Opinion
No. 289 C.D. 2007.
Submitted on Briefs: June 8, 2007.
Decided: November 5, 2007.
Appeal from the Court of Common Pleas, York County, No. 2006-SU-3944-Y08, Adams, J.
Daniel M. Fennick, York, for petitioner.
Michael W. King, York, for respondent.
BEFORE: SMITH-RIBNER, Judge, and PELLEGRINI, Judge, and LEAVITT, Judge.
M.T. for A.T. (Student) appeals from an order of the Court of Common Pleas of York County (trial court) affirming the decision of the Central York School Board (Board) expelling Student for the remainder of the first semester of the 2006-2007 school year because he violated Central York School District's (School District) Computer Use Policy.
The School District has adopted a "Code of Student Conduct" (Student Code) which generally provides that violating "any local, state or federal law" can result in suspension or expulsion from school. It includes a detailed "Acceptable Computer Use Policy" (Computer Use Policy) which states, in pertinent part, the following:
Prohibitions. Use of the Internet, email, and network technology must be in support of the educational mission and instructional program of the Central York School District. With respect to all users, the following are expressly prohibited and violation may result in loss of privileges:
1. Use of inappropriate or illegal purposes.
2. Use in an illegal manner or to facilitate illegal activity.
* * *
9. Use to infiltrate or interfere with a computer system and/or damage the data, files, operations, software, or hardware components of a computer system.
* * *
11. Use to obtain, copy, or modify files, passwords, data or information belonging to other users.
12. Loading or using unauthorized games, programs, files, music, or other electronic media.
* * *
23. Any attempt to circumvent or disable the filter for any security measure.
* * *
26. Shall not disclose, use, or disseminate any personal identification information of themselves or other students.
The Student Code also has an Appendix that contains tables of offenses and shows the disciplinary options for each one. According to the Appendix table, the disciplinary options for violating the Computer Use Policy are denial of computer and internet privileges or possible suspension for one to 10 days. The Student Code further advises that "the Appendix is a guide and individual case may warrant the modification of . . . penalties." Students and parents are provided with copies of the Student Code, including the Computer Use Policy, through distribution of the Student Planner. Regarding computer-related misconduct, the Student Planner states that any inappropriate use of the internet or the School District's technology will result in "technology restrictions and/or disciplinary action."
The Student Planner further provides:
Inappropriate Computer use will be disciplined according to the following progressions:
First Offense: 5-day loss of privileges and detention or ISS [in-school suspension].
Second Offense: 10-day loss of privileges and ISS [in-school suspension].
Third Offense: 15-day loss of privileges and OSS [out-of-school suspension].
At the beginning of the 2006-2007 school year, Student and his mother, M.T., acknowledged receipt of the Student Planner and their awareness of its contents, including the Student Code. Student also signed a copy of the Computer Use Policy.
On October 16, 2006, an unauthorized photograph of a shirtless male student appeared on the School District's web site. The School District investigated the incident and determined that the security of its network and computer systems had been breached. It suspected that Student, a tenth grader at Central York High School, was responsible for the breach because he had been suspended for other computer-related misconduct during the preceding school year. The School District questioned him, and he admitted that he had helped another student hack into the School District's computer system by "cracking the hash" or decoding encrypted information with "OPH Crack" software. Student further admitted that he supplied user names and passwords to the other student who used that information to enter non-student areas of the computer system to install software and to manipulate the School District's database. Pending a hearing before the School Board, the School District suspended Student on October 18, 2006. Approximately one week later, the School District issued a formal notice of charges, including violation of the Computer Use Policy and violations of any local, state or federal law, and scheduled a hearing.
Student received a three-day in-school suspension after being involved in creating a web site where persons could create fake identification cards that were virtually identical to those issued by the School District.
At the hearing, Richard Burd (Burd), the Superintendent for Administration testified that when he became aware of the unauthorized use of the School District's computer systems, he spoke to Student based on some investigative work. Student admitted to him that another student had attempted to gain access to the main server but because it had an encrypted code, he was unable to do so. Student was able to "crack the hash" and passed the information on to the other student. Burd stated that Student was cooperative in the investigation.
