Robbins v. Lower Merion School District: Difference between revisions

Robbins v. Lower Merion School District is a federal class action lawsuit (pending certification), brought in February 2010 on behalf of students of two high schools in the Philadelphia, Pennsylvania suburbs.^[1]

The suit alleges that, in what has been dubbed the "WebcamGate" scandal, the schools secretly spied on the students while they were in the privacy of their homes.^[2][3] School authorities surreptitiously and remotely activated webcams embedded in school-issued laptops the students were using at home.^[4] After the suit was brought, the school district, of which the two high schools are part, revealed that it had secretly snapped more than 58,000 images (and its computer consultant revealed that the number exceed 66,000).^[5][6] The suit charges that in doing so the school district infringed on the privacy rights of its students.^[7][8][4]

The lawsuit was filed after 15-year-old high school sophomore Blake Robbins was disciplined at school for his behavior in his home.^[4][9] The school's "evidence" that triggered his discipline was a photograph that the school had secretly taken of him in his bedroom, via the webcam in his school-issued laptop. Without telling its students, the schools remotely accessed their school-issued laptops to secretly snap pictures of students in their own homes, their chat logs, and records of the websites they visited. The school then transmitted the snapshots to servers at the school.^[10] In one widely published photo, the school had photographed Robbins in his bed.^[11] The Federal Bureau of Investigations (FBI), U.S. Attorney's Office, and Montgomery County District Attorney all initiated criminal investigations of the matter, which they combined and then closed because they did not find evidence "that would establish beyond a reasonable doubt that anyone involved had criminal intent". In addition, a U.S. Senate Judiciary subcommittee held hearings on the issues raised by the schools' secret surveillance, and Senator Specter introduced draft legislation to protect against it in the future. Parents, media, and academicians criticized the schools, and the matter was cited as a cautionary example of how modern technology can be used to infringe on personal privacy.^[12]

In July 2010, a second student filed a parallel second suit. It related to 1,000+ images that the school snapped surreptitiously via his computer over a two-month period, including shots of him in his bedroom. The district had deactivated its surveillance of the student in February 2010, after the Robbins lawsuit was filed. Five months later—pursuant to a court order in the Robbins case—it informed him for the first time that it had secretly taken the photographs.^[13]

The lawsuit Robbins v. Lower Merion School District was filed on February 11, 2010, in the U.S. District Court for the Eastern District of Pennsylvania, by plaintiffs' lead lawyer, Mark S. Haltzman of Lamm Rubenstone LLC.^[14] The complaint was filed on behalf of Blake J. Robbins, and other high school students from the school district who were also issued laptops, by Robbins' parents.^[14][15]

The complaint alleges that school-issued MacBook laptops with built-in iSight webcams were used by school staff to invade the students' privacy, by remotely activating the laptop cameras covertly while the students were off school property.^[14][15] The plaintiffs said they had not consented to the spying.^[14] The defendants are the Lower Merion School District (LMSD) in Pennsylvania (of which the two high schools are part), its nine-member Board of Directors, and its Superintendent (Christopher McGinley).^[16] Henry E. Hockeimer, Jr., of Ballard Spahr LLP is lead counsel for the defendants.

At the beginning of the 2009–10 school year, LMSD (in Ardmore, Pennsylvania, a Lower Merion Township suburb of Philadelphia in the United States) issued Apple MacBook laptops to all of its 2,306 high school students.^[4][13][17] It was part of the school district's One-to-One initiative, a program piloted in September 2008 at Harriton High School in Rosemont, Pennsylvania, and expanded in September 2009 to Lower Merion High School in Ardmore. Each student was provided his or her individual laptop computer, for both in-school and at-home use.^[1][18] The program cost $2.6 million, less than a third of which was covered by grants.^[19][17]

The school loaded each student's computer with LANrev's remote activation and tracking software. This included the now-discontinued "TheftTrack".^{[20][21][13][22]} While TheftTrack was not enabled by default on the software, the program allowed the school district to elect to activate it, and to choose which of the TheftTrack surveillance options the school wanted to enable.^[6]

TheftTrack allowed school district employees to secretly and remotely activate a tiny camera webcam embedded in the student's laptop, above the laptop's screen.^{[20][21][13][22]} That allowed school officials to secretly take photos through the webcam, of whatever was in front of it and in its line of sight, and send the photos to the school's server.^[13][6] The system snapped and sent a new photo every 15 minutes when the laptop was on, and TheftTrack was activated, though school employees could could adjust the timeframe to as low as one-minute intervals.^[23][24][6] The LANrev software disabled the webcams for all other uses (e.g., students were unable to use Photo Booth or video chat), so most students mistakenly believed that their webcams did not work at all.^[25]

In addition to webcam surveillance, TheftTrack allowed the school officials to take screenshots (pictures showing a copy of an image of whatever was on the laptop's screen), and send them to the school's server as well.^[13][6] Furthermore, a locating device woud record the laptop's Internet (IP) address, which could enable district technicians to pinpoint the location of the laptop.^[24] In addition, LANrev allowed school officials to take snapshots of instant messages, web browsing, music playlists, and written compositions, all of which can still be monitored and archived via screen capture.^[26][13]

After sending the image to the school's server, the laptop was programmed to erase the "sent" file created on the laptop, so that there would not be any trace by which students might realize that they were being watched and photographed.^[27] The forwarded photos, screenshots, and IP addresses were stored on the school's server, until they were purged by a school employee.^[17] It is not clear who in the Lower Merion schools had access to the webcam photos and other images.^[27] Further, LANrev could be programmed to capture webcam pictures and screen captures automatically, and store them on the laptop's hard disk for later retrieval in areas of the computer's memory that were not accessible by the student, and which could be deleted remotely.<refname="spy">"The Spy at Harriton High". Stryde Hax. February 21, 2010. Retrieved August 11, 2010. {{cite web}}: Unknown parameter |Author= ignored (|author= suggested) (help)</ref>

Fred Cate, Director of the Center for Applied Cybersecurity Research at Indiana University, said: "This is the classic definition of spyware. It's as bad as you can imagine."^[28] After the suit was filed, Eileen Lake of Wynnewood, whose three children attend district schools, said: "If there's a concern that laptops are misplaced or stolen, they should install a chip to locate them instead. There shouldn't be a reason to use webcams for that purpose."^[29] Marc Rotenberg, Georgetown University Law School information privacy professor and President and Executive Director of the Electronic Privacy Information Center (EPIC), said: "There are less intrusive ways to track stolen laptops, no question about it.^[30]

Commenting on TheftTrack, Carol Cafiero (school district Information Systems Coordinator, and supervisor of 16 technicians and administrative assistants) wrote to her boss Virginia DiMedio (district Director of Technology for a number of years, until June 2009, and a member of the district Superintendent’s five-person Cabinet) that district Network Technician Mike Perbix "loves it, and I agree it is a great product."^[27][31] Perbix also raved about the spying capabilities of the LANrev TheftTrack software in a May 2008 LANrev promotional webcast, saying he "really, really" liked it.^{[32][28][17][17]}

DiMedio considered Perbix and Cafiero's recommendations that the school district purchase the software, including a memo in which Cafiero noted that: "we can mark [a student's laptop as] stolen on the LANrev server, and then the laptop will take screenshots and pictures of the user with the built-in camera, and transmit that information back to our server."^[17] DiMedio then approved the purchase and installation of the $156,000 surveillance software.^[33][27]

The school district intentionally did not publicize the existence of the surveillance technology, and actively sought to conceal it.^[34][17] In neither the promotion of the laptop program nor the individual contracts that students signed did the school make any mention of the computer's remote surveillance activation features.^[20] The district did not inform students or their parents, in any of its communications with them or in district guidelines about the laptops, that the laptops gave the district the ability to secretly snap photos of whatever was in the line of sight of the student-issued laptop webcams, and to take screenshots.^[17] Nor did it inform them that the district would avail itself of those capabilities.^[17] The district also did not adopt policies regarding the use of TheftTrack by district employees.^[17]

DiMedio said “the district did not widely publicize the feature 'for obvious reasons'.^[17] She reportedly declined to tell students about TheftTrack because doing so could “defeat its purpose.”^[17]

Perbix said that when "you're controlling someone's machine, you don't want them to know what you're doing."<refname="spy"/>^{[27][35][35][36]} He had previously praised TheftTrack in a YouTube video he produced, saying: "It's ... just a fantastic feature ... especially when you're in a school environment".^[37] Perbix maintained a personal blog in which he discussed computer oversight techniques, including how to cloak remote monitoring so it is invisible to the user.^[38]

On August 11, 2008, weeks before the district handed the laptops out to students, a Harriton High School student interning in the school's IT Department sent an email to DiMedio, with the subject line: “1:1 concern (Important)”. He said that he had recently learned of the district's purchase of LANrev, and had researched the software. He had made the "somewhat startling" discovery that it would allow school employees to monitor students' laptops remotely.^[33][39][17] He wrote:

I would not find this a problem if students were informed that this was possible, for privacy’s sake. However, what was appalling was that not only did the District not inform parents and students of this fact ... [W]hile you may feel that you can say that this access will not be abused, I feel that this is not enough to ensure the integrity of students, and that even if it was no one would have any way of knowing (especially end-users). I feel it would be best that students and parents are informed of this before they receive their computers.... I could see not informing parents and students of this fact causing a huge uproar.^[17]

DiMedio responded:

[T]here is absolutely no way that the District Tech people are going to monitor students at home.... If we were going to monitor student use at home, we would have stated so. Think about it—why would we do that? There is no purpose. We are not a police state.... There is no way that I would approve or advocate for the monitoring of students at home.

I suggest you take a breath and relax.^[33][39][17]

DiMedio then forwarded the e-mails to District Network Technician Perbix, who suggested a further response to the student intern. With DiMedio’s approval, Perbix e-mailed the student intern, also dismissing the student's concern:

[T]his feature is only used to track equipment ... reported as stolen or missing. The only information that this feature captures is IP and DNS info from the network it is connected to, and occasional screen/camera shots of the computer being operated.... The tracking feature does NOT do things like record web browsing, chatting, email, or any other type of “spyware” features that you might be thinking of.

Being a student intern with us means that you are privy to some things that others rarely get to see, and some things that might even work against us. I assure you that we in no way, shape, or form employ any Big Brother tactics, ESPECIALLY with computers off the network.^[40][39][17]

In addition, two members of the Harriton High School student council twice privately confronted their Principal, Steven Kline, more than a year prior to the suit. They were concerned "that the school could covertly photograph students using the laptops' cameras."^[27][17] Students were particularly troubled by the momentary flickering of their webcams' green activation lights, which several students reported would periodically turn on when the camera wasn't in use, signaling that the webcam had been turned on.^[19][6][17][1] Student Katerina Perech recalled: "It was just really creepy".^[19] Some school officials reportedly denied that it was anything other than a technical glitch, and offered to have the laptops examined if students were concerned. Kline says that he admitted that the students' suppositions were true, and the students told him they were worried about privacy rights. The students also asked whether the school system read the saved files on their computers, and said that students should be notified. At the end of the day, however, no such action was taken.^[35]

On October 20, 2009, school district officials knew Blake J. Robbins, a sophomore at Harriton High School, was in possession of his laptop and had taken it home.^[41] On that day, they nevertheless decided to begin capturing webcam photos and screenshots from his school-issued MacBook, by activating its covert camera.^[41] Building-Level Technician Kyle O'Brien testified later, at his deposition, that Harriton High School Assistant Principal Lindy Matsko directed O’Brien to activate the tracking. O'Brien complied, by e-mailing District Network Technician Perbix, and directing him to initiate the TheftTrack.^[17] In contrast, however, the Assistant Principal testified at her own deposition that she did not authorize the tracking.^[17]

Two hours later, Perbix e-mailed O'Brien to let him know that TheftTrack was running on Robbins' computer, and that Perbix had determined Robbins' location.^[41] Perbix wrote: "Now currently online at home."^[41] The next day, Perbix asked O’Brien whether he should continue tracking the laptop, and O’Brien responded “yes.”^[17]

Over the next 15 days, the school district captured at least 210 webcam photos and 218 screenshots. Those 429 images, however, only reflected the number of images later recovered—in later litigation the district said it had been unable to recover a week's worth of images that it had taken.^[28] They included photos inside his home of Robbins sleeping and of him partially undressed, as well as photos of his father.^[41] The district also snapped images of Robbins' instant messages and video chats with his friends, and sent them to its servers.^[41]

On October 26, Perbix observed one of the screenshots of Robbins, taken in his bedroom.^[39] Four days later Perbix showed it to his boss, district Director of Information Systems George Frazier.^[39] After discussing it with Frazier, Perbix shared the images captured from Robbins' webcam and screenshots with Harriton High School Principal Kline and with Matsko.^[42] In early November, a number of Harriton High School administrators, including Kline, Matsko, and Assistant Principal Lauren Marcuson, met to discuss the images.^[39] According to Matsko, Kline advised her that unless there was additional evidence giving them a contextual basis for doing so, they should not discuss the images with Robbins or his parents, because they involved off-school-campus activities. However, Matsko ultimately decided to discuss certain of the images with Robbins and/or his parents.^[17]

Matsko called Robbins into her office on November 11, 2009. She showed him a photograph taken with the webcam embedded in his school-issued laptop, as he was in his bedroom in his Penn Valley home. Matsko indicated that she thought it was "proof", and initially disciplined him for "improper behavior".^{[4][7][13][9][43][44][45][24]} His parents were contacted, and they told school officials that the officials were mistaken. Ultimately, Blake was not disciplined.

Robbins said that Matsko told him that the district was able to activate the webcam embedded in a student's laptop remotely at any time, and view and capture whatever image was visible—without the knowledge or consent of anyone in the webcam's line of sight.^[46][47] After a district counselor told them that an account of the incident had been placed in Blake's personal school file, however, the family decided to bring suit.^[48]

The plaintiffs alleged that:

many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, incuding ... various stages of dress or undress.^[16]

In a widely published photograph, Robbins was shown sleeping in his bed.^[11] The hundreds of photos taken of the 15-year-old also included him standing shirtless after getting out of the shower, as well as photos of his father and friends.^[23][28] Not included in what was turned over to the family was one week's worth of images that the school district said it had not been able to recover.^[28]

The lawsuit claims that the district's use of the webcams violated the United States Constitution's guarantees of privacy of the students and their families and friends at home, as well as Pennsylvania common law (expectation of privacy) and Section 1983 of the U.S. Civil Rights Act (right to privacy).^[4]

It also accused officials of spying through "indiscriminate use of an ability to remotely activate the webcams incorporated into each laptop", and thereby violating the Fourth Amendment of the Constitution (right to privacy) and a number of electronic communications laws: the U.S. Electronic Communications Privacy Act (ECPA; intentional intercepts of electronic communications), the Computer Fraud and Abuse Act (CFAA; intentional access of a computer that exceeds authorization to obtain information), the Stored Communications Act (SCA; unauthorized acquisition of stored electronic communications), and the Pennsylvania Wiretapping and Electronic Surveillance Act (PWESA; intentional intercept of electronic communications).^[4][14]

"We will prevail," said school district spokesman Doug Young, announcing that the school district intended to contest the lawsuit.^[49] Henry E. Hockeimer, Jr., and four Ballard Spahr attorneys represent the district.^[50][43]

On February 18, 2010, the day the case was made public, the school district posted an initial reply on its website asserting that: "The tracking-security feature was limited to taking a still image of the operator and the operator's screen," and that it "has only been used for the limited purpose of locating a lost, stolen, or missing laptop. [T]his includes tracking down a loaner computer that, against regulations, might be taken off campus."^[51][6][52] The complaint had not indicated whether Robbins' laptop had been reported lost or stolen, and Young said the district could not disclose that fact.^[12] Young asserted that the district never violated its policy of only using the remote-activation software to find missing laptops. "Infer what you want," Young said.^[12]

That same day, the district turned off TheftTrack on tracked laptops, and deleted pictures from LANrev, as discovered by a subsequent forensics review.^[6] The district also denied that the school administrator had ever used a photo taken by a school-issued laptop to discipline a student.^[53] The Vice Principal herself repeated the statement in a video distributed to national media on February 24, 2010.^[54]

On February 20, 2010, Haltzman told msnbc Live that Robbins had been sitting in his home eating "Mike and Ike" candy in front of his school-issued laptop.^[9] The attorney said that the Vice Principal had accused Robbins of taking illegal pills, after seeing him eating the candy in a webcam image.^[13] Michael Smerconish, a Philadelphia Inquirer columnist who reviewed the photo, said that it did in fact appear to be the same size and shape as Mike and Ike candy.^[22] Haltzman said that his client's laptop had not been reported stolen or lost. The lawyer also raised questions as to who in the school system decided when to activate each student's webcam, and for what reasons.^[50][43]

In a statement to the press on February 24, 2010, Robbins emphasized that the case was about the undisclosed spying capabilities which the district covertly maintained.^[55]

As of May 2010, the district had not filed an Answer to the plaintiffs' complaint.^[17]

The school district later admitted to "serious mistakes" and "misguided actions." It also acknowledged that its monitoring system was flawed, and was "not handled appropriately". The district's Superintendent admitted that students and parents were not informed of the secret spying feature, and the district said that "notice should have been given" to the students and parents, and that the district's failure to do so "was a significant mistake".^{[13][5][56][29][19][57][58]} School Board President David Ebby said: "It's a big, big horrible error in judgment."^[59]

The school district eventually acknowledged that it had snapped more than half the images after missing laptops were recovered.^[5] A computer forensics study commissioned by the defendants recovered 66,503 images produced by LANrev, though it was not able to recover all that had been deleted by district employees.^[6] The district asserted that it did not have any evidence that individual students had been specifically targeted.^[5] Haltzman said: "I wish the school district [had] come clean earlier, as soon as they had this information ... not waiting until something was filed in court revealing the extent of the spying".^[60]

Christopher Null, technology writer for Yahoo! News, observed: "It's a little difficult to believe that none of the material captured is scandalous".^[61]

The district also admitted that in Robbins' case the remote surveillance was activated and left running for two weeks, even though school officials knew the laptop was at Robbins' home.^[2] It also admitted that its technology staff activated the camera on his computer, and gave images it covertly snapped to two Harriton High School principals.^[62]

