Content-Type: text/html This paper was presented at the Association for Education in Journalism and Mass Communication in San Antonio, Texas August 2005. If you have questions about this paper, please contact the author directly. If you have questions about the archives, email rakyat [ at ] eparker.org. For an explanation of the subject line, send email to [log in to unmask] with just the four words, "get help info aejmc," in the body (drop the ""). (Jan 2006) Thank you. Elliott Parker ==================================================================== Hacking Authority: Teens Negotiating Acceptable Use in School Computing Abstract In the context of growing global reliance on networked computers, the negative impact of malicious computer hacking, or cracking, is increasing in speed and magnitude. While corporations can allocate significant resources to network security, government agencies, schools, and not-for-profit organizations struggle to protect sensitive information from malicious attacks. Noting that preventive ethics-based education of young computer-users is largely absent from the discourse of network security strategy, the author argues that the dearth of ethics-based computing curriculum, policies, and procedures causes schools to inadvertently function as training grounds for young crackers. Tight public education budgets and inadequate technical training for school staff members lead educators to implement policies, procedures, and pedagogical methods that teach computer-proficient students the value and practice of ethical computing. The article describes results of an ethnographic study of the ways in which staff at a public high school attempted, using various strategies, to invest students in protecting network security on campus. Growing global reliance on networked computers has increased the impact of malicious network hacking, or cracking. While government agencies and corporations have focused substantial organizational resources and rhetoric on legalization and implementation of heightened surveillance of networks, pursuit and prosecution of criminals, and recovery of data, the dearth of preventative policy and program development indicates an overlooked but crucial component of a national strategy to prevent and reduce cracking. In this article I develop the argument that policy makers must address the need for ethical computing strategies and policies at the K-12 level designed to acculturate young computer hackers away from cracking and toward ethical computing. Using the case of New Technology High School, a U.S. Department of Education Demonstration Site public school in Napa, California, this article describes a three-year long participant observer ethnographic study of the successes and failures associated with the school's attempt to socialize its hacker students to act as ethical and invested citizens in a networked environment. The Cost of Network Attacks Crimes committed using computers include those that are unique to computers and those that criminals have adapted for perpetration over international computer networks. A large portion of computer crime can be understood as new iterations of crimes that predate personal computers and the Internet. Fraud, piracy, identity theft, credit card theft, insider trading, and child pornography distribution are examples of pre-PC era crimes that are now frequently perpetrated via computer networks. Certain features of the Internet, including instant communication, relative anonymity, and international scope, have enabled criminals to commit crimes more easily and with greater gain. Acquiring money and goods with little effort is the primary goal of such crimes (Goslar, 2000). The second category of computer crime includes crimes unique to networked computer environments. These crimes include denial-of-service attacks, data destruction, Trojan attacks, password theft, slave platforming, graffiti, email-borne viruses, firewall attacks, and syn-flood attacks. Rather than financial gain, what typically motivates the individuals who commit such crimes is thrill-seeking; learning new tricks; seeking the opportunity to show off skills; becoming part of an exclusive community; taunting authority; and enacting David vs. Goliath scenarios (Goslar, 2000). Because these intrusions are often little more than pranks, they exist in contrast to the blatantly criminal "hard-core" computer crimes mentioned earlier. In some cases the pranks are labeled "hacktivism," such as politically-motivated graffiti on corporate web sites that challenges the ideology of the company. For example, in September 2000 a hacktivist defaced the OPEC web with commentary including the statement, "I think I speak for everyone out there … when I say you guys need to get your collective asses in gear with the price of crude" (as quoted in Knight, 2000). In another case, a selfdescribed tagger nicknamed "Nemesystm" tagged sites such as the U.S. Navy Patrol Squadron's with his lyrical poetry (Lemos, 2000b). Scholar and cyber-liberties activist Doug Rushkoff reports experiencing guilty pleasure when they hear of hacktivist attacks, reveling in the subversive, anti-hegemonic flavor of the pranks, viewing them as fleeting reminders of the fact that the Internet was originally developed with public funds and therefore rightfully belongs to all citizens (Rushkoff, 2000). The tolerance of ideological hacking is expected to wane as more citizens go on-line more frequently and are consequently affected by network slow-downs and site unavailability caused by hacktivists and others. Civil libertarians and privacy advocates, who cherish the remaining open, free-wheeling "new frontier" remnants of the Internet, have argued that increased publicity of attacks will result in tighter government regulation and increased surveillance of citizens' Internet activities in the name of national security (United Press International, 2000). In fact, in September, 2000 European and U.S. officials were finalizing the world's first international cybercrime treaty, which would require countries to allow police and government agencies significant leeway in search and seizure of computers and networks, despite strenuous objections from privacy advocates (Gruenwald, 2000). Hackers fear that unless the hacker/hacktivist community moves aggressively toward self-regulation, including the reining-in of "script kiddies" (young, unskilled crackers) and those who write tools for them, corporate and public pressure to crack down on hackers will result in a witch-hunt. Old-guard hackers and network security administrators who work toward responsible network use, so-called "white hat" hackers, have admonished those "black hat" hackers who disclose security holes to the public and even create and distribute tools to allow script kiddies to exploit the holes (Lemos, 2000c). Until self-regulation is visibly effective in deterring network attacks, businesses and government agencies will continue to advocate increased restrictions. E-commerce businesses and government agencies have reacted to destructive computer network attacks by calling for and attempting to implement tighter security measures and more serious punishments for criminal attacks against computer networks. Business leaders fear the lower profits that could result because of loss of consumer confidence in e-commerce and computer network security in general (Robinson, 2000). This fear appears to be wellfounded, according to a recent poll commissioned by the Information Technology Association of America which found that four out of five respondents doubted the U.S. government's ability to keep computers secure (Reuters, 2000a). According to the head of the National Security Agency Lt. Gen. Michael Hayden, even non-malicious hacker break-ins cause great damage to public confidence, forcing the NSA to redouble efforts to protect ecommerce as well as military networks (Reuters, 2000b). The threat to e-commerce is well-publicized in part because businesses and commercial networks are the most common targets of both hacktivists and crackers (Rushkoff, 2000). In addition, companies are increasingly willing to attach large dollar figures to their prevention and recovery efforts, knowing that such publicity will bolster the argument for legalizing more surveillance and tighter restrictions on Internet use. Loss of productivity caused by cracking has thus far resulted in billions of dollars' worth of damage worldwide (Biagi, 2000), with a predicted cost of $1.6 trillion for the year 2000 (Goslar, 2000). The private sector and government agencies have focused organizational resources on improved network surveillance, better recovery of data, vigorous prosecution, and harsher punishment. Corporations are able to allocate significant resources to network security. American companies spent $4.2 billion in 1999 for security software alone, with a predicted increase to $7.4 billion by 2002 (Koerner & Glasser, 2000). Despite the large monetary investment in security software, such software catches only attacks by unskilled crackers. The recent highprofile attacks wrought by script kiddies who used unsophisticated, off-the-shelf attack programs are examples of the type of attack that security software is designed to detect (Taylor, 2000a). Highly-skilled security administrators are necessary to detect and trace more sophisticated attacks, and even so most high-level attacks go unsolved (Koch, 2000). Workers with network security skills are in critically short supply, typically leaving the military and other federal agencies, where they received training, for more lucrative private sector positions (Bajaj, 2000). Even though network security workers' average annual salary increased 11.47% from the previous year (Fujii, 2000), the disparity between federal and private salary scales for security administrators is striking: entry level workers with the government earn at most $30,000 per year, compared to the $90,000 to $120,000 earned in the private sector (United Press International, 2000). The increasing demand in the private sector for skilled security experts forces government agencies, schools, and other not-for-profit organizations to compete in vain with the escalating salaries and stock option packages that private sector companies offer to skilled security administrators (Bajaj, 2000). The inability of the government to compete for workers is unfortunate, since arguably the national defenserelated networks are the United States' resource most in need of protection. Government agencies are concerned about network attacks due to the possibility of unauthorized access to and manipulation of secret government information systems, including military systems. The current rethinking of the very parameters of national security is in part due to the threat of computer sabotage (Matthews, 2000). However, the inability to compete with corporations for workers has lead to serious gaps in the government's network security. A recent congressional investigation of federal agencies' readiness to repel network infiltration netted an overall grade of D-, indicating the high level of vulnerability throughout government networks (House Subcommittee on Government Management, Information, and Technology, 2000). Growing concern about network vulnerability lead President Clinton to propose a plan to spend $2 billion to protect national infrastructure-related computer networks (United Press International, 2000). Among the efforts to combat malicious attacks are an increasing number of "counterhacking" education courses available. While higher education has been slow to catch on to the need for high-level network security training (Bajaj, 2000), private companies such as EDS, Foundstone, and Ernst & Young have begun to offer courses with names like "Extreme Hacking" which train corporate employees to hack into their own networks in order to better protect them. However, hackers such as Emmanuel Goldstein, editor of the hacker publication 2600, assert, "corporations can't teach hacking" (Taylor, 2000b). According to Goldstein, "[hacking] has to be in you" (Taylor, 2000b), implying that even when corporations attempt to teach technical skills, employees will still lack the innate sensibility necessary to think like a hacker. This observation suggests that if white hat hackers, civil libertarians, business leaders, and government agencies believe in the importance of acculturating computer-proficient individuals toward responsible computing, such acculturation must begin early. K-12 educational institutions provide an opportunity for such acculturation to occur. Schools as Hacker Training Grounds Since Jeffersonian times, the public school has functioned as the primary means of educating U.S. citizens to live and work in participatory democracy (Botstein, 1997). While the overt curriculum (defined as the easily observable portions of the curriculum such as course offerings, syllabi, and assignments) plays a major role in students' academic education, the covert curriculum (school policies and procedures, social activities, etc.) is crucial in acculturating students to understand and learn to function within the social and economic hierarchies outside school walls (McAllister & McAllister, 1998). As networked, Internet-connected personal computers become common in public schools, computer-related covert curriculum becomes an important yet understudied factor in the educational programs of U.S. youth. Hackers, crackers, hacktivists, and script kiddies typically first learn and hone their computer skills at school, where they usually have access to multiple networked computers with little security software blocking their experimentation. School is also often where they first encounter a community of like-minded peers. Whether students' curiosity and passion is directed toward white hat ethical computing or toward black hat cracking depends upon the school environment, including computer-related curriculum, policies, and procedures. Understanding the impact of pedagogical models employed by schools on the ethics education and acculturation of young hackers is vital to maintaining a balance between network security and the protection of citizens' Internet civil liberties. The constructivist theory of pedagogy, developed and championed by scholars including Dewey (1897), Bruner (1966), Piaget (1972), and Papert and Harel (1993), is a theory in which students are conceptualized as active creators of their own ideas and meaning, rather than as empty vessels to be filled with knowledge by the professor. Learning can only take place when students relate new information to cognitive structures that exist in their minds. An emphasis on integrating theory with practice via learning by doing replaces rote memorization of facts because it is through actively working with material, with peers or alone, that students solidify their understanding on a deep cognitive level. Constructivists who advocate educational technology believe in freely using flexible productivity tools such as programming, word processing, spreadsheet, database, art, and animation software to enable teachers and students to tailor their computer use to their particular needs. The goal for today's constructivists is to move away from lecture-based instruction and multiple-choice testing, and instead engage students in "project-based learning" where students are more closely connected to "real world" concerns as they work independently and in teams to define problems, figure out what tools and resources they need to find and analyze pertinent information (beyond the textbook and the teacher), and come up with feasible