Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
Security Privacy

HS Students Steal SSNs to Prove They Can 701

thatshortkid writes "Local news in Chicago is reporting about two Hinsdale Central High School students who breached their school's computer system and retrieved all of their peers' (plus staff's) Social Security Numbers. They claim they have destroyed the information and haven't given it out, but the SSA and FTC have been alerted for good measure. While they claim their motive was to prove that the breach could take place and no malice was involved, they face possible school disciplinary action and criminal charges."
This discussion has been archived. No new comments can be posted.

HS Students Steal SSNs to Prove They Can

Comments Filter:
  • ridiculous (Score:5, Insightful)

    by faldore ( 221970 ) on Monday May 16, 2005 @12:49AM (#12540204)
    They should be paying them not punishing them.
    • G I T M O (Score:4, Funny)

      by Anonymous Coward on Monday May 16, 2005 @01:12AM (#12540350)
      Right or wrong they might provide expertise to terrorists, or might engage in weapons of mass destruction related activity programs.
    • Re:ridiculous (Score:3, Insightful)

      Theres a big difference between whistle-blowing and breaking the law. Would you go into someone's house and steal their TV just to prove how ineffective their door lock is? HSs are rather small, if they spread word around, maybe at a PTA meeting, they might have gotten the same results without going to jail for computer crimes. Crime, even for a good reason, is still crime, and if we don't enforce the law all the time, we might as well not inforce it at all.
  • Dumbasses..... (Score:5, Insightful)

    by Palal ( 836081 ) on Monday May 16, 2005 @12:49AM (#12540206) Homepage
    Unfortunately, people do not learn from others' mistakes. How many times have people broken into school databases only to be arrested! It does prove that you can break into a DB, but so what? Once again it goes to show you "no good deed goes unpunished!"
  • by Bananatree3 ( 872975 ) on Monday May 16, 2005 @12:50AM (#12540214)
    While it may be an obvious way to get the schools attention on the matter, it is, as the article said, a good way to get yourself expelled, etc. Maybe if they took the issue with the IT staff, and showed them one-on-one how it could be done, they would not be in any harms way.
    • by Anonymous Coward on Monday May 16, 2005 @12:58AM (#12540260)
      "Maybe if they took the issue with the IT staff"

      hahahahahaha... .. whew. oh... you were serious?
      They would have probably gotten the kids in trouble for thinking about "hacking" into the computers. Those hacker kids are nothing but trouble you know. School IT staffs are a JOKE in 90% of schools, and don't give a damn or don't know a damn thing.
    • To prevent being expelled just send the SSNs to the IT administration through anonymous snail mail. Explain how you broke in, and hopefully they will fix the problem.
  • Over react much? (Score:5, Interesting)

    by r_glen ( 679664 ) on Monday May 16, 2005 @12:50AM (#12540215)
    Okay, I understand that what these kids did was stupid, and serious, but is it really necessary to include quotes like this...?

    "When we grow up and get our jobs, that's our life right there. They can access anything about us. It just screws us up for the rest of our lives," said Julianne Junus, student.
    • by Anonymous Coward on Monday May 16, 2005 @12:55AM (#12540242)
      It shouldn't be, but since the SSNs are used for everything a person does for the rest of their lives, it should be included. As a reason not to use SSNs at Schools and the like.
  • by Zakabog ( 603757 ) <john@j[ ] ['mau' in gap]> on Monday May 16, 2005 @12:50AM (#12540217)
    I guess it kind of sucks that they're gonna get punished for this, but they deserve it. You can't legally break into someone's house just to show you can, they should have told the school (or some news stations) that they were planning to show how easy it would be to get into the system. Then under a controlled environment (with some type of supervisors there) they can show how easy it would be. That way everyone knows the attack is going on and the school knows what was done by the students rather than relying on their word.
    • by EmbeddedJanitor ( 597831 ) on Monday May 16, 2005 @12:58AM (#12540257)
      Exactly so. 90% of the badness of being burgled is not that stuff was taken or tampered with, but that your private space was violated. This violation happens regardless of the violators intentions.

