, a quiet boy who lived about 10 minutes away. Their families welcomed the connection. By 7th grade, the two were having regular sleepovers, staying up all night to play Counter Strike and mess around on their computers. Seventh grade was also the year the boys noticed a sticky note attached to one of the public computers in the middle school library. It had a username and password on it, they said, in case students or staff wanted to look up books but had forgotten their own credentials. Jeremy and Seth discovered that by logging in with the information on the note, then closing out of the library software, they could access files that had been shared with the librarys adult staff. One of the files, they said, was a Microsoft Excel spreadsheet with a filename that included the school year and the word students. The file was unprotected. They opened it up. It contained the passwords for every student in the Rochester district. I was 12. I didnt want to go up to a teacher and say, Hey, I just found an entire list of student passwords, Jeremy said. We wanted to do a little more exploring. According to the boys, their next step was to access the network from home, via the districts online portal. Over the next two years, they also found a district program that allowed them to change passwords for everyone in the system. They browsed through selected teacher files containing lesson plans, emails, tests, and answer keys. They installed a software program called TeamViewer on a machine in the back of a science classroom, turning it into a slave computer that afforded them remote access to any PC in the district. After the district installed new internet-enabled security cameras, the boys found another sticky note with a username and password, left on the laptop of a school security guard. They used that information to access the camera system, figuring out how to pan, zoom, and watch old footage. The boys also installed crypto-mining software on the districts servers. It remains unclear whose idea it was, whether any money was generated, and who had access to any proceeds. Its also not clear if thats the full extent of the boys exploits. Citing the possible criminal investigation, both families declined to answer questions about the possibility of violations not referenced in the disciplinary documents they received from the Rochester Community Schools, copies of which they provided to Education Week. Regardless, Rochester technology officials bear considerable blame for what happened, said Douglas A. Levin, a K-12 cybersecurity expert who first published an account of the hack on his blog in September. By leaving its network essentially unprotected, Levin said, the district made it easy for Jeremy and Seth to execute a mind-boggling security breach. The notion that two 12-year olds were able to do this is honestly just extraordinary, he said.They had complete and utter access. But just as noteworthy, Levin argued, is what the boys didnt do. Theres no evidence they cheated or changed grades, disrupted classes or sold answers to tests, zeroed out lunch balances or broke into anyones locker, installed malware or deleted files, harassed people online or stole anyones identity. Through a bewildering ordeal, that reality has given Seths parents some solace. There are things in our everyday lives that we can all do, that we have access to do, but you just dont, because you know thats crossing the line, his father said. I think thats where Seth was. Scott and Michele Stephens met 17 years ago, while bowling. Not long after they were married, they moved to Rochester Hills, a suburban community subdivided into neighborhoods with names like Meadowbrook Valley and Heritage Oaks. The schools were a big reason why. Seths elementary years went smoothly enough. He did well in his classes and took care of his dog and developed a quirky fascination with the Weather Channel. He also showed an aptitude for coding, which eventually led to him using YouTube tutorials to teach himself programming languages like Javascript and Visual Basic. By 6th grade, though, serious issues had surfaced. Seth was diagnosed with attention-deficit hyperactivity disorder. He had trouble falling asleep. He would close himself up in his room, get lost in his computer, and refuse to go to bed. Explosive fights would ensue. Michele and Scott removed the door to his bedroom. Towards the end of 9th grade, they found out Seth was failing three of his classes. Scott and Michele felt their sons needs were going unmet. Worse, his computer talents seemed to be going unrecognized. They started seriously considering other options for the rest of high school. Still, the call from his principal, saying their son was in trouble, came as a shock. It was very much a freak-out, Michele said. Officials from Rochester Community Schools declined to comment on the case or be interviewed about the districts cybersecurity practices, citing privacy concerns and the possible criminal investigation. But letters sent to the Stephens and Currier families as part of the disciplinary proceedings against their sons spell out the districts perspective. While the boys did not directly threaten the safety of staff or students, Rochester officials wrote, their breach of the districts network was pre-mediated [sic], deliberate, and ongoing. Giving Jeremy and Seth the chance to make amendsperhaps by helping the district better understand its cyber vulnerabilitieswould not undo the privacy violations suffered by staff or students, Rochester officials maintained. Nor would it compensate the district for time lost investigating the hack and rebooting its systems. Ultimately, the district said, expulsion was necessary to deter other students from similar misbehavior. That decision has left Jeremy and Seth staring into uncertain futures. Their long-term employment prospects should have been bright. In the coming decade, for example, the federal government will be looking for thousands of skilled cybersecurity workers. The growing demand has only been underscored by a steady drumbeat of news stories about hacks, cyberattacks, and digital espionage. But the boys are unlikely to be eligible for many of those public-sector positions, said Davina Pruitt-Mentle, who helps head cybersecurity-education efforts at the U.S. Department of Commerce in Washington. Will they be able to pass a background check and get a security clearance? she said, noting that the process includes a review of candidates moral character, not just criminal background. Im not a lawyer, but my money would probably be on No. Depending on how the possible criminal investigation unfolds, private-sector employers may be more accommodating. But even in the best-case scenario, the teens face a rocky road to the postsecondary degrees and credentials that will unlock more than entry-level IT jobs. Since getting kicked out of Rochester Community Schools, Jeremy has enrolled at Oxford Virtual Academy, a full-time online school run by the Oxford, Mich., school district. He started the year on a kind of probation; because of the nature of his expulsion, the school wouldnt give him a laptop to use at home. So twice a week, he heads to a storefront in a strip mall to work at one of Oxford Virtuals drop-in centers. Even before his expulsion, Janet Currier said, she felt on an island, trying to encourage her sons interests and talents, even though theyd long since exceeded her capacity. Now, she alternates between fury and exasperation at what she views as the Rochester districts scapegoating of Jeremy, as well as the criticism shes received on Facebook for not punishing him more harshly. What am I supposed to do? Lock him in his room? Set him on fire? Discourage him from his chosen career path? she asked. Seths education, meanwhile, now consists mostly of online Khan Academy courses. No longer allowed to have a computer in his bedroom, he works mostly downstairs, at a desk cluttered with game controllers and Tootsie rolls, in the room where his dad stores dozens of bowling balls. After working nightshifts as an electrician at the local Ford plant, Scott spends his days home-schooling Seth, trying to reach his son in a way that a 2017 National Blue Ribbon-winning school district apparently could not. With little idea how to proceed, Scott has leaned on what he knows. The main project hes assigned Seth this semester is to build a website and app that will allow bowlers to track their bowling equipment. Seth says he still hopes to go to college, to study computer science. His parents hope that opportunity hasnt been lost. Its like theres this big mature person inside of this little body, Michele said as her son hung his head quietly beside her. He showed very bad judgment. But theyre treating him like a criminal.
Post Comment Private Reply Ignore Thread |
[Home] [Headlines] [Latest Articles] [Latest Comments] [Post] [Mail] [Sign-in] [Setup] [Help] [Register]
|