Robbins v. Lower Merion School District

Robbins v. Lower Merion School District
Court	U.S. District Court for the Eastern District of Pennsylvania
Full case name	Blake J. Robbins, Michael E. Robbins and Holly S. Robbins, individually, and on behalf of all similarly situated persons v. Lower Merion School District, the Board of Directors of the Lower Merion School District, and Christopher W. McGinley, Superintendent of Lower Merion School District
Decided	Settled October 2010 ($610,000)
Docket nos.	10-cv-0665
Case history
Related action	Hasan v. Lower Merion School District (filed July 27, 2010)
Court membership
Judges sitting	Senior U.S. District Judge Jan E. DuBois

Robbins v. Lower Merion School District is a federal class action lawsuit, brought during February 2010 on behalf of students of two high schools in Lower Merion Township, a suburb of Philadelphia. In October 2010, the school district agreed to pay $610,000 to settle the Robbins and parallel Hasan lawsuits against it.

The suit alleged that, in what was dubbed the "WebcamGate" scandal, the schools secretly spied on the students while they were in the privacy of their homes. School authorities surreptitiously and remotely activated webcams embedded in school-issued laptops the students were using at home. After the suit was brought, the school district, of which the two high schools are part, revealed that it had secretly taken more than 66,000 images. The suit charged that in doing so the district infringed on its students' privacy rights. A federal judge issued a preliminary injunction, ordering the school district to stop its secret webcam monitoring, and ordered the district to pay the plaintiffs' attorney fees.

The lawsuit was filed after 15-year-old high school sophomore (second year student) Blake Robbins was disciplined at school for his behavior in his bedroom. The school based its decision to discipline Robbins on a photograph that had been secretly taken of him in his bedroom, via the webcam in his school-issued laptop. Without telling its students, the schools remotely accessed their school-issued laptops to secretly take pictures of students in their own homes, their chat logs, and records of the websites they visited. The school then transmitted the images to servers at the school, where school authorities reviewed them and shared the snapshots with others. In one widely published photo, the school had photographed Robbins in his bed. The Federal Bureau of Investigation (FBI), U.S. Attorney's Office, and Montgomery County District Attorney all initiated criminal investigations of the matter, which they combined and then closed because they did not find evidence "that would establish beyond a reasonable doubt that anyone involved had criminal intent". In addition, a U.S. Senate Judiciary subcommittee held hearings on the issues raised by the schools' secret surveillance, and Senator Arlen Specter introduced draft legislation in the Senate to protect against it in the future. Parents, media, and academics criticized the schools, and the matter was cited as a cautionary example of how modern technology can be used to infringe on personal privacy.

In July 2010, another student, Jalil Hasan, filed a parallel second suit. It related to 1,000+ images that the school took surreptitiously via his computer over a two-month period, including shots of him in his bedroom. The district had deactivated its surveillance of the student in February 2010, after the Robbins lawsuit was filed. Five months later—pursuant to a court order in the Robbins case—it informed Hasan for the first time that it had secretly taken the photographs. The district was put on notice of a third parallel suit that a third student intended to bring against the district, for "improper surveillance of the Lower Merion High School student on his school issued laptop", which included taking over 700 webcam shots and screenshots between December 2009 and February 2010.

Complaint

The lawsuit Robbins v. Lower Merion School District was filed on February 11, 2010, in the U.S. District Court for the Eastern District of Pennsylvania, by plaintiffs' lead lawyer, Mark S. Haltzman of Silverang, Donohoe, Rosenzweig & Haltzman LLC. It was filed on behalf of Blake J. Robbins, and other high school students from the school district, by Robbins' parents.

The complaint alleged that after the high schools issued MacBook laptops with built-in iSight webcams to the students, school staff remotely activated the laptops' webcams covertly while the students were off school property, thereby invading the students' privacy. The plaintiffs said they had not consented to the spying.

The defendants were the Lower Merion School District (LMSD) in Pennsylvania (of which the two high schools are part), its nine-member Board of Directors, and its Superintendent (Christopher McGinley). Henry E. Hockeimer, Jr., of Ballard Spahr LLP was lead counsel for the defendants.

Laptops with covert cameras

Program

Lower Merion High School

At the beginning of the 2009–10 school year, the school district issued individual Apple MacBook laptop computers to each of its 2,306 high school students. The laptops were for both in-school and at-home use.

It was part of the school district's One-to-One initiative. The program was piloted in September 2008 at Harriton High School and expanded in September 2009 to Lower Merion High School. It cost $2.6 million, less than a third of which was covered by grants.

Covert surveillance capability

The school loaded each student's computer with LANrev's remote activation and tracking software. This included the now-discontinued "TheftTrack". While TheftTrack was not enabled by default on the software, the program allowed the school district to elect to activate it, and to enable whichever of TheftTrack's surveillance options the school desired.

The school elected to enable TheftTrack to allow school district employees to secretly and remotely activate the standard webcam featured in all Apple laptops since 2006. That allowed school officials to secretly take photographs through the webcam, of whatever was in front of it and in its line of sight, and send the photographs to the school's server. The system took and sent a new photograph every 15 minutes when the laptop was on, and TheftTrack was activated, though school employees could adjust the timeframe to as low as one-minute intervals. LANrev disabled the webcams for all other uses (e.g., students were unable to use Photo Booth or video chat), so most students mistakenly believed that their webcams did not work at all.

In addition, TheftTrack allowed school officials to take screenshots, and send them to the school's server. Furthermore, a locating device would record the laptop's Internet (IP) address, enabling district technicians to discover which city the laptop was located in and its Internet service provider, though a subpoena to the provider would be required to pinpoint the exact location. In addition, LANrev allowed school officials to take snapshots of instant messages, web browsing, music playlists, and written compositions.

After sending the image to the school's server, the laptop was programmed to erase the "sent" file created on the laptop. That way, there would not be any trace by which students might realize that they were being watched and photographed. The forwarded photos, screenshots, and IP addresses were stored on the school's server, until they were purged by a school employee. It is not clear who in the schools had access to the photos and other images. Further, LANrev could be programmed to capture webcam pictures and screen captures automatically, and store them on the laptop's hard disk for later retrieval in areas of the computer's storage that were not accessible by the student, and which could be deleted remotely.

Fred Cate, Director of the Center for Applied Cybersecurity Research at Indiana University, said: "This is the classic definition of spyware. It's as bad as you can imagine." Eileen Lake of Wynnewood, whose three children attend district schools, said: "If there's a concern that laptops are misplaced or stolen, they should install a chip to locate them instead. There shouldn't be a reason to use webcams for that purpose." Marc Rotenberg, Georgetown University Law School information privacy professor and President and executive director of the Electronic Privacy Information Center (EPIC), said: "There are less intrusive ways to track stolen laptops, no question about it."

Purchase

The type of MacBook involved

Commenting on the now-discontinued TheftTrack, Carol Cafiero (school district Information Systems Coordinator, and supervisor of 16 technicians and administrative assistants) wrote to her boss Virginia DiMedio (district Director of Technology for a number of years, until June 2009, and a member of the district Superintendent's five-person Cabinet) that district Network Technician Mike Perbix "loves it, and I agree it is a great product". Perbix also raved about the spying capabilities of TheftTrack in a May 2008 LANrev promotional webcast, saying he "really, really" liked it.

DiMedio considered Perbix and Cafiero's recommendations that the district purchase the software, including a memo in which Cafiero noted that "we can mark [a student's laptop as] stolen on the LANrev server, and then the laptop will take screenshots and pictures of the user with the built-in camera, and transmit that information back to our server." DiMedio then approved the purchase and installation of the $156,000 surveillance software.

Concealment of surveillance

The school district intentionally did not publicize the existence of the surveillance technology. It also actively sought to conceal it.

The district did not inform students or their parents, in any of its communications with them (including the district's promotion of the laptop program, guidelines about the laptops, and the individual contracts that it gave students to sign), that the laptops gave the district the ability to secretly take photographs of whatever was in the line of sight of the student-issued laptop webcams, and to take screenshots; nor did it inform them that the district would avail itself of those capabilities. The district also did not adopt policies regarding the use of TheftTrack by district employees.

DiMedio said "the district did not widely publicize the feature 'for obvious reasons'". She reportedly declined to tell students about TheftTrack because doing so could "defeat its purpose".

Perbix said that when "you're controlling someone's machine, you don't want them to know what you're doing". He praised TheftTrack in a YouTube video he produced, saying: "It's ... just a fantastic feature ... especially when you're in a school environment". Perbix maintained a personal blog in which he discussed computer oversight techniques, including how to cloak remote monitoring so it is invisible to the user.

Concerns raised by student intern

On August 11, 2008, weeks before the district handed the laptops out to students, a Harriton High School student interning in the school's IT Department sent an email to DiMedio, with the subject line: "1:1 concern (Important)". He said that he had recently learned of the district's purchase of LANrev, and had researched the software. He had made the "somewhat startling" discovery that it would allow school employees to monitor students' laptops remotely. He wrote:

I would not find this a problem if students were informed that this was possible, for privacy's sake. However, what was appalling was that not only did the District not inform parents and students of this fact ... [W]hile you may feel that you can say that this access will not be abused, I feel that this is not enough to ensure the integrity of students, and that even if it was no one would have any way of knowing (especially end-users). I feel it would be best that students and parents are informed of this before they receive their computers. ... I could see not informing parents and students of this fact causing a huge uproar.

DiMedio responded:

[T]here is absolutely no way that the District Tech people are going to monitor students at home. ... If we were going to monitor student use at home, we would have stated so. Think about it—why would we do that? There is no purpose. We are not a police state. ... There is no way that I would approve or advocate for the monitoring of students at home. I suggest you take a breath and relax.

DiMedio then forwarded the e-mails to District Network Technician Perbix, who suggested a further response to the student intern. With DiMedio's approval, Perbix e-mailed the student intern, also dismissing the student's concern:

[T]his feature is only used to track equipment ... reported as stolen or missing. The only information that this feature captures is IP and DNS info from the network it is connected to, and occasional screen/camera shots of the computer being operated. ... The tracking feature does NOT do things like record web browsing, chatting, email, or any other type of "spyware" features that you might be thinking of. Being a student intern with us means that you are privy to some things that others rarely get to see, and some things that might even work against us. I assure you that we in no way, shape, or form employ any Big Brother tactics, ESPECIALLY with computers off the network.

Principal Kline

In addition, two members of the Harriton High School student council twice privately confronted their Principal, Steven Kline, more than a year prior to the suit. They were concerned "that the school could covertly photograph students using the laptops' cameras". Students were particularly troubled by the momentary flickering of their webcams' green activation lights, which several students reported would periodically turn on when the camera was not in use, signaling that the webcam had been turned on. Student Katerina Perech recalled: "It was just really creepy." Some school officials reportedly denied that it was anything other than a technical glitch, and offered to have the laptops examined if students were concerned. Kline admitted the school could covertly photograph students using the laptops' cameras. The students told him they were worried about privacy rights, asked whether the school system read the saved files on their computers, and suggested that at minimum the student body should be warned formally of possible surveillance. No such action was taken.

Robbins lawsuit

Covert surveillance

On October 20, 2009, school district officials knew Blake J. Robbins, a sophomore at Harriton High School, was in possession of his laptop and had taken it home. On that day, they nevertheless decided to begin capturing webcam photos and screenshots from his school-issued MacBook, by activating its camera covertly. Building-Level Technician Kyle O'Brien testified later, at his deposition, that Harriton High School Assistant Vice Principal Lindy Matsko directed O'Brien to activate the tracking. O'Brien complied, by e-mailing District Network Technician Perbix, and directing him to initiate the TheftTrack. At her deposition, Matsko denied authorizing the tracking.

Two hours later on October 20, Perbix e-mailed O'Brien to let him know that TheftTrack was running on Robbins' computer, and that Perbix had determined Robbins' location. Perbix wrote: "Now currently online at home." The next day, Perbix asked O'Brien whether he should continue tracking the laptop, and O'Brien responded "yes".

Over the next 15 days, the school district captured at least 210 webcam photos and 218 screenshots. They included photos inside his home of Robbins sleeping and of him partially undressed, as well as photos of his father. The district also snapped images of Robbins' instant messages and video chats with his friends, and sent them to its servers. Those 429 images, however, only reflected the number of images later recovered—during the ensuing litigation the district conceded it had been unable to recover a week's worth of images that it had taken.

On October 26, Perbix observed one of the screenshots of Robbins, taken in his bedroom. Four days later Perbix showed it to his boss, district Director of Information Systems George Frazier. After discussing it with Frazier, Perbix shared the images captured from Robbins' webcam and screenshots with Harriton High School Principal Kline and with Matsko. In early November, a number of Harriton High School administrators, including Kline, Matsko, and Assistant Principal Lauren Marcuson, met to discuss the images. According to Matsko, Kline advised her that unless there was additional evidence giving them a contextual basis for doing so, they should not discuss the images with Robbins or his parents, because they involved off-school-campus activities. However, Matsko ultimately decided to discuss certain images with Robbins or his parents.

Matsko called Robbins into her office on November 11, 2009. She showed him a photograph taken with the webcam embedded in his school-issued laptop, as he was in his bedroom in his Penn Valley home. Matsko indicated that she thought it was "proof", and initially disciplined him for "improper behavior" (drug use and sales). His parents were contacted, and they told school officials that the officials were mistaken. Ultimately, Robbins was not disciplined.

Robbins said that Matsko told him that the district was able to activate the webcam embedded in a student's laptop remotely at any time, and view and copy whatever image was visible—without the knowledge or consent of anyone in the webcam's line of sight. After a district counselor told them that an account of the incident had been placed in Robbins' personal school file, however, the family decided to bring suit.

Complaint

The plaintiffs alleged that:

many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, including ... various stages of dress or undress.

In a widely published photograph, Robbins was shown sleeping in his bed. The hundreds of photos taken of the 15-year-old also included him standing shirtless after getting out of the shower, as well as photos of his father and friends. Not included in what was turned over to the family was one week's worth of images that the school district said it had not been able to recover.

The lawsuit claimed that the district's use of the webcams violated the United States Constitution's guarantees of privacy of the students and their families and friends at home, as well as Pennsylvania common law (expectation of privacy) and Section 1983 of the U.S. Civil Rights Act (right to privacy).

It also accused officials of spying through "indiscriminate use of an ability to remotely activate the webcams incorporated into each laptop", and thereby violating the Fourth Amendment of the Constitution (right to privacy) and a number of electronic communications laws: the U.S. Electronic Communications Privacy Act (ECPA; intentional intercepts of electronic communications), the Computer Fraud and Abuse Act (CFAA; intentional access of a computer that exceeds authorization to obtain information), the Stored Communications Act (SCA; unauthorized acquisition of stored electronic communications), and the Pennsylvania Wiretapping and Electronic Surveillance Act (PWESA; intentional intercept of electronic communications).

Initial response

School district spokesman Doug Young announced on February 19 that the school district intended to contest the lawsuit. Henry E. Hockeimer, Jr., and four Ballard Spahr attorneys represented the district.

On February 18, 2010, the day the case was made public, the school district posted an initial reply on its website asserting that: "The tracking-security feature was limited to taking a still image of the operator and the operator's screen", and that it "has only been used for the limited purpose of locating a lost, stolen, or missing laptop." On 19 February the district said in a further statement to parents that "this includes tracking down a loaner computer that, against regulations, might be taken off campus." The complaint had not indicated whether Robbins' laptop had been reported lost or stolen, and Young said the district could not disclose that fact. Young asserted that the district never violated its policy of only using the remote-activation software to find missing laptops.

That same day, the district turned off TheftTrack on tracked laptops, and deleted pictures from LANrev, as noted on the 16th page of a subsequent forensics review. The district also denied that the school administrator had ever used a photo taken by a school-issued laptop to discipline a student. The vice principal reiterated the statement in a video distributed to national media on February 24, 2010.

On February 20, 2010, Haltzman, Robbins' counsel, told MSNBC Live that Robbins had been sitting in his home eating "Mike and Ike" candy in front of his school-issued laptop. The attorney said that the vice-principal had accused Robbins of taking illegal pills after seeing him eating the candy in a webcam image. Michael Smerconish, a Philadelphia Inquirer columnist who reviewed the photo, said that it did in fact appear to be the same size and shape as Mike and Ike candy. Haltzman said that his client's laptop had not been reported stolen or lost. The lawyer also raised questions as to who in the school system decided when to activate each student's webcam, and for what reasons.

In a statement to the press on February 24, 2010, Robbins emphasized that the case was about the undisclosed spying capabilities which the district covertly maintained.

Admissions, and further instances

The school district later admitted to "serious mistakes" and "misguided actions". It also acknowledged that its monitoring system was flawed, and was "not handled appropriately". The district's Superintendent admitted that students and parents were not informed of the secret spying feature, and the district said that "notice should have been given" to the students and parents, and that the district's failure to do so "was a significant mistake". School Board President David Ebby said: "It's a big, big horrible error in judgment."

The school district eventually acknowledged that it had taken more than half the images after missing laptops were recovered. A computer forensics study commissioned by the defendants recovered 66,503 images produced by LANrev, though it was not able to recover all that had been deleted by district employees. The district asserted that it did not have any evidence that individual students had been specifically targeted. Haltzman said: "I wish the school district [had] come clean earlier, as soon as they had this information ... not waiting until something was filed in court revealing the extent of the spying".

Christopher Null, technology writer for Yahoo! News, observed: "It's a little difficult to believe that none of the material captured is scandalous".

The district also admitted that in Robbins' case the remote surveillance was activated and left running for two weeks, even though school officials knew the laptop was at Robbins' home. It also admitted that its technology staff activated the camera on his computer, and gave images it covertly took to two Harriton High School principals.

Six days after the initiation of the lawsuit, and after a district review of its privacy policies, the school district disabled its ability to activate students' webcams remotely. Lillie Coney of the Electronic Privacy Information Center said: "If they thought it was right, they wouldn't have stopped."

On February 24, the district suspended and put on paid administrative leave its two staffers who were authorized to activate the remote monitoring, district 12-year veterans Information Systems Coordinator Cafiero and Network Technician Perbix. The district indicated that it had done so as a precautionary measure, in light of their roles in activating TheftTrack, and the ensuing investigation.

In a motion seeking to examine Cafiero's computer, excerpts of emails between her and Amanda Wuest, District Desktop Technician, about the surreptitious webcams were cited in which the technician emailed Cafiero: "This is awesome. It's like a little LMSD soap opera", and Cafiero replied, "I know, I love it". Her lawyer, Charles Mandracchia of the law firm Mandracchia & McWhirk LLC, said she had only turned the webcam system on when requested to do so by school officials.

When Haltzman sought to depose Cafiero, she fought his effort to ask her questions at a deposition. However, U.S. District Judge Jan DuBois refused to quash Haltzman's subpoena, ruling in April 2010 that Cafiero may have information relevant to the case. In her first deposition, Cafiero declined to answer questions, citing her Fifth Amendment right against self-incrimination. However, after she was interviewed by the FBI in April 2010, in a later deposition she answered questions under oath. Others deposed included Matsko, Perbix, and O'Brien.

In June and July 2010, in accordance with an order from the federal judge, dozens of other high school students were notified by counsel for the schools that they too had been secretly photographed by school authorities via their webcams. The school district said that more than 58,000 photos had been taken from November 2008 through February 2010 and recovered on school servers, but that the exact number was not known as a number of the photos had been deleted by the district. The students and their parents were invited to privately review the photos that had been taken, and a federal judge oversaw the review process. In about 15 cases, the school said it had no answer as to who ordered the surreptitious webcam activation, or why.

Student reactions

Tom Halpern, a 15-year-old sophomore who attends the high school, told CBS News, "Everybody's pretty disgusted. ... I think it's pretty despicable." Many students said they mostly used their laptops in their bedrooms, and rarely turned them off. Karen Gotlieb, whose daughter attends the school, said, "I just received an e-mail from my daughter, who is very upset, saying, 'Mom, I have my laptop open in my room all the time, even when I'm changing.'" Savanna Williams, a sophomore at Harriton, said she always kept her computer open, its webcam exposed, when she was changing in her bedroom, and in the bathroom when she was taking a shower. She said: "I was like, 'Mom, I have this open all the time. ... This is disturbing.'" Her mother said: "the possibility of this being true is a complete violation of her privacy, of our entire home—not just Savanna. They have the option to watch [me], my husband, my other child. They violated our trust."

Another mother, Candace Chacona, said she was "flabbergasted" by the allegations: "My first thought was that my daughter has her computer open almost around the clock in her bedroom. Has she been spied on?" Chuck Barsh, an insurance broker whose son is in high school, called the district's actions a "gross invasion" of student privacy, and supported the lawsuit, saying: "These people were able to look at our kids in our house". Mike Salmonson, father of an elementary school student, said the matter was "part of ... institutional arrogance—a lack of full disclosure and honesty" on the part of district administrators.

Reactions of legal experts and computer experts

Harvard Law School Professor John Palfrey

John Palfrey, Harvard Law School professor and Vice Dean, and co-director of the Berkman Center for Internet & Society cyberspace research center, said: "If the facts are as they appear to be in the claims by the student, it's shocking." David Kairys, a Temple University Law School professor who specializes in civil rights and constitutional law and is author of Philadelphia Freedom: Memoir of a Civil Rights Lawyer, described the school district's policy as "Orwellian". He said that it appeared to be a "very clear civil-rights violation", continuing: "It's pretty outrageous. It's sort of beyond belief that they wouldn't say, 'This is going too far.'" Susan Friewald, University of San Francisco Law School professor and expert in electronic privacy law, said: "they had to get consent to take photos ... [I]f the school districts are going to use [laptops] to spy on students, we should certainly be concerned."

Witold "Vic" Walczak, the Legal Director of the Pennsylvania chapter of the American Civil Liberties Union (not a party in the lawsuit), commented:

This is an age where kids explore their sexuality, so there's a lot of that going on in the room. This is fodder for child porn.

Joseph Daly, who retired in 2009 as Lower Merion Police Superintendent, when told about the pictures taken from students' laptops, said: "That's illegal as hell."

Lillie Coney, associate director of the Electronic Privacy Information Center (a civil liberties public interest research center), said: "This definitely was not ... a rational thing for the school to be engaged in", and called it "an outrageous invasion of individual privacy". Ari Schwartz, Vice President and COO at the Center for Democracy and Technology (a civil liberties public interest organization), said: "What about the [potential] abuse of power from higher-ups, trying to find out more information about the head of the PTA [Parent-Teacher Association]? If you don't think about the privacy and security consequences of using this kind of technology, you run into problems."

Kevin Bankston, senior staff attorney specializing in privacy law with the Electronic Frontier Foundation (an international digital rights advocacy and legal organization), said: "I've never heard of anything this egregious. Nobody would have imagined that schools would peer into students' private homes, and even bedrooms, without any kind of justification." He continued: "This is utterly shocking, and a blatant violation of [the students' Fourth Amendment] constitutional rights. The school district would have no more right to [use the laptop's webcam] than to install secret listening devices in the textbooks that they issued students." He suggested that students tape over the lens of their laptop's camera. Parry Aftab, an Internet privacy lawyer and executive director of WiredSafety.org, said the district committed a clear violation of several laws including the Fourth Amendment.

Dan Tynan, Executive Editor of PC World and author of Computer Privacy Annoyances (2005), said: "This is extremely creepy, and way beyond the purview of the school. ... There's really no need to try to take a picture of someone—in fact, how can you prove the person in front of the laptop was the one who stole it? ... And to install this stuff on anyone's computer and not notify them about, it is just begging for a world of pain." Robert Richardson, Director of the Computer Security Institute, said: "It's incredible that they didn't realize they were playing with fire." Technology journalist Robert X. Cringely wrote in InfoWorld:

Is there any reason why you'd need to take two weeks' worth of photos to locate a missing laptop, especially when you already have other ways of tracking it? I don't think so. ... Cafiero issued ... the rather interesting statement that the 15-year-old Robbins had "no reasonable expectation of privacy" in his own home, because ... his family hadn't paid the $55 insurance fee required by the school for home loaners. In other words: If you don't pay your dues, we can watch you while you sleep. Did I say "creepy" already?

LANrev, the manufacturer of the software—which was acquired by Absolute Software, and rebranded as "Absolute Manage" in February 2010—denounced the use of its software for any illegal purpose, emphasized that theft recovery should be left to law enforcement professionals, and criticized vigilantism. The company denied any knowledge of, or complicity in, either Perbix's or the district's actions. Absolute Software then permanently disabled TheftTrack in its next LANrev update.

Media reactions

The Philadelphia Inquirer columnist Monica Yant Kinney wrote:

School district techies peering into private homes, even for a moment, under the guise of locating a lost laptop? Even in this "surveillance society", it's almost beyond comprehension.

The newspaper, in an editorial, called the school's decision to use the remote camera feature "misguided", and wrote "families had every right to be shocked. As an anti-theft strategy, the webcam tracking was overkill—and not even as useful as other means. Then failing to disclose the webcam use was a huge gaffe, compounded by a lack of policies safeguarding students' privacy." Talk radio host and The Philadelphia Inquirer columnist Michael Smerconish added:

[M]ost shocking were the [images] showing the faces or ... postings of [classmates, friends, family members, and parents] with whom Robbins was communicating. What gave Lower Merion the right to invade the privacy of these people? Their images represent a gross violation of privacy, akin to listening in on a private telephone communication between two individuals, at least one of whom has absolutely no idea of the presence of an interloper. That's the real outrage ... it was inexcusable for the school district to invade the privacy of third parties en route to violating that of Blake Robbins.

The Pittsburgh Post-Gazette wrote in an editorial: "Schools have no business or jurisdiction in the homes of students. The ... District ... should never have been in the business of surveillance in the first place. Tough laws are needed to prevent Lower Merion or other school districts from going down this path again." The New York Times, in an editorial, said: "Conducting video surveillance of students in their homes is an enormous invasion of their privacy. If the district was really worried about losing the laptops, it could have used GPS devices to track their whereabouts ... Whatever it did, the school had a responsibility to inform students that if they accepted the laptops, they would also accept monitoring."

Technology writer Dan Gillmor, writing in Salon, said: "The case also reminds us that civil lawsuits play a vital role in our society. ... sometimes, as in this case, they are the last line of defense when powerful institutions beat up on individuals. We forget that at our peril."

Motions; injunction and legal fees granted

Haltzman filed an emergency motion seeking an injunction to prevent the school district from reactivating what he referred to as its "peeping-tom technology". The Pennsylvania chapter of the American Civil Liberties Union (ACLU) submitted an amicus brief in support of the student, arguing that the photo amounted to an illegal search. Citing case law regarding privacy and unconstitutional searches, the ACLU's brief stated: "While the act of placing the camera inside students' laptops may not implicate the Fourth Amendment, once the camera is used a search has occurred that, absent a warrant or consent, violates the Fourth Amendment (see United States v. Karo)." Witold "Vic" J. Walczak, the ACLU of Pennsylvania Legal Director, said:

No government official, be it police officer or school principal, can enter a private home, physically or electronically, without an invitation or warrant. In this case, the officials are not just entering the foyer, but a child's bedroom. Assuming the allegations are true, this is an egregious invasion of privacy.

U.S. District Court Judge Jan DuBois granted Haltzman's request on February 23, 2010, ordering the district to stop remotely activating the web cameras and taking screenshots from the students' school-issued laptops, and to preserve all relevant electronic data. While remote activation of the webcam was deactivated, the LANrev software was not removed. Untrusting students at the two high schools took to taping over their laptops' webcams, even though school officials insisted they had stopped the practice. In May, after it was revealed that the school had secretly captured tens of thousands of webcam images and screenshots, the judge made the ban on the school's secret webcam monitoring permanent.

In addition, the court issued a gag order, prohibiting district officials from discussing the case with students and parents without first clearing their communications with the plaintiffs' attorney.

The class-action lawsuit sought class status on the grounds that individual compensation may be small, and therefore multiple parties would need to share in covering the legal fees. On July 7, 2010, Judge DuBois issued an order granting the district its second extension of time to respond to plaintiffs' request for class action certification.

The judge issued an order in April 2010 granting Haltzman's motion requiring Cafiero to let Haltzman make copies of the hard drives of her two personal computers, to determine whether Cafiero had used the software to spy on students, and transferred images to her own computers. The judge issued an order in May, requiring school officials to arrange for 40 high school students and their parents to see the images taken secretly from their laptops. Judge DuBois in June 2010 ordered the district to share with a consultant for Robbins some of its computer evidence, gathered in an investigation performed by lawyers and computer experts hired by the defendants.

The district suggested that Robbins had a 'loaner' laptop, because he had not paid a $55 insurance fee which would have permitted him to use a regular computer. In a 2009 letter to parents, Harriton High School Principal Kline said that "no uninsured laptops are permitted off campus", and said that students who had not paid the insurance fee could use a loaner. Asked if Robbins took a loaner computer home without authorization, Young refused to comment. Haltzman denied that Robbins was ever notified that his computer use was a problem, and said that Robbins had taken his computer home "every single day" for a month. He also pointed out that while Robbins was one of about 20 students who had not paid the $55 insurance fee, he was the only one tracked.

On August 31, 2010, Judge DuBois ordered the school district, as the losing party, to pay plaintiffs' attorney his legal fees related to his bringing the action that resulted in the preliminary injunction against the school district's secret webcam monitoring, inasmuch as plaintiffs were the successful "prevailing party" in a civil rights case.

School district litigation with its insurance company

The school district and its insurance company, Graphic Arts Mutual Insurance Company, filed federal lawsuits against each other in April 2010. They argued over who should pay any settlements by the district, and the district's related bills. Ballard Spahr also represented the district in the insurance litigation.

Graphic Arts asked for a declaratory judgment, so it would not have to pay the district's legal bills. The insurance company contended that none of Robbins' claims amounted to "personal injury", as defined and covered in the district's $1 million liability policy. The district and the insurance company also accused each other of breaching their contract.

The district, on Philadelphia's Main Line, is one of Pennsylvania's richest school systems. It had a $193 million budget and spent $21,600 per student in 2008–09, the most in the Philadelphia region.

The district had been billed $953,000 in legal fees by May 2010 by Ballard Spahr's four attorneys. In addition, L-3 Communications, its computer consultant, had billed the district $240,000 through May 2010 for forensically analyzing the district's computers. Furthermore, by June 30, software company SunGard had billed the district $32,000 to help it revise its policies on school-issued laptops. The district was also paying the aggregate $200,000 salary of its two employees whom it had suspended. If the judge were to side fully with the insurance company, the district would have also been responsible for paying all of the costs of its litigation with the insurer.

Ultimately, the insurance company agreed to cover $1.2 million of the district's costs.

Defendants' report

Conclusions

The defendants commissioned a 69-page report, which was prepared by lawyers from Ballard Spahr, the same law company that the school district had hired to defend it in the Robbins lawsuit. The defendants' counsel nevertheless entitled their May 3, 2010, report: "Independent Investigation".

The report cited the district for inconsistent policies, shoddy recordkeeping, misstep after misstep, and "overzealous" use of technology "without any apparent regard for privacy considerations". As to some of the secret surveillance, the report remarked: "the wisdom and propriety of activating image tracking in these circumstances are questionable at best."

The report said that to the extent that district Board members, its Superintendent (who learned of TheftTrack at a meeting of his Cabinet in 2008), and its principals were aware of TheftTrack's capabilities, they "did not appreciate the potential of that ability to raise serious privacy concerns, and they should have sought more information ... or advice" from the district lawyer. The report also said that school Board members and school administrators who knew that tracking was in place failed to ask the right questions regarding privacy issues, district lawyers did not probe the legal considerations of handing out computers, and administrators did not talk about the ramifications. It noted that Harriton High School Principal Kline, for example, learned about TheftTrack monitoring in September 2008, and said he asked DiMedio whether the district should advise students and parents about it. But he never revisited the subject after DiMedio opined that the district should not because doing so would undermine TheftTrack's effectiveness. The report faulted district administrators and staffers for failing to disclose and mismanaging the surveillance system, and for failing to establish strict policies to protect "unsuspecting" students' privacy.

The report also found that district officials knew that Robbins had taken his laptop home, but still decided to activate the covert surveillance that secretly captured hundreds of webcam photos and screenshots—included pictures of Robbins sleeping and partially undressed, a photo of his father, and images of instant messages and photos of friends with whom Robbins was video-chatting. After the program was activated on Robbins' computer, one district employee had emailed another: "Now currently online at home".

The report acknowledged that investigators were unable to find explanations for a number of the tracking activations, and for why the district failed to consider privacy implications. It noted conflicting accounts from district employees, that there were gaps in data, and said evidence was still being gathered. The report said the covert cameras were used both for missing computers and for unknown purposes, and that the district left such webcams activated for long periods in cases "in which there was no longer any possible legitimate reason" for capturing images.

Images recovered

The report attached an L-3 computer forensics study indicating it had recovered 66,503 images produced by LANrev from those instances in which the school chose to activate the covert webcam snapshot and screenshot feature, though the investigators were not able to recover all images as a number had been deleted by district employees. Of those images that were recovered, the report indicated that 30,564 webcam photos and 27,428 screenshots were recovered from the LANrev server itself. The report noted that images that had been taken covertly were deleted from the district server intermittently from March 2009 on. Many of the photographs were of students, their family members, and others in their homes and elsewhere. The secret photos included "a number of photographs of males without shirts, and other content that the individuals appearing in the photographs might consider to be of a similarly personal nature".

Looking at the information available to it, the report found evidence of TheftTrack being used on 177 laptops in the 2008–2010 time period. In 57% of the cases, the school chose to activate only the IP-address-tracking feature, and not to activate the feature that triggered the capture of secret webcam snapshots and screenshots. Based on the available evidence, the report found that Cafiero activated TheftTrack 3 times on student laptops, and Perbix activated it 161 times. The report noted that in a number of instances TheftTrack was left activated, taking photos and screenshots for extended periods of time even when a laptop was not considered missing or stolen.

In addition, there were 13 activations on student laptops for which investigators were unable to determine who activated TheftTrack, as well as 10 activations for which investigators were unable to determine why tracking was initiated. Together, they resulted in thousands of photos and screenshots. Of the 10 unexplained activations, in 7 cases the investigators were unable to recover any images at all from the remaining district record.

It was not only students who had their laptops' covert surveillance mechanism activated. The school also activated surveillance through the laptops of six high school teachers. Investigators were unable to determine why the teachers' secret surveillance had been initiated or, in half the cases, who had made the surveillance request.

Investigators were not able to determine how often the images were viewed by school personnel. A total of 18 members of the district's systems staff had LANrev administrator permissions during the 2008–2010 school years, and 16 of them had access to data stored on the LANrev server. Furthermore, those with access to the photos and screenshots could, and in some circumstances did, forward the photos and screenshots to others.

IT staff

The report also criticized the district information systems personnel. The district's chief technology administrator since July 2009, George Frazier, told investigators that he considered the systems department the "Wild West", "because there were few official policies, and no manuals of procedures, and personnel were not regularly evaluated". The report said former information systems Director DiMedio and her staffers "were not forthcoming" about the tracking technology; DiMedio declined to be interviewed unless the district reimbursed her for the cost of her retaining an attorney, which the district declined to do. DiMedio's lawyer criticized the report for faulting DiMedio's role in the district's use of web cameras. He criticized the cover-page description of the investigators' work as an "independent" probe, saying: "It was not an independent investigation. What flows from that [report] is a clear attempt to insulate and protect the current [district] board at the expense of the IT [information technology] department and employees like Ginny ... to throw her under the bus."

The report criticized Perbix for reacting negatively on September 11, 2009, when Frazier told him a teacher had requested that his webcam be disabled, with Perbix writing to Frazier: "teachers should not even be allowed to cover the cameras as they do now ... theft track ... does not record video, only a snapshot every 15 minutes. Is someone afraid that we are spying on them?" Jason Hilt, district Supervisor of Instructional Technology, when he learned that TheftTrack could be activated without police involvement, taped over his camera and shared his concern about remote webcam activation with Frazier and Director of Curriculum Services Steve Barbato.

Changes of policy

The school district did not have any official policies or procedures for the use of TheftTrack. Neither its Board, administrators, school administrators, nor the heads of its IT Department imposed any official restrictions on the use of the software's covert surveillance features.

In May 2010, Judge DuBois ordered the district to adopt a policy relating to its surveillance through students' laptops. The district promised never to look at a student's laptop files, unless: a) the laptop has been returned to the school; b) there is "reasonable suspicion" that the student is violating law, school rules, or district policies; or c) a student has signed a consent form. Following criticism of the district's training requirements and computer responsibility standards, the district is considering new written policies in those areas as well. On August 16, 2010, the Board banned the district from conducting webcam surveillance through students' laptops, in response to the Robbins lawsuit.

Opposition

In opposition to the lawsuit, some parents formed the Lower Merion Parents committee. The parents were angry about the school district's secret use of webcams to view students and their friends and families in their homes. However, the parents were concerned that they themselves would have to bear a financial cost in paying for the district's litigation, and possible settlement or court-ordered penalty.

The group was concerned that the Robbins lawsuit would be costly, attract negative attention to the district while harming its "civic tone" and distracting from its educational mission, and take a long time to resolve. Particular attention was given to the fact that payment for the members of the class in the class action suit would effectively come from the district's taxpayers, if not its insurer. Lower Merion Parents did not, however, oppose a full investigation of the district's technological capabilities and of any abuses the district committed.

On March 2, 2010, more than 100 parents met in Narberth, Pennsylvania, to discuss the issues. Robbins' attorney Mark Haltzman requested an opportunity to speak to the group to update the parents, but was denied. The meeting mainly concerned whether the parents wanted the Robbins family to represent them, how to lift the court's "gag order" agreement that district officials and school board members not talk about the case without first consulting the Robbinses and their lawyer, and how to learn what actually happened with the laptops and webcams. One option opposing parents have is to file a motion to intervene, which is an agreement to be parties in the case, but with different interests than the plaintiff. A similar group called Parents in Support of the Lower Merion School District collected over 750 signatures by March 3 in an online petition. Philadelphia Weekly noted that "Paradoxically, this group of Lower Merion parents are going to try to stop the gratuitous litigation by getting more lawyers involved."

Criminal investigations

The FBI, U.S. Attorney, and Montgomery County District Attorney all investigated whether the school district had violated criminal laws. On August 17, 2010, U.S. Attorney Zane David Memeger announced he would not file charges against district officials, because: "We have not found evidence that would establish beyond a reasonable doubt that anyone involved had criminal intent".

The U.S. Attorney's Office in Philadelphia had initiated a criminal probe, and in February 2010 issued a grand jury subpoena, asking the district for a broad range of records. The Office took the unusual step of announcing on February 22 that it would be investigating the matter, and said that: "Our focus will only be on whether anyone committed any crimes." In April, the Office sought access to the photos of a number of children, some of which may include nude or partially clothed shots, inasmuch as taking nude images of children could be criminal conduct.

The Federal Bureau of Investigation investigated whether federal criminal laws, including wiretap, computer-intrusion, and privacy laws, were violated. The FBI and U.S. Attorney's Office said in a joint statement in July 2010: "[The U.S. Attorneys Office] intend[s] to work as a team with the Federal Bureau of Investigation, the Montgomery County District Attorney's Office, Montgomery County detectives, and the Lower Merion Police Department to determine if any crimes were committed". FBI agents reviewed the school district's computers and thousands of images secretly captured from students' computers, interviewed district employees, and reviewed district records.

The Montgomery County District Attorney and Lower Merion detectives had also begun an investigation to see if any criminal laws were violated, including wiretap and privacy laws. District Attorney Risa Vetri Ferman said: "we were inundated with calls from members of the community asking about this. It became clear to me that we needed to look at this further."

The civil lawsuit had a much lesser burden of proof, and was unaffected by the decision. Lower Merion Police Superintendent Michael McGrath said: "This would appear to be a matter to be resolved in civil court."

U.S. Senate Judiciary Subcommittee hearing

Senator Arlen Specter.

Arlen Specter, U.S. senator (D-PA) and Chairman of the Senate Judiciary Subcommittee on Crime and Drugs, held a hearing on March 29, 2010, investigating the use of computers to spy on students. Specter said: "The issue is one of surreptitious eavesdropping. Unbeknownst to people, their movements and activities were under surveillance."

Specter said existing wiretap and video-voyeurism statutes do not address today's widespread use of cellphone, laptop, and surveillance cameras. After hearing testimony at the hearing from Blake Robbins and others, Specter said that new federal legislation was needed to regulate electronic privacy.

Specter introduced legislation to clarify that it is illegal to capture silent visual images inside a person's home. Specter said there was "a very significant invasion of privacy with these webcams":

Many of us expect to be subject to certain kinds of video surveillance when we leave our homes and go out each day - at the ATM, at traffic lights, or in stores, for example. What we do not expect is to be under visual surveillance in our homes, in our bedrooms, and, most especially, we do not expect it for our children in our homes.

Other ramifications

An "LMSD is Watching You" Facebook page was started, and within days had hundreds of members. At the same time, parody T-shirts were already being sold on the net, including one featuring the ominous red camera eye of HAL 9000 from the science fiction movie 2001: A Space Odyssey, inside the school district's circular logo.

Both The Philadelphia Inquirer and The New York Times reported that: "With a mop of brown hair and clad in a black T-shirt and jeans, Blake Robbins smiled when told the suit had earned him a Wikipedia page."

The litigation also prompted a "What's Wrong With People?" segment on the Dr. Phil show. The British news organization The Register reported that: "The U.K. agency in charge of IT in UK schools has insisted there is no chance of the government's free laptops program exposing the bedroom activities of British students."

The litigation also prompted new legislation in New Jersey, sponsored by New Jersey State Senator Donald Norcross. "Big Brother has no place in our schools. It's the administration's job to educate, not monitor their students," said Norcross. New Jersey's "Anti-Big Brother Act" (S-2057) was signed into law by New Jersey Governor Chris Christie on April 15, 2013. The law requires New Jersey school districts to notify students (and their parents) who receive electronic devices from their school that their activities may be monitored or recorded. It subjects a school district that fails to comply with the law's requirements to a fine of $250 per student, per incident.

Hasan lawsuit

On July 27, 2010, a second high school student, Jalil Hasan, and his mother filed a civil suit for invasion of privacy against the school district. The suit was over the school's surveillance of Jalil at his home, via his school-issued computer, without the high school student's or his parents' knowledge or consent. Hasan was 17 years old at the time. The suit also named as defendants the district's board of directors and Superintendent, as well as Perbix, Charles Gintner (a district IS Department employee), and "John Does 1–5" (district employees who requested, authorized, activated, or viewed the images, or allowed the surveillance to continue). Mark Haltzman also represented the Hasans.

Lower Merion school administrators had informed the Hasans by letter that the schools had secretly monitored Jalil by the webcam embedded in his school-issued laptop for two months, while he was a senior at Lower Merion High School. The letter was one of 40 that the district sent out to comply with a May 2010 court order by U.S. Chief Magistrate Judge Thomas Rueter. Rueter had ordered the district to send out letters to all relevant high school students indicating the dates of the schools' activations of their webcams, and the number of photographs and screenshots taken by each affected student's computer.

Hasan had misplaced his laptop at his high school on Friday, December 18, 2009. The complaint states that day a teacher found the laptop, and turned it in to the IS Department, from which Hasan retrieved it on Monday, December 21, 2009. However, the complaint alleges that it is believed that on the day Hasan retrieved the laptop from information systems, Gitner, Perbix, and others covertly activated the TheftTrack surveillance software on Hasan's school-issued laptop. They allegedly continued to run the surveillance for the nearly two months after returning the laptop to Hasan. They only deactivated the surveillance in the wake of the publicity surrounding the Robbins lawsuit that broke on February 18, 2010.

More than 1,000 images were taken surreptitiously by the district through Hasan's school-issued laptop—consisting of 469 photographs taken via the laptop's webcam and 543 screenshots. They included shots of him in his bedroom in his Ardmore, Pennsylvania, home, and of other family members and friends. The school district did not inform Hasan and his family of this until July 8, 2010, when a lawyer for the district (Hank Hockeimer) notified them of the existence of the photographs. The complaint said: "In fact, had the Robbins class action lawsuit not been filed, arguably Jalil's laptop would have continued whirring away snapping photographs and grabbing screenshots each time it was powered up."

The lawsuit was brought on the basis of defendants' invasion of Hasan's privacy without his knowledge or authorization, referring to the same laws cited in the Robbins lawsuit. It charged the district with:

gross negligence, reckless indifference and wanton abandonment of all responsibility to train, supervise, control, monitor, and discipline the employees of the school district acting in the course and scope of their employment, and with actual or tacit approval of the School District in the activities and behavior of its ... employees which were, by all moral, legal, ethical, and rational standards ... outrageous.

Jalil Hasan said, "When I saw these pictures, it really freaked me out". His mother said: "Right now I feel very violated ... When I'm looking at these pictures, and I'm looking at these snapshots, I'm feeling, 'Where did I send my child?'"

The district was put on notice of a third parallel suit that a third student intended to bring against the district, for "improper surveillance of the Lower Merion High School student on his school issued laptop", which included taking 729 webcam photos and screenshots between December 14, 2009, and February 18, 2010. The third student also learned about the school's surveillance of him when he received a letter from the district that the judge had ordered the district send to all students who had been subjected to webcam surveillance. Sources told Main Line Media News that the student never reported the computer missing.

Settlement of $610,000

In October 2010, the school district agreed to pay $610,000 to settle the Robbins and Hasan lawsuits against it. The settlement must be approved by Judge DuBois, who could also make his injunction barring the district from secretly tracking students permanent. The settlement also included $175,000 that was to be placed in a trust for Robbins and $10,000 for Hasan. The attorneys for Robbins and Hasan received $425,000.

See also

• Internet privacy
• iSeeYou
• Spyware
• Webcam
• Panopticon, an institution that thwarts improper behavior through the suggestion of ever-present surveillance.
• List of class-action lawsuits

External links

• "Class Action Complaint", Robbins v. Lower Merion School District, U.S. District Court for the Eastern District of Pennsylvania, February 11, 2010
• "Brief of Amicus Curae American Civil Liberties Union of Pennsylvania Supporting Issuance of Injunction", Robbins v. Lower Merion School District, February 22, 2010, friend of the court brief citing privacy caselaw in favor of Robbins
• "Complaint", Hasan v. Lower Merion School District, U.S. District Court for the Eastern District of Pennsylvania, July 27, 2010
• "Dockets & Filings", Robbins v. Lower Merion School District, Justia.com
• Report Regarding Monitoring of Student Laptop Computers by the Lower Merion School District, Ballard Spahr (LMSD's counsel), May 3, 2010
• ""Appendix to Report" Regarding Monitoring of Student Laptop Computers by the Lower Merion School District" (PDF). Archived from the original (PDF) on June 15, 2010. Retrieved September 16, 2013., Ballard Spahr (LMSD's counsel), May 3, 2010
• "Initial LANrev System Findings" (PDF). Archived from the original (PDF) on June 15, 2010. Retrieved August 13, 2010., LMSD Redacted Forensic Analysis, L-3 Services – prepared for Ballard Spahr (LMSD's counsel), May 2010
• "Stryde Hax, February 21, 2010, detailed technical discussion". Archived from the original on August 9, 2010. Retrieved February 23, 2010.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
• "Laptop Security Updates". Archived from the original on April 20, 2010. Retrieved February 24, 2010.
• Michael Perbix of LMSD, discussing the use of LANrev (laptop tracking software)
• Best thing since sliced bread, personal tech blog of Michael Perbix, District Network Technician (administrative leave)
• lmsdparent.org, parents opposed
• "LMSD is Watching You", Facebook page