Joseph Lucia (Lucia), the Network Administrator for the School District, also testified that he interviewed Student who told him that he obtained passwords that he was not authorized to have or to use to enter other portions of the computer system. Specifically, he used an administrator password to install Log Me IN software which allowed users from the internet to connect to the computer. He also had access to a few teacher accounts, but he did not identify which teachers; he also logged in to the HVAC system and the MySQL database, a web database that held a ticket system, an inventory, and a student database that held passwords for teachers. Lucia stated that once he knew how the user names and passwords were obtained, he could determine what logins were on the domain and was able to change the passwords so that anyone who had them to gain access to the web server would not have that access any longer. Additionally, the folder that was created that housed this information was removed and put into backup in case evidence was needed. Only then was the system secured, and the School District was able to continue as normal. Lucia summed up by stating that Student's principal role in this matter was cracking the code and supplying that information to another student, but it was the other student who disrupted service to the School District.
Finally, Jay Butterfield (Butterfield), the Principal at Central York High School, testified for the School District regarding the acceptable use guidelines for computers and network for the School District which he indicated was signed by Student. Butterfield stated that he believed that "the mining of any resource that opens the door to our secure systems is an extremely serious event for a school. We don't know the extent to which someone with that information could undermine or, in fact, completely disable or destroy the systems that we have become dependent upon. As we have gone from a paper system to a paperless system, and as we have gone to more electronic management, the security of our systems have become much more critical and also much more vulnerable to that sort of an attack." (Reproduced Record at 168a-169a.) When he recommended that Student be expelled for the remainder of the semester and removal of computer privileges for the remainder of the entire school year for such egregious conduct, counsel for Student asked him if anywhere in the Computer Use Policy it indicated that a violation of the Policy could lead to expulsion. Butterfield responded by saying, "No." (Reproduced Record at 172a.) When Counsel for Student further asked if any of the offenses listed in the Student Code that could lead to expulsion included a reference to computer use policy, he also responded, "No." (Reproduced Record at 173a.) He admitted that the discipline for such a violation was a 10-day loss of privileges and an in-school suspension, but also noted that the Student Code also stated that the appendix was a guide and individual cases would warrant modification of penalties. Further, the Student Code provided that any violation of local, state or federal law could result in expulsion, and to his knowledge, there were state laws that dealt with the issue of computer hacking and unauthorized access to computer systems.
As for any testimony by Student, he was advised by his counsel and parents not to testify, but an exhibit was offered into evidence by the School District that he "saved student password database to a PDF, logged into, but did not change the HVAC system as well as the MYSOL database; had access to a few teacher accounts, remote administration tools were used with the passwords to log into computers." Student's mother testified that she did not recall receiving the Code of Student Conduct, but even if she did, she was not aware that it was a violation of the School District's rules for students to gain unauthorized access to the computer systems, stating that "I think I would have know that, even if I hadn't read anything. It's just something I would have known, yes." (Reproduced Record at 188a.) Similarly, when asked if Student read the Code of Student Conduct and was aware of the rules regarding illegal use of computer systems, she responded, "I think so. I don't think that he knew the specifics of — You know, there was all of these different books and rules and stuff. I don't think he knew the specifics, but I think he knew in general that it was something he should not be doing." (Reproduced Record at 189a.)
Following the hearing, the School Board concluded that Student's conduct constituted a violation of Sections 1, 2, 9, 11, 12, 23 and 26 of the Computer Use Policy and Section 1318 of the Public School Code of 1949 (School Code). The School Board further concluded that Student had violated Sections 7611(a)(2) and (a)(3) of the Pennsylvania Crimes Code, 18 Pa.C.S. §§ 7611(a)(2) and (a)(3), which prohibit unlawful use of a computer. Based on these violations, the School Board issued an adjudication expelling Student for the remainder of the first semester of the 2006-2007 school year which was to end on January 27, 2007. The School Board found that while Student was forthcoming in cooperating with the investigation, it was troubling that he was previously disciplined for computer-related misconduct. Student filed an appeal with the trial court, which affirmed the School Board's decision, and this appeal followed.
Act of March 10, 1949, P.L. 30, as amended, 24 P.S. § 13-1318. That section provides, in relevant part, that a school board may expel a student for misconduct after a proper hearing.
18 Pa.C.S. § 7611(a)(2) and (a)(3) provide the following:
In Pennsylvania, a person commits the offense of unlawful use of a computer if he:
(2) intentionally and without authorization accesses or exceeds authorization to access, alters, interferes with the operation of, damages or destroys any computer, computer system, computer network, computer software, computer program, computer database, World Wide Web site or telecommunication device or any part thereof; or
(3) intentionally or knowingly and without authorization gives or publishes a password, identifying code, personal identification number or other confidential information about a computer, computer system, computer network, computer database, World Wide Web site or telecommunication device.
