Original URL: https://www.theregister.com/2014/02/04/california_students_expelled_for_grade_tampering_in_hacking_row/

California high school hackers expelled for grade tampering, test thievery

Where's Matthew Broderick when you need him?

By Shaun Nichols in San Francisco

Posted in Security, 4th February 2014 22:33 GMT

A group of students have been kicked out of a California high school over charges that they hacked teachers' computers in order to change their grades.

The Newport-Mesa Unified School District said that it had voted to expel 11 students in connection with charges of grade tampering and unauthorized access to teachers' computers.

According to local news reports, the students – all of whom attended Corona del Mar High School – illegally accessed teachers' computers not only to change their grades, but also to steal materials for upcoming tests.

The school board confirmed it had voted in all 11 cases to impose expulsion, the harshest possible penalty for the students, with votes ranging from 4-to-3 to 7-to-0. The school cited confidentiality policies and legal restrictions in declining to name the students involved.

The alleged mastermind in the case, however, remains at large, and some believe his capture could shed light on an even larger scandal.

The district said 28-year-old Timothy Lance Lai is being sought in connection with the case, and is believed to have helped the students access the target computers. Lai is accused of providing the students with key loggers, which were installed on the teachers' systems in order to extract account credentials.

"The Newport Beach Police Department is currently seeking to interview the alleged private tutor for his involvement in the incident," the district said in a statement. "The district is currently involved in an intensive audit of all CdM teachers' grade books so that we can ensure the integrity and accuracy of all posted grades.

"The District has also taken preventative measures and is implementing a new notification system districtwide to flag grade changes."

According to documents posted by the Orange County Register (no relation to El Reg), some administrators believe that the district is trying to cover up a larger scandal that could involve as many as 150 additional students.

"I would warn any parent who hired Tim Lai to be prepared for the inevitable," wrote administrator Jane Garland.

"Or probably not, because I believe the system is willing to allow these 11 students to take the fall and close the book on this matter."

Local newspaper the Daily Pilot noted that academic pressure at Corona del Mar, a school well regarded for the success of its students, could well have played a role in driving the students to resort to hacking in order to boost their grades.

John Hawes, a security researcher writing for the Sophos Naked Security blog, noted that while school networks are traditionally difficult to secure and maintain, certain measures could be put in place by IT staff to prevent such incidents in the future.

"Something as simple as different user rights for students and teachers is probably not enough," Hawes wrote.

"It might make more sense to block all access to test and grade data from terminals accessible to students, and provide teachers with access to a segregated network section, ideally from systems in off-limits areas." ®