Security Experts Baffled By Pa. School Webcam Spying Case

Parents of sophomore Blake Robbins last week filed a lawsuit against Harriton High School alleging that the school monitored him via Webcam while he was at home. The family filed the suit after a school administrator accused Robbins of engaging in "improper behavior" in his home and offered a still image from the laptop Webcam as evidence, the Philadelphia Inquirer reported last week.

All Harriton High School students use school-issued Apple MacBooks with built-in Webcams that are designed to capture images if the laptops are lost or stolen. The school district says it only activates the Webcams without students' knowledge for security purposes, but that policy doesn't appear to have been followed in this case.

School officials have acknowledged remotely activating the Webcams 42 times over the past 14 months in order to find missing laptops, but they deny that any students were spied on, the Associated Press reported over the weekend. The Federal Bureau of Investigation, meanwhile, is looking into the possibility that Harriton High violated federal wiretap law.

In order to use the school laptops, students must first agree to the terms and conditions of protecting school property. But does this privilege come with strings attached? In the opinion of security VARs, this is a clear case of a school overstepping its bounds.

"Even from an IT security professional perspective, spying on the kids at home with or without prior consent is invasion of privacy," said Darrel Bowman, CEO of Tacoma, Wash.-based security solution provider Mynetworkcompany.com. "Regardless of their consent or knowledge, it's against the law."

David Sockol, president and CEO of eMagined Security, based in Santa Clara, Calif., says the answer lies in the students' expectation of privacy. "In this situation, it appears that the students would have a reasonable expectation of privacy," Sockol said. "It would be difficult for the school officials to justify that it is not an invasion of privacy if the school officials activated the camera without the student's prior knowledge."

Andrew Plato, president of Anitian Enterprise Security, says that while Webcam surveillance isn't a new phenomenon, it would be extremely improper for the school to have engaged in such conduct. "It's one thing to install antivirus software or restrict rights so the student cannot damage the system, but very different to take pictures of the person in their home -- not to mention the fact that this is a child," said Plato.

Sockol cites the FTC's Children Online Privacy Protection Act of 1998, which is designed to protect individuals under the age of 13 from company abuse on the Internet, and says school officials don't have the right to activate webcams on school-issued laptops at their whim.

Within the ever-expanding context of technology, the line between security and invasion of privacy can easily be blurred. Schools and companies alike must tread this line with a high level of sensitivity to protect all parties involved.

Emagined Security advises its clientele to work with legal teams to ensure the monitoring, capturing and storing of data is conducted legally and with due diligence.

"When we talk with clients, we discuss these and many other potential misuses of technology," Sockol said. "Organizations need to be very aware of their decisions on how they use technology and the implications of their actions."