Internetworkers: http://www.ibiblio.org/internetworkers/

[childers.paula AT epamail.epa.gov]

OK, gang, sensationalism and overkill aside, let's look at the facts:

1. A Citrix server stops working correctly, disallowing administrative
logins.
2. The school officials decide that it may have been hacked (not HAS
been, only MAY have been), and tell their "campus cop."
3. The campus cop calls the local Police Department to get a "computer
crime specialist" assigned to the case.
4. Since that cop was on vacation, two other cops were assigned the
case.
5. Those two other guys were training with an "FBI High Tech Crime Task
Force," but were not officially members of this force.
6. A student tipster tells a faculty member of a "hacking" mention in
another student's blog.
7. The faculty member pases this information to the not-FBI-agents.
8. The two not-FBI agents show up to interrogate the student, with FBI
clothing, business cards, etc., passing themselves off as FBI agents.
9. the student is freaked out but informed and willing to stand up for
her Constitutional rights.
10. the Citrix server is found to be busted, not hacked.
11. The cops are suspended for passing themselves off as FBI agents when
they weren't yet.

Now, let's look at the places this whole process got fucked at:
1. Citrix? On Microsoft? now there's a problem ;-)
3. Why did the campus cop feel s/he had to call in a "computer crime
specialist" before there had even been a firm determination of any
illicit activity actually occuring?  What - was this a "pre-emptive
strike"??
4. how does a maybe, possibly, we-don't-know-for-sure-it-might-be-or-not
hacked server at a high school warrant the assignment of TWO veteran
police officers?
6. did anyone question why one student might be "ratting" on another?
isn't this sort of stupid/malicious tipstering why we didn't want
Operation TIPS?
7. Did the faculty member even bother to READ the blog before calling
the cops?
8. If these two cops were being trained by an FBI Task Force to
understand computer crime, why didn't they do a little more actual
technical investigating before interrogating a student? Like, say,
looking over the server with the sysadmin? Discovering if a hack/crime
had actually taken place or not? The cop in the article says it was a
"no-brainer" to interrogate the student, and that about describes it :
no brain was used to think up that plan.   What if the student HAD
actually been part of something much bigger? These morons could have
completely screwed up a real case with their "we're FBI, fear us and
grovel" fake dog and pony show, not to mention they actually HAVE made
the Chapel Hill Police Dept look like a bunch of fascist idiots.
9. The student rightfully deserves to be scared, upset, and feel that
her privacy has been invaded. There is such a thing as "security through
obscurity," in that (regardless of POTENTIAL reach) it is highly
unlikely that many people would ever have even known this student's blog
existed were it not for these events. It also has to be pretty chilling
as a 17 yr old to think that The Government is Monitoring What You
Write, regardless of where you wrote it. Perhaps she did get
overdramatic, but hell, all 17 yr olds are overdramatic. I am pretty
damn proud of her for standing up to these morons and asserting her
Constitutional rights. That took a lot of guts. I wonder how many of us
would have such guts if two (supposed) FBI guys showed up at our
workplace?
11. I'm just sad they didn't suspend them WITHOUT pay, they bungled the
whole thing so badly. They are, in essence, getting a vacation on our
tax dollars. Boy, I'd like to get time off with pay every time I screwed
something to hell. Not exactly incentive to do better next time, now is
it?

If this is an example of the fine quality high tech policework our law
enforcement officers are being trained in as part of Homeland Security,
then I for one am disgusted. I just don't know who to be more disgusted
with, CHPD, CHHS, or the FBI group supposedly training these petty
thugs.

YMMV,
Paula

disclaimer: these comments are all my own, not those of anyone I work
for, or who they work for. I have volunteered at NC indymedia, but do
not know the student involved in these events and have no knowledge of
the events beyond that noted in the posted articles.