1 / 31

Institutional Surveillance

Institutional Surveillance. Maxine Major October 2013. Overview. Topic Summary Robbins v. Lower Merion School District Legal Process Pending Outcomes Similar Cases Current Landscape Conclusions. Summary of Issue. Institutional Surveillance

kalkin
Télécharger la présentation

Institutional Surveillance

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Institutional Surveillance Maxine Major October 2013

  2. Overview Topic Summary Robbins v. Lower Merion School District Legal Process Pending Outcomes Similar Cases Current Landscape Conclusions

  3. Summary of Issue Institutional Surveillance Do institutions have a legal right to use loaned equipment to monitor the equipment (and consequently the customers who use their equipment)? If so, when is this permissible, and when is it crossing the line into unwarranted surveillance?

  4. Robbins v. Lower Merion School District • Lower Merion School District • Harriton High School in Rosemont, PA • Lower Merion High School in Ardmore, PA • Macbook laptop given to each of 1800+ students as part of a “One to One” initiative • Mandatory use • Students and parents not of remote monitoring software installed on Macbooks

  5. Robbins v. Lower Merion School District • LANrev’s “TheftTrack” • Could be activated remotely • Collect images from webcam and/or desktop of laptop • Permission to activate granted by IT department cooperating with LANrev • Deactivating also must be handled by IT, security, and LANrev

  6. Robbins v. Lower Merion School District • Lower Marion School District • Policy to activate TheftTrack only if Macbook was reported lost, stolen or missing • Assisted in the return of 18 of 42 laptops reported missing in the 2009-2010 school year • IT reportedly stated that it was not necessary that students were aware of the TheftTrack feature

  7. Robbins v. Lower Merion School District • Blake Robbins • Nov 11. 2009 – Harriton High sophomore Blake Robbins in trouble for engaging in “improper behavior” at home. • Assistant principal of Lower Merion High School showed Robbins webcam images of him taking pills. (Robbins claims it was candy.) • February 11, 2010 - Robbins’s parents file class action lawsuit

  8. Robbins v. Lower Merion School District • Jalil Hasan • Dec 18, 2009 – Reported his laptop missing • Dec 21, 2009 – Laptop found by a teacher and returned to Hasan • February 2010 – TheftTrack remained active until Robbins lawsuit resulted in TheftTrack deactivation on all laptops • 469 webcam pictures • 543 screen shots • July 8, 2010 – Hasan alerted to the existence of the photographs by a lawyer for LMSD

  9. Robbins v. Lower Merion School District • Summary of case: • 179 times TheftTrack activated • 12 laptops with webcams left active after laptop returned • 57,986 images taken • Images included students and family members sometimes in non laptop-related activities including sleeping and in various states of dress. • FBI opened an investigation in regards to claims that school officials were actively monitoring students via webcam.

  10. Robbins v. Lower Merion School District • LMSD Response • Use of TheftTrack halted immediately • Series of letters sent to parents explaining the situation and apologizing for not making clear the presence of and the capabilities of the TheftTrack software. • (Had to cease sending letters after class action lawsuit filed.) • Several memos and letters were posted on the LMSD website explaining the situation. • No immediate remedy offered.

  11. Robbins v. Lower Merion School District • Class Action Lawsuit • Claimed “Defendants have been spying on the activities of Plaintiffs” • “continuing surveillance” • “indiscriminate remote activation of the webcams”

  12. Robbins v. Lower Merion School District • Seven counts outlined in lawsuit, including violations of: • Electronic Communications Privacy Act (ECPA) • Computer Fraud Abuse Act (CFAA) • The Stored Communications Act (SCA) • The Civil Rights Act • U.S. Constitution, Amendment IV • Pennsylvania Wiretapping and Electronic Surveillance Act (PWESA) • Pennsylvania Common Law

  13. Robbins v. Lower Merion School District • Class Action Lawsuit “invasion of Plaintiffs’ privacy, theft of Plaintiffs’ private information and unlawful interception and access to acquired and exported data and other stored electronic communications in violation of the Electronic Communications Privacy Act, the Computer Fraud Abuse Act, the Stored Communications Act, § 1983 of the Civil Rights Act, The Fourth Amendment of the United States Constitution, the Pennsylvania Wiretapping and Electronic Surveillance Act and Pennsylvania common law.”

