The hack started small, in 7th grade, when they bypassed their middle school鈥檚 internet filters to watch YouTube during lunch.
But by the time Jeremy Currier and Seth Stephens were caught, more than two years later, their exploits had given them extraordinary reign over the computer network of the Rochester Community 69传媒, a well-to-do suburban district about 45 minutes outside Detroit.
The teens had access to the logins, passwords, phone numbers, locker combinations, lunch balances, and grades of all 15,000 of their classmates.
They could view teachers鈥 tests, answer keys, and email messages.
They could control the district鈥檚 security cameras and remotely operate its desktop computers via their phones.
The boys were even using district servers to mine for .
鈥淚t wasn鈥檛 anything malicious,鈥 said Jeremy, now 15. 鈥淚 mostly just wanted to figure out what else I could do.鈥
That鈥檚 not how Rochester school officials saw it. Though there鈥檚 no evidence to date that Jeremy and Seth directly threatened anyone, the district expelled both boys, then referred them to the county sheriff鈥檚 office.
Now, the case is raising a number of big questions. Chief among them: How can schools better develop the potential of children with advanced computing skills and a penchant for probing boundaries鈥攂efore things go bad?
Ambitious and creative young people are pushing well beyond the boundaries of school and shaping the conversation about the future of work. Education Week鈥荣 Faces of the Future series profiles students whose stories hold important lessons about the promise鈥攁nd peril鈥攖hat all of today鈥檚 students will face in tomorrow鈥檚 uncertain labor market.
Part 1: The Extraordinary Education of an Elite, 13-Year-Old Problem-Solver
Part 2: He Wants Chicago Kids to Build the Next Silicon Valley. He鈥檚 13.
With the nation facing mounting cyber threats and a severe shortage of qualified cybersecurity workers, the K-12 sector is under considerable pressure to make that a priority. But the reality is that many school districts are still struggling to protect their own networks, let alone prepare the high-tech workforce of tomorrow.
That鈥檚 why Jeremy and Seth are the latest students to be featured for Education Week鈥檚 Faces of the Future series.
Instead of finding themselves on track for advanced degrees and lucrative careers, the boys are at the center of a possible criminal investigation.
鈥淚 can鈥檛 begin to fathom what they did or didn鈥檛 know,鈥 said Michele Stephens, Seth鈥檚 mom. 鈥淭hey were far more knowledgeable than we could ever keep up with.鈥
鈥業 Just Love Figuring Out Problems鈥
Having a young computer whiz in the family can be a mixed blessing.
Just ask Jeremy鈥檚 grandmother.
On a gray October afternoon, Jeremy perched on the edge of her sofa, hands wrapped around his knees in a vain attempt to keep from fidgeting. He sped through the process of helping the 82-year-old set up a new iPad, tossing out mile-a-minute explanations of how to set account preferences and send text messages via Siri.
鈥淒o they have a language on here called 鈥楯eremy Speak?鈥欌 his grandmother asked.
Now a lanky teen with a wispy mustache, Jeremy started taking computers apart when he was 9. He built his first machine from scratch when he was 11. Before long, he was trying to build computing rigs with enough processing power to 鈥渕ine鈥 encrypted digital currencies. After seeing what Jeremy had learned on his own via Reddit, an IT contractor offered him a job on the spot.
鈥淚 just love figuring out problems,鈥 Jeremy said. 鈥淧eople turn on their computer and think it鈥檚 magic. But there鈥檚 actually way more to it than that.鈥
Unfortunately, said Jeremy鈥檚 mother, Janet Currier, the local public schools didn鈥檛 really tap into that passion for hands-on problem-solving. Teachers and counselors didn鈥檛 seem to know what to do with him. The STEM classes offered in middle school felt far beneath Jeremy鈥檚 abilities. Potentially exciting computer science classes weren鈥檛 available until junior or senior year. Jeremy, focused intently on what he could accomplish right now, started bristling at the Rochester district鈥檚 heavy emphasis on college prep.
鈥淚 never wanted to go to school in the morning,鈥 he said. 鈥淏uilding stuff at home was my only interest.鈥
Making things more complicated, Jeremy had few friends.
One of the few peers who shared his passions was Seth, a quiet boy who lived about 10 minutes away.
Their families welcomed the connection.
By 7th grade, the two were having regular sleepovers, staying up all night to play 鈥淐ounter Strike鈥 and mess around on their computers.
鈥楥omplete and Utter Access鈥
Seventh grade was also the year the boys noticed a sticky note attached to one of the public computers in the middle school library. It had a username and password on it, they said, in case students or staff wanted to look up books but had forgotten their own credentials.
Jeremy and Seth discovered that by logging in with the information on the note, then closing out of the library software, they could access files that had been shared with the library鈥檚 adult staff.
States, the federal government, and private businesses are all pushing the K-12 sector to start now with teaching students the foundational skills they鈥檒l need to protect the nation鈥檚 future information-technology infrastructure. It鈥檚 a big lift for many districts, which often lack the money, curriculum, teachers, time, and expertise to introduce such a big topic into an already-crowded school day.
But there are other ways to make sure students don鈥檛 languish or fall through the cracks, said Davina Pruitt-Mentle, the lead for academic engagement for the National Institute for Cybersecurity Education, which is housed in the federal Department of Commerce.
Among the resources available: independent cyberdefense competitions, statewide cyber ranges, and programs like CyberPatriots and Hacker High School.
鈥淵ou have to figure out the aptitude of these students and grab them quickly so they can be put on the right track,鈥 Pruitt-Mentle said.
One of the files, they said, was a Microsoft Excel spreadsheet with a filename that included the school year and the word 鈥渟tudents.鈥 The file was unprotected. They opened it up.
It contained the passwords for every student in the Rochester district.
鈥淚 was 12. I didn鈥檛 want to go up to a teacher and say, 鈥楬ey, I just found an entire list of student passwords,鈥欌 Jeremy said. 鈥淲e wanted to do a little more exploring.鈥
According to the boys, their next step was to access the network from home, via the district鈥檚 online portal.
Over the next two years, they also found a district program that allowed them to change passwords for everyone in the system. They browsed through selected teacher files containing lesson plans, emails, tests, and answer keys.
They installed a software program called 鈥淭eamViewer鈥 on a machine in the back of a science classroom, turning it into a 鈥渟lave computer鈥 that afforded them remote access to any PC in the district.
After the district installed new internet-enabled security cameras, the boys found another sticky note with a username and password, left on the laptop of a school security guard. They used that information to access the camera system, figuring out how to pan, zoom, and watch old footage.
The boys also installed crypto-mining software on the district鈥檚 servers. It remains unclear whose idea it was, whether any money was generated, and who had access to any proceeds.
It鈥檚 also not clear if that鈥檚 the full extent of the boys鈥 exploits. Citing the possible criminal investigation, both families declined to answer questions about the possibility of violations not referenced in the disciplinary documents they received from the Rochester Community 69传媒, copies of which they provided to Education Week.
Regardless, Rochester technology officials bear considerable blame for what happened, said Douglas A. Levin, a K-12 cybersecurity expert who first published an in September.
By leaving its network essentially unprotected, Levin said, the district made it easy for Jeremy and Seth to execute a mind-boggling security breach.
鈥淭he notion that two 12-year olds were able to do this is honestly just extraordinary,鈥 he said. 鈥淭hey had complete and utter access.鈥
鈥業t Was Very Much a Freakout鈥
But just as noteworthy, Levin argued, is what the boys didn鈥檛 do.
There鈥檚 no evidence they cheated or changed grades, disrupted classes or sold answers to tests, zeroed out lunch balances or broke into anyone鈥檚 locker, installed malware or deleted files, harassed people online or stole anyone鈥檚 identity.
Through a bewildering ordeal, that reality has given Seth鈥檚 parents some solace.
鈥淭here are things in our everyday lives that we can all do, that we have access to do, but you just don鈥檛, because you know that鈥檚 crossing the line,鈥 his father said. 鈥淚 think that鈥檚 where Seth was.鈥
Scott and Michele Stephens met 17 years ago, while bowling. Not long after they were married, they moved to Rochester Hills, a suburban community subdivided into neighborhoods with names like Meadowbrook Valley and Heritage Oaks. The schools were a big reason why.
Seth鈥檚 elementary years went smoothly enough. He did well in his classes and took care of his dog and developed a quirky fascination with the Weather Channel. He also showed an aptitude for coding, which eventually led to him using YouTube tutorials to teach himself programming languages like Javascript and Visual Basic.
A spate of recent hackings and cyberattacks directed at K-12 schools鈥攎any by students鈥攈as shone a harsh light on the weak cybersecurity practices in many districts.
Even more worrisome: Surveys suggest district technology officials don鈥檛 appreciate the magnitude of the threat and often aren鈥檛 taking even basic steps to protect their networks.
鈥淔rom a larger perspective, one has to wonder why it鈥檚 been so easy for students to hack their schools,鈥 said Douglas A. Levin, who runs the K-12 Cybersecurity Resource Center. 鈥淚n this particular incident, [Rochester Community 69传媒] left their systems essentially wide open.鈥
By 6th grade, though, serious issues had surfaced. Seth was diagnosed with attention-deficit hyperactivity disorder. He had trouble falling asleep. He would close himself up in his room, get lost in his computer, and refuse to go to bed. Explosive fights would ensue. Michele and Scott removed the door to his bedroom.
Towards the end of 9th grade, they found out Seth was failing three of his classes.
Scott and Michele felt their son鈥檚 needs were going unmet. Worse, his computer talents seemed to be going unrecognized. They started seriously considering other options for the rest of high school.
Still, the call from his principal, saying their son was in trouble, came as a shock.
鈥淚t was very much a freak-out,鈥 Michele said.
Staring Into Uncertain Futures
Officials from Rochester Community 69传媒 declined to comment on the case or be interviewed about the district鈥檚 cybersecurity practices, citing privacy concerns and the possible criminal investigation.
But letters sent to the Stephens and Currier families as part of the disciplinary proceedings against their sons spell out the district鈥檚 perspective.
While the boys 鈥渄id not directly threaten the safety of staff or students,鈥 Rochester officials wrote, their breach of the district鈥檚 network was 鈥減re-mediated [sic], deliberate, and ongoing.鈥
Giving Jeremy and Seth the chance to make amends鈥攑erhaps by helping the district better understand its cyber vulnerabilities鈥攚ould not undo the privacy violations suffered by staff or students, Rochester officials maintained. Nor would it compensate the district for time lost investigating the hack and rebooting its systems.
Ultimately, the district said, expulsion was necessary to deter other students from similar misbehavior.
That decision has left Jeremy and Seth staring into uncertain futures.
There鈥檚 no clear consensus in the field about how to discipline students who hack into their district computer systems, and educators across the country have handled incidents in very different ways.
Research suggests that harsh punishments such as expulsion don鈥檛 have the intended effect, Harper said, either on those who committed the offense or on the broader student body.
鈥淭he message you end up sending is that if students commit an offense, they should do everything in their power not to get caught, because there鈥檚 no way to repair what they broke,鈥 she said.
Their long-term employment prospects should have been bright. In the coming decade, for example, the federal government will be looking for thousands of skilled cybersecurity workers. The growing demand has only been underscored by a steady drumbeat of news stories about hacks, cyberattacks, and digital espionage.
But the boys are unlikely to be eligible for many of those public-sector positions, said Davina Pruitt-Mentle, who helps head at the U.S. Department of Commerce in Washington.
鈥淲ill they be able to pass a background check and get a security clearance?鈥 she said, noting that the process includes a review of candidates鈥 moral character, not just criminal background. 鈥淚鈥檓 not a lawyer, but my money would probably be on 鈥楴o.鈥欌
Depending on how the possible criminal investigation unfolds, private-sector employers may be more accommodating.
But even in the best-case scenario, the teens face a rocky road to the postsecondary degrees and credentials that will unlock more than entry-level IT jobs.
Since getting kicked out of Rochester Community 69传媒, Jeremy has enrolled at Oxford Virtual Academy, a full-time online school run by the Oxford, Mich., school district. He started the year on a kind of probation; because of the nature of his expulsion, the school wouldn鈥檛 give him a laptop to use at home. So twice a week, he heads to a storefront in a strip mall to work at one of Oxford Virtual鈥檚 drop-in centers.
Even before his expulsion, Janet Currier said, she felt on an island, trying to encourage her son鈥檚 interests and talents, even though they鈥檇 long since exceeded her capacity.
Now, she alternates between fury and exasperation at what she views as the Rochester district鈥檚 scapegoating of Jeremy, as well as the criticism she鈥檚 received on Facebook for not punishing him more harshly.
鈥淲hat am I supposed to do? Lock him in his room? Set him on fire? Discourage him from his chosen career path?鈥 she asked.
Seth鈥檚 education, meanwhile, now consists mostly of online Khan Academy courses.
No longer allowed to have a computer in his bedroom, he works mostly downstairs, at a desk cluttered with game controllers and Tootsie rolls, in the room where his dad stores dozens of bowling balls.
After working nightshifts as an electrician at the local Ford plant, Scott spends his days home-schooling Seth, trying to reach his son in a way that a 2017 National Blue Ribbon-winning school district apparently could not.
With little idea how to proceed, Scott has leaned on what he knows. The main project he鈥檚 assigned Seth this semester is to build a website and app that will allow bowlers to track their bowling equipment.
Seth says he still hopes to go to college, to study computer science.
His parents hope that opportunity hasn鈥檛 been lost.
鈥淚t鈥檚 like there鈥檚 this big mature person inside of this little body,鈥 Michele said as her son hung his head quietly beside her.
鈥淗e showed very bad judgment. But they鈥檙e treating him like a criminal.鈥