Six days after the initiation of the lawsuit, and after a district review of its privacy policies, the school district disabled its ability to activate students' webcams remotely.^[4][6] Lillie Coney of the Electronic Privacy Information Center said: "If they thought it was right, they wouldn't have stopped."^[63]

On February 24, the district suspended and put on paid administrative leave its two staffers who were authorized to activate the remote monitoring, district 12-year-veterans Information Systems Coordinator Cafiero and Network Technician Perbix.^{[5][43][44][17][39]} The district indicated that it had done so as a precautionary measure, in light of their roles in activating TheftTrack, and the ensuing investigation.^[17]

In a motion seeking to examine Cafiero's computer, excerpts of emails between her and Amanda Wuest, District Desktop Technician, about the surreptitious webcams were cited in which the technician emailed Cafiero: "This is awesome. It's like a little LMSD soap opera," and Cafiero replied, "I know, I love it".^[64][65][17] Her lawyer, Charles Mandracchia of the law firm Mandracchia & McWhirk LLC, said she had only turned the webcam system on when requested to do so by school officials.^[64][36]

When Haltzman sought to depose Cafiero, she fought his effort to ask her questions at a deposition.^[66][67] However, U.S. District Judge Jan DuBois refused to quash Haltzman's subpoena, ruling in April 2010 that Cafiero may have information relevant to the case.^[66] In her first deposition, Cafiero declined to answer questions, citing her Fifth Amendment right against self-incrimination. However, after she was interviewed by the FBI in April 2010, in a later deposition she answered questions under oath.^[68] Others deposed included Matsko, Perbix, and O'Brien.^[17][69][17]

In June and July 2010, in accordance with an order from the federal judge, dozens of other high school students were notified by counsel for the schools that they too had been secretly photographed by school authorities via their webcams.^[44] The school district said that more than 58,000 photos had been taken from November 2008 through February 2010 and recovered on school servers, but that the exact number was not known as a number of the photos had been deleted by the district.^[68][39][6] The students and their parents were invited to privately review the photos that had been taken, and a federal judge is overseeing the review process.^[44][65] In about 15 cases, the school said it had no answer as to who ordered the surreptitious webcam activation, or why.^[23][60]

Tom Halpern, a 15-year-old sophomore who attends the high school, told CBS News, "Everybody's pretty disgusted.... I think its pretty despicable."^[70] Many students said they mostly used their laptops in their bedrooms, and rarely turned them off.^[66][71] Karen Gotlieb, whose daughter attends the school, said, "I just received an e-mail from my daughter, who is very upset, saying, 'Mom, I have my laptop open in my room all the time, even when I'm changing."^[70] Savanna Williams, a sophomore at Harriton, said she always keeps her computer open, its webcam exposed, when she's changing in her bedroom, and in the bathroom when she's taking a shower. She said: "I was like, 'Mom, I have this open all the time. … This is disturbing.'"^[70] Her mother said: "the possibility of this being true is a "complete violation of her privacy, of our entire home–not just Savanna. They have the option to watch [me], my husband, my other child. They violated our trust."^[70]

Mother Candace Chacona said she was "flabbergasted" by the allegations: "My first thought was that my daughter has her computer open almost around the clock in her bedroom. Has she been spied on?"^[72] Chuck Barsh, an insurance broker whose son is in high school, called the district's actions a "gross invasion" of student privacy, and supported the lawsuit, saying: "These people were able to look at our kids in our house".^[19] Mike Salmonson, father of an elementary school student, said the matter was "part of ... institutional arrogance—a lack of full disclosure and honesty" on the part of district administrators.^[73]

John Palfrey, Harvard Law School professor and Vice Dean, and Co-Director of the Berkman Center for Internet & Society cyberspace research center, said: “If the facts are as they appear to be in the claims by the student, it’s shocking."^[74] David Kairys, a Temple University Law School professor who specializes in civil rights and constitutional law and is author of Philadelphia Freedom, Memoir of a Civil Rights Lawyer, described the school district's policy as "Orwellian". He said that it appeared to be a "very clear civil-rights violation", continuing: "It's pretty outrageous. It's sort of beyond belief that they wouldn't say, 'This is going too far.'"^[75] Susan Friewald, University of San Francisco Law School professor and expert in electronic privacy law, said: "they had to get consent to take photos... [I]f the school districts are going to use [laptops] to spy on students, we should certainly be concerned."^[76]

Witold "Vic" Walczak, the Legal Director of the Pennsylvania chapter of the American Civil Liberties Union (not a party in the lawsuit), commented:

This is an age where kids explore their sexuality, so there's a lot of that going on in the room.
This is fodder for child porn.^[77][78][79]

Joseph Daly, who retired in 2009 as Lower Merion Police Superintendent, when told about the pictures snapped from students' laptops, said: "That's illegal as hell."^[27]

Lillie Coney, Associate Director of the Electronic Privacy Information Center (a civil liberties public interest research center), said: "This definitely was not ... a rational thing for the school to be engaged in," and called it "an outrageous invasion of individual privacy."^[70][72] Ari Schwartz, Vice President and COO at the Center for Democracy and Technology (a civil liberties public interest organization), said: "What about the [potential] abuse of power from higher-ups, trying to find out more information about the head of the PTA [Parent-Teacher Association]? If you don't think about the privacy and security consequences of using this kind of technology, you run into problems."^[78][79]

Kevin Bankston, senior staff attorney specializing in privacy law with the Electronic Freedom Foundation (an international digital rights advocacy and legal organization), said: "I've never heard of anything this egregious. Nobody would have imagined that schools would peer into students private homes, and even bedrooms, without any kind of justification.^[71] He continued: "This is utterly shocking, and a blatant violation of [the students' Fourth Amendment] constitutional rights. The school district would have no more right to [use the laptop's webcam] than to install secret listening devices in the textbooks that they issued students."^[49] He suggested that students tape over the lens of their laptop's camera.^[49]

Dan Tynan, Executive Editor of PC World and author of Computer Privacy Annoyances (2005), said: "This is extremely creepy, and way beyond the purview of the school.... There's really no need to try to take a picture of someone—in fact, how can you prove the person in front of the laptop was the one who stole it?... And to install this stuff on anyone's computer and not notify them about, it is just begging for a world of pain."^[80] Robert Richardson, Director of the Computer Security Institute, said: "It's incredible that they didn't realize they were playing with fire."^[28] Technology journalist Robert X. Cringely wrote in InfoWorld:

Is there any reason why you'd need to take two weeks' worth of photos to locate a missing laptop, especially when you already have other ways of tracking it? I don't think so.... Cafiero issued ... the rather interesting statement that the 15-year-old Robbins had "no reasonable expectation of privacy" in his own home, because ... his family hadn't paid the $55 insurance fee required by the school for home loaners. In other words: If you don't pay your dues, we can watch you while you sleep. Did I say "creepy" already?^[81]

LANrev, the manufacturer of the software—which was acquired by Absolute Software, and rebranded as "Absolute Manage" in February 2010—denounced the use of its software for any illegal purpose, emphasized that theft-recovery should be left to law enforcement professionals, and criticized vigilantism".^[82][25] The company denied any knowledge of, or complicity in, either Perbix's or the district's actions. Absolute Software then permanently disabled TheftTrack in its next LANrev update.^[21][28]

The Philadelphia Inquirer columnist Monica Yant Kinney wrote:

School district techies peering into private homes, even for a moment, under the guise of locating a lost laptop?
Even in this "surveillance society," it's almost beyond comprehension.^[63]

The newspaper, in an editorial, called the school's decision to use the remote-camera feature "misguided", and wrote "families had every right to be shocked. As an anti-theft strategy, the webcam tracking was overkill–and not even as useful as other means. Then failing to disclose the webcam use was a huge gaffe, compounded by a lack of policies safeguarding students' privacy."^[83] Talk radio host and The Philadelphia Inquirer columnist Michael Smerconish added:

[M]ost shocking were the [images] showing the faces or ... postings of [classmates, friends, family members, and parents] with whom Robbins was communicating. What gave Lower Merion the right to invade the privacy of these people? Their images represent a gross violation of privacy, akin to listening in on a private telephone communication between two individuals, at least one of whom has absolutely no idea of the presence of an interloper. That's the real outrage ... it was inexcusable for the school district to invade the privacy of third parties en route to violating that of Blake Robbins.^[22]

The Pittsburgh Post-Gazette wrote in an editorial: "Schools have no business or jurisdiction in the homes of students. The ... District ... should never have been in the business of surveillance in the first place. Tough laws are needed to prevent Lower Merion or other school districts from going down this path again."^[84] The New York Times, in an editorial, said: "Conducting video surveillance of students in their homes is an enormous invasion of their privacy. If the district was really worried about losing the laptops, it could have used GPS devices to track their whereabouts ... Whatever it did, the school had a responsibility to inform students that if they accepted the laptops, they would also accept monitoring."^[85]

Haltzman filed an emergency motion seeking an injunction to prevent the school district from reactivating what he referred to as its "peeping-tom technology".^[75] In support of the motion for injunction, the Pennsylvania chapter of the American Civil Liberties Union (ACLU) sought permission from the plaintiffs to participate in the case. It submitted an amicus brief in support of the student, arguing that the photo amounted to an illegal search.^[86][87] Citing caselaw regarding privacy and unconstitutional searches, the ACLU's brief stated: "While the act of placing the camera inside students’ laptops may not implicate the Fourth Amendment, once the camera is used a search has occurred that, absent a warrant or consent, violates the Fourth Amendment" (see United States v. Karo)."^[88] Witold "Vic" J. Walczak, the ACLU of Pennsylvania Legal Director, said:

No government official, be it police officer or school principal, can enter a private home, physically or electronically, without an invitation or warrant. In this case, the officials are not just entering the foyer, but a child's bedroom. Assuming the allegations are true, this is an egregious invasion of privacy.^[86][89]

U.S. District Court Judge Jan DuBois granted Haltzman's request on February 23, 2010, ordering the district to stop remotely activating the web cameras and taking screenshots from the students' school-issued laptops, and to preserve all relevant electronic data.^[15][17] While remote activation of the webcam was deactivated, the LANrev software was not removed. Untrusting students at the two high schools took to taping over their latops' webcams, even though school officials insisted they had stopped the practice.^[87] In May, after it was revealed that the school had secretly captured tens of thousand of webcam images and screenshots, the judge made the ban on the school's secret webcam monitoring permanent.^[90][90]

In addition, the court issued a gag order, prohibiting district officials from discussing the case with students and parents without first clearing its communications with the plaintiffs' attorney.^{[91][92][93][15]}

The class-action lawsuit seeks class status on the grounds that individual compensation may be small, and therefore multiple parties will need to share in covering the legal fees.^[94] On July 7, 2010, Judge DuBois issued an order granting the district its second extension of time to respond to plaintiffs' request for class action certification.[2]

The judge issued an order in April 2010 granting Haltzman's motion requiring Caliero to let Haltzman make copies of the hard drives of her two personal computers, to determine whether Caliero had used the software to spy on students, and transferred images to her own computers.^[39] The judge issued an order in May, requiring school officials to arrange for 40 high school students and their parents to see the images secretly taken from their laptops.^[90] Judge DuBois in June 2010 ordered the district to share with a consultant for Robbins some of its computer evidence, gathered in an investigation conducted by lawyers and computer experts hired by the defendants.^[68]

The district suggested that Robbins had a loaner laptop, because he had not paid a $55 insurance fee which would have permitted him to use a regular computer. In a 2009 letter to parents, Harriton High School Principal Kline said that "no uninsured laptops are permitted off campus," and said that students who had not paid the insurance fee could use a loaner. Asked if Robbins took a loaner computer home without authorization, Young declined to comment.^[95] Haltzman denied that Robbins was ever notified that his computer use was a problem, and said that Robbins had taken his computer home "every single day" for a month.^[91] He also pointed out that while Robbins was one of about 20 students who had not paid the $55 insurance fee, he was the only one tracked.^[96]

The school district and its insurance company, Graphic Arts Mutual Insurance Company, filed lawsuits against each other in federal court in April 2010 over who should pay any settlements by the district, and the district's related bills.^[97] Graphic Arts asked for a declaratory judgment, so it would not have to pay the district's legal bills in the case.^[97] Ballard Spahr is also representing the district in the insurance litigation.^[97]