solutions. The skills of these "free range students" (Conte, 1995) closely match what corporations say they desire in employees (team work, problem-solving, etc.). Among the skills the students are learning is how to use computer technology responsibly with minimal or no supervision. Because schools have stepped up use of Internet-connected computers, the issue of protecting network security as well as preventing student access to inappropriate on-line material has been an increasingly pressing concern for school staff. Most schools, lacking trained network security staff, opt for Internet content management (ICM) measures, such as off-the-shelf filtering software and proxy servers, as a stopgap measure. A May 1999 report by Quality Education Data estimated that usage of ICM software in K-12 schools would increase to 71.5% in the 1999-2000 school year over the 52.5% of U.S. school districts that used ICM in the 1998-1999 school year (Burt, 2000). As noted earlier, such software catches only the simplest of network intrusions and abuses while failing to detect or deter more sophisticated attacks. Often school staff members lack even the most basic understanding of types of hacks, leaving them unable to discriminate between harmless, potentially harmful, and malicious computing. One high school student was reprimanded by school officials for malicious hacking when he reported a security hole he found in the school's password system. Another teenager, who thought his classroom computer's Netscape settings were configured incorrectly, was reported for hacking by a student aide when he was simply looking at the browser settings (Lemos, 2000a). Incidents like these can lead student hackers to feel a sense of disillusionment and distrust of school officials when their efforts to help are unheeded or even punished. ICM use teaches hacker and non-hacker students, in a covert way, that they cannot be trusted to use computers responsibly. Furthermore, it teaches students that school staff member do not deem students capable of learning to use computers responsibly. Not only does the use of ICMs contradict the goals of constructivist pedagogy, but such measures also represent an irresistible challenge for hacker students who view network restrictions imposed by school officials as an opportunity to demonstrate their hacking prowess to their peer group while simultaneously subverting institutional authority. Public schools that are unprepared to handle network security have few workable options for addressing the need to control the actions of hacker students. The following section of the article describes a school at which school staff members gave up trying to control hacker students, instead opting to harness and channel their passion and talent toward helping the school as white hat hackers. The Study Site New Technology High School (NTHS) in Napa, California, opened its doors to 220 juniors and seniors in the fall of 1996. It was a public magnet school that featured project-based, integrated curriculum; constant access to networked, Internet-connected computers; and a school culture and physical environment modeled upon that of a high tech start-up business. I conducted participant observation data from 1996 – 1999 while serving as the Multimedia Instructor at the school. Sites of investigation included school databases, email exchanges, classroom observations, student-staff meeting observations, staff meeting observations, and personal interviews with students and staff (Van Buren, 1999). NTHS students were required to meet Napa Valley Unified School District (NVUSD) graduation requirements, including reading District-approved novels and textbooks, in addition to NTHS-specific requirements in subjects that NTHS staff members deemed beneficial for college and career success in the Information Age, such as computer applications and new media design. Proficiency in word processing, spreadsheet, database, and presentation software served as a foundation for other courses at the school; similarly, interactive multimedia design skill was crucial during students' careers at NTHS because many teachers required students to create interactive multimedia presentations. Students could either take all their classes at NTHS or spend part of their day at the other high schools or the local college taking courses not offered at NTHS such as marching band, chorus, and sports. Students were required to complete at least four college classes and complete work experience/internship hours in order to graduate. Curriculum is academically rigorous; students reported they work much harder at NTHS than they did at their previous high schools (New Technology High School, 1997). To attend NTHS students needed a 2.0 GPA or higher and must have passed Algebra I. The moderate GPA requirement indicated the desire of NTHS staff to attract a broad range of students, from Advanced Placement students to those who had failed to thrive in traditional schools. Qualified students were required to attend an informational meeting about the school with their parents or guardians. Students who did not meet the entrance requirements may enter an appeals process and gain admission after writing an essay and participating in a 30- minute panel interview with a committee of adults. In 1997-98, the NTHS student body was more ethnically diverse than at Napa's comprehensive high schools, with NTHS reporting 40% students of color vs. 36% and 24% at the other schools (California Department of Education, 1997). Sixty-three percent of NTHS students were male, a percentage disproportionate to the population at large. The cultural environment of NTHS was that of a super-democratic institution where students were encouraged and empowered to speak, rabble-rouse, and cooperatively shape decisions including disciplinary policies. School planners hoped that a tremendously open environment, including the interior architecture of the building and the structure of the information network, would encourage students to feel enfranchised within the school's structure. The atmosphere at NTHS was one of openness, vigorous discussion, freedom of mobility, responsibility to others, and high visibility at all times. Students at NTHS were actively socialized to make wellreasoned demands of the school staff and other students, with the expectation that institutional changes would occur based on their demands. Students and staff were recruited based on overt use of the high-tech business metaphor. Because the school sought "to prepare students to excel in an information-based, technologically advanced society" (New Technology High School, 1996) the school used high-tech business models whenever appropriate to form policy and make decisions. Rather than implement a multitude of restrictive policies, staff members kept rules to a minimum while emphasizing education about appropriate technology use and responsibility to the organization. Students were systematically invited to participate in policy discussions and decision-making and were expected to behave as responsible adults. The school did not use bells to prompt students to go to class; instead students were expected to be responsible for their own timeliness. Students did not have to raise their hands to ask permission to get a drink of water or go to the bathroom—they could come and go as they needed unless they abused the privilege. Computer use at NTHS fit precisely within the constructivist model of technology implementation. The school's open and unrestricted model of computer use was a major feature of the attempt to implement a "high tech business model" at the school. Planners distinguished the NTHS high tech business model as one in which workers were trusted to get their work done and act responsibly on-line. In such open, trusting high-tech start up environments, use of Internet filters and other computer restrictions would destroy the corporate culture of openness, camaraderie, creativity, and innovation. Pedagogy focused on teaching students that they were in control of their computers and could manipulate the hardware and software in order to achieve academic goals. Computer hardware and software products were high-quality, ample, and kept up-to-date by the school's sponsors. Students and staff had access to about 250 networked Pentium-chip PCs which meant that students always had access to a computer when required. The software used was business-grade software since a primary goal at the school was to prepare students for the workplace. Students had unfiltered access to email and the World Wide Web (WWW) and used their computers for research, database discussion, document retrieval, and creation of school-related essays, journals, research papers, and multimedia projects. Not all use of NTHS computers is academic, however. Some students formed a Games Club and met outside of instructional time to play staff-approved computer games. During breaks and after class students could use the computers for email and WWW browsing as long as their use complied with the District's Appropriate Use agreement. Teachers used computers to post course information and assignments in databases and on the WWW, email students their grades and comments on school work, record and calculate grades in grading software, perform research for curriculum development, and develop and deliver class presentations and lectures. Students and staff used the computer network to arrange meetings and check schedules, share important school-wide announcements, and collaborate on projects by circulating files. According to constructivist ideals for technology use, NTHS exemplified a best practices model in the way that students learn to responsibly control and access computer technology. The Computer Network Structure As long as the trend of incorporating computer technology into school curricula continues, the U.S. public education system will increasingly be forced to grapple with the following issues faced at NTHS during the study. The description and analysis of the impact of computer use on the covert curriculum revealed that, first, substantial staff and student time was diverted from academic curriculum and instruction because of student misuse and abuse of the computers and computer network. Second, the disciplinary system held different lessons for less-computer proficient students than it did for highly-computer proficient students, creating separate classes of students within the high-tech school environment. Third, although technology abuse as a type of school crime is laughable to most officials from traditional schools, at NTHS it constituted a constant struggle against high-tech abuse that, as noted earlier, American law enforcement officials believe constitutes a threat to the stability of the U.S. economy and security. Maintaining the stability and functionality of the NTHS computer network for instructional use demanded that control of network functions was restricted, albeit minimally. Accidental or purposeful changes in the network could have resulted in network crashes, disrupted and lost instructional time, and extra hours of work for teachers and the network manager. Even with software-based restrictions, teachers and other staff members had to visually monitor student use of computer technology and educate students about appropriate use, adding to the already-full workloads of staff. NTHS staff members dealt with diversions from academics common to all schools due to typical school activities (assemblies, rallies) and traditional disciplinary activities (referrals for smoking, 'defiance'), and other miscellaneous problems such as forgotten textbooks or school supplies. These traditional school diversions combined with the unique technology-related diversions at NTHS resulted in an increase in personnel time required to run the school and loss of instructional time for students. Contrary to the myth that computers are labor-saving devices that save educational dollars, at NTHS the computers added to personnel costs. The minimal software-based control of the network and individual computers that the school chose to implement, as described below, helped only a small extent to lessen staff workload. Student access to the school network was restricted by individual passwords, administered by the school's network manager. No passwords, student or staff, were secret from her. Students had two passwords: one for logging on to the network, and another for accessing their Lotus Notes accounts. They could log on to any computer in the building and access their individual "My Documents" folders housed on a school server and their Lotus Notes files housed on a different server, giving them a high degree of freedom and flexibility in moving about the building throughout the day. Thanks to the World Wide Web, students and staff could also access their Lotus Notes email from outside the school by entering their usernames and passwords at the school's web site. Using the C-drives of individual workstations for saving files was discouraged (but not prohibited) since the C-drives were accessible to other students, making files vulnerable to alteration or erasure. In addition to their own password-protected folders on the school servers, students had read and write access to other partitioned sections of school servers, such as the Students on Server3 section (where teachers and some administrative staff maintained folders) and the WebServer on Server3 (where students posted their web page folders for the school web site). Students could use those publicly-accessible servers to view, post, and copy files for staff and each other, but students could not alter or delete files once they were posted in these public areas of the network. When the school first opened, staff members were very naďve about the possible mischief and damage students could cause when they had unrestricted access to the computers and network. Computer-related discipline problems were simply outside the consciousness of staff members. Our initial expectation was that we would face traditional disciplinary issues that public schools faced; we never considered the possibility that students would abuse the privilege of their access to high technology. Exacerbating the problem of unpreparedness was that staff lacked training in network security. For example, when the school opened students had DOS access, but the network manager soon encountered problems maintaining the functionality of the network and individual computers because of students who tampered with system settings. NTHS staff members acknowledged that due to limited time, resources, and expertise we could not hope to completely control the school's computer network, especially since some NTHS students possessed far superior computer skills than all NTHS staff put together. As a result the staff tried to enfranchise all students in the process of building effective computer technology policy. Working from the desire to build a "culture of trust" with students, staff members began by trusting students to use the network responsibly and educating them about how to use the network responsibly. Eventually the staff realized that despite the effort to build a culture of trust, the school would have been negligent if staff members did not monitor student computer use at all. Staff members attempted to minimize the need for monitoring by preventive education. All students and their parents or guardians read and signed the school's "Appropriate Use Policy" which detailed the school's computer policies and procedures. Staff members repeatedly reminded students that the whole world was watching the school's progress, and students should conduct themselves as if the world was looking over their shoulders. Students had been invited twice in the first three years of the school's operation (1996-1999) to help develop the school technology policy. Known and potential hacker students were repeatedly invited to serve as network consultants and troubleshooters, performing such white hattype tasks as helping to plug network security holes and assist in the formulation of network policy and procedures. Teachers and staff members actively socialized students to view the technology resources as privileges they enjoyed rather than resources to which they were entitled. We frequently reminded students that the computers and networks were owned by the school district, and that school facilities were for educational use only. The monitoring at NTHS was minimal. Teachers looked at students' computer monitors in the course of walking around to help students, watching for signs of inappropriate activities. The network manager installed a program on each computer that tracked installation of applications by comparing what was installed on the machine at last start-up to what was installed on the machine at the current start-up. When new applications were noted the manager was able, as her busy schedule allowed, to look at the log-on records and see who was last logged on to that particular computer, indicating who installed the software without permission. Students were aware that staff could read their email and track web site visitation, as well as read postings on the various discussion databases that the school offered. Even the minimal network restrictions in place at NTHS have incensed the school's more computer-proficient students. Accustomed to having complete control over their home computers (and in some cases, home computer networks), such students arrive at NTHS expecting to have similar control over school computers. This caused computer-proficient students to complain bitterly, eventually driving them underground to constantly and surreptitiously test the network for holes in security. However, students were also aware that the staff was so busy with curriculum development, teaching, research, staff development and training, student tutoring, discipline, parent-student conferences, staff meetings, grading, preparing for conference presentations, and other duties that we rarely had time to monitor student use of the network. The times that I caught students misusing or abusing the computer network were entirely by accident and in person (for example, I happened to walk by a student's workstation and see the "download file" window open on the monitor, or see an email with obscene language), rather than because of systematic electronic monitoring. Non-Proficient Students The less-computer proficient students appeared for the most part to follow the appropriate use guidelines established through the "culture of trust" campaign. Although they occasionally misused email, the Web, and databases by engaging in social/recreational use during class time, and were punished accordingly, they did not attempt to penetrate or bypass network security blocks or damage the system. Low-level abuse of the network was easily discovered and traced by school staff, leading non-proficient students to fear being caught. As a result, nonproficient students learned to fear monitoring and punishment. The definition of appropriate use of email, discussion databases, and software of various kinds involved refraining from activities that will damage the school's culture, reputation, or network. Students were not allowed to create sexist, racist, homophobic, obscene, or otherwise harassing messages using words, images, or sounds. Students were not to send large files over email in order to avoid overloading and crashing the email system. Students were not to use the network recreationally during instructional time, i.e. sending social email or social database postings during class time, unless they have finished their assignments. These limitations were in keeping with the "business model," since similar limitations were in place in various businesses to avoid lost productivity and harassment lawsuits. Knowing that students more readily accepted limitations if the limitations are framed in terms of "business standards," teachers periodically discussed recent cases in which a worker was fired for viewing pornography at work, or for sending harassing email from an employer's computer network. That the limitations on computer use also kept NTHS within the California Educational Code guidelines pertaining to the maintenance of an appropriate educational environment was rarely discussed with students. Controlling appropriate use of student email proved difficult. The existence of email groups in the school email address database allowed standard messages to reach large groups of people quickly and easily. These groups include "Staff," "Junior Students," "Senior Students," and "Students." Teachers were able to make email address groups for their classes. For example, I could send email to my students, period by period, regarding assignments and multimedia contests. Students quickly realized the power of being able to send a message to a large group of people. On the second day the school was open in 1996, which was the first day that students' email accounts were functional, a student sent an all-student email containing a picture of a skull-and-crossbones with the message "Death to all students." Because no staff members were on the "Student" email group, we did not know of the message until recipients complained to us about the message as a death threat. The sender of the email, who claimed that the message was a joke, was immediately called into the school director's office and sent back to his previous high school. After this incident staff members were included in all official student group email address lists, and students were required to secure and note staff member permission when sending all-student email (Figure 1). Figure 1: Example of Permissible All-Student Email, 1999 FROM: Amanda (5/27/99) TO: Students SUBJECT: Raffle Attention Students! Friday Night Live will hold a drawing for 2 passes to Six Flags Marine World. You may purchase a drawing ticket for $2. Buy as many as you like. Tickets will be on sale in the front hall during break tomorrow. Drawing will be held on Monday, June 7 and one lucky winner will walk away with the two passes. Ms. Matzke gave me permission Figure 2: Anonymous External All-Student Emails, 1999 FROM: SuperFreak <[log in to unmask]> (4/21/2002) TO: Students SUBJECT: hi everybody hello boys and girls. FROM: [log in to unmask] (11/20/98) TO: Students SUBJECT: hello i love you all. FROM: [log in to unmask] (5/14/99) TO: Students SUBJECT: dear josh thanks for giving me your email address. I think that you are dumb. Have a nice day. FROM: [log in to unmask] (5/18/99) TO: Students SUBJECT: asdfjkl;;lkjfdsaasdfkl;jj Asjidfljkas;fljakknsvdo,w/qngv/wnSDhgo:qi/awv/lzcoiIQWE'24 92878:0AD 9ur08 2y /HLADJjL?KDSGDgPU30RhnAV?as:flakknsvdo:w:/qngv/wnSDhgo:qi/awv/lzcoiI [repeated 81 more times] Figure 2: Anonymous External All-Student Emails, cont'd FROM: [log in to unmask] (5/18/99) TO: Students SUBJECT: m-eye eye-denti-ty I yam da terror dat lurks in da nyte…. I yam de un forseen cir-cum-stance behind all that is just… u will never discover my identity….you will never discover me… for I am and always will be the phantom menace that will forever be unseen…. u all will nevah know…and u can never track me down…. bwa ha ha ha ha…. FUCK U ALL FUCK U ALL FUCK U ALL FUCK U ALL FUCK [last line repeated 41 more times] FROM: Hombre con los huevos a [log in to unmask]> (5/26/99) TO: Students SUBJECT: por favor Dear Javier, How are you? I am ok. Ever since you fled to America I have been lonely. It's been tough without you, but because of the all the loving that the men in the village are giving me, I am not always depressed. Come home soon. Your Hot Latin Lover, Fidel This policy did not address what was possible due to the proliferation of web sites that offered anonymous email accounts. Sites such as hushmail.com, china.com, and latinmail.com allowed anyone to establish an email account under a name of their choice. For students and others who wished to send anonymous email to people within the school, such sites offered the power to communicate without responsibility for the message. In May, 1999 the school suffered a rash of anonymous all-student emails (Figure 2), mostly innocuous in nature with one that was both threatening and vulgar. Two of the messages contained large quantities of text that when sent to every student in the school could clog the email server to the extent that the server might crash. One email was sent by someone who managed to create a fake school email account ("[log in to unmask]"). This and one other email contain bogus dates, indicating that the sender deliberately changed the date and time on the sending computer to make the prank more elaborate. The existence of numerous web sites that offered anonymous email meant that even if NTHS moved to block mail from a specific email account or even a specific provider, a student bent on sending anonymous emails could simply switch account providers over and over again. Despite the relatively benign nature of these anonymous messages, they nonetheless sent a sobering message to the school, particularly to school staff. The senders wished to remind us of the school's vulnerability. The emails announced the power these people possess to subvert school rules with impunity, as well the potential damage these people could cause if they so desired. It was tempting to view these email pranks as mere high school foolishness, but there were unmistakable parallels between the NTHS incidents and other incidents of hacker tampering at the corporate and governmental levels. In response to the anonymous emails an NTHS teacher who also served as the school web site manager sent out an all-student email hoping to send the strong message that the offender(s) were jeopardizing the openness of the school's information system: The recent flood of outside e-mail is a good example of the problems of having an open network. Although some students use outside e-mail accounts appropriately (to send themselves assignments from home, etc.) a few students who misuse our web access could force us to tighten the network. It would take very little effort to put our access of the web through a proxy server which would limit access to sites the staff pre-selects, or to remove the e-mail option for Lotus, or to use only the electronic library and remove all WWW access. The rest of the nation is watching us to see if an open network can work at a public school. As in any government structure or institution, unless each of us acts responsibly and encourages others to do the same, it will be much easier to remove liberties. This summer, the staff will be making those decisions as we update our system for next year.! The behavior of you and your peers during these last few weeks will be fresh in our minds.! If you agree with the staff that an open network is what we want, then please use our network in a professional manor [sic]. If you have any thoughts on the matter, please e-mail them to the Tech Management Team (P. Curtis, personal communication, May 28, 1999). One attempt at systematic electronic monitoring was quickly abandoned. In Fall 1998 a highly computerproficient student approached school staff with an idea for an electronic method of monitoring web site use on campus. He proposed installing what is called a "Unix box," which would allow the constant and complete recording of every web site visited by everyone in the building. The school director and network manager agreed to let him install the Unix box, and within the first 30 minutes of tracking, people in the building visited dozens of obviously inappropriate sex-related web sites. By noting the computers from which the sites were accessed and the time of access, the network manager could then determine who was logged on to the computers at the time of access. Quickly the record of inappropriate site visitation became so staggering that the school director removed the Unix box because he did not have time to discipline all the transgressors. The director also noted that the Unix box, like filtering software, contradicted his desire to build a "culture of trust" with students at the school. In this instance the school chose to ignore the problem rather than reallocate time and resources to deal with the problem. Hackers In contrast to the activities and lessons learned by non-computer proficient students, hacker students, who clearly knew how to use computer technology much better than staff, scoffed at the school's policies and procedures and knew that they could move in and out of the school network and engage in other inappropriate computer activity without being detected. A group of three such students, all boys, agreed to be interviewed for the study regarding what they knew was possible in the way of infiltrating the school's computer network and individual computers. These boys expressed their views about hacking. For these boys the goal was to determine what security holes existed and what damage they could do, but did not do, to the network. An additional thrill in the case of hacking the school system was the secret knowledge of their technological superiority to the adult staff members at NTHS. I approached them as informants, carefully characterizing what I wanted to know as activities they knew were possible, not necessarily activities in which they themselves had engaged. Some of these students had already helped the school director plug security holes in the school's network. Nevertheless, because the conversation could lead to disciplinary action by school staff I protected their identities in order to understand the extent and nature of actual and potential computer system abuse at NTHS. What follows is a description of actual and potential transgressive computer activity at the school gleaned from a personal interview with students. When asked to describe activities that students could engage in at school that could potentially damage the school computer system, the students' responses filled three hand-written pages of notes. Activities could be placed into two categories: nuisance-producing activities and maliciously-damaging activities. The activities could create physical damage to computer hardware; software-based damage to individual computers; and software-based damage to the computer network as a whole. The cost of overcoming such damage ranged from the expenditure of small amounts of staff and instructional time and money to expenditure of large amounts of staff and instructional time and money. In the case of data loss the risk involved irreparable loss of student and staff privacy if confidential grade, personnel, and address information is accessed. Theft of software and hardware was the first activity the students mentioned. Students can steal software applications by taking the actual disk or CD on which the licensed software was delivered. They could also copy software from school computers or download illegal copies of software posted at "warez" sites on the Internet. Downloading from the Internet at NTHS was appealing because the school's high-speed Internet connection allowed students to gather more software in a shorter amount of time than they would be able to gather at home on slower Internet connections. If students installed the software on NTHS machines the school is liable for software license violation. Students can also copy the software to Zip disks or CD-ROMs at school to take home and install on other computers or distribute freely to others. The school made no attempt to track the extent of software theft but did try to minimize unauthorized installation of software on school machines through education, the executable application detection program described earlier, and walk-around monitoring by teachers. Minor nuisance-causing network activities were the equivalent of mischievous student pranks. Students could change the network log-on screen information in subtle ways (for example instead of the required domain name NAPA_NTHS, a prankster typed NTHS_NAPA or some other variation). When the next student attempted to log on to the network he or she got an error message and usually could not figure out what the problem was, requiring teacher assistance which in turn delayed instruction for the entire class. Pranksters also typed vulgar words into logon windows for the next student to read before logging on, the equivalent of on-screen graffiti. Pranksters wrote and installed tiny computer programs that created a nuisance but did not damage anything. Rather these programs waste instructional time as students and staff work to figure out the problem. For example, one student-created program automatically logged students off the network as soon as they logged on, in effect shutting them out of the network until the program was disabled. Students wrote programs in Lotus Notes which were executed by clicking on an on-screen button. They sent the buttons in email to other students with the simple message "click me." When recipients clicked the button, hundreds of email messages were automatically sent out, sometimes with offensive messages that appeared to be sent by the hapless button-clickers. The dilemma for the button-clickers then became whether to take the blame for the email spam they inadvertently sent out or to turn in the senders of the "click me" buttons. Other abuses of the NTHS network were more sinister. Occasionally the school was "nuked," causing the computers to get "bluescreened." This meant that someone ran a program called Win Nuke on the school computers, causing the machines to lose their network connectivity, lose any unsaved data, and require restarting. Win Nuke did not cause permanent damage, but it did delay instruction, cause students and staff to lose data, and serve as a reminder of the school's vulnerability to technological terrorism. A more malicious program called Back Orifice (a name parodying the Microsoft Back Office software) plagued the school in Fall 1998. Back Orifice was surreptitiously installed on several NTHS machines, enabling remote control of the infected computers. The implications of Back Orifice installation were quite grave. For example, the program allowed the installer to remotely control the computer desktop, restart the computer, display pop-up messages to the user, read files including temporary files containing password information, record keystrokes, send email from the user's account, and capture screen shots of the user's monitor. If a video camera was installed on the user's computer, Back Orifice allowed the remote installer to control the camera and take video shots of the user surreptitiously. The ability of Back Orifice installers to access and maliciously use confidential information in a school setting was very serious cause for concern. The students I interviewed revealed that the entire school network had been open to hackers. Everything – including the school web server, student and staff servers, individual student and staff network accounts, email accounts, and individual hard drives – was accessible to motivated hackers from both on- and off-campus. The implications of this unauthorized access on the privacy of students and staff were profound. Because the network manager had saved a text document in her files containing all NTHS passwords, finding the school passwords was as easy as opening a text document. Student records, staff discussions on the database, staff email regarding student grades and behavior, and student grade databases were accessible. Reading these files, editing them, and sending email in another person's name was possible. This had been the case from Fall 1996 – Fall 1998, until the school moved its Internet connection from a commercial service provider to the NVUSD wide area network. The students I interviewed maintained that despite the move to the NVUSD network they could still, with a great deal of work, gain access to the entire NTHS network because of security holes. I questioned my interviewees about how to solve the problem of network security in poorly-funded public institutions, and they could not come up with any suggestions. They believed that there would always be security holes in computer systems that leave information vulnerable to attack. However, they maintained that overall NTHS hackers were non-malicious, and offered the fact that nothing serious had happened to the school networks as evidence of their peer groups' beneficent nature. Consequences When misuse and abuse of the network occurred, offenders who were caught were punished by having their network privileges removed for a period of time, in essence an in-house suspension from the system. Students who are "off the system" receive their assignments via printout and turn their work in by writing by hand or using computers at the city/county library, Napa Valley College, or at home. In some classes, such as in the multimedia class which required the use of expensive computer animation software generally not available anywhere else, project deadlines are extended until the student is back on the system. After the initial expulsion from NTHS (the email death threat situation discussed earlier), the political difficulty of sending NTHS students back to the other Napa high schools prevented even those students who repeatedly abused the network from being sent back to their previous high schools. On only three occasions did the school director successfully convinced repeat network abusers and their parents that returning to the previous school offered the best solution for timely and trouble-free completion of high school requirements. In these cases, the return to the previous school was entirely voluntary, thus avoiding giving the other school principals grounds for complaints about "dumping" of problem students. Over the course the study, I noted that it was typically a small portion of the less computer-proficient students who made mistakes when misusing the computer system and are consequently caught and punished. The school's Appropriate Use Policy and attendant disciplinary system functioned as a strong deterrent against malicious behavior on the part of less computer-proficient students, socializing them to accept limitations on the uses of computer technology in public settings. Highly technologically-skilled students, on the other hand, remained unconvinced of the school's ability or desire to follow through with technology-related discipline. The hacker students I interviewed found the school's disciplinary policy on system abuse laughable, saying it served no deterrent function whatsoever. Because word of the Unix box incident quickly spread among them, in which school administration chose to ignore the conduct, hackers learned that the school staff would not or could not work seriously to enforce appropriate network use. These students felt quite secure in their ability to hack into the school system without being traced or punished. Because these hacker students possessed technology skills far superior to staff skills, in reality the hackers truly were beyond policing by staff. The striking resemblance between NTHS computer crime and computer crime in the larger society indicates that NTHS hackers were using their time and access to high-speed technology at school to further develop their hacking skills. For these students the covert curriculum was one in which their sense of superiority over the adult, non-technological world was reinforced. The problem of network security holes is not specific to NTHS or any other school. Rather, security breaches are a hazard faced by all public and private institutions that use Internet-connected computer technology. Ensuring network security requires the expensive time and expertise of highly-skilled computer professionals, a luxury which schools and other public institutions can rarely afford. In the case of public institutions, which are supposed to inspire trust in the citizenry and represent stability in the face of societal changes, the vulnerability of confidential and sensitive information becomes a public safety issue. In a K-12 setting the particular vulnerability of minors escalated the need to protect their confidential information from unauthorized access. The contributions of this analysis are significant to the degree that computer technology is blended into American high school classrooms. Tremendous staff and student time is channeled from academic curriculum and instruction because of student misuse and abuse of the computers and computer network, requiring more, not less, personnel time. This finding refutes the myth that computers are labor saving devices that will replace teachers and other school staff. The computer technology policies and procedures at NTHS, in the context of the overall strategy of constructivist pedagogy, contributed a great deal to the covert curriculum and the development of the educational culture of the school. The strategies employed by staff members to enfranchise hacker students can be seen as partially successful in that some students apparently hacked the network, but did so largely without malicious intent and without serious harm. Some hacker students were successfully recruited as white hat hackers who helped to troubleshoot and secure the integrity of the network. Conclusion Societal unease about computer network security has the potential to threaten cyber-liberties currently enjoyed by Internet users around the globe. Corporations and governments may see no alternative to restrictive laws unless Internet users, cyber-liberties activists, and hacktivists work together to create a culture in which responsible hacking is rewarded and destructive hacking is discouraged. Groups concerned about developing an overall computing culture which maintains a balance between cyber-liberties and cyber-responsibility should work with educators to develop and implement ethics-based computing curriculum for K-12 schools. Further study of pedagogical models that foster student self-responsibility and ethical computing habits is necessary to develop a range of best-practices models from which educators can work. Bibliography Bajaj, V. (2000, Mar. 12). Web security posts hard to fill with skilled workers. The Dallas Morning News, 22L. Berinato, S., & Ferguson, R. (2000, Sep. 15). Hack alert: Where's the outrage? EWeek [On-line]. Available: http://www.zdnet.com/eweek/stories/general/0,11011,2628787,00.html Biagi, S. (2000, Oct. 2). A personal touch. Telephony [On-line]. Available: http://www.internettelephony.com/asp/ItemDisplay.asp?ItemID=11222&AreaID=8. Botstein, L. (1997). Jefferson's Children: Education and the Promise of American Culture. New York: Doubleday. Bruner, J. (1966). Toward a theory of instruction. Cambridge, MA: Harvard University Press. Burt, D. (2000, July 20). Written Testimony of David Burt, Child Online Protection Act Commission [On-line]. Available: http://www.copacommission.org/meetings/hearing2/burt.test.pdf California Department of Education (1997, October). CBEDS Profile (CBEDS-EE9), Napa County, Napa Valley Unified School District. Carnevale, A., & Porro, J. (1994). Quality Education: School Reform for the New American Economy. Washington, D.C.: U.S. Department of Education, Office of Educational Research and Improvement. Conte, C. (1995, October 20). Networking the classroom. CQ Researcher pp. 923-943. Dewey, J. (1897). My pedagogic creed. Reprinted in J. Boydston (Ed.) (1967-1991). The collected works of John Dewey. Carbondale: Southern Illinois University Press. House Subcommittee on Government Management, Information, and Technology (2000, Sept. 11). Report card on computer security in the federal government. Committee on Government Reform [On-line]. Available: http://www.house.gov/reform/gmit/hearings/2000hearings/000911computersecurity/000911.htm. Fujii, R. (2000, Apr. 3). Companies employ multiple defenses against computer hackers. The Record [On-line]. Available: Electric Library http://www.elibrary.com. Goslar, M. (2000, Sep. 6). Cracker attacks for a different reason. Enterprise [On-line]. Available: http://www.zdnet.com/zdnn/stories/news/0,4586,2624613,00.html?chkpt=zdnnmoreon Gruenwald, J. (2000, Sep. 25). Nations struggling to fight cybercrime. Inter@ctive Week [On-line]. Available: http://www.zdnet.com/zdnn/stories/news/0,4586,2631389,00.html Knight, W. (2000, Sep. 15). OPEC web site defaced. Enterprise [On-line]. Available: http://www.zdnet.com.au/enterprise/security/stories/au0005622.html Koch, L. (2000, Jul. 6). Open sources: Preventing cybercrime. Inter@ctive Week [On-line]. Available: http://www.zdnet.com/intweek/stories/news/0,4164,2601565,00.html Koerner, B., & Glasser, J. (2000, Feb. 28). Who can stop cybervandals? U.S. News and World Report [On-line]. Available: Electric Library http://www.elibrary.com. Lemos, R. (2000a, Jul. 14). Hard times at hacker high. ZDNet News [On-line]. Available: http://www.zdnet.com/zdnn/stories/news/0,4586,2604043,00.html Lemos, R. (2000b, Jul. 12). Script kiddies: The net's cybergangs. ZDNet News [On-line]. Available: http://www.zdnet.com/zdnn/stories/news/0,4586,2602573,00.html?chkpt=zdnnmoreon Lemos, R. (2000c, Jul. 26). Silence the best security policy. ZDNet News [On-line]. Available: http://www.zdnet.com/zdnn/stories/news/0,4586,2608077,00.html Matthew, R. (2000). The environment as a national security issue. Journal of Policy History 12(1), 101-122. McAllister, P. & McAllister, K. (1998). Critical Resources in Teaching with Technology: Introduction to Techno- Critical Pedagogy [On-line]. Available: http://www.engl.uic.edu/~stp/intro.htm New Technology High School (1997). Focus Group Comments. Self-published document. New Technology High School (1996). Napa's New Technology High School: A U.S. Department of Education Demonstration site. Self-published brochure. Papert, S., & Harel, I. (Eds.). (1993). Constructionism. Norwood, NJ: Ablex. Reuters (2000a, Oct. 16). Americans question cyber-security. TechTV [On-line]. Available: http://www.techtv.com/cybercrime/hackingandsecurity/story/0,9955,3005501,00.html Reuters (2000b, Oct. 16). NSA chief: We protect cyberspace. Wired News [On-line]. Available: http://www.wired.com/news/print/0,1294,39476,00.html. Rushkoff, D. (2000, Feb. 10). Recent Internet attacks are a reaction to the commercialism of the Internet. All Things Considered, National Public Radio. [Online]. Available: Electric Library http://www.elibrary.com. Robinson, C. (2000). Electronic commerce commands canny insight into hacker moves. Signal 54(9):53-56. Taylor, C. (2000a, Feb. 21). Behind the hack attack. Time, 44-47. Taylor, C. (2000b, Mar. 22). Business: Cracking the code. Time, 60. United Press International (2000, Jan. 7). Clinton announces security plan [On-line]. Available: Electric Library http://www.elibrary.com. Van Buren, C. (1999). High technology learning at "The School That Business Built": Perceptions of education at New Technology High School (University of Texas at Austin, unpublished dissertation).