Presentation on theme: "Maxine Major October 2013. Topic Summary Robbins v. Lower Merion School District Legal Process Pending Outcomes Similar Cases Current Landscape."— Presentation transcript:
Maxine Major October 2013
Topic Summary Robbins v. Lower Merion School District Legal Process Pending Outcomes Similar Cases Current Landscape Conclusions
Institutional Surveillance Do institutions have a legal right to use loaned equipment to monitor the equipment (and consequently the customers who use their equipment)? If so, when is this permissible, and when is it crossing the line into unwarranted surveillance?
Lower Merion School District Harriton High School in Rosemont, PA Lower Merion High School in Ardmore, PA Macbook laptop given to each of students as part of a “One to One” initiative Mandatory use Students and parents not of remote monitoring software installed on Macbooks
LANrev’s “TheftTrack” Could be activated remotely Collect images from webcam and/or desktop of laptop Permission to activate granted by IT department cooperating with LANrev Deactivating also must be handled by IT, security, and LANrev
Lower Marion School District Policy to activate TheftTrack only if Macbook was reported lost, stolen or missing Assisted in the return of 18 of 42 laptops reported missing in the school year IT reportedly stated that it was not necessary that students were aware of the TheftTrack feature
Blake Robbins Nov – Harriton High sophomore Blake Robbins in trouble for engaging in “improper behavior” at home. Assistant principal of Lower Merion High School showed Robbins webcam images of him taking pills. (Robbins claims it was candy.) February 11, Robbins’s parents file class action lawsuit
Jalil Hasan Dec 18, 2009 – Reported his laptop missing Dec 21, 2009 – Laptop found by a teacher and returned to Hasan February 2010 – TheftTrack remained active until Robbins lawsuit resulted in TheftTrack deactivation on all laptops 469 469 webcam pictures 543 543 screen shots July 8, 2010 – Hasan alerted to the existence of the photographs by a lawyer for LMSD
Summary of case: 179 times TheftTrack activated 12 laptops with webcams left active after laptop returned 57,986 images taken Images included students and family members sometimes in non laptop-related activities including sleeping and in various states of dress. FBI opened an investigation in regards to claims that school officials were actively monitoring students via webcam.
LMSD Response Use of TheftTrack halted immediately Series of letters sent to parents explaining the situation and apologizing for not making clear the presence of and the capabilities of the TheftTrack software. (Had to cease sending letters after class action lawsuit filed.) Several memos and letters were posted on the LMSD website explaining the situation. No immediate remedy offered.
Class Action Lawsuit Claimed “Defendants have been spying on the activities of Plaintiffs” “continuing surveillance” “indiscriminate remote activation of the webcams”
Seven counts outlined in lawsuit, including violations of: Electronic Communications Privacy Act (ECPA) Computer Fraud Abuse Act (CFAA) The Stored Communications Act (SCA) The Civil Rights Act U.S. Constitution, Amendment IV Pennsylvania Wiretapping and Electronic Surveillance Act (PWESA) Pennsylvania Common Law
Class Action Lawsuit “invasion of Plaintiffs’ privacy, theft of Plaintiffs’ private information and unlawful interception and access to acquired and exported data and other stored electronic communications in violation of the Electronic Communications Privacy Act, the Computer Fraud Abuse Act, the Stored Communications Act, § 1983 of the Civil Rights Act, The Fourth Amendment of the United States Constitution, the Pennsylvania Wiretapping and Electronic Surveillance Act and Pennsylvania common law.”
“intercept”: “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” § 2510 “electronic, mechanical, or other device”: “any device or apparatus which can be used to intercept a wire, oral, or electronic communication.” § 2510 School laptops were used to “intercept” communications Violators of ECPA are responsible to pay all appropriate damages plus litigation costs. § 2520 Those who even attempt to intercept and / or use electronic communications in violation of the ECPA are subject to punishment. § 2511
“whoever… intentionally accesses a computer without authorization or exceeds authorized access and there by obtains… information from any protected computer if the conduct involved an interstate or foreign communication; shall be punished as provided…” §1030(e)(22)(C) “protected computer” includes “a computer… which is used in interstate or foreign commerce of communication. §1030(e)(2)(B) School-provided laptops were “protected”
Whoever intentionally accesses without authorization… or intentionally exceeds an authorization to access [a] facility through which an electronic communication service is provided … and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided…” § 2701 “Electronic communication”: “any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a …system that affects interstate or foreign commerce.” §2711 Using the webcams to obtain images of the students was unauthorized per the SCA. Type of permissible punishment for those who do not use the images for commercial gain are outlined in § 2701(b)
All Defendants (LMSD) are “persons” in that at all times they were acting as representative of the Commonwealth of Pennsylvania §1983 Plaintiffs filed lawsuit within two-year statute of limitations § 1983 Additional claim that remote activation of the webcams “which resulted in the deprivation of the Plaintiff’s…constitutionally-protected right to privacy was intentional, extreme and outrageous” and thus entitled the students and their families to “an award of punitive damages.”
The Fourth Amendment: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” Plaintiffs “had a reasonable expectation of privacy with respect to the use of the webcams embedded in the laptop computers issued by the School District” Plaintiffs were never informed that the webcam could be remotely activated and images taken.
It was believed that LMSD had captured images of the students and their families “without their permission and authorization, all of which is embarrassing and humiliating.” Because laptops were used by students and their family at home, “it is believed that many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, including, but not limited to, in various stages of dress or undress.”
A person is guilty of a third degree felony if they even attempt to intercept electronic communication. § 5703 Persons whose electronic communications have been intercepted (violated) by another party are entitled to recover actual damages, punitive damages, and litigation costs. §5725
Students and their families “had a reasonable expectation of privacy with respect to the operation of the webcams.” Students and their families were never informed that the school district could remotely activate the webcams. Because the webcams were used at home, many student, family, and friend images “may include embarrassing or compromising positions, including, but not limited to, in various states of dress or undress.”
Robbins v. Lower Merion School District “WebcamGate” Class action lawsuit dropped as both parties believed proceeding with lawsuit would be unprofitable $610,000 settlement with both Robbins and Hasan lawsuits Aug 17, no criminal charges, per U.S. Attorney’s Office
“One to One” still in effect School-provided laptops are mandatory for students to use. LMSD has switched to Casper Suite - a remote management software IP tracking No images taken of desktop or webcam
Remote access software still resides on laptops for technical support
LANrev rebranded as Absolute Manage Camera feature to be disabled on LANrev software TheftTrack not listed as a product on website Still in the same business with laptop recovery software such as “LoJack” and “Computrace “ Recovery features include: GPS location reporting Does not take webcam or screen images
In regards to TheftTrack’s ability to activate the webcam and take images of the thief: “It really doesn't serve any purpose” - Steven Midgley Absolute Software, Marketing
Aaron’s Inc (May 2011) A national rent-to-own chain Brian and Crystal Byrd (WY) claim a computer rented from Aaron’s came with software for keylogging, intercepting electronic messages, and taking webcam images. Only discovered the software was installed when a manager from the store came to their house claiming they were in default on payments. Manager provided images of Brian taken with the webcam. Case Byrd v. Aaron's Inc. is ongoing.
Agreement between Federal Trade Commission and DesignerWare All monitoring technology to be removed from computers intended to be rented to customers. Tracking technology to be limited to cases in which customers are notified. “No Deceptive Gathering of Consumer Information”
Aaron’s Inc (May 2011) Software: Designerware’s PC Rental Agent designed to remotely monitor activity on the PC Now PC Rental Agent advertises that the customer “can be assured that the store employees cannot access anything they did while renting the computer (pictures, files, financial information, personal data, Credit Card Information, web history, , cookies, personal files, etc)”
Although there is no specific law stating that an institution may not commit surveillance on its own equipment, where that surveillance invades the privacy of the end user, such surveillance is unlawful. Due to out-of-court settlements and a lack of challenging existing laws, the landscape remains somewhat unchanged.
ABC News, “Laptop Spying: Rental Company Sued Over Alleged Webcam Spying” (May 4, 2011) Absolute.com “” Absolute.com “Absolute Software” (retrieved Oct 2, 2013) CNN.com, “FBI investigates allegations webcam used to monitor student” (Feb 22, 2010) Computer World, “Pennsylvania schools spying on students using laptop webcams, claims lawsuit” (Feb 18, 2010) uit uit Computer World, “Software maker blasts 'vigilantism' in Pa. school spying case” (Feb 22, 2010) &pageNumber=1 &pageNumber=1 FBI.gov, “Inquiry into Lower Merion School District Activating Web Cams on Student Issued Computers” (Feb 22, 2010) Federal Trade Commission Harriton High School “Letter to Harriton HS Parents/Guardians” (June 12, 2013) Huffington Post, “Lower Merion School District Settles Webcam Spying Lawsuits For $610,000” (Dec 11, 2010) Lower Merion School District, “One to One” (retrieved Oct 2, 2013) PC Rental Agent, “PC Rental Agent” (Retrieved Oct 3, 2013) PCMAG.com, “Another Lawsuit Filed Over School Webcam Spying” (July 30, 2010) PCMAG.com, “High School Webcam Allegations Interest FBI” (Feb 22, 2010) Robbins v. Lower Marion School Disctrict Class Action Complaint Tech & Learning, “Lessons learned from Lower Merion’s “Webcamgate”” Tech Republic, “LANrev to lose Theft Track feature following Pa. school spying allegations” (Feb 23, 2010)