      Being bust or not is not the issue. If they had been bust while trying to get in then they would have had no excuses. The broke in and that is bad.

      • by mcc ( 14761 ) <> on Monday May 16, 2005 @01:10AM (#12540338) Homepage
        If I ever found myself in such a situation, the way I would look at it is that my private space was violated by the people who put my personal information where it could be indirectly but publicly accessed, not the people who chose to take advantage of that.

        Just a thought.
        • by TheFlyingGoat ( 161967 ) on Monday May 16, 2005 @02:13AM (#12540631) Homepage Journal
          So if you forget to lock your windows when you leave one day and end up getting robbed, you won't blame the people that broke in? You'd blame yourself or the police department for not doing a good enough job with security?

          Every time this argument comes up, someone tries using that line of logic. The fact is, though, that even though your actions were stupid, the burglar broke the law.
      • Assuming the students got the SSNs truly with the sole purpose of verifying the existence of the security flaw, then I think they deserve NO punishment. This is not a black-and-white issue, and the teacher should explain it to both the cracker and the other students very carefully. In this case the crack might do more harm than good, but if the school simply punishes the offending students hard without much explanation, the other students may easily extrapolate that to "don't do anything when you see some
    • by ZorbaTHut ( 126196 ) on Monday May 16, 2005 @01:01AM (#12540281) Homepage
      On the other hand . . .

      . . . imagine you're legally required to keep your electronics and jewelry in someone else's house. And not only that, but several hundred of your friends are too. And imagine that you know the security in this house is bad, and you've tried telling the owner of the house that your possessions are in danger, but he doesn't care. And you've tried telling the government that your possessions are in danger, but they don't care either. Your friends care though, and they're really frustrated knowing that all their possessions are in danger, just like yours, and that nobody seems to be able to do anything about it.

      Maybe then you'd break in, to demonstrate it's possible, and get the owner of the house to tighten up security for the sake of you and your friends?
      • by tftp ( 111690 ) on Monday May 16, 2005 @01:38AM (#12540488) Homepage
        Maybe then you'd break in, to demonstrate it's possible, and get the owner of the house to tighten up security for the sake of you and your friends?

        No; I would have filed a civil lawsuit against the school. There are very good chances that the problem would be fixed in matter of hours - and I would get a useful experience in defending my rights in a completely legal way.

        (I recall an old movie with Hulk Hogan where scenario of this sort was presented.)

        • Evidence? (Score:3, Interesting)

          by MarkByers ( 770551 )
          A lawsuit with no evidence is not going to get very far. How will you prove that information is not secured? You would have to test it by trying to break in, in order to prove your case. That is what the students should have done, then after they have the evidence, they should go to court.

          Oh wait... that's what happened.
  • Common Sense (Score:3, Insightful)

    by OverlordQ ( 264228 ) on Monday May 16, 2005 @12:51AM (#12540219) Journal
    Just because you can doesn't mean you should.

    I know people will come on here and say "OH but the administrators probably wouldn't listen so they had to do this to prove how serious it was". I'm sure if they followed good procedure and presented a good presentation to the Board/etc they would of gotten a better reception then what they did.
    • Re:Common Sense (Score:5, Insightful)

      by SimplyCosmic ( 15296 ) on Monday May 16, 2005 @01:04AM (#12540297) Homepage
      At the least, they should have made a very real effort to alert the school administration that this was a problem.

      In that way, even if they were completely ignored, they'd at least have something to back them up when they make the futile claim that they tried all the normal means to make the school aware of the issue.

      Sure, they'd still get in trouble with the school, but at least they'd have some credibility in the public's eye as doing this for a good reason rather than simply because they could.
  • Yup. (Score:5, Insightful)

    by beavis88 ( 25983 ) on Monday May 16, 2005 @12:51AM (#12540222)
    Nothing will bring pain to you quite like making someone (or some organization) look foolish. Even if you probably are at least somewhat in the right.
  • by Daffy Duck ( 17350 ) on Monday May 16, 2005 @12:55AM (#12540240) Homepage
    Honestly, what a bunch of fuck ups. If you're trying to do a service by penetration testing, you at the very least notify the sysadmins of the vulnerability you plan to explore.

    To go all the way through to stealing *everyone's* information, and then afterwards claim you only did it to help is bad judgment at best. In some states it's criminal.
  • Well, is hacking... (Score:5, Interesting)

    by Creepy Crawler ( 680178 ) on Monday May 16, 2005 @12:56AM (#12540248)
    Copying the openly readable, unencrypted database (say in MySQL) and parsing for XXX-YY-ZZZZ found to be hacking?

    Well, for one, it is public knowledge that the SSN X's (in my representation) are in fact, state codes. I have some reason to believe that the Y might be county or some sort of district code, but I cant be soo sure unless I'd gather enough SSN's and location of birth

    Yes, the mail center in which you were born is what the state code is attributed to, not the actual locale you live in. Say your parents lived in Phoenix, Arizona but went on a trip to New York City. The baby's SSN would start with 050 to 134, NOT the Arizona 526 prefix.

    Well, hope this sparks up some replys (and mod points! yay mod points!)
    • by _Sharp'r_ ( 649297 ) <sharper&booksunderreview,com> on Monday May 16, 2005 @01:13AM (#12540352) Homepage Journal
      Different SSN prefixes are assigned to specific SS offices to give out. What determines which one you get is which office you get your numbers/original card through.

      In many cases (especially recently), SSNs are applied for semi-automatically through the hospital someone is born in, so in that case the hospital location would determine the prefix.

      Personally, I didn't have a SSN until I was 23 (and only then because I couldn't avoid it anymore without causing myself hassles with otherwise-decent employers that I didn't feel like hassling with), so my prefix is the same as the office I applied through when I got mine at age 23, nothing to do with my birth location.
      • ---Personally, I didn't have a SSN until I was 23 (and only then because I couldn't avoid it anymore without causing myself hassles with otherwise-decent employers that I didn't feel like hassling with), so my prefix is the same as the office I applied through when I got mine at age 23, nothing to do with my birth location.

        I should have clarified myself. The SSN state code is based off of the location of the mail collection where you requested it. So, if you lived in the sticks near a border of a state, an
  • would you? (Score:4, Insightful)

    by zappepcs ( 820751 ) on Monday May 16, 2005 @12:59AM (#12540267) Journal
    Personally, this makes me wonder why I would ever give anyone my SSN, unless they can prove they will live up to their federally mandated responsibilities.

    This just shows that most companies and governments cannot do so.
  • I had the "fun" of working in our school's server room my freshman year. We had the servers get hacked at least twice.

    The first time was a simple brute force attack on a AppleShare server, because the main admin refused to put a limit on the number of password attempts because it was too inconvient to have them simply go up to an admin and reset their password, despite that's more or less exactly what would have to happen if someone forgot their password anyways. I found out that year who had done it, but congratulated the person.

    The second time it was because the rather ancient admin password leaked out and they were able to use that to not only get into the teacher's file server but also the SASI server with all the grade data! Why did we use this password? Well be cause it was tradition! I found out only a couple months ago who did this, he didn't

    There's so much incompetence at so many High Schools it wouldn't surprise me if it was something as simple as a server that hadn't been patched in ages. Aren't you glad to know that these are the people with all your insensitive data? As it stands at my college they use SS#s for *everything* even though they probably shouldn't.
    • There's so much incompetence at so many High Schools it wouldn't surprise me if it was something as simple as a server that hadn't been patched in ages.

      Imagine how much incompetence there is at universities.

      During my senior year, my school's network was being brought to its knees on a regular basis by Napster. It wasn't students downloading that was the problem, it's that they'd go home for the weekends, leave their connections running, and everyone uploading god-knows-what from all over campus would ju
  • by Dr. Mu ( 603661 ) on Monday May 16, 2005 @01:00AM (#12540274)
    The real problem is not that SSNs are so easy to get but that possesion of another person's SSN gives one so much power to do ill. I think it's time that agencies and institutions quit relying on such a dubious means of identification as a key to perform transactions. Heck, some of them only require the last four digits!

    I'm certainly not suggesting something as draconian as RealID. But it should not be necessary to keep one's SSN any more secret than the account and routing numbers printed on personal checks.

    • MOD !^$# PARENT UP! (Score:4, Interesting)

      by daniel_mcl ( 77919 ) on Monday May 16, 2005 @01:14AM (#12540365) Homepage
      For goodness sake, anyone who's seen your driver's license -- say the bartender at whatever club or whatever -- can open a credit card under your name, and from that point on you're pretty much screwed. There is no reason that SSN should be legal proof-of-identity, because it's absurdly easy to steal.
    • by aaronl ( 43811 )
      The private sector isn't supposed to use SSNs to begin with. Take a look at the Social Security Act (1936 I believe) and then at the Privacy Act of 1974.

      We don't need RealID or anything other stupid thing, we just need to enforce the existing laws. Just like almost everything else Congress passes new laws about.
  • Punish who? (Score:5, Interesting)

    by djdanlib ( 732853 ) on Monday May 16, 2005 @01:01AM (#12540277) Homepage
    I support punishment of the administrators who did not sufficiently secure that sensitive information. I also support to a lesser degree the punishment of the children who stole the information. However, had that event not taken place, some less scrupulous children might have misused the information that was so easily stolen.

    Most databases and file servers have permissions systems in place that can authenticate by host and IP range. Most administrators assign different IP ranges for different purposes - staff should be different from student-accessible. Also, multiple passwords are required in most systems to access sensitive information: computer login, network login, database login. Passwords are also supposed to change often. Why were these precautions not taken, and why did the admin not notice anything suspicious until it was too late?

    Never underestimate 15 year olds. Why? First, they have WAY more free time than any of us working folk. Come on. They get home at 3, and have maybe an hour or two of homework to do sometimes, then they stay up until 1-2 AM. Second, there are a lot of them for every administrator at any school. Third, they are hormonally imbalanced and do irrational stuff to prove irrational points. They can exploit all of those points to their advantage at almost no notice. I did, you did, most everyone did.

    Someone needs to be made an example to prevent this sort of thing elsewhere. I think the administrator is the best choice, personally.
  • by brg ( 37117 ) <> on Monday May 16, 2005 @01:05AM (#12540299) Homepage
    What I think this incident really underscores is that high schools, where security is (unfortunately) likely to be lax, should not be using or storing students' Social Security numbers. High schools are perfectly capable of assigning unique ID numbers of their own to students wherever they are necessary; if and when their security is breached, the numbers are not useful for anything beyond the school's own internal databases.

    Keeping SSNs around obviously can't be avoided for the school's employees (for tax and other reasons), but employee databases should be separate from student records, and there are far fewer employees than students anyway.

    Basically, SSNs seem to have become the knee-jerk instant universal ID number for American firms and institutions of all sorts, which is a pity. It's best if we (as IT professionals) try to encourage the keepers of old databases to transition away from using them, and to strongly recommend that new databases not use them at all, wherever possible.

    • Huh? Schools definitely need SSNs. How else do you think they put things on YOUR PERMANENT RECORD?!?!
    • by Infonaut ( 96956 ) <> on Monday May 16, 2005 @02:21AM (#12540680) Homepage Journal
      High schools are perfectly capable of assigning unique ID numbers of their own to students wherever they are necessary

      From my experiences doing pro-bono work at four different high schools, I'd say that most of them barely have the capability to deal with the most rudimentary data management tasks. I'm not saying this to be dismissive of schools or the people who work there, but they are in many cases so short on human and technology resources that creating and managing unique IDs for each student isn't something that would even cross their minds.

      The SSN is, as you mentioned, the knee-jerk instant universal ID number precisely because it requires no extra effort. This is not a good situation, but it has come about because there is no compelling reason (that many institutions can see) to devote extra time and effort to coming up with alternate ID schemes for schools.

