More News

This story was corrected on Feb. 3, 2010. An explanation of the correction follows the story.

Montgomery County Public Schools officials are beefing up computer security at all schools and Winston Churchill High School teachers are reviewing grades after a handful of students allegedly hacked into the Potomac school's grading system, according to school system spokesman Dana Tofig.

The students allegedly used a program that can be run off a portable USB drive to record keystrokes and to uncover teacher passwords, Tofig said. The students may have changed grades, he said.

"In response to this incident, we will be limiting what actions can be done using a USB device. So, for instance, a person may be able to save a document to a thumb drive, but will not be able to run a program off of a USB device," Tofig wrote in an e-mail to The Gazette.

The issue of students changing grades and people attempting to break into MCPS data systems is "not new," Tofig wrote. Walt Whitman High School principal Alan Goodwin confirmed that a student hacker broke into the grading system at Whitman last fall after plugging into the school's network through a personal laptop.

The student was found to have changed two grades and was punished, Goodwin said.

The student was using sophisticated hacking techniques and could potentially have caused more damage than he did, Goodwin said.

"The phenomenon with some of these computer hackers is they like the challenge, and they don't necessarily do a lot of damage once they've been able to reach whatever their goal was," Goodwin said.

Some of the securities the school system has in place to ward of hackers include access controls and firewalls, Tofig wrote in his e-mail.

Churchill parents were notified of the possible breach Jan. 27, Tofig said.

A Churchill teacher noticed "something wasn't right" with a student's grades and brought it to the attention of the administration, Tofig said. The school's IT department began investigating students at Churchill, he said.

"Obviously we take the security of data and information very seriously, and if students were found to have changed grades, they would face very serious consequences from the school system," Tofig said. Student penalties would be issued on a case-by-case basis, he said.

As of Tuesday, six students had been identified as potentially involved with the scheme, though their level of involvement — and whether there are more students involved — is still under investigation, Tofig said. Students used the program to uncover the access codes and passwords of "at least three" teachers.

Principal Joan Benz did not return calls for comment. The investigation is internal to MCPS, and the school's educational facilities officer is helping to gather information, said police spokeswoman Lucille Baur. There is not a criminal investigation at this time.

The grading system tracks who makes changes, what those changes were, when they were made and what the original grade was, Tofig said.

Janis Sartucci, an activist with the Parents' Coalition and former Churchill parent, said "there are a fair number of students given access to computer work stations, through [student service learning] hours or internships or assisting teachers, where they can have access to the same computer that's being used by teachers."

Tofig said he did not believe the problem was "widespread."

"At this point in the investigation, we don't believe that this is something that affected a large number of students, but we need to look and make sure that that's the case," Tofig said. "Even if it's one or two students, it's too many."

Teachers are in the process of checking and verifying that student grades for this school year are correct, Tofig said. The investigation will not delay the issuing of second quarter report cards today, Tofig said.

"If as a part of our investigation we found a grade that was changed and it's on a report card, we can make that change if we need to" by re-issuing the report card with the correct grade, Tofig said.

Laura Siegel, a Winston Churchill cluster coordinator and Churchill parent, said that some parents are raising concerns about information security at the school. "How could the system be accessed so easily, that's my question," Siegel said.

Correction: This story was corrected to report that there is not currently a criminal investigation into the alleged hacking.