Before they to be teenagers, Rochester Hills, Mich., students Jeremy Currier and Seth Stephens showed the progressed computer skills and probing minds the are highly sought after ~ by employers. How did points go therefore wrong?
Rochester Hills, Mich.

You are watching: How to hack into school system

The hack started small, in 7th grade, when they bypassed their middle school’s net filters to watch YouTube during lunch.

But by the time Jeremy Currier and also Seth Stephens were caught, an ext than two years later, your exploits had offered them extraordinary power over the computer system network the the Rochester ar Schools, a well-to-do suburban district around 45 minutes exterior Detroit.


The teenagers had accessibility to the logins, passwords, call numbers, locker combinations, having lunch balances, and grades of all 15,000 of their classmates.

They could view teachers’ tests, prize keys, and also email messages.

They could regulate the district’s protection cameras and also remotely run its desktop computers via your phones.

The boys were also using district servers come mine because that cryptocurrency.


“It no anything malicious,” claimed Jeremy, currently 15. “I mostly just wanted to number out what else I could do.”

That’s not just how Rochester institution officials saw it. Though there’s no proof to date that Jeremy and also Seth straight threatened anyone, the ar expelled both boys, climate referred them to the county sheriff’s office.

Now, the case is increasing a number of big questions. Chief amongst them: How deserve to schools far better develop the potential of youngsters with progressed computing an abilities and a penchant because that probing boundaries—before points go bad?


About This Series


Ambitious and creative young people are pushing well beyond the boundaries of school and shaping the conversation around the future of work. Education and learning Week‘s encounters of the Future collection profiles students whose stories hold necessary lessons about the promise—and peril—that every one of today’s college student will face in tomorrow’s uncertain labor market.

Part 1: The Extraordinary education and learning of an Elite, 13-Year-Old Problem-Solver

Part 2: He desires Chicago children to build the next Silicon Valley. He’s 13.


With the nation facing mounting cyber threats and a severe shortage that qualified cybersecurity workers, the K-12 ar is under significant pressure to make the a priority. However the truth is that countless school districts space still struggling to protect their very own networks, allow alone prepare the high-tech workforce of tomorrow.

That’s why Jeremy and Seth are the latest students to be featured for education Week’s faces of the Future series.

Instead of finding us on monitor for progressed degrees and lucrative careers, the boys room at the center of a possible criminal investigation.


“I can’t start to fathom what they did or no know,” said Michele Stephens, Seth’s mom. “They to be far an ext knowledgeable than we can ever store up with.”

‘I just Love Figuring out Problems’

Having a young computer system whiz in the family can be a blended blessing.

Just ask Jeremy’s grandmother.

On a gray October afternoon, Jeremy perched on the leaf of she sofa, hands wrapped roughly his knee in a vain effort to store from fidgeting. The sped v the process of help the 82-year-old collection up a brand-new iPad, tossing out mile-a-minute explanations of how to collection account preferences and also send text messages via Siri.

“Do they have actually a language top top here dubbed ‘Jeremy Speak?’” his grandm asked.


*

Jeremy Currier, 15, sits at his residence in Rochester Hills, Mich. Currier hacked Michigan"s Rochester ar Schools district v his classmate, Seth Stephens, for 3 years. Together a result, Currier and Stephens to be expelled in may of 2018.
Rachel Woolf for education and learning Week

Now a lanky teen with a wispy mustache, Jeremy began taking computer systems apart once he to be 9. He built his first machine indigenous scratch as soon as he to be 11. Before long, he to be trying to construct computing rigs with enough processing strength to “mine” encrypted digital currencies. After seeing what Jeremy had learned ~ above his own via Reddit, an it contractor available him a job on the spot.


“I simply love figuring the end problems,” Jeremy said. “People rotate on their computer and think that magic. However there’s actually means more come it 보다 that.”

Unfortunately, said Jeremy’s mother, Janet Currier, the local public institutions didn’t really tap into that passion for manual problem-solving. Teachers and counselors no seem to understand what to execute with him. The STEM classes available in middle school felt far beneath Jeremy’s abilities. Possibly exciting computer system science classes weren’t available until small or senior year. Jeremy, focused intently ~ above what he could accomplish right now, started bristling in ~ the Rochester district’s heavy emphasis on college prep.


*

Jeremy Currier, 15, build a computer system for his employer, an independent contractor, on the kitchen island as his mother, Janet Currier, watches at their home.
Rachel Woolf for education and learning Week

“I never ever wanted to walk to college in the morning,” that said. “Building ingredient at residence was my just interest.”

