It's a story that won't go away. Last week, the family of 15-year-old Blake Robbins filed a lawsuit against Lower Merion School District near Philadelphia, alleging that the school district activated the Webcam in the student's school-issued MacBook to photograph him in his own home. The school district admitted that it did have the capacity to remotely turn on Webcams and said that it did so 42 times in the past 14 months, but only to "locate a laptop in the event it was reported lost, missing or stolen so that the laptop could be returned to the student."
In a civil complaint (PDF), the Robbins family claims that an assistant principal at the district's Harriton High School accused young Blake of using drugs and cited as evidence a photograph of him taken in his own home via the Mac Webcam. Blake said that the "pills" he was accused of taking were Mike and Ike candies.
Subsequent to all of the hubbub over the case, the district pledged to stop activating the cameras even in the event of a suspected theft and that decision was reinforced on Monday when a federal judge ordered the school to stop activating the cameras. The judge also ordered them to stop taking screenshots from the computers and to preserve all data on the computers pertaining to the alleged Webcam photos. The judge didn't issue an injunction because the school district consented to the ruling.
Software used to activate Webcams no longer available
The software used on these Macs was a product called LANRev published by Pole Position Software. LANRev is a remote management tool that enables administrators to manage laptops including making sure that software is up-to-date and that they are working properly. The software can also be used to take screen shots, track web activity or any other activity that the user does and to activate the built-in Webcam.
Pole Position was acquired last year by Absolute Software, maker of the consumer product LoJack for Laptops and Computrace which is sold to enterprise customers including school districts. In an interview, Absolute's Vice President for Global Marketing Stephen Midgley, said that the company has renamed LANRev and it is no longer positioning it as a theft recovery tool. Instead it is migrating institutional customers to Computrace. Unlike LANRev, customers themselves can't go in and track a computer. If a computer is missing they must first file a police report and then Absolute technicians will conduct a trace using IP address and GPS. Midgley said that the company no longer does Webcam activation because it's not that good a forensic technique. "The photography doesn't always take a picture of the criminal, and it's not always permissible in a court of law," he said. He said that by the time a laptop is reported stolen it is probably being used by someone other than the thief so having a picture of the person using the machine is of little value to investigators.
School tech talks about "curtain mode"
There is a new twist to the case. The local Philadelphia Fox TV affiliate WTFX uncovered a video clip of a 2008 Webcast that featured Mike Perbix, an employee of the Lower Merion School district talking about how he was able to configure LANRev to go into "curtain mode" to surreptitiously peer into remote machines. In the Webcast, Perbix said "You can go into curtain mode, so if you're controlling someone's machine and you don't want them to see what you're doing you just click on the curtain mode icon...you can take a snapshot of the screen by clicking on the little camera icon." He also told about a time when they "actually had some laptops we thought were stolen which actually were still in a classroom because they were misplaced, and by the time we found out that they were back I had to turn the tracking off and I had a good 20 snapshots of the teacher and the students using the machines in the classroom." When I checked on Tuesday, Perbix was listed as a Network Tech in the staff directory on the school's Website but his name is no longer listed. I wouldn't be surprised if that's because he was getting overwhelmed with calls and emails.
The U.S. Attorney's Office and the FBI on Monday said that they are investigating whether the district violated federal privacy laws.