Boy, 9, accused of hacking into Fairfax schools' computer system

By Tom Jackman
Washington Post Staff Writer
Thursday, April 15, 2010

Are you smarter than a third-grader? Because the online education system used by the Fairfax County public schools apparently is not.

Police say a 9-year-old McLean boy hacked into the Blackboard Learning System used by the county school system to change teachers' and staff members' passwords, change or delete course content, and change course enrollment. One of the victims was Fairfax Superintendent Jack D. Dale, according to an affidavit filed by a Fairfax detective in Fairfax Circuit Court this week.

But police and school officials decided no harm, no foul. The boy did not intend to do any serious damage, and didn't, so the police withdrew and are allowing the school district to handle the half-grown hacker.

"It's a warning," said Paul Regnier, the Fairfax schools spokesman. "No damage was done, but we went to Blackboard to work with them and make sure somebody else isn't able to do this and cause real harm."

A Blackboard spokesman did not immediately return a call Wednesday seeking comment. Blackboard enables teachers and administrators to post assignments, host discussions and track grades, and students log on to do their work from home. Blackboard's Web site says its software is used by more than 5,000 institutions, including government entities that use it to train or share information with workers. It is also used at George Mason University.

In January, students at Churchill High School in Montgomery County broke into their system to change grades, but that involved stolen passwords, not hacking, and did not involve Blackboard, Montgomery police said.

The Fairfax schools' network security manager reported the breach to police March 22, according to a search warrant affidavit written by Detective Brooke D. Ware. The manager found that most of those targeted worked at Spring Hill Elementary or Churchill Road Elementary schools and that a student's account at Spring Hill had been enabled with administrator privileges, Ware wrote. System administrators typically have the authority to enter the accounts of most or all of the users in a system.

The schools found that the changes to passwords and course work were made from the same IP address. Police obtained a court order from Cox Communications to track down the original computer and then targeted a home in McLean.

Investigators initially suspected the boy's mother and obtained a search warrant for her home computers. But an intensive police investigation -- speaking with the mother and the son -- quickly identified the true culprit, and police decided he didn't deserve a spot on the chain gang just yet.

"He's a very intelligent 9-year-old," Officer Don Gotthardt said, "with no criminal intent." Regnier declined to discuss what might happen to the Blackboard eraser or provide his name, citing confidentiality laws.

© 2010 The Washington Post Company