Making things an ext complicated, Jeremy had few friends.

One the the couple of peers who shared his passions was Seth, a quiet boy who lived around 10 minutes away.

Their family members welcomed the connection.


By 7th grade, the two were having consistent sleepovers, staying up every night come play “Counter Strike” and mess approximately on their computers.

‘Complete and also Utter Access’

Seventh class was additionally the year the boys noticed a sticky note attached to among the public computer systems in the center school library. It had a username and password top top it, lock said, in instance students or employee wanted come look up publications but had forgotten their own credentials.

Jeremy and Seth uncovered that by logging in v the information on the note, then closing the end of the library software, lock could access files that had been mutual with the library’s adult staff.


How deserve to Schools support Cybersecurity Education?


States, the federal government, and private businesses space all pushing the K-12 sector to start now with teaching students the foundational an abilities they’ll require to protect the country future information-technology infrastructure. It’s a big lift for numerous districts, which frequently lack the money, curriculum, teachers, time, and expertise to introduce such a big topic into an already-crowded school day.

But there space other ways to make sure students don’t languish or autumn through the cracks, claimed Davina Pruitt-Mentle, the command for academic engagement for the national Institute because that Cybersecurity Education, i beg your pardon is housed in the commonwealth Department of Commerce.

Among the sources available: independent cyberdefense competitions, statewide cyber ranges, and programs favor CyberPatriots and Hacker High School.

“You have actually to number out the aptitude of these students and also grab them conveniently so they have the right to be placed on the right track,” Pruitt-Mentle said.

Read more about the state that K-12 cybersecurity education.


According to the boys, their following step was to accessibility the network native home, via the district’s digital portal.

Over the next two years, they also found a district program that permitted them to change passwords for anyone in the system. Lock browsed through selected teacher records containing great plans, emails, tests, and answer keys.

They set up a software program referred to as “TeamViewer” ~ above a an equipment in the earlier of a science classroom, turning it into a “slave computer” that afforded castle remote accessibility to any kind of PC in the district.

After the ar installed brand-new internet-enabled protection cameras, the boys found one more sticky keep in mind with a username and also password, left on the laptop the a school protection guard. They supplied that details to accessibility the camera system, figuring out exactly how to pan, zoom, and also watch old footage.

The boys likewise installed crypto-mining software program on the district’s servers. It stays unclear who idea that was, whether any type of money to be generated, and also who had accessibility to any type of proceeds.

It’s also not clean if that’s the full extent of the boys’ exploits. Citing the possible criminal investigation, both families decreased to answer questions about the opportunity of violations no referenced in the disciplinary papers they received from the Rochester community Schools, copies of i beg your pardon they noted to education and learning Week.


Regardless, Rochester technology officials bear considerable blame for what happened, claimed Douglas A. Levin, a K-12 cybersecurity professional who very first published one account the the hack top top his blog in September.

By leaving its network basically unprotected, Levin said, the ar made it easy for Jeremy and also Seth to execute a mind-boggling protection breach.

“The id that 2 12-year olds were able to do this is honestly just extraordinary,” he said.“They had actually complete and also utter access.”

‘It Was an extremely Much a Freakout’

But simply as noteworthy, Levin argued, is what the guys didn’t do.

There’s no evidence they cheated or adjusted grades, disrupted great or offered answers come tests, zeroed the end lunch balances or damaged into anyone’s locker, set up malware or turned off files, harassed human being online or stole anyone’s identity.


*

“There room things in our daily lives the we can all do, that we have accessibility to do, yet you simply don’t, since you know that’s cross the line,” his father said. “I think that’s where Seth was.”

Scott and Michele Stephens met 17 years ago, if bowling. Not long after they to be married, they relocated to Rochester Hills, a suburban ar subdivided into communities with names prefer Meadowbrook Valley and also Heritage Oaks. The institutions were a large reason why.

Seth’s elementary years went clear enough. He did well in his classes and also took care of his dog and also developed a quirky fascination with the Weather Channel. He additionally showed one aptitude because that coding, which ultimately led to him making use of YouTube tutorials come teach self programming languages favor Javascript and also Visual Basic.


A spate of current hackings and cyberattacks directed at K-12 schools—many by students—has shone a harsh light on the weak cybersecurity practices in many districts.

Even much more worrisome: Surveys indicate district technology officials don’t evaluate the size of the threat and often aren’t taking even basic steps to protect their networks.

“From a bigger perspective, one needs to wonder why it’s been so simple for students come hack their schools,” stated Douglas A. Levin, that runs the K-12 Cybersecurity source Center. “In this particular incident, left their solution essentially vast open.”

