BUSTED —

Eighth-grader charged with felony for shoulder-surfing teacher’s password

The larger crime may be school administrators' poor op sec.

A 14-year-old Florida boy has been charged with felony computer intrusion after shoulder-surfing his school's computer network password and using it to play a prank on a teacher.

Domanik Green, an eighth-grader at Paul R. Smith Middle School in Holiday, Florida, was charged with an offense against a computer system and felony unauthorized access, according to a report published Thursday by The Tampa Bay Times. In late March, the youth allegedly used the administrative-level password without permission to log in to the school's network and change the images displayed on a teacher's computer to one of two men kissing. One of the computers accessed allegedly contained encrypted questions to the FCAT, short for the Florida Comprehensive Assessment Test.

While the factual allegations laid out in the article seem to indicate the youth perpetrated some form of trespass, they also alleged a litany of poor practices on the part of school administrators. These practices include weak passwords, entering passwords in front of others, and widespread unauthorized access, possibly that went undetected. From the report:

But Green, interviewed at home, said students would often log into the administrative account to screen-share with their friends. They'd use the school computers' cameras to see each other, he said.

Green had previously received a three-day suspension for accessing the system inappropriately. Other students also got in trouble at the time, he said. It was a well-known trick, Green said, because the password was easy to remember: a teacher's last name. He said he discovered it by watching the teacher type it in.

Green said that on the morning in question, he accessed the computer that stored the FCAT files and, realizing that computer didn't have a camera, found another.

"So I logged out of that computer and logged into a different one and I logged into a teacher's computer who I didn't like and tried putting inappropriate pictures onto his computer to annoy him," Green said.

The teacher he was targeting was out that day. Instead, the substitute teacher saw the picture and reported it to the school's administration.

School district administrators are in the process of changing the network password.

Channel Ars Technica