[ISN] Ex-student faces felony charge in Clay case

From: InfoSec News (alerts@private)
Date: Thu Feb 15 2007 - 22:27:12 PST


By Robin Erb
Blade Staff Writer
February 14, 2007

A former Clay High School student was charged yesterday with a felony 
after police said he hacked into school personnel and student files, 
downloading sensitive information onto his iPod.

The junior, who has since withdrawn from the school, was charged with 
unauthorized use of a computer, a felony. He was also charged with 
possessing a criminal tool - the iPod - since it was used in the crime, 
said Oregon Police Detective Janet Zale.

Oregon City Superintendent John Hall and a police detective said the 
personal information did not make its way beyond the student's iPod.

"We contained [the information leak] to the school. That's the good part 
of this story," Mr. Hall said.

Mr. Hall declined to discuss whether the student withdrew from the high 
school on his own or was forced to do so.

The superintendent also refused to identify "two certified high school 
staff" who received written reprimands in the incident for their 
"inaction or lack of follow-through."

Keith Stephens, a computer program teacher, is listed as a witness on 
the police report.

The student - who has no previous criminal record - was in the school's 
computer lab on Jan. 11 when he accessed the school's personnel files, 
police said.

The teen later argued with a student after she accused him of cheating. 
The suspect threatened to open up a credit card in her name and ruin her 
credit, she told police.

A school resource officer began investigating the girl's claims that day 
and talked to another student, who said he'd seen sensitive files on the 
suspect's computer. Confronted, the suspect told the officer that the 
files had simply appeared on his computer. He denied downloading the 
information, according to the police report.

The officer also spoke to Mr. Stephens. The teacher said the suspect and 
another student were "somewhat loud" earlier that day in his classroom 
as they looked "intently" at a computer screen.

Mr. Stephens saw the students were looking at the personal files of 
teachers and students, asked the students how they got them, and they 
told him they just appeared. He ordered them to log out of the files and 
delete any information that may have been downloaded, according to his 
statement to the school resource officer.

"The suspects stated they would, but [Mr. Stephens] did not see them do 
it," the police officer reported. The report does not indicate the 
identity of the other district employee involved.

After staff confiscated the iPod later that day, the school's technical 
engineer found the sensitive information on it, police said.

The case was turned over to Oregon police, who consulted with the Toledo 
Police Department and the Defiance County Sheriff's Department.

Detective Zale said it appeared that the computer files were created the 
same day the iPod was seized from the suspect and the information was 
not disseminated or used elsewhere. In fact, a report several days later 
from another teacher about $352.23 in bogus credit card charges on Jan.
10 and Jan. 13 does not appear related to the Jan. 11 incident, he said.

As of yesterday, Lucas County Juvenile Court had not scheduled a first 
hearing in the youth's criminal case.

Subscribe to the InfoSec News RSS Feed

This archive was generated by hypermail 2.1.3 : Thu Feb 15 2007 - 22:39:51 PST