Investigation continues into student hacking info from Oregon Schools
Written by Autumn Lee | | news@toledofreepress.com
Oregon City Schools Superintendent John Hall confirmed an information security breach occurred Jan. 11 when a male Clay High School student obtained confidential student and staff information through inappropriate means.
The main suspect, who Hall did not name, shared with another student that morning he had accessed the information.
The student who learned of this information leak told a staff member midday Jan. 11, said Hall.
The administration immediately investigated the situation and learned the student had transferred the information to a portable 30-gigabyte storage device. That device, identified as an iPod in an Oregon Police incident report, was confiscated by the administration. The administration has also taken the computers pertinent to the incident for analysis.
“The situation was contained early on,” said Hall.
When the police incident report was filed, another male student was considered a suspect.
That student cannot yet be ruled out as a suspect, said Detective Janet Zale of the Oregon Police Division.
Both juvenile suspects’ names were withheld from an incident report obtained from the Oregon Police Division. Zale said the case is still being investigated. She also has some forensic analysis work to do on some of the high school’s computers.
The Oregon Police Division is now in possession of the student’s iPod, Zale said. From what investigation she has completed, she has ascertained the iPod contains district-wide personal information, such as names, addresses, birthdays and Social Security numbers of students, as well as information on Clay faculty and staff.
Zale said she knows the main suspect verbally talked about the information, but does not know if he physically gave the information to anyone. Zale went to the main suspect’s home, but decided not to take his personal computer at this time, she said.
According to the police incident report, potential offenses include unauthorized use of property and menacing.
Charges will be filed in juvenile court, Zale said, though she cannot specify what those charges might be.
Within the Oregon Police report, Officer Tim McLeod explained steps taken within the investigation including questioning the suspects and witnesses.
McLeod wrote in the report an argument between two students led to the main suspect telling a female student he would “bum her car” and “open up a credit card in her name and ruin her credit.” When the female student replied he would not be able to since he did not have her personal information, the male student said he did, knew everything about her and other students.
The other suspect referred to as “Suspect No. 2” within the report, told the main suspect to show the female student the files on the iPod as proof of possessing the confidential information. The main suspect said he would not because then she would have evidence against him, the report read.
The second suspect claimed the main suspect had the personal information on a computer that morning, but did not think he downloaded it.
The report later continued, “[Suspect No. 2] stated he wasn’t sure how Suspect No. 1 obtained the information, but did see him looking at it. He further stated that he had no involvement in the incident.”
When questioned by Officer McLeod the main suspect claimed when he plugged his iPod into the school’s computer the student files “just appeared.” He denied downloading the information and claimed he was “just joking around” when he made the threat to the female student about using her information to buy a vehicle.
Officer McLeod spoke with “Witness No. 4,” Keith Stephens, a Clay High School IT Programming teacher and only non-juvenile witness in this case, about what he observed.
Stephens said he saw the two suspect students “looking intently at the computer and getting worked up over it,” the report read. Stephens approached the students and saw the personal files on the computer. He then questioned them about how they got the information. They stated it “just appeared.”
He advised them to log out of those files and delete any they may have downloaded.
The suspects said they would, but the teacher did not witness them doing so.
The second suspect again denied involvement and gave the administration permission to look through his “jump drives” and any other electronic device he had on him.
Nothing was found during this search, the report read.
“At this point, it is still unknown how the suspect obtained this information and for how long he had it, or if he gave it to anyone else. It is unknown whether the suspect had the files on his iPod prior to [Jan.] 11 or if he obtained them that day,” Officer McLeod wrote in the report’s concluding paragraph.
On Jan. 12 and Jan. 17, Hall sent letters notifying the local community about the incident.