  • there will be a lot of teeth gnashing from slashdotters about this "injustice". usually because the average slashdotter trusts some anarchist high school students more than they probably trust their own police department. they will point out that a security system untested is never sound, and that this move will strengthen security. that better these high school students than someone with truly dark intent break in.

    the problem has to do with what the word "trust" means. society at large doesn't trust an intelligent well-intentioned hacker (these students are hackers as in the old school sense if there ever was one, as opposed to the new school "hacker=terrorist" sense). but they DO trust a bumbling idiotic underpaid school administrator.


    it's about how the average slashdotter views "trust" and how society at large views "trust". the average slashdotter trusts intelligence, cleverness, technical literacy. but the average joe simply trusts accountability.

    the school administrator's job is to keep security, he is trusted by society, paid by society to do this. he is accountable. the school administrator will be reprimanded by this breach, and the breach will be repaired. this is society at work. meanwhile, there is no social contract with the high school student. there is no trust. there is no accountability.

    yes, security will be better because of what they did. yes, their intent is perfectly sound. but there is no trust, there is no accountability as far as the average joe sees it.

    the lesson therein is for the average slashdotter then:

    accountability is more important than cleverness.

    to put it another way, the average joe doesn't care how technologically sophisticated the security is on their SSNs. the average joe just cares if THERE IS SOME ACCOUNTABILITY. so the SSNs could be on a text file on webserver, they don't care. the question si: is someone's job on the line for the theft? the average joe understands this concept: someone will suffer if my identity is stolen. there fore, someone out there is motivated to protect me.

    meanwhile, these students have no social contract, no accountability. what is their intent? what is their motivation to do good by me? all i have to trust is their word, and i don't know them from adam. therefore, all that they have done for the average joe goes unheeded, unrecognized. the students helped the average joe, but the average joe sees them as criminals.

    folks: gnash your teeth all you want, i'm just trying to give you all a heads up about the difference in thinking between the average joe and the average slashdotter. if you don't like what i am saying, don't be mad at me, don't shoot the messenger.

    be angry that trust does not mean same thing to you and the average guy on the street.
    • It's an interesting point, and I think you're at least mostly right. However, there is an inconsistency in that no administrator appears to be losing their job over failing to protect these SSNs from the students. By your logic, if no one's job is on the line, where is the accountability?

      That said, someone getting yelled at by the boss seems very likely here...

    • by hyfe ( 641811 ) on Monday May 16, 2005 @03:24AM (#12540901)
      meanwhile, these students have no social contract, no accountability. what is their intent? what is their motivation to do good by me? all i have to trust is their word, and i don't know them from adam. therefore, all that they have done for the average joe goes unheeded, unrecognized. the students helped the average joe, but the average joe sees them as criminals.

      The difference for the students is the one between numbers and people.
      For the school board (or however you're organized over there), there is a case of '500 SSN's got leaked, oh well.. the bad publicity will cost us less than hiring competent people'.
      For the students it's, 'holy shit, they're practically giving away our SSN's, I don't want my bank-account suddenly emptied'

      The victims have an inherit motivation in not becoming fucked over. The overseer's main motivation is not being yelled at.

    • to put it another way, the average joe doesn't care how technologically sophisticated the security is on their SSNs. the average joe just cares if THERE IS SOME ACCOUNTABILITY. so the SSNs could be on a text file on webserver, they don't care. the question si: is someone's job on the line for the theft? the average joe understands this concept: someone will suffer if my identity is stolen. there fore, someone out there is motivated to protect me.

      I guess I have to disagree with this. The average joe onl
  • by Vegeta99 ( 219501 ) <> on Monday May 16, 2005 @01:14AM (#12540361)
    Jesus. My ID has it printed right on it. If you forgot your ID, you had to tell them your social to get lunch.
  • by rogueuk ( 245470 ) on Monday May 16, 2005 @01:48AM (#12540534) Homepage
    Why does a public high school even need your SSN? I can understand them needing the staff SSNs for payroll, but why do they need a kid's social security number?