The insurance company contended that none of Robbins' claims amounted to "personal injury", as defined and covered in the district's $1 million liability policy.^{[98][99][28][100][59]} The district and the insurance company also accused each other of breaching their contract.^[44]

The district, on Philadelphia's Main Line, is one of Pennsylvania's richest school systems. It had a $193 million budget and spent $21,600 per student in 2008–09, the most in the Philadelphia region.^[59][101]

The district had been billed $953,000 in legal fees by May 2010 by Ballard Spahr's four attorneys.^[59][97] In addition, Level-3 Communications, its computer consultant, had billed the district $240,000 through May 2010 for forensically analyzing the district’s computers, and by June 30 software company SunGard had billed the district $32,000 to help the district revise its policies on school-issued laptops.^[97][3] The District was also paying the aggregate $200,000 salary of its two employes who it had suspended.^[44] If the judge sides fully with the insurance company, the district will also be responsible for paying all of the costs of its litigation with the insurer.[4]

The defendants commissioned a 69-page report, which was prepared by lawyers from Ballard Spahr, the same law firm that the school district had hired to defend it in the Robbins lawsuit.^[68] The defendants' counsel nevertheless entitled their May 3, 2010, report: "Independent Investigation".^[68]

The report cited the district for inconsistent policies, shoddy recordkeeping, misstep after misstep, and "overzealous" use of technology "without any apparent regard for privacy considerations."^[102][17] As to some of the secret surveillance, the report remarked: "the wisdom and propriety of activating image tracking in these circumstances are questionable at best."^[17]

The report said that to the extent that district Board members, its Superintendent (who learned of TheftTrack at a meeting of his Cabinet in 2008), and its principals were aware of TheftTrack's capabilities, they "did not appreciate the potential of that ability to raise serious privacy concerns, and they should have sought more information ... or advice" from the district lawyer.^[17] The report also said that school Board members and school administrators who knew that tracking was in place failed to ask the right questions regarding privacy issues, district lawyers didn't probe the legal considerations of handing out computers, and administrators didn't talk about the ramifications.^[68][17] It noted that Harriton High School Principal Kline, for example, learned about TheftTrack monitoring in September 2008, and said he asked DiMedio whether the district should advise students and parents about it. But he never revisited the subject after DiMedio opined that the district should not because doing so would undermine TheftTrack’s effectiveness.^[17] The report faulted district administrators and staffers for failing to disclose and mismanaging the surveillance system, and for failing to establish strict policies to protect "unsuspecting" students' privacy.^[68]

The report also found that district officials knew that Robbins had taken his laptop home, but still decided to activate the covert surveillance that secretly captured hundreds of webcam photos and screenshots—included pictures of Robbins sleeping and partially undressed, a photo of his father, and images of instant messages and photos of friends with whom Robbins was video-chatting.^[103] After the program was activated on Robbins' computer, one district employee had emailed another: "Now currently online at home".^[103]

The report acknowledged that investigators were unable to find explanations for a number of the tracking activations, and for why the district failed to consider privacy implications.^[34] It noted conflicting accounts from district employees, that there were gaps in data, and said evidence was still being gathered.^[104] The report said the covert cameras were used both for missing computers and for unknown purposes, and that the district left such webcams activated for long periods in cases "in which there was no longer any possible legitimate reason" for capturing images.^[105]

The report indicated that there were 30,564 webcam photos and 27,428 screenshots among the non-deleted images, from those instances in which the school chose to activate the covert webcam snapshot and screenshot feature.^[17] The report indicated that webcam and screenshot images that had been covertly taken were deleted from the district server intermittently from March 2009 on.^[17] Many of the photographs were of students, their family members, and others in their homes and elsewhere.^[17] The secret photos included "a number of photographs of males without shirts, and other content that the individuals appearing in the photographs might consider to be of a similarly personal nature".^[17]

Looking at the information available to it, the report found evidence of TheftTrack being triggered on 177 laptops in the 2008–10 time period.^[17] Approximately half of the time (57%) the school chose only to activate the IP-address-tracking feature, and not to activate the feature that triggered the capture of secret webcam snapshots and screenshots.^[17] Based on the available evidence, the report found that Cafiero activated TheftTrack 3 times on student laptops, and Perbix activated it 161 times.^[17] The report noted that in a number of instances TheftTrack was left on, snapping photos and screenshots, for extended periods of time even when a laptop was not considered missing or stolen.^[17]

In addition, there were 13 activations on student laptops for which investigators were unable to determine who activated TheftTrack. As well as 10 activations from various high school personnel for which investigators were unable to determine why tracking was initiated. Together, they resulted in thousands of photos and screenshots.^[17] Of the 10 unexplained activations, in 7 cases the investigators were unable to recover any images at all from the remaining district record.^[17] It was not only students who had their laptop's covert surveillance mechanism turned on–laptops of six high school teachers also had their surveillance activated. Investigators were unable to determine why the teachers' secret surveillance had been initiated or, in half the cases, who had made the surveillance request.^[17]

The report indicated that investigators had not been able to determine how often the images were viewed by school personnel.^[17] A total of 18 members of the district's systems staff had LANrev administrator permissions at times during the 2008–10 school years, and 16 of them during that period had access to data stored on the LANrev server.^[17] Furthermore, those with access to the photos and screenshots could, and in some circumstances did, forward the photos and screenshots to others.^[17]

The report also criticized the district information systems personnel.^[17] The district's top technology administrator since July 2009, George Frazier, told investigators that he considered the systems department the "Wild West", "because there were few official policies, and no manuals of procedures, and personnel were not regularly evaluated."^[68][106] The report said former informations systems Director DiMedio and her staffers "were not forthcoming" about the tracking technology; DiMedio declined to be interviewed unless the district reimbursed her for the cost of her retaining an attorney, which the district declined to do.^[34][17] DiMedio's lawyer criticized the report for faulting DiMedio's role in the district's use of web cameras.^[34] He criticized the cover-page description of the investigators' work as an "independent" probe, saying: "It was not an independent investigation. What flows from that [report] is a clear attempt to insulate and protect the current [district] board at the expense of the IT [information technology] department and employees like Ginny ... to throw her under the bus."^[34] He said DiMedio never hid the software's tracking features from administrators or board members.^[34] He also noted that DiMedio had been gone for months when the assistant principal confronted Robbins with the photo taken by his laptop webcam in his home.^[34]

