M.T. Ex Rel. A.T. v. Central York School District

937 A.2d 538, 2007 Pa. Commw. LEXIS 611

Opinions

OPINION BY

Judge PELLEGRINI.*

M.T. for A.T. (Student) appeals from an order of the Court of Common Pleas of York County (trial court) affirming the decision of the Central York School Board (Board) expelling Student for the remainder of the first semester of the 2006-2007 school year because he violated Central York School District’s (School District) Computer Use Policy.

The School District has adopted a “Code of Student Conduct” (Student Code) which generally provides that violating “any local, state or federal law” can result in suspension or expulsion from school. It includes a detailed “Acceptable Computer Use Policy” (Computer Use Policy) which states, in pertinent part, the following:

Prohibitions. Use of the Internet, email, and network technology must be in support of the educational mission and instructional program of the Central York School District. With respect to all users, the following are expressly prohibited and violation may result in loss of privileges:

1. Use of inappropriate or illegal purposes.

2. Use in an illegal manner or to facilitate illegal activity.

9. Use to infiltrate or interfere with a computer system and/or damage the data, files, operations, software, or hardware components of a computer system.

11. Use to obtain, copy, or modify files, passwords, data or information belonging to other users.

12. Loading or using unauthorized games, programs, files, music, or other electronic media.

23. Any attempt to circumvent or disable the filter for any security measure.

26. Shall not disclose, use, or disseminate any personal identification information of themselves or other students.

The Student Code also has an Appendix that contains tables of offenses and shows the disciplinary options for each one. According to the Appendix table, the disciplinary options for violating the Computer Use Policy are denial of computer and internet privileges or possible suspension for one to 10 days. The Student Code further advises that “the Appendix is a guide and individual case may warrant the modification of ... penalties.” Students and parents are provided with copies of the Student Code, including the Computer Use Policy, through distribution of the Student Planner. Regarding computer-related misconduct, the Student Planner states that any inappropriate use of the internet or the School District’s technology will result in “technology restrictions and/or disciplinary action.”¹

At the beginning of the 2006-2007 school year, Student and his mother, M.T., acknowledged receipt of the Student Planner and their awareness of its contents, including the Student Code. Student also signed a copy of the Computer Use Policy.

On October 16, 2006, an unauthorized photograph of a shirtless male student appeared on the School District’s web site. The School District investigated the incident and determined that the security of its network and computer systems had been breached. It suspected that Student, a tenth grader at Central York High School, was responsible for the breach because he had been suspended for other computer-related misconduct during the preceding school year.² The School District questioned him, and he admitted that he had helped another student hack into the School District’s computer system by “cracking the hash” or decoding encrypted information with “OPH Crack” software. Student further admitted that he supplied user names and passwords to the other student who used that information to enter non-student areas of the computer system to install software and to manipulate the School District’s database. Pending a hearing before the School Board, the School District suspended Student on October 18, 2006. Approximately one week later, the School District issued a formal notice of charges, including violation of the Computer Use Policy and violations of any local, state or federal law, and scheduled a hearing.

At the hearing, Richard Burd (Burd), the Superintendent for Administration testified that when he became aware of the unauthorized use of the School District’s computer systems, he spoke to Student based on some investigative work. Student admitted to him that another student had attempted to gain access to the main server but because it had an encrypted code, he was unable to do so. Student was able to “crack the hash” and passed the information on to the other student. Burd stated that Student was cooperative in the investigation.

Joseph Lucia (Lucia), the Network Administrator for the School District, also testified that he interviewed Student who told him that he obtained passwords that he was not authorized to have or to use to enter other portions of the computer system. Specifically, he used an administrator password to install Log Me IN software which allowed users from the internet to connect to the computer. He also had access to a few teacher accounts, but he did not identify which teachers; he also logged in to the HVAC system and the MySQL database, a web database that held a ticket system, an inventory, and a student database that held passwords for teachers. Lucia stated that once he knew how the user names and passwords were obtained, he could determine what log-ins were on the domain and was able to change the passwords so that anyone who had them to gain access to the web server would not have that access any longer. Additionally, the folder that was created that housed this information was removed and put into backup in case evidence was needed. Only then was the system secured, and the School District was able to continue as normal. Lucia summed up by stating that Student’s principal role in this matter was cracking the code and supplying that information to another student, but it was the other student who disrupted service to the School District.

Finally, Jay Butterfield (Butterfield), the Principal at Central York High School, testified for the School District regarding the acceptable use guidelines for computers and network for the School District which he indicated was signed by Student. Butterfield stated that he believed that “the mining of any resource that opens the door to our secure systems is an extremely serious event for a school. We don’t know the extent to which someone with that information could undermine or, in fact, completely disable or destroy the systems that we have become dependent upon. As we have gone from a paper system to a paperless system, and as we have gone to more electronic management, the security of our systems have become much more critical and also much more vulnerable to that sort of an attack.” (Reproduced Record at 168a-169a.) When he recommended that Student be expelled for the remainder of the semester and removal of computer privileges for the remainder of the entire school year for such egregious conduct, counsel for Student asked him if anywhere in the Computer Use Policy it indicated that a violation of the Policy could lead to expulsion. Butterfield responded by saying, “No.” (Reproduced Record at 172a.) When Counsel for Student further asked if any of the offenses listed in the Student Code that could lead to expulsion included a reference to computer use policy, he also responded, “No.” (Reproduced Record at 173a.) He admitted that the discipline for such a violation was a 10-day loss of privileges and an in-school suspension, but also noted that the Student Code also stated that the appendix was a guide and individual cases would warrant modification of penalties. Further, the Student Code provided that any violation of local, state or federal law could result in expulsion, and to his knowledge, there were state laws that dealt with the issue of computer hacking and unauthorized access to computer systems.

As for any testimony by Student, he was advised by his counsel and parents not to testify, but an exhibit was offered into evidence by the School District that he “saved student password database to a PDF, logged into, but did not change the HVAC system as well as the MYSOL database; had access to a few teacher accounts, remote administration tools were used with the passwords to log into computers.” Student’s mother testified that she did not recall receiving the Code of Student Conduct, but even if she did, she was not aware that it was a violation of the School District’s rules for students to gain unauthorized access to the computer systems, stating that “I think I would have know that, even if I hadn’t read anything. It’s just something I would have known, yes.” (Reproduced Record at 188a.) Similarly, when asked if Student read the Code of Student Conduct and was aware of the rules regarding illegal use of computer systems, she responded, “I think so. I don’t think that he knew the specifics of— You know, there was all of these different books and rules and stuff. I don’t think he knew the specifics, but I think he knew in general that it was something he should not be doing.” (Reproduced Record at 189a.)

Following the hearing, the School Board concluded that Student’s conduct constituted a violation of Sections 1, 2, 9, 11, 12, 23 and 26 of the Computer Use Policy and Section 1318 of the Public School Code of 1949 (School Code).³ The School Board further concluded that Stu dent had violated Sections 7611(a)(2) and (a)(3) of the Pennsylvania Crimes Code, 18 Pa.C.S. §§ 7611(a)(2) and (a)(3), which prohibit unlawful use of a computer.⁴ Based on these violations, the School Board issued an adjudication expelling Student for the remainder of the first semester of the 2006-2007 school year which was to end on January 27, 2007.⁵ The School Board found that while Student was forthcoming in cooperating with the investigation, it was troubling that he was previously disciplined for computer-related misconduct. Student filed an appeal with the trial court, which affirmed the School Board’s decision, and this appeal followed.⁶

Student contends that the School Board erred in expelling him because the School District charged him with a violation of the Computer Use Policy and a violation of state law. However, under the Computer Use Policy, the maximum penalty was a suspension of up to 10 days, and under the policy violations in the Student Code, which indicated that a student could be punished for violating “any local, state or federal law,” violation of computer usage was not listed. The Board disagrees and argues that it used the School Code as a whole to determine the appropriate penalties because the Computer Use Policy does not presume to identify all conduct that is also a violation of law or conduct that is so severe that it would be considered a felony under Pennsylvania law.

In this case, the School Board properly exercised its discretion to expel Student. While the Computer Use Policy suggested penalties up to a 10-day suspension, it also indicated in the Appendix that such a punishment was only to act as a guide, and an individual case could warrant the modification of the listed penalties. This is such a case. Although Student argues that there is a “lack of proportionality” between the violation and the sentence, the evidence suggests otherwise. Previously, he committed a serious and potentially damaging violation of the School District’s Computer Use Policy when he made false student identification cards, and this time he committed a more serious violation of the School District’s Computer Use Policy by decoding encrypted information and helping another student access extremely sensitive and private School District information. Given his history, a 10-day suspension was not likely to get his attention because he did not learn from his prior suspension for computer misconduct, and given that his conduct is felonious under the Crimes Code, an expulsion was entirely appropriate.⁷

Accordingly, the order of the trial court is affirmed.

ORDER

AND NOW, this 5th day of November, 2007, the order of the Court of Common Pleas of York County, dated January 12, 2007, is affirmed.

Footnotes

*

This opinion was reassigned to the author on September 17, 2007.

1

. The Student Planner further provides:

Inappropriate Computer use will be disciplined according to the following progressions:

First Offense: 5-day loss of privileges and detention or ISS [in-school suspension].

Second Offense: 10-day loss of privileges and ISS [in-school suspension].

Third Offense: 15-day loss of privileges and OSS [out-of-school suspension].

2

. Student received a three-day in-school suspension after being involved in creating a web site where persons could create fake identification cards that were virtually identical to those issued by the School District.

3

. Act of March 10, 1949, P.L. 30, as amended, 24 P.S. § 13-1318. That section provides, in relevant part, that a school board may expel a student for misconduct after a proper hearing.

4

. 18 Pa.C.S. § 7611(a)(2) and (a)(3) provide the following:

In Pennsylvania, a person commits the offense of unlawful use of a computer if he:

(2) intentionally and without authorization accesses or exceeds authorization to access, alters, interferes with the operation of, damages or destroys any computer, computer system, computer network, computer software, computer program, computer database, World Wide Web site or telecommunication device or any part thereof; or

(3) intentionally or knowingly and without authorization gives or publishes a password, identifying code, personal identification number or other confidential information about a computer, computer system, computer network, computer database, World Wide Web site or telecommunication device.

5

. It is unclear as to whether this case is moot because we do not know if Student was actually expelled for any portion of the fall semester of his sophomore year. Nonetheless, because this issue is capable of repetition and evading review and because a school district’s ability to regulate student conduct is of great public importance, we shall address the issues raised in this appeal. In re: Appeal of JAD, 782 A.2d 1069 (Pa.Cmwlth.2001).

6

. Our scope of review is limited to determining whether the School Board’s adjudication is in violation of the Student’s constitutional rights, whether it is in accordance with the law or whether the findings of fact are supported by substantial evidence. Hamilton v. Unionville-Chadds Ford School District, 552 Pa. 245, 714 A.2d 1012 (1998).

7

. Citing Commonwealth v. Oxford Area School District, 24 Pa.Cmwlth. 421, 356 A.2d 857 (1976), Student argues that the deliberations of the School Board were tainted where Dr. Estep, the Superintendent, acted both as a prosecutor and as a judge when she discussed Student’s conduct with Burd, thereby merging the adjudicatory and prosecutorial functions of the administration. In Oxford, the superintendent voted along with the school board that rendered the final decision and acted as an adverse witness at the dismissal hearing of the teacher. We found that this constituted a commingling of functions and that the teacher’s rights were not reasonably safeguarded. However, Oxford is clearly distinguishable from this case because the Superintendent was not part of the voting process and was not an adverse witness at Student’s disciplinary hearing. Moreover, the testimony of Burd indicated that he did not discuss the details of the case with her or any recommended discipline, but rather whether they should talk to the students about whether they should erase everything from their computers. (Reproduced Record at 137a-139a.) Based on this limited conversation, we do not believe there was any commingling of her functions as both prosecutor and judge, and Student’s rights were properly safeguarded.