    Does anyone know? It's not like the students are paying any taxes towards social security through the high school
  • Thought Experiment (Score:3, Interesting)

    by The Slashdolt ( 518657 ) on Monday May 16, 2005 @01:50AM (#12540543) Homepage
    When it comes to data, I'm wondering what possession actually means. Specifically, say I have a list of SSN's as S, and I apply an encryption function encrypt(), they become encrypt(S). Given only encrypt(S), am I illegally possessing data? Taken one step further. Clearly, applying decrypt() to encrypt(S) gives me back S. Assume I have some data D. If I can arrive at a function decrypt() that can turn D into the original S, shouldn't D be as illegal as encrypt(S)?

    As a realistic example, imagine I was able to write a function decrypt() such that it could turn a text file of one of the works of shakespeare into a list of social security numbers. Would then, all people who have a text version of said shakespearean work be in possession of illegal material?

    Quite honestly, if you take this to a logical extreme, no matter what the input data, given the ability to write any function, the output data could be anything you could conceive. What if your function is simply the concatenation of "illegal" data to the output. Would then the "reverse engineering" of said "encryption" function be illegal according to the DMCA? It is a "security device" at this point, right?

    This all boils down to the difference between data and functions on data. It is illegal to hold certain data. But what if we lable data as functions on data. In fact, security device functions on data. Could we then distribute the functions and make it illegal for people to reverse engineer the functions without permission?

  • How do SSNs work? (Score:3, Interesting)

    by pesc ( 147035 ) on Monday May 16, 2005 @02:03AM (#12540595)
    I'm not from the US and now I have to get this explained. I'm not trolling. I can't really understand how SSNs are supposed to work.

    The SSN seems to be a number identifying a person. (We have that where I live too.) But somehow, this number is assumed to be secret, like a password. If yout can learn the number you can access anything about the person and you also seem to be able to hurt the person financially. Withdraw funds? The security seems to revolve around the fact that the number (the identity of the person) is secret! Because everyone here seems to be upset that these kids expose all those numbers!?!? This boggles my mind.

    Are there no other attempts at authentication? IDs? If your SSN is your password, how do you change it? (I would like to have it changed several times a year, no matter what if there is no other security than secrecy.) Can someone explain?
    • Re:How do SSNs work? (Score:5, Interesting)

      by kobaz ( 107760 ) on Monday May 16, 2005 @03:34AM (#12540920)
      Social Security numbers were originally designed for use with the social security system, and that was *it*. The social security system is set up where the working class have a portion of their pay given to the government's social security program. People who have worked all their life and retire will start collecting money from social security that was paid for by the working class.

      The SSN was only intended to be the number you would use to identify yourself to the social security department where they could look up your info and validate that you are ready to recieve your money when you retire.

      Now your SSN is your life for the most part. If somsone has your number, they dont even need to know anything else to screw you over. With the number they can do searches and find your name and current residance. With that info they can sign up for credit cards in your name and screw over your credit. They can basicly steal your identity just by knowing that one special number. If someone with bad intentions has your SSN, you are basicly fscked unless you have alot of money to pay lawyers to fix everything.

      It's basicly a fairly fscked up system.
  • letter (Score:3, Interesting)

    by tdmg ( 881818 ) on Monday May 16, 2005 @02:39AM (#12540752)
    I sent this to District 86 in Chicago:

    Dear Superintendent Miller,

    I am sure you have been receiving a barrage of e-mails recently, so I'll make this short.
    Recently I read about two of your students attending Hinsdale Central High School breaching network security and the stealing Social Security Numbers for students and staff. While I do not believe that stealing the SSNs was appropriate, I do not support the way your administration has handled the situation.
    A communal perspective needs to be taken when looking at the actions of those two students. Often drastic measures, both vulgar and offensive to those in charge, has to be taken. At this moment the citizens of Arizona are spitting in the face of the government by protecting their on boarders. This is not very different from what these two students did at HCHS. While they did break the law by cracking though security, they were trying to protect the student body (including themselves) and the staff by alerting the school of its flaws. Lets say someone was to break into their bank and steal their safety deposit box, and then handed it back to the bank manager the next day. An conceited bank manager wouldn't be able to see the good in what this man had done and would call the cops. However, an intelligent bank manager would hire this man.
    Also, I am well acquainted with system admins in school districts. A close friend of mine has been one of the head network admins for the Boston Public Schools for almost 15 years. While he works with gifted students to patch holes in security, many of the other admins disregard student warnings. They let their titles, status, and education get in the way of common sense.
    Punishing these students is just another way that red tape and policy is destroying ingenuity in America. Strictly disciplining these students will only perpetuate the notion that students in America should strive for mediocrity and that being bold and initiating change should be shunned.

    - Xxx Xxxxxxxxx-Xxxxxxx
  • Cover up (Score:5, Insightful)

    by panurge ( 573432 ) on Monday May 16, 2005 @03:04AM (#12540845)
    Trying to get into places they shouldn't, whether it is safes or knickers, is something that adolescent boys are programmed to do. Anybody responsible for school systems has an obligation to understand this and deal with it. This is nothing to do with social relativism, as the more fascist /.ers seem to think: it's elementary precaution. Regardless of the motivation of the hackers, the people responsible for the system should be required to be trained in security (and perhaps be downgraded till they had passed their exam) because they failed to take account of something widely known in education. If the zoo keeper leaves the doors unlocked on the lion cages, the lions may escape and end up having to be shot, but what about the zoo keeper?

    The truth is the lazy, idle and incompetent always prefer the cover up to the fix. Whether it is the Roman Catholic church and child abuse, torture at Guantanamo Bay, or security holes, the people in charge will conceal rather than cure. Two examples from my own career:

    I was once asked to investigate the apparent failure of an automated component test system. Eventually a review of the hardware and software left the only option as being that the production personnel were deliberately falsifying results and passing rejected batches. Result: three senior managers demanding I be sacked. Fortunately at this point we acquired a new CEO who had several clues. One manager was fired, one left of his own accord and the other was downgraded. But customer confidence had been eroded and the plant eventually had to be shut down. The second example was less exciting: a production director who resisted for years the introduction of statistical process control because it would make clear where systems were failing.

    I'm sure many of us have similar examples. It is not in fact important what the motivation of the whistle blower is, we need to change the culture to one in which the response is "Fix it", not "shoot the messenger". With hindsight, we may one day conclude that the tradition of open bug fixing is FOSS is its greatest social legacy.

  • by hs-student ( 884341 ) on Monday May 16, 2005 @04:26AM (#12541045)
    Although I graduated several years ago, I don't doubt such a thing happened. Would you believe that they actually used your initials and the last 4 digits of your social security # as a hard-coded unchangeable password for all staff, faculty, and administrative accounts, assumable some with access to this stolen information? For the students, at least when I was there, the last 4 digits were substituted with the last 4 digits of your student ID. As you an imagine, this also was about as secure as the last 4 digits of your credit card number. Rumor has it that many years ago someone hacked the system and changed the principal's paycheck to 86 cents in resemblance of the school district #. Figures.
  • by john_anderson_ii ( 786633 ) on Monday May 16, 2005 @04:28AM (#12541050)
    If they had plan, and a means to carry out said plan, then they should have gone to the media first.

    Seriously. If these kids had cornered a reporter, made an argument for his/her involvement and brought along said reporter with the promises of an exclusive, their ass would be automatically covered. The presence of the media would have proved they were whistle blowers and not some renegade "vigilantes" that got caught in the act. Nothing could prove different once the film and commentaries went to air.

    The moral is....Once you decide to show some self centered egotistical bastard which way the wind blows....bring a weathervane.
  • by Bigman ( 12384 ) on Monday May 16, 2005 @09:00AM (#12542262) Homepage Journal
    .. with less risk would be to send a formal letter to someone high up that you believe that the information held on that server to be insecure, and ask that it be secured or your information be promptly removed. Offer to demonstrate how the information is insecure, maybe, but point out that since you have informed them of the possibility of an intrusion you will consider sueing (?) if *your* information is stolen. That will get their attention!
  • by jcr ( 53032 ) <> on Monday May 16, 2005 @10:52AM (#12543464) Journal
    Since when did a high school become an employer of its students? I want someone to find out why the school had the kids' SSNs in the first place.


When you are working hard, get up and retch every so often.