A coupe thoughts. First off, I don't think the facts on this particular case are clear in the slightest and they probably won't be until this case hits the courts (assuming it does.)

Secondly, on a more philosophical note, just because you state something (or imply it) doesn't actually make it legal to do it. The real question that this whole debate will come down to is whether or not the school districts actions should be legal rather than asking is it legal. My guess is either this question, or one similar, will make it's way to the Supreme Court, because it's a morals debate more than it is a legal issue.

Agreed. And I would add that just because they can, that doesn't mean they should.

Isn't there a better way to track stolen, lost Macs?

I am confident the school's intentions were honorable. But if the plaintiff can find one example where the capability was accessed and not logged, the school will take a hit. One example of an inappropriate pic, too, would sink them in court. Think the school was foolish to put themselves in this position.

A Jewish lawyer friend of mine whose dad was a Rabbi would call the last few entries of this thread a pilpul. Classically this is an argument between scholars over the fine points of the Talmud, but colloquially (at least in New York City) it's defined: casuistic hairsplitting. One side tries to think of examples and the other shreds them on the details. Goes nowhere because it's really an argument about personal feelings for what "expectation of privacy" means.

Surely we can all agree that secret activation of a monitoring device given to a person in (literally) a Trojan Horse qualifies as invasion of privacy?

I suspect the judge is about to tell them just that.

Yes, but a Trojan Horse doesn't come with specified rules of use. Something that does come with rules is hardly a Trojan Horse.

What rules of use are you referring to? What someone does in their house is their business. The school board in this case does not have eminent domain over whatever the camera sees when they secretly activate it.

Try this Reductio ad Absurdum argument:

Sidwell Friends School gives identical laptops to Sasha and Malia Obama. They take them home and use in the normal manner. As part of 'routine' checks they get imagery of interior parts of the White House that are probably not on the public tour.

I'll bet good money the IT department won't get out of Attica for at least a couple of OS versions.

Yes, what they do in their house is their business. If they choose to allow a government owned camera to operate in their house, that is their choice and they must accept the consequences associated with that choice.

As for Sasha and Malia, I'll bet good money that their laptops don't make it into the White House without modifications and/or restrictions on where and when they can use them.

Those computers are probably hardened to this level, at least:
NSA Security Configuration Guides for Mac OS X

They're pretty strict, talking about removing kernel extensions that support various ports and the camera.

Exactly! The White House recognizes that if those computers were used to spy on the First Family and/or the government then the people most at fault would be the Secret Service. Most parents don't have the Secret Service working for them, so it's their responsibility to secure any device brought into their house. There is no excuse for not being aware of the Macbook's capabilities or how it is being used. "They didn't tell me!" certainly doesn't qualify as one.

Well, working in a 1:1 with 6,000 Macbooks and where students can take them home and being in public education I can clarify a few things for all of you.

First off let me start with Federal Regulations:

The Federal Government requires that we censor and block certain content from all students in a K-12 environment, even those students who are 18 years of age. These standards are set by the FCC, and directly affect our eRate eligibility. eRate is a government protocol that allows school systems to purchase massive amounts of technology at a flat guaranteed rate. This means that both the schools and the companies have to be eRate compliant. I don't know all the ins and outs of eRate because I am not in charge of writing checks and stamping POs here at my job. However, I do know that is allows both companies and academia to purchase mass amounts of technology. It is win:win for both sides when this happens. The federal government also enforces the school systems to provide a safe learning environment, which is totally up for interpretation of what safe means. Each state has different regulations on how this should be. There are many other federal mandates, like us keeping HIPPA info safe and to HIPPA standards, and us keeping back ups of archived files and emails for every user for a particular amount of time in case a federal investigation ever occurs, via the Patriot Act. Plus many other federal mandates are applied as well. Which is why when a student complains about us filtering their Internet I tell them to write their government representatives to have such federal policies changed.

Now lets look at how schools handle this:

School systems are forced to take zero tolerance policies, this is to protect the school from lawsuit. This can get quite out of hand, but let me give you an example that is relevant to technology. Student gets a school owned laptop issued to them. Student goes home and commits crime with laptop or does something illegal with said laptop the parent will end up blaming the school and ask, why did the school not set up precautions for such things? The same people that bark up the schools trees are the same parents that are active at school board meetings and voice their needs to the school board, these exact needs to be exact.