  14. Electronic Communications Privacy Act (ECPA) • “intercept”: “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” § 2510 • “electronic, mechanical, or other device”:“any device or apparatus which can be used to intercept a wire, oral, or electronic communication.” § 2510 • School laptops were used to “intercept” communications • Violators of ECPA are responsible to pay all appropriate damages plus litigation costs. § 2520 • Those who even attempt to intercept and / or use electronic communications in violation of the ECPA are subject to punishment. § 2511

  15. Computer Fraud Abuse Act (CFAA) • “whoever… intentionally accesses a computer without authorization or exceeds authorized access and there by obtains… information from any protected computer if the conduct involved an interstate or foreign communication; shall be punished as provided…” §1030(e)(22)(C) • “protected computer” includes “a computer… which is used in interstate or foreign commerce of communication. §1030(e)(2)(B) • School-provided laptops were “protected”

  16. The Stored Communications Act (SCA) • Whoever intentionally accesses without authorization… or intentionally exceeds an authorization to access [a] facility through which an electronic communication service is provided … and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided…” § 2701 • “Electronic communication”: “any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a …system that affects interstate or foreign commerce.” §2711 • Using the webcams to obtain images of the students was unauthorized per the SCA. • Type of permissible punishment for those who do not use the images for commercial gain are outlined in § 2701(b)

  17. Civil Rights Act All Defendants (LMSD) are “persons” in that at all times they were acting as representative of the Commonwealth of Pennsylvania §1983 Plaintiffs filed lawsuit within two-year statute of limitations § 1983 Additional claim that remote activation of the webcams “which resulted in the deprivation of the Plaintiff’s…constitutionally-protected right to privacy was intentional, extreme and outrageous” and thus entitled the students and their families to “an award of punitive damages.”

  18. Invasion of Privacy (U.S. Const. Amend. IV) • The Fourth Amendment: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” • Plaintiffs “had a reasonable expectation of privacy with respect to the use of the webcams embedded in the laptop computers issued by the School District” • Plaintiffs were never informed that the webcam could be remotely activated and images taken.

  19. Invasion of Privacy (U.S. Const. Amend. IV) • It was believed that LMSD had captured images of the students and their families “without their permission and authorization, all of which is embarrassing and humiliating.” • Because laptops were used by students and their family at home, “it is believed that many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, including, but not limited to, in various stages of dress or undress.”

  20. Pennsylvania Wiretapping and Electronic Surveillance Act (PWESA) A person is guilty of a third degree felony if they even attempt to intercept electronic communication. § 5703 Persons whose electronic communications have been intercepted (violated) by another party are entitled to recover actual damages, punitive damages, and litigation costs. §5725

  21. Invasion of Privacy: Pennsylvania Common Law Students and their families “had a reasonable expectation of privacy with respect to the operation of the webcams.” Students and their families were never informed that the school district could remotely activate the webcams. Because the webcams were used at home, many student, family, and friend images “may include embarrassing or compromising positions, including, but not limited to, in various states of dress or undress.”

  22. Legal Procedings • Robbins v. Lower Merion School District • “WebcamGate” • Class action lawsuit dropped as both parties believed proceeding with lawsuit would be unprofitable • $610,000 settlement with both Robbins and Hasan lawsuits • Aug 17, 2010 - no criminal charges, per U.S. Attorney’s Office

  23. Where Are We Now? • “One to One” still in effect • School-provided laptops are mandatory for students to use. • LMSD has switched to Casper Suite - a remote management software • IP tracking • No images taken of desktop or webcam

  24. Where Are We Now? Remote access software still resides on laptops for technical support

  25. LANrev & TheftTrack • LANrev rebranded as Absolute Manage • Camera feature to be disabled on LANrev software • TheftTrack not listed as a product on website • Still in the same business with laptop recovery software such as “LoJack” and “Computrace “ • Recovery features include: • GPS location reporting • Does not take webcam or screen images

  26. LANrev & TheftTrack In regards to TheftTrack’s ability to activate the webcam and take images of the thief: “It really doesn't serve any purpose” - Steven Midgley Absolute Software, Marketing

  27. Similar Cases • Aaron’s Inc (May 2011) • A national rent-to-own chain • Brian and Crystal Byrd (WY) claim a computer rented from Aaron’s came with software for keylogging, intercepting electronic messages, and taking webcam images. • Only discovered the software was installed when a manager from the store came to their house claiming they were in default on payments. • Manager provided images of Brian taken with the webcam. • Case Byrd v. Aaron's Inc. is ongoing.

  28. Similar Cases • Agreement between Federal Trade Commission and DesignerWare • All monitoring technology to be removed from computers intended to be rented to customers. • Tracking technology to be limited to cases in which customers are notified. • “No Deceptive Gathering of Consumer Information”

  29. Similar Cases • Aaron’s Inc (May 2011) • Software: Designerware’s PC Rental Agent designed to remotely monitor activity on the PC • Now PC Rental Agent advertises that the customer “can be assured that the store employees cannot access anything they did while renting the computer (pictures, files, financial information, personal data, Credit Card Information, web history, email, cookies, personal files, etc)”

  30. Conclusions Although there is no specific law stating that an institution may not commit surveillance on its own equipment, where that surveillance invades the privacy of the end user, such surveillance is unlawful. Due to out-of-court settlements and a lack of challenging existing laws, the landscape remains somewhat unchanged.

  31. References ABC News, “Laptop Spying: Rental Company Sued Over Alleged Webcam Spying” (May 4, 2011)http://abcnews.go.com/Technology/laptop-spying-rental-company-sued-alleged-webcam-spying/story?id=13528292 Absolute.com “”http://www3.absolute.com/shared/faqs/l4l-faq-e.pdf Absolute.com “Absolute Software” (retrieved Oct 2, 2013)http://www3.absolute.com/lojackforlaptops/technology CNN.com, “FBI investigates allegations webcam used to monitor student” (Feb 22, 2010)http://www.cnn.com/2010/CRIME/02/20/laptop.suit/index.html Computer World, “Pennsylvania schools spying on students using laptop webcams, claims lawsuit” (Feb 18, 2010)http://www.computerworld.com/s/article/9158818/Pennsylvania_schools_spying_on_students_using_laptop_webcams_claims_lawsuit Computer World, “Software maker blasts 'vigilantism' in Pa. school spying case” (Feb 22, 2010)http://www.computerworld.com/s/article/9160278/Software_maker_blasts_vigilantism_in_Pa._school_spying_case?taxonomyId=12&pageNumber=1 FBI.gov, “Inquiry into Lower Merion School District Activating Web Cams on Student Issued Computers” (Feb 22, 2010)http://www.fbi.gov/philadelphia/press-releases/2010/ph022210a.htm Federal Trade Commissionhttp://www.ftc.gov/os/caselist/1123151/designerware/120925designerwareagree.pdf Harriton High School “Letter to Harriton HS Parents/Guardians” (June 12, 2013) http://www.courthousenews.com/2010/02/18/Eyes.pdf http://www.lmsd.org/data/files/gallery/ContentGallery/121_hhs_1314letter.pdf Huffington Post, “Lower Merion School District Settles Webcam Spying Lawsuits For $610,000” (Dec 11, 2010)http://www.huffingtonpost.com/2010/10/11/lower-merion-school-distr_n_758882.html Lower Merion School District, “One to One” (retrieved Oct 2, 2013)http://www.lmsd.org/academics/instructional-tech/one-to-one/index.aspx PC Rental Agent, “PC Rental Agent” (Retrieved Oct 3, 2013)http://www.pcrentalagent.com/eSiteWay/Home.aspx?tabindex=0&tabid=497 PCMAG.com, “Another Lawsuit Filed Over School Webcam Spying” (July 30, 2010)http://www.pcmag.com/article2/0,2817,2367209,00.asp PCMAG.com, “High School Webcam Allegations Interest FBI” (Feb 22, 2010)http://www.pcmag.com/article2/0,2817,2360172,00.asp Robbins v. Lower Marion School Disctrict Class Action Complaint Tech & Learning, “Lessons learned from Lower Merion’s “Webcamgate””http://www.techlearning.com/features/0039/watch-it/47166 Tech Republic, “LANrev to lose Theft Track feature following Pa. school spying allegations” (Feb 23, 2010)http://www.techrepublic.com/blog/tr-dojo/lanrev-to-lose-theft-track-feature-following-pa-school-spying-allegations/

More Related