Okey, this is going to be quite a specific question about something that has come up.
I am a school student, and I sent various emails to the developers of the school management software that my school uses.
I was questioning them about the possibilities of API access into the data, besides the unofficial API which I (you could almost say) hacked into. I did mention that I broke into the unofficial API in my emails, and it may be questionable whether that was legal or not - but besides the point at this stage. (Their system was totally unsecured, so technically I didn't hack it at all, but this is a question for security.stackexchange. Another important thing is that I used the words "reverse engineered" which doesn't really describe what I did, but would be technically illegal full stop)

So, my school has been contacted by the developers (whom I had emailed), and basically the school is now wanting a meeting with me and my parents. I am not sure exactly what the meeting is about at this stage, but it may have something to do with my last email which was abusive and I described how terrible the software this company makes actually was. (I sent this email after they ceased to respond to my emails, in frustration) Facts

  • I NEVER metioned my school in my emails, and my emails where from my personal email address which is NOT associated in ANY way with the school.
  • I used my full name in the emails
  • I stated my study year level at school

Somehow, this company has tracked my school down (possibly through the national student data, since this company is basically managing it - is this even fully legal?)

But here's my primary question: Does my school have any right to get involved, considering I never involved my school or linked to them in any way?

If I had referenced my school, I can see why they would want to get involved - I have basically been pointing out how terrible the student management software they use is. But I didn't. How do they have a right to be involved?

  • 1
    What jurisdiction is this? – Dale M Aug 23 '15 at 7:34
  • New Zealand, is that what your asking? – UnfortunateQuestion Aug 23 '15 at 8:56
  • 2
    Please read our policy for questions: the less personalized you can make your question(s) the better. I don't see how most of the detail you provided is relevant to the legal questions. Especially since your titular question is negated by your statement, "I am not sure exactly what the meeting is about...." – feetwet Aug 23 '15 at 14:53

From the sound of it, you have stated that you gained access to school data, possibly including private information about other students, professors, schedules, grades, disciplinary information, financial tuition or salary info, etc., that you were not authorized to have. The question of whether it was properly secured is rather beside the point.

The school will now need to know the precise scope of your snooping: whether you were able to modify any information (i.e. change grades), what purpose to your snooping, etc.


Almost certainly.

The relationship of a student to a school is governed by specific laws and, in the case of a private school, a contract. These will impose obligations on the student to comply with whatever rules are applicable and, in general, to not take actions that are not in the school's interest.

If a school has become aware of activities by a student that breach the "rules"; then they can most certainly take disciplinary action. This would be applicable even if the activities were directed towards a third-party and had the effect of "bringing the school into disrepute".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.