Robbins v. Lower Merion School District is a federal class action lawsuit, brought during February 2010 on behalf of students of two high schools in Lower Merion Township, a suburb of Philadelphia. In October 2010, the school district agreed to pay $610,000 to settle the Robbins and parallel Hasan lawsuits against it.
The suit alleged that, in what was dubbed the "WebcamGate" scandal, the schools secretly spied on the students while they were in the privacy of their homes. School authorities surreptitiously and remotely activated webcams embedded in school-issued laptops the students were using at home. After the suit was brought, the school district, of which the two high schools are part, revealed that it had secretly taken more than 66,000 images. The suit charged that in doing so the district infringed on its students' privacy rights. A federal judge issued a preliminary injunction, ordering the school district to stop its secret webcam monitoring, and ordered the district to pay the plaintiffs' attorney fees.
The lawsuit was filed after 15-year-old high school sophomore (second year student) Blake Robbins was disciplined at school for his behavior in his bedroom. The school based its decision to discipline Robbins on a photograph that had been secretly taken of him in his bedroom, via the webcam in his school-issued laptop. Without telling its students, the schools remotely accessed their school-issued laptops to secretly take pictures of students in their own homes, their chat logs, and records of the websites they visited. The school then transmitted the images to servers at the school, where school authorities reviewed them and shared the snapshots with others. In one widely published photo, the school had photographed Robbins in his bed. The Federal Bureau of Investigation (FBI), U.S. Attorney's Office, and Montgomery County District Attorney all initiated criminal investigations of the matter, which they combined and then closed because they did not find evidence "that would establish beyond a reasonable doubt that anyone involved had criminal intent". In addition, a U.S. Senate Judiciary subcommittee held hearings on the issues raised by the schools' secret surveillance, and Senator Arlen Specter introduced draft legislation in the Senate to protect against it in the future. Parents, media, and academics criticized the schools, and the matter was cited as a cautionary example of how modern technology can be used to infringe on personal privacy.
In July 2010, another student, Jalil Hasan, filed a parallel second suit. It related to 1,000+ images that the school took surreptitiously via his computer over a two-month period, including shots of him in his bedroom. The district had deactivated its surveillance of the student in February 2010, after the Robbins lawsuit was filed. Five months later—pursuant to a court order in the Robbins case—it informed Hasan for the first time that it had secretly taken the photographs. The district was put on notice of a third parallel suit that a third student intended to bring against the district, for "improper surveillance of the Lower Merion High School student on his school issued laptop", which included taking over 700 webcam shots and screenshots between December 2009 and February 2010.
Complaint The lawsuit Robbins v. Lower Merion School District was filed on February 11, 2010, in the U.S. District Court for the Eastern District of Pennsylvania, by plaintiffs' lead lawyer, Mark S. Haltzman of Silverang, Donohoe, Rosenzweig & Haltzman LLC."Class Action Complaint" , Robbins v. Lower Merion School District, U.S. District Court for the Eastern District of Pennsylvania, February 11, 2010. Retrieved August 15, 2010. It was filed on behalf of Blake J. Robbins, and other high school students from the school district, by Robbins' parents.
The complaint alleged that after the high schools issued MacBook laptops with built-in iSight webcams to the students, school staff remotely activated the laptops' webcams covertly while the students were off school property, thereby invading the students' privacy. The plaintiffs said they had not consented to the spying.
The defendants were the Lower Merion School District (LMSD) in Pennsylvania (of which the two high schools are part), its nine-member Board of Directors, and its Superintendent (Christopher McGinley). Henry E. Hockeimer, Jr., of Ballard Spahr LLP was lead counsel for the defendants.
Laptops with covert cameras
Program
At the beginning of the 2009–10 school year, the school district issued individual Apple MacBook laptop computers to each of its 2,306 high school students. The laptops were for both in-school and at-home use.
It was part of the school district's One-to-One initiative. The program was piloted in September 2008 at Harriton High School and expanded in September 2009 to Lower Merion High School. It cost $2.6 million, less than a third of which was covered by grants.
Covert surveillance capability The school loaded each student's computer with LANrev's remote activation and tracking software. This included the now-discontinued "TheftTrack". While TheftTrack was not enabled by default on the software, the program allowed the school district to elect to activate it, and to enable whichever of TheftTrack's surveillance options the school desired.
The school elected to enable TheftTrack to allow school district employees to secretly and remotely activate the standard webcam featured in all Apple laptops since 2006. That allowed school officials to secretly take photographs through the webcam, of whatever was in front of it and in its line of sight, and send the photographs to the school's server. The system took and sent a new photograph every 15 minutes when the laptop was on, and TheftTrack was activated, though school employees could adjust the timeframe to as low as one-minute intervals. LANrev disabled the webcams for all other uses (e.g., students were unable to use Photo Booth or video chat), so most students mistakenly believed that their webcams did not work at all.
In addition, TheftTrack allowed school officials to take screenshots, and send them to the school's server. Furthermore, a locating device would record the laptop's Internet (IP) address, enabling district technicians to discover which city the laptop was located in and its Internet service provider, though a subpoena to the provider would be required to pinpoint the exact location. In addition, LANrev allowed school officials to take snapshots of instant messages, web browsing, music playlists, and written compositions.Cory Doctorow, "School spying: infected laptops mandatory, jailbreaking grounds for expulsion" , Boing Boing, February 22, 2010. Retrieved August 15, 2010.
After sending the image to the school's server, the laptop was programmed to erase the "sent" file created on the laptop. That way, there would not be any trace by which students might realize that they were being watched and photographed. The forwarded photos, screenshots, and IP addresses were stored on the school's server, until they were purged by a school employee. It is not clear who in the schools had access to the photos and other images. Further, LANrev could be programmed to capture webcam pictures and screen captures automatically, and store them on the laptop's hard disk for later retrieval in areas of the computer's storage that were not accessible by the student, and which could be deleted remotely.
Fred Cate, Director of the Center for Applied Cybersecurity Research at Indiana University, said, "This is the classic definition of spyware. It's as bad as you can imagine." Eileen Lake of Wynnewood, whose three children attended district schools, said, "If there's a concern that laptops are misplaced or stolen, they should install a chip to locate them instead. There shouldn't be a reason to use webcams for that purpose." Marc Rotenberg, Georgetown University Law School information privacy professor and President and executive director of the Electronic Privacy Information Center (EPIC), said: "There are less intrusive ways to track stolen laptops, no question about it."
Purchase
Commenting on the now-discontinued TheftTrack, Carol Cafiero (school district Information Systems Coordinator, and supervisor of 16 technicians and administrative assistants) wrote to her boss Virginia DiMedio (district Director of Technology for a number of years, until June 2009, and a member of the district Superintendent's five-person Cabinet) that district Network Technician Mike Perbix "loves it, and I agree it is a great product". Perbix also raved about the spying capabilities of TheftTrack in a May 2008 LANrev promotional webcast, saying he "really, really" liked it. Webcast, May 20, 2008
DiMedio considered Perbix and Cafiero's recommendations that the district purchase the software, including a memo in which Cafiero noted that "we can mark [a student's laptop as] stolen on the LANrev server, and then the laptop will take screenshots and pictures of the user with the built-in camera, and transmit that information back to our server." DiMedio then approved the purchase and installation of the $156,000 surveillance software.
Concealment of surveillance The school district intentionally did not publicize the existence of the surveillance technology. It also actively sought to conceal it.
The district did not inform students or their parents, in any of its communications with them (including the district's promotion of the laptop program, guidelines about the laptops, and the individual contracts that it gave students to sign), that the laptops gave the district the ability to secretly take photographs of whatever was in the line of sight of the student-issued laptop webcams, and to take screenshots; nor did it inform them that the district would avail itself of those capabilities. The district also did not adopt policies regarding the use of TheftTrack by district employees.
DiMedio said "the district did not widely publicize the feature 'for obvious reasons. She reportedly declined to tell students about TheftTrack because doing so could "defeat its purpose".
Perbix said that when "you're controlling someone's machine, you don't want them to know what you're doing". He praised TheftTrack in a YouTube video he produced, saying: "It's ... just a fantastic feature ... especially when you're in a school environment". Perbix maintained a personal blog in which he discussed computer oversight techniques, including how to cloak remote monitoring so it is invisible to the user.
Concerns raised by student intern On August 11, 2008, weeks before the district handed the laptops out to students, a Harriton High School student interning in the school's IT Department sent an email to DiMedio, with the subject line: "1:1 concern (Important)". He said that he had recently learned of the district's purchase of LANrev, and had researched the software. He had made the "somewhat startling" discovery that it would allow school employees to monitor students' laptops remotely. He wrote:
I would not find this a problem if students were informed that this was possible, for privacy's sake. However, what was appalling was that not only did the District not inform parents and students of this fact ... [W]hile you may feel that you can say that this access will not be abused, I feel that this is not enough to ensure the integrity of students, and that even if it was no one would have any way of knowing (especially end-users). I feel it would be best that students and parents are informed of this before they receive their computers. ... I could see not informing parents and students of this fact causing a huge uproar.
DiMedio responded: