This story resonates somewhat with me as I was definitely a problem-teenager but have since mellowed out substantially, thankfully without ever encountering trajectory-altering consequences (although probably deserving to in some ways)
When I look back I simply wasn't engaged/challenged in the right ways and was looking for every opportunity to challenge myself - even pushing the limits of authority was a source of enjoyment and punishment was almost a reward for me: I never really responded positively to punishment and definitely didn't learn anything from them.
This became really obvious to me after I had the following observations:
- at high school I was highly disruptive
- at college I was fully engaged because the environment was academically challenging
- many years after at coding bootcamp I felt some of the old teenage urges to disrupt bubbling under the surface when classes were too slow (thankfully I know much better than to act on them now)
So I guess my point is that it feels natural to condemn the individual, but we really don't know anything about them or their circumstances, and with my educator hat on, I'd rather assume a misguided individual and challenge myself to find a way to teach a new lesson than opt for the easy way out and condemn them with some kind of heavy punishment (like expulsion).
Perhaps in this case some of the following may be useful lessons:
- some labour-intensive efforts that directly relate to cleaning up the mess of security breaches and election counting
- work on fixing vulnerabilities of the school network (if money were no issue, have the student try to protect the school against a pen-tester, in the hopes of establishing some empathy for the difficulties of being a time-poor underpaid school sysadmin, or at the least have some constructively directed black/white-hat energy)
- find some relatable issues on the morality / pain of vote rigging and have the student study them
And that's the point. You're dealing with smart, misguided youth with a literal hacker mindset. You'd hope this wouldn't need explaining on Hacker News, but here we are...
Having been in this kid's shoes many beers ago, I technically committed major felonies. The District flipped a lid, mind you I'd been reporting vulnerabilities two years, when I gained access to their server with their financials and PII. Wasn't doing it because I wanted to sell my shit-heel English teacher's identity to Russian cybercriminals... no... I was having fun learning and discovering this fucking awesome world of computers.
Those of y'all acting as if this kid if a real piece of work need to check your outlook. That is some real "get off my lawn" stuff. He's a high schooler, and capable enough to pull this crap off. Show him the right path, turn it into a teaching (it's school, y'all) moment, and if he doesn't want to walk the right path then who are we kidding, a detention isn't going to change that outlook anyway.
The problem with your attitude is that you have become the authoritarian in this situation. The district wasn't interested in fixing their security issues (their right), and you didn't like this, so you went ahead and broke into their systems anyway.
"I was having fun learning and discovering this fucking awesome world of computers."
There are plenty of other ways to do this.
"He's a high schooler, and capable enough to pull this crap off. Show him the right path, turn it into a teaching (it's school, y'all) moment"
A teaching moment would be punishment. Maybe a suspension. In the real world, you can't just trample on others' rights, without some sort of repercussions.
Also a teaching moment surely isn't a suspension. That's how you burn any bridges towards getting the kid to learn. You said that in the real world you can't trample others' rights, well sure but it's kind of the point that high school isn't the real world. A teaching moment would be sitting someone down, getting them to admit/explain what they did, telling them that in the real world they would get in trouble, and pointing them towards a better outlet. Teach them what it means to be a white hat and send them on their way.
I wasn't holding anything hostage. I didn't tell them "Fix it or else." I'd been reporting vulnerabilities I'd been finding. Found more. Reported 'em.
> In the real world, you can't just trample on others' rights, without some sort of repercussions.
Sounds like you've never lived in the real world.
Again, it's high-school. You seriously have no idea how to incentivize this type of kid.
You're the one talking about how it's somehow your right to break into private systems, because muh learning.
This doesn't sound like the real world to me.
"Again, it's high-school. You seriously have no idea how to incentivize this type of kid."
Why should we? Why shouldn't this type of kid have to follow the same rules as anyone else?
The administration was already aware of potential flaws in their system, but chose not to fix it. These kids decided to exploit them anyway. If this was at a workplace, they would be fired at best and have a criminal record at worst.
No one is saying this.
> Why should we? Why shouldn't this type of kid have to follow the same rules as anyone else?
Why don't we punish 5 year olds as adults? Hint: answer is the same.
> The administration was already aware of potential flaws in their system, but chose not to fix it.
And now they will. Both are at fault. Both have blame. But we're saying "Don't turn these kids into criminals. Push them to use their skills in a way that can help our society (ie: security researcher). They're still young enough that they can change. These aren't hardened criminals we're talking about. We're talking about kids.
tldr: Kids aren't adults. Who knew this was such a controversial topic?
Even if it's not actually important, it's the perception of importance to the student that matters. The idea that "it's ok to commit fraud if I think it's something important" is definitely one we don't want becoming widespread.
The guy accessed other people's email accounts. The punishment for "hacking the elections" is one thing, accessing someone's email account goes way beyond that. So even comparing it to abusing a paper ballot system is not at all appropriate. It's comparable to someone opening up your mailbox, reading your mail, then sending some in your name. For fun.
Rehabilitation versus retribution.
Among countless other problems, high school elections promulgate the idea that there can be only one hierarchy, that there is a group of "betters" that should comprise that hierarchy, and that the only measure of merit in that hierarchy is popularity.