[ISN] Wood River student expelled for hacking into computer

[InfoSec News]

http://www.mtexpress.com/index2.php?issue_date=04-20-2005&ID=2005102706

By MEGAN THOMAS
Express Staff Writer
April 20, 2005

A case of "senioritis" took a turn for the worse after a former Wood
River High School senior discovered how to excuse his absences.

"A buddy of mine and I found a security hole," said Noah Brod, 18, of
Hailey.

The security hole enabled Brod, at the time a WRHS senior, along with
four other WRHS students to crack the school's attendance system.

The group discovered how to enter the School Administrative Student
Information program—known as SASI—that contains students' attendance
records, transcripts, class schedules and demographic information. The
students reportedly guessed the default administrative user name and
the password. The access enabled the students to excuse absences at
their liberty.

Four of the students were punished with a session of Saturday school.  
The other student, Brod, found himself expelled for the rest of the
year.

Brod's record indicates he was a diligent student. According to his
first trimester transcript, he earned four A grades and one B grade.  
He was also a four-year member of the debate team, Chess Club
president and a member of the National Honor Society.

Brod appeared at an expulsion hearing Wednesday, Feb. 9, in front of
the Blaine County School board of directors based on accusations of
breaking into the computer system, altering the attendance record and
altering grades. All members of the board, with the exception of Kathy
Pruett, attended the hearing

"I only excused absences. Really, I had no reason to change my grades.  
I am a 3.5 student," Brod told the Mountain Express.

Brod appeared before the board with his lawyer, Andy Parnes. Brod
described the process as a four- to five-hour hearing, during which he
and other students and adults addressed the board. Brod said the
majority of the hearing addressed the issue of attendance, rather than
grade changing.

Blaine County School District Clerk Cathy Zaccardi said the hearing
was held in a closed executive session and that no information was
available from the district.

"It's a student issue, the Brod situation. It was a board decision
during executive session. I am not at liberty to say anything about
it," District Assistant Superintendent Mary Gervase said.

Brod this week provided the district's findings of fact and
conclusions of law that detail the board's decision.

The findings state that the board voted unanimously to expel Brod for
the remainder of the second trimester.

"I believe the decision was discriminatory. It shows Noah was singled
out," said David Brod, Noah's father.

The expulsion carried a list of conditions permitting Brod to return
the second semester. The conditions mandated that he write a letter of
apology, not attend extracurricular activities and complete 40 hours
of community service with 10 hours allocated to writing a 20-page
essay on the topic of honesty and integrity.

Upon completion of the conditions, Brod was permitted to return for
the third trimester at WRHS, provided that he check in with
administrators when arriving and leaving campus. The provisions also
banned Brod from extracurricular activities, prom, school computers,
visiting other district schools and the Community Campus. Finally, he
was not allowed to participate in graduation ceremonies.

"By the time the board handed down the decision my grades had already
slipped. If I wanted to appeal it would take longer than the third
trimester," Brod said.

Brod wrote a letter of apology and decided not to complete the other
conditions. Brod was not permitted back to the school for the third
trimester. His plans for college were sidelined, and he plans to
complete his remaining credits in Wyoming's Teton County School
District next year. Then he plans to attend college and join the Peace
Corps.

In the meantime, David Brod said he plans to move forward with a
lawsuit against the Blaine County School District.

The district has also taken measures to prevent student access to the
SASI system. The district disabled all of the default user name
accounts and is encouraging teacher diligence to log off their
computers, explained the district's director of technology Jerry
Huchins.

Principal Graham Hume declined to comment.