Is this scenario legal,

A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. Keylogging records are kept by the school as well. This school gets the account details of the student in question, and logs into the accounts of the student. The school gets records of things said at school through a chat.

The school argues that because the student logged into the account on their network(s), that they can legally view what is in the accounts, even if they do not own them. On top of this, they also say that they have the authority to view the messages because they were sent within the network of the school.

The student claims that the school's actions are illegal. The account(s) that have been compromised do not belong to the school, and the student says that regardless of what network he accesses them on, they cannot legally obtain and/or use the credentials.

Who is legally correct, the student or the school? What laws dictate as such, and why? For the purposes of this scenario, assume the school is in the US state of Indiana.

closed as off-topic by schroeder, Xander, Mark, Jens Erat, Eric G Mar 4 '15 at 3:23

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    There is a HUGE distinction that is being blurred: did the school log into the student's non-school account, or did the school merely listen/observe what was being communicated while the student was using the account? – schroeder Mar 3 '15 at 22:15
  • @schroeder The school logged on to the accounts to obtain something said at the school, for this example they do not have any screenshots of what happened. – Aurora Mar 3 '15 at 22:17
  • Is this a public school? The difference might matter in the US (public schools are government entities, private schools are not). – cpast Mar 3 '15 at 22:25
  • We will assume that it is a charter school, and therefor a public school. – Aurora Mar 3 '15 at 22:27
  • 8
    I'm voting to close this question as off-topic because legal questions are highly dependant on jurisdiction and we are InfoSec professionals, not legal advisors. – schroeder Mar 3 '15 at 22:57

I think the basic idea here is "unauthorized access." If the school accessed a student's non-school account, there can be a case made for the school accessing that account without authorization.

There are a couple things that could negate matters:

  1. The account is a school account - the school is authorized because it is their account
  2. The network access policy included a clause granting the school permission to access accounts that it discovers
  3. The school did not log into the account, but had a record of what was transmitted over its network to the account
  • Can an entity write a clause as you have mentioned without repercussions? – Aurora Mar 4 '15 at 0:24
  • 1
    When dealing with minors, I have heard of some surprising powers granted to schools, but that is entirely dependant on jurisdiction. I cannot speak for Indiana or the US, though. – schroeder Mar 4 '15 at 0:29

I would have to say that if you have a privacy concern then you should not be using devices which you see as compromised or risky, the onus is on you to do this.

Would you do a bank transfer by giving your details to your worst enemy and asking them to do it ?

I have had employers which have essentially blocked Internet access off to prevent this

The staff at said school will be aware of any policies that may concern the and may or may not be accessing their own personal accounts from employer related hardware due to this. ( a employer can dictate that there is no personal use of provided hardware or network , and may use technical means to enforce this )

Not the answer you're looking for? Browse other questions tagged or ask your own question.