I agree with almost everything you've said :)

> I absolutely agree, that a student (or anyone) could gain unauthorized access to the computer / network is the primary concern. The fault there lies not with the student, but with the computer / network security.

This is incorrect and your reasoning here is faulty. It is diametrically opposed to how the community at large views this issue. If we treat children in this way, and then when the clock strikes 12 and they turn 18 they are suddenly treated in the exact opposite way!! A 180 degree flip. According to your logic, within in the school setting its a harmless prank and the blame squarely lies with the school. However, turn 18 and perform the exact same actions (simple intrusion) on an corporate server. Guess where the (legal) blame will lie??

I took issue with comments that the actions were a harmless prank. As adults, and particularly as teachers our duty is to help shape the next generation of ethical citizenry. Laughing this incident off and applying a token punishment would send the wrong message.

In many jurisdictions unauthorized computer access is a crime. If a student gained access to a NSA computer, do you think law enforcement would treat it as a harmless prank? Even if no data was destroyed or tampered with. The act of intrusion is itself a serious matter.

The school has a duty to use this as an opportunity to

1. Update their network security (obviously!)

2. Educate students that they can end up in prison (even as minors!) if they break into the wrong computer network.

This doesn't mean applying an out of proportion punishment to this student in order to make an example of him. This means applying a fair and proportionate response which, and i'' say it again... sits between the 2 extremes of "harmless prank" and felony offense.

The issue I've had all along is with brushing this away as harmless. Unlawful intrusion is a crime. As teachers we would do a poor job preparing our students for the real world by treating it, within the school setting, as a "harmless prank"

A harmless prank is throwing a water balloon at someone. Breaking and entering (digital or otherwise) is not in this category.

In addition, the law does not treat the flimsiness of the lock as a mitigating circumstance. You can protect your physical property with a $2 lock and, in the eyes of the law anyone circumventing this would be guilty of break and enter, in the same way as if they broke into a far more fortified premises.

laughing away the student's actions as a "harmless prank" would be to miss a valuable learning opportunity for everyone involved!

> What the student in this case did was effectively provide free pen-testing

This was not a noble white-hat! If the student found an exploit and then went straight to the teacher to inform them, do you think this would have ever made front page news? The student had a history of "free pen testing", and they used this particular exploit to attempt malicious access and tampering of a teacher's machine.

Imagine if you did the same at your workplace. "Hey boss I have a habit of stealing coworker passwords. Dont worry though, it's just a harmless prank! HAHA"