How the school handles technology:

Each student, teacher and other classified employees are required to sign an AUP, also all minors must have their parents sign. The AUP states that all information created and stored on technology is not private and may be searched whenever called for. It also states that the technology is property of the state and thus all state regulations are applied and it is not anyone's personal property.

Now, the web cam issue, well I think it is clear violation of the 4th amendment. The school being allowed to spy on any data on the computer is legal, and think fairly covered. However, turning the web cam on to spy on things outside the computer should require probable cause and a warrant. If the computer was stolen, then I would say that would be probable cause and easily have a warrant on it, since the property was stolen.

The software in question is third party too, it is something that Apple did not build into their laptops.

As far as tracking stolen laptops, we use a service called Comp-U-Trace, which is the enterprise version of lojack. What it does, is it has a client piece that phones home every day, with various information. Last known WAN IP, reverse DNS look up, which ISP is hosting that, MAC address and some unique hardware information, what user account is logged in during this time, and so forth.

When we report a laptop stolen Comp-U-Trace contacts the local police/sheriff of where the last phone in occurred. Then a subpoena is issued for that stolen equipment after a police report is filed. This subpoena would then legally allow for things like a web cam to be activated. The product actually is embedded in firmware (on the PC side) and cannot be deleted or wiped. It also allows for features like remote wipe if a laptop has sensitive data on it.

This service is obviously not free, but if you go back to my last post about eRate you can get their service under eRate I believe which makes it affordable to public educational institutes.

We use remote desktop and products like Comp-U-Trace to track stolen assets, and we use law enforcement to do so. Also, our country prosecutor does in fact charge the person stealing the laptop with a felony as they are valued at over $1,000 each.

After reading the links in the post in the Hardware section, there are some real questions here as to what the school was using the laptop access to accomplish... school accused of taking a photo in a bedroom (obviously not a lost computer, huh?) of a kid alleged to have drugs and confronting the child/parents with the evidence. School also accused of counseling students about inappropriate home behavior, including parents. To be fair, school is denying those two allegations.

Since my little one has a macbook (not from school), I am hoping someone can explain how to shut down this apparent loop hole in security..... short of setting the mic to mute and taping over the webcam. Is there a real threat here for an off the shelf Macbook?

There is no loop hole and zero threat to your personal Mac. You need admin rights to do it, which basically means that you must be the owner. In this case, that was the school system.

The hysteria over this is mind boggling. Companies routinely fire people for using company property to do things just like what this kid did. Where is the uproar in those cases? The kid used government property in violation of the rules, possibly even the law, and he got caught! He and his parents should take the penalty and stop their whining.

Does anyone here really believe that his parents didn't have to sign some sort of agreement, and do you further believe that agreement didn't warn them and the kid about the rules?

You sure? I don't think there's enough extra space in the firmware for that much functionality. Hidden partition perhaps?

Do you end up with a good cost/benefit ratio at the end of the year? e.g. cost of service < cost of stolen machines ?

It seems to me that ideally you'd have a system that deterred theft to the point where the cost of stolen machines was zero. Such a service would certainly be worth much more than $0.00

As it happens, the kid was eating some kind of candy that looks exactly like an illicit drug.

As it happens, the kid was apparently eating some kind of candy that looks exactly like an illicit drug (not familiar territory for me).

Thanks for confirming that, CWT.

Really don't think this issue is creating hysteria. It's different because it is in the home.... our last sanctuary from public intrusion. Already cameras are going up all over the place monitoring our activities. Feds sometimes reading our emails (or searching them for key words). Autos can be stopped and searched for little or no cause. And on and on. The home is the final place where we have a right to expect privacy, and nobody wants to see an attack on that right for any reason whatsoever.

Also, the presumption by all was this involved teenagers (and it probably did), but looking at the school's web site, they appear to have some very small children with MacBooks, too.

Companies using webcams to watch employees in their homes would rapidly be sued out of existance. At work and within the physical boundaries of the computer are fair game. Plus, when you have people take things home you have to expect a reasonable amount of personal use. Capturing passwords and checking their hotmail account is too far.

What violation? Doesn't appear the kid did anything illegal.

a) it appears the details were conveniently omitted. (the original article states that the waivers did not include the cameras)
b) Do you read everything put in front of you? In detail, considering all implications of each sentence? Without looking, what is in clause 10 of the iTunes EULA and how does it affect you?

That woud be the ideal. My question for tlarkin was does the theft protection cost more than the theft itself.