Read an ext about schools’ struggles to fend the cyberattacks.


By sixth grade, though, serious issues had surfaced. Seth to be diagnosed v attention-deficit hyperactivity disorder. He had actually trouble fall asleep. He would certainly close self up in his room, acquire lost in his computer, and also refuse to go to bed. Explosive fights would certainly ensue. Michele and also Scott gotten rid of the door come his bedroom.

Towards the finish of nine grade, they discovered out Seth was failing three of his classes.

Scott and also Michele felt their son’s needs were walk unmet. Worse, his computer system talents seemed to be going unrecognized. They started seriously considering other alternatives for the remainder of high school.


Still, the contact from his principal, speak their son was in trouble, come as a shock.

“It was very much a freak-out,” Michele said.

Staring into Uncertain Futures

Officials from Rochester community Schools decreased to discuss the instance or be interviewed about the district’s cybersecurity practices, citing privacy concerns and the feasible criminal investigation.

But letters sent out to the Stephens and also Currier families as part of the disciplinary proceedings against their sons spell out the district’s perspective.

While the guys “did not straight threaten the security of staff or students,” Rochester officials wrote, your breach that the district’s network to be “pre-mediated , deliberate, and also ongoing.”

Giving Jeremy and also Seth the chance to make amends—perhaps by help the district better understand that is cyber vulnerabilities—would no undo the privacy violations experienced by employee or students, Rochester public official maintained. Nor would it compensate the ar for time shed investigating the hack and rebooting that is systems.


There’s no clear agreement in the field around how to discipline students who hack into their district computer systems, and educators across the country have handled incidents in an extremely different ways.

Research suggests that harsh punishments such together expulsion don’t have the intended effect, Harper said, either on those who committed the violation or ~ above the wider student body.

“The blog post you finish up sending is the if students go an offense, they have to do everything in your power no to gain caught, since there’s no means to fix what castle broke,” she said.

Read an ext about student hacking incidents.


Their permanent employment prospects should have been bright. In the comes decade, because that example, the federal government will be trying to find thousands of skilled cybersecurity workers. The farming demand has only been underscored by a steady drumbeat the news stories around hacks, cyberattacks, and digital espionage.

But the boys room unlikely to be eligible for plenty of of those public-sector positions, claimed Davina Pruitt-Mentle, that helps head cybersecurity-education efforts at the U.S. Department of commerce in Washington.

“Will they be able to pass a background check and get a defense clearance?” she said, noting that the process includes a testimonial of candidates’ moral character, not just criminal background. “I’m no a lawyer, but my money would most likely be top top ‘No.’”

Depending on exactly how the possible criminal examination unfolds, private-sector employers might be more accommodating.


But even in the best-case scenario, the teens confront a rocky road to the postsecondary degrees and also credentials that will certainly unlock an ext than entry-level it jobs.

Since getting kicked the end of Rochester community Schools, Jeremy has actually enrolled in ~ Oxford virtual Academy, a full time online school run by the Oxford, Mich., institution district. He began the year on a type of probation; since of the nature that his expulsion, the school wouldn’t offer him a laptop to usage at home. So double a week, he top to a storefront in a strip mall to work-related at one of Oxford Virtual’s drop-in centers.

Even prior to his expulsion, Janet Currier said, she feeling on one island, trying to encourage her son’s interests and also talents, also though they’d long due to the fact that exceeded she capacity.

Now, she alternates between fury and also exasperation in ~ what she views together the Rochester district’s scapegoating of Jeremy, as well as the criticism she’s received on on facebook for no punishing him more harshly.

“What am I supposed to do? Lock that in his room? collection him ~ above fire? Discourage that from his liked career path?” she asked.


*

No longer permitted to have a computer in his bedroom, he works largely downstairs, in ~ a workdesk cluttered with game controllers and Tootsie rolls, in the room whereby his dad stores dozens the bowling balls.

After working nightshifts as an electrician at the neighborhood Ford plant, Scott spends his job home-schooling Seth, make the efforts to reach his child in a means that a 2017 national Blue Ribbon-winning college district apparently might not.

With small idea exactly how to proceed, Scott has actually leaned top top what the knows. The main project he is assigned Seth this semester is to develop a website and also app the will allow bowlers to track their bowling equipment.

Seth states he still wishes to go to college, to study computer science.

His parents hope that opportunity hasn’t been lost.

See more: How To Hide Dark Spots On Bikini Line Update, Bikini Line 101

“It’s prefer there’s this big mature human inside of this little body,” Michele said as her son hung his head quietly beside her.