The report criticized Perbix for reacting negatively on September 11, 2009, when Frazier told him a teacher had requested that his webcam be disabled, with Perbix writing to Frazier: "teachers should not even be allowed to cover the cameras as they do now ... theft track ... does not record video, only a snapshot every 15 minutes. Is someone afraid that we are spying on them?"^[17] Jason Hilt, district Supervisor of Instructional Technology, when he learned that TheftTrack could be activated without police involvement taped over his camera and shared his concern about remote webcam activation with Frazier and Director of Curriculum Services Steve Barbato.^[17]

The school district did not have any official policies or procedures for the use of TheftTrack. Neither the district's Board, district administrators, school administrators, nor the heads of its IS Department imposed any official restrictions on the use of the software's covert surveillance features.^[17]

In May 2010, Judge DuBois ordered the district to adopt a policy relating to its surveillance through students' laptops.^[107] Months after the suit was filed, the district adopted new policies that now require it to obtain a student's permission before the school activates the monitoring software.^[13][108] The district also now promises never to look at a student's laptop files, unless: a) the laptop has been returned to the school; b) there is "reasonable suspicion" that the student is violating law school rules, or district policies; or c) a student has signed a consent form.^[13][108] Following criticism of the district's training requirements and computer responsibility standards, the district is considering new written policies in those areas as well.^[109] On July 19, 2010, a proposal was introduced at a district meeting to adopt a new written policy banning all laptop webcam surveillance by school officials.^[9]

In opposition to the lawsuit, some parents formed the Lower Merion Parents committee. The parents on the one hand were angry about the school district's secret use of webcams to view students and their friends and families in their homes. On the other hand, however, the parents were concerned that they themselves would have to bear a financial cost in paying for the district's litigation, and possible settlement or court-ordered penalty.^[110]

The group was concerned that the Robbins lawsuit would be costly, attract negative attention to the district while harming its "civic tone" and distracting from its educational mission, and take a long time to resolve. Particular attention was given to the fact that payment for the members of the class in the class action suit would effectively come from the district's taxpayer, if not its insurer. Lower Merion Parents did not, however, oppose a full investigation of the district's technological capabilities and of any abuses the district committed.

On March 2, 2010, more than 100 parents met in Narberth, Pennsylvania, to discuss the issues.^[111][112] Robbins' attorney Mark Haltzman requested an opportunity to speak to the group to update the parents, but was denied.^[113] The meeting focused on whether the parents wanted the Robbins family to represent them, how to lift the court's "gag order" agreement that district officials and school board members not talk about the case without first consulting the Robbinses and their lawyer, and how to learn what actually happened with the laptops and webcams. One option opposing parents have is to file a motion to intervene, which is an agreement to be parties in the case, but with different interests than the plaintiff.^[114] A similar group called Parents in Support of the Lower Merion School District collected over 750 signatures by March 3 in an online petition. Philadelphia Weekly noted that "Paradoxically, this group of Lower Merion parents are going to try to stop the gratuitous litigation by getting more lawyers involved."^[115]

The FBI, U.S. Attorney, and Montgomery County District Attorney all investigated the school district to determine if it had violated any criminal laws. On August 17, 2010, U.S. Attorney Zane David Memeger announced that he would not file charges against officials in the district, because: “We have not found evidence that would establish beyond a reasonable doubt that anyone involved had criminal intent".[5]

The Federal Bureau of Investigation investigated whether federal laws, including wiretap, computer-intrusion, and privacy laws, were violated by school administrators and technology staffers as they monitored the webcam images without alerting the students.^[83][75][78] The FBI and U.S. Attorney's Office said in a joint statement in July 2010: "[The U.S. Attorneys Office] intend[s] to work as a team with the Federal Bureau of Investigation, the Montgomery County District Attorney's Office, Montgomery County detectives, and the Lower Merion Police Department to determine if any crimes were committed".^[86] FBI agents reviewed the school district's computers, thousands of images secretly captured from students' computers, interviewed district employees, and reviewed district records as part of the investigation.^[57][65]

The U.S. Attorney's Office in Philadelphia initiated a probe into the matter, and in February 2010 federal prosecutors issued a grand jury subpoena to the district for documents related to the remote-control cameras, asking for a broad range of records related to the webcams and the security system that district officials used to activate them.^[43][29] The Office took the unusual step of commenting on an ongoing FBI and U.S. Justice Department investigation, with it stating on February 22, 2010, that it would "be involved in the inquiry into allegations that the Lower Merion School District activated webcams on computers issued to students", and quoting U.S. Attorney Michael L. Levy as saying: "The issues raised by these allegations are wide-ranging and involve the meeting of the new world of cyberspace with that of physical space. Our focus will only be on whether anyone committed any crimes."^[30][17]

In April 2010, Levy wrote the judge, that the court's freeze order on dissemination of the photos to individuals not involved in the civil lawsuit “interfered with the government’s obligation to investigate possible criminal conduct occurring within this district”, and asked that the order be modified to allow the prosecutors access to them as well.^[116] The U.S. Attorneys Office was seeking to examine the webcam photos of a number of children, some of which may include nude or partially clothed shots, inasmuch as taking nude images of children is likely criminal conduct.^[116]

The Montgomery County District Attorney and detectives also launched an investigation to see if any criminal laws were broken, including wiretap and privacy laws.^[23][29] District Attorney Risa Vetri Ferman said: "Upon arriving in the office this morning, we were inundated with calls from members of the community asking about this. It became clear to me that we needed to look at this further to see if a criminal investigation is warranted."^[29][75]

Senator Arlen Specter (D-PA) held a hearing of the Senate Judiciary Subcommittee on Crime and Drugs, which he chairs, on March 29, 2010, on the use of student-issued computers to allegedly spy on students in their homes.^[117] Specter said: "The issue is one of surreptitious eavesdropping. Unbeknownst to people, their movements and activities were under surveillance."^[117]

Specter said he believes existing wiretap and video-voyeurism statutes do not adequately address concerns in today's era of widespread use of cell-phone, laptop, and surveillance cameras.^[118] After hearing testimony at the hearing from Blake Robbins and others, Specter said that the testimony and Lower Merion's use of laptop cameras for surveillance had convinced him that new federal legislation was needed to regulate electronic privacy.^{[118][119][120]}

Specter then introduced legislation in April 2010 to amend the federal Wiretap Act to clarify that is is illegal to capture silent visual images inside another person's home. Specter said: "This is going to become law. You have a very significant invasion of privacy with these webcams, as more information is coming to light."^[28][121] Speaking on the floor of the Senate, he said:

Many of us expect to be subject to ... video surveillance when we leave our homes and go out each day—at the ATM, at traffic lights, or in stores, for example. What we do not expect is to be under visual surveillance in our homes, in our bedrooms, and, most especially, we do not expect it for our children in our homes.^[24]

An "LMSD is Watching You" Facebook page was started, and within days had hundreds of members.^[75] At the same time, parody T-shirts were already being sold on the net, including one featuring the ominous red camera eye of HAL 9000 from the science fiction movie 2001: A Space Odyssey, inside the school district's circular logo.^[75]

Both The Philadelphia Inquirer and The New York Times reported that: "With a mop of brown hair and clad in a black T-shirt and jeans, [Blake Robbins] smiled when told the suit had earned him a Wikipedia page."^{[122][123][124]}

The litigation also prompted a "What's Wrong With People?" segment on the Dr. Phil show.^{[28][124][125]} The British news organization The Register reported that: “The U.K. agency in charge of IT in UK schools has insisted there is no chance of the government’s free laptops program exposing the bedroom activities of British students.”[6]

On July 27, 2010, a second high school student, Jalil Hasan, and his mother filed a civil suit for invasion of privacy against the school district. The suit was over the school's surveillance of Jalil at his home, via his school-issued computer, without the high school student's or his parents' knowledge or consent.^[11][13] Hasan was 17 years old at the time.^[126] The suit also named as defendants the district's Board of Directors and Superintendent, as well as Perbix, Charles Gintner (a district IS Department employee), and "John Does 1–5" (district employees who requested, authorized, activated, and viewed the images and/or allowed the surveillance to continue).^[126] Mark Haltzman is also representing the Hasans.^[5]

Lower Merion school administrators had informed the Hasans by letter that the schools had secretly monitored Jalil by the webcam embedded in his school-issued laptop for two months, while he was a senior at Lower Merion High School.^[11][42] The letter was one of 40 that the district sent out to comply with a May 2010 court order by U.S. Chief Magistrate Judge Thomas Rueter. Rueter had ordered the district to send out letters to all relevant high school students indicating the dates of the schools' activations of their webcams, and the number of photographs and screenshots taken by each affected student's computer.^[127][99]

Hasan had misplaced his laptop at his high school on Friday, December 18, 2009. The complaint states that that day a teacher found the laptop, and turned it in to the IS Department, from which Hasan retrieved it on Monday, December 21, 2009.^[126][13] However, the complaint alleges that it is believed that on the day Hasan retrieved the laptop from information systems, Gitner, Perbix, and others covertly activated the TheftTrack surveillance software on Hasan's school-issued laptop.^[126] They allegedly continued to run the surveillance for the nearly two months after returning the laptop to Hasan. They only deactivated the surveillance in the wake of the publicity surrounding the Rollins lawsuit that broke on February 18, 2010.^{[126][128][129][11][13][11][42]}

Over 1,000 images were surreptitiously taken by the district through Hasan's school-issued laptop—consisting of 469 photographs taken via the laptop's webcam and 543 screenshots. They included shots of him in his bedroom in his Ardmore, Pennsylvania, home, and of other family members and friends.^[11][2] The school district did not inform Hasan and his family of this until July 8, 2010, when a lawyer for the district (Hank Hockeimer) notified them of the existence of the photographs.^[13] The complaint said: "In fact, had the Robbins class action lawsuit not been filed, arguably Jalil's laptop would have continued whirring away snapping photographs and grabbing screenshots each time it was powered up.^[126]

The lawsuit was brought on the basis of defendants' invasion of Hasan's privacy without his knowledge or authorization, referring to the same laws cited in the Robbins lawsuit.^[126] It charged the district with:

gross negligence, reckless indifference and wanton abandonment of all responsibility to train, supervise, control, monitor, and discipline the employees of the school district acting in the course and scope of their employment, and with actual or tacit approval of the School District in the activities and behavior of its ... employees which were, by all moral, legal, ethical, and rational standards ... outrageous.^[126]

"When I saw these pictures, it really freaked me out," said Jalil Hasan.^[11] His mother said: "Right now I feel very violated... When I'm looking at these pictures, and I'm looking at these snapshots, I'm feeling, 'Where did I send my child?'"^[5][42]

• "Class Action Complaint", Robbins v. Lower Merion School District, U.S. District Court for the Eastern District of Pennsylvania, February 11, 2010
• "Brief of Amicus Curae American Civil Liberties Union of Pennsylvania Supporting Issuance of Injunction", Robbins v. Lower Merion School District, February 22, 2010, friend of the court brief citing privacy caselaw in favor of Robbins
• "Complaint", Hasan v. Lower Merion School District, U.S. District Court for the Eastern District of Pennsylvania, July 27, 2010
• "Dockets & Filings", Robbins v. Lower Merion School District, Justia.com
• Report Regarding Monitoring of Student Laptop Computers by the Lower Merion School District, Ballard Spahr (LMSD's counsel), May 3, 2010
• "Initial LANrev System Findings", LMSD Redacted Forensic Analysis, L-3 Services – prepared for Ballard Spahr (LMSD's counsel), May 2010
• "The Spy at Harriton High", Stryde Hax, February 21, 2010, detailed technical discussion
• "Laptop Security Updates", LMSD.org
• Michael Perbix of LMSD, discussing the use of LANrev (laptop tracking software)
• Best thing since sliced bread, personal tech blog of Michael Perbix, District Network Technician (administrative leave)
• lmsdparent.org, parents opposed
• "LMSD is Watching You", Facebook page