School rule-breakers to hand over Facebook and Twitter passwords

library
crime | hacking | security

US school students in the state of Illinois may be forced to hand over their Facebook or Twitter passwords if they’re suspected of cyberbullying or of otherwise breaking school rules.

That’s what at least one Illinois school district is telling parents, following a new law that mentioned social media accounts in its definition of cyberbullying and harassment.

That law went into effect on 1 January.

It requires schools to implement a policy that includes a “process to investigate whether a reported act of bullying is within the permissible scope of the district’s or school’s jurisdiction.”

But the law, by itself, doesn’t explicitly mention forfeiture of social media account login credentials.

Rather, it merely defines cyberbullying and makes harassment on Facebook, Twitter, or via other digital means a violation of the state’s school code – including bullying that takes place outside of school hours, via non-school-owned devices, and/or off of school grounds.

But as Motherboard reports, a school district located near the city of St. Louis, Illinois, has sent a letter claiming that school officials can in fact demand passwords “under certain circumstances”.

Leigh Lewis, superintendent of the Triad district, told Motherboard the district could resort to criminal charges if students don’t comply:

I would imagine that turning it over to the police would certainly be one way to go. If they didn’t turn over the password, we would call our district attorneys because they would be in violation of the law. That would only be in some cases. We’d certainly look at the facts and see what we’re dealing with before we make the decision.

The fact that passwords are to be demanded in the case of any rule-breaking sounds too strong. That’s the conclusion reached by Kade Crockford, director of Massachusetts’ American Civil Liberties Union.

She dubbed Illinois’s move “government overreach” and said that either the law or schools’ implementation of that law may well be unconstitutional.

Crockford told Motherboard that the ACLU is now backing legislation that would make such policies illegal in Massachusetts:

It’s a tragic example of government overreach – the notion that there’s a substantial difference between cyberbullying and regular bullying is confusing. Anytime a school is trying to control students’ behavior outside school, it’s a serious threat to their privacy and to their futures.

The law is also, likely, redundant. After all, if cyberbullying gets bad enough, law enforcement can just get at social media accounts by getting a search warrant, she said.

While the Fourth Amendment protects US citizens from unreasonable searches and seizures, it doesn’t offer protection in cases where due process has been followed, such as when the request is made under a search warrant.

As Motherboard points out, the law could also violate the Computer Fraud and Abuse Act, given that sharing passwords with unauthorized people is prohibited by terms of service of companies such as Facebook.

I can sympathize with school officials who want similar power to fight cyberbullying – something that surely must be an overwhelming, daily battle.

But isn’t the power already there to fight cyberbullying and harassment?

Yes, you have to go through the police and the court system to secure a warrant.

Going through the work to establish just cause as opposed to a school arbitrarily violating students’ privacy: that doesn’t seem like an unfair tradeoff to me.