Okey, this is going to be quite a specific question about something that has come up.
I am a school student, and I sent various emails to the developers of the school management software that my school uses.
I was questioning them about the possibilities of API access into the data, besides the unofficial API which I (you could almost say) hacked into. I did mention that I broke into the unofficial API in my emails, and it may be questionable whether that was legal or not - but besides the point at this stage. (Their system was totally unsecured, so technically I didn't hack it at all, but this is a question for security.stackexchange. Another important thing is that I used the words "reverse engineered" which doesn't really describe what I did, but would be technically illegal full stop)
So, my school has been contacted by the developers (whom I had emailed), and basically the school is now wanting a meeting with me and my parents. I am not sure exactly what the meeting is about at this stage, but it may have something to do with my last email which was abusive and I described how terrible the software this company makes actually was. (I sent this email after they ceased to respond to my emails, in frustration) Facts
- I NEVER metioned my school in my emails, and my emails where from my personal email address which is NOT associated in ANY way with the school.
- I used my full name in the emails
- I stated my study year level at school
Somehow, this company has tracked my school down (possibly through the national student data, since this company is basically managing it - is this even fully legal?)
But here's my primary question: Does my school have any right to get involved, considering I never involved my school or linked to them in any way?
If I had referenced my school, I can see why they would want to get involved - I have basically been pointing out how terrible the student management software they use is. But I didn't. How do they have a right to be involved?