A report commissioned by the Lower Merion School District says school officials failed to implement appropriate policies governing the use of tracking software by the school system's IT department, leaving the technology open to abuse. The findings are the latest twist in a legal battle in which a family is accusing the district of spying on a student in his home using the Webcam on a school-issued laptop.
The Lower Merion
School District in Pennsylvania failed
to adopt official guidelines governing the use of tracking software on school
laptops and left the technology open to abuse, according to a report released
May 3.
The 72-page report
was commissioned by the school district (PDF) in response to Webcam spying
allegations leveled by the family of a local student. In February, the parents
of Harriton High
School student Blake
Robbins sued the district, accusing it of using tracking software to take
a picture of Robbins in his home via the Webcam on his school-issued Apple
MacBook.
While the report, by Ballard Spahr, the law firm hired by the school district,
acknowledges that "copies of 30,564 Webcam photographs and 27,428
screenshots existed in IS [Information Services] Department systems as of Feb. 23, 2010," it says
there is no
evidence that district administrators were involved in spying on students.
"Notwithstanding the large quantity of images collected by LANrev
TheftTrack, we found no evidence that the feature was used to 'spy' on
students," the report states.
"Although there is no forensic method
to determine with certainty how often images stored on the LANrev server were
viewed, we found no evidence that any District 3 personnel surreptitiously
downloaded images from the LANrev server. Rather, the collection of images from
laptops while they were in the possession of students resulted from the district's
failure to implement policies, procedures and recordkeeping requirements, and
the overzealous and questionable use of technology by IS personnel without any
apparent regard for privacy considerations or sufficient consultation with
administrators."
According to the district, the software used to remotely activate the
laptops was a security feature designed to recover the computers if they were
lost or stolen. After the Robbins family filed suit, the school system said it
would not reactivate the feature without written notification to parents and
students.
"There is no evidence that members of LMSD's board or top-level district
administrators (including the superintendent, assistant superintendent, and the
principals and assistant principals of HHS
and LMHS) knew how TheftTrack worked or understood that it could collect
large quantities of Webcam photographs or screenshots from unsuspecting
students and their laptops," the report reads.
A copy of the Robbins lawsuit
can be viewed here. (PDF)