It is unclear as to whether this case is moot because we do not know if Student was actually expelled for any portion of the fall semester of his sophomore year. Nonetheless, because this issue is capable of repetition and evading review and because a school district's ability to regulate student conduct is of great public importance, we shall address the issues raised in this appeal. In re: Appeal of JAD, 782 A.2d 1069 (Pa.Cmwlth.2001).
Our scope of review is limited to determining whether the School Board's adjudication is in violation of the Student's constitutional rights, whether it is in accordance with the law or whether the findings of fact are supported by substantial evidence. Hamilton v. Unionville-Chadds Ford School District, 552 Pa. 245, 714 A.2d 1012 (1998).
Student contends that the School Board erred in expelling him because the School District charged him with a violation of the Computer Use Policy and a violation of state law. However, under the Computer Use Policy, the maximum penalty was a suspension of up to 10 days, and under the policy violations in the Student Code, which indicated that a student could be punished for violating "any local, state or federal law," violation of computer usage was not listed. The Board disagrees and argues that it used the School Code as a whole to determine the appropriate penalties because the Computer Use Policy does not presume to identify all conduct that is also a violation of law or conduct that is so severe that it would be considered a felony under Pennsylvania law.
In this case, the School Board properly exercised its discretion to expel Student. While the Computer Use Policy suggested penalties up to a 10-day suspension, it also indicated in the Appendix that such a punishment was only to act as a guide, and an individual case could warrant the modification of the listed penalties. This is such a case. Although Student argues that there is a "lack of proportionality" between the violation and the sentence, the evidence suggests otherwise. Previously, he committed a serious and potentially damaging violation of the School District's Computer Use Policy when he made false student identification cards, and this time he committed a more serious violation of the School District's Computer Use Policy by decoding encrypted information and helping another student access extremely sensitive and private School District information. Given his history, a 10-day suspension was not likely to get his attention because he did not learn from his prior suspension for computer misconduct, and given that his conduct is felonious under the Crimes Code, an expulsion was entirely appropriate.
Citing Commonwealth v. Oxford Area School District, 24 Pa.Cmwlth. 421, 356 A.2d 857 (1976), Student argues that the deliberations of the School Board were tainted where Dr. Estep, the Superintendent, acted both as a prosecutor and as a judge when she discussed Student's conduct with Burd, thereby merging the adjudicatory and prosecutorial functions of the administration. In Oxford, the superintendent voted along with the school board that rendered the final decision and acted as an adverse witness at the dismissal hearing of the teacher. We found that this constituted a commingling of functions and that the teacher's rights were not reasonably safeguarded. However, Oxford is clearly distinguishable from this case because the Superintendent was not part of the voting process and was not an adverse witness at Student's disciplinary hearing. Moreover, the testimony of Burd indicated that he did not discuss the details of the case with her or any recommended discipline, but rather whether they should talk to the students about whether they should erase everything from their computers. (Reproduced Record at 137a-139a.) Based on this limited conversation, we do not believe there was any commingling of her functions as both prosecutor and judge, and Student's rights were properly safeguarded.
Accordingly, the order of the trial court is affirmed.
ORDER
AND NOW, this 5th day of November, 2007, the order of the Court of Common Pleas of York County, dated January 12, 2007, is affirmed.
The question is not whether we judges approve of the School District's decision to expel Student for helping a friend hack into the school's computer. The establishment of a student disciplinary policy lies, appropriately, with school administrators. However, once that policy is established, those school administrators have a statutory duty to communicate the particulars of that policy, in writing, to students and their families. Here, Student's expulsion was directly contradicted by the Code of Student Conduct's (Student Code) explicit directive that Student's misconduct would be punished, at most, by a 10-day suspension. Therefore, I must respectfully dissent.
The School District makes computers available to its students and has adopted rules for their use. The rules identify "appropriate use" of the District's computers and, reasonably enough, also identify prohibited uses. With respect to the latter category of uses, the "Acceptable Computer Use Policy" (Computer Use Policy) states, in relevant part, as follows:
Prohibitions. Use of the Internet, email, and network technology must be in support of the educational mission and instructional program of the Central York School District. With respect to all users, the following are expressly prohibited and violation may result in loss of privileges:
1. Use for inappropriate or illegal purposes.
2. Use in an illegal manner or to facilitate illegal activity.
* * *
9. Use to infiltrate or interfere with a computer system and/or damage the data, files, operations, software, or hardware components of a computer system.
* * *
11. Use to obtain, copy, or modify files, passwords, data or information belonging to other users.
12. Loading or using unauthorized games, programs, files, music, or other electronic media.
* * *
23. Any attempt to circumvent or disable the filter for any security measure.
* * *
26. Shall not disclose, use, or disseminate any personal identification information of themselves or other students.
Reproduced Record at 221a (R.R. ___).
The Computer Use Policy is part of the Student Code that is "designed to maintain a standard of conduct in the schools of the district." Supplemental Reproduced Record at 3b (S.R.R. ___). The Appendix to the Student Code contains tables that list offenses and the discipline that can be imposed for each type of offense. According to this table, violating the Computer Use Policy can result in a denial of computer and internet privileges and possible suspension for one to ten days. Additionally, the Student Planner states that any inappropriate use of the internet or the School District's technology will result in "technology restrictions and/or disciplinary action." Specifically, it states:
According to Principal Jay V. Butterfield, the Student Planner is a handbook distributed to students every school year. Notes of Testimony, November 1, 2006, at 44; R.R. 160a. The scope of the Student Planner is unclear since only relevant portions and not the entire document have been included in the record. According to Butterfield, the Student Planner is "derived directly from the [Student] Code," and consolidates the expectations for students regarding the school's rules and regulations. Id. at 45; R.R. 161a.
Inappropriate Computer use will be disciplined according to the following progression:
First Offense: 5-day loss of privileges and detention or [in-school suspension].
Second Offense: 10-day loss of privileges and [in-school suspension].
Third Offense: 15-day loss of privileges and [out-of-school suspension].
R.R. 229a (emphasis added). Thus, a second instance of inappropriate computer use by a student will result in a 10-day "loss of privileges and suspension."
The School Board found that Student engaged in conduct prohibited by the Computer Use Policy, including the proscription against using a computer in an illegal manner, and that it was Student's second "computer-type" offense. According to the Appendix to the Student Code, a violation of the Computer Use Policy, including using a computer in an illegal manner, can be punished by a denial of computer/internet privileges and/or possible suspension for one to ten days. According to the Student Planner, a second violation of the School District's technology rules will result in a 10-day loss of technology privileges and in-school suspension. In short, these very specific disciplinary directives establish that a 10-day suspension is the maximum penalty for student's conduct. However, the School Board did not suspend student but expelled him.
Student's first offense involved his creation of a web site, apparently using his own computer, where persons could create fake identification cards that were virtually identical to those issued by the School District. Student received a three-day in-school suspension for this misconduct, but it is not clear whether his first action violated the Computer Use Policy or some other provision of the School Code.
To justify its expulsion of Student, the School Board relied on the "Exclusion from School" provision in the School Code that identifies a long list of conduct that can result in either suspension or expulsion. The list includes such conduct as drinking, using drugs, theft, gambling, vandalism of school property and bringing incendiary devices to school. Nowhere on that list is there any reference to the school's computers, a point acknowledged by the School District.
The School Code states:
Exclusions from School
The Board of School Directors has defined the types of offenses, which could lead to exclusion from school. These offenses may take the form of suspension or expulsion and include the following:
1. Disrespect/ Insubordination or defying school staff;
2. Destruction or willful defacing of school property;
3. Hazardous or unauthorized use of vehicles;
4. Use, possession or distribution of dangerous drugs or drug related paraphernalia as defined in the "Dangerous Drugs, Device and Cosmetics Act";
5. Use, possession, or distribution of "look-alike" drugs defined as a non-controlled substance that has a stimulant or depressant effect on humans and substantially resembles a controlled substance in appearance;
6. Use, possession, or distribution of anabolic steroids as defined in Act 93 or 1989;
7. Use or possession of alcoholic beverages;
8. Use or possession of dangerous weapons, look-alike weapons, or fireworks;
9. Use or possession of tobacco products or lighted cigarettes;
10. Fighting or physical assault;
11. Theft;
12. Gambling;
13. Use of profane language or obscene gestures;
14. Disorderly, vicious, illegal, or immoral conduct;
15. Persistent or severe harassment, intimidation, extortion, or bullying;
16. Participation in or responsibility for causing willful damage, destruction, or vandalism to the personal property of District employees, either on or off school premises;
17. Verbal or physical assault directed toward a District employee or toward an employee of the school bus company, either on or off school premises;
18. Violation of any local, state, or federal law;
19. Persistent violation of school rules and regulations;
20. Excessive unexcused absence by a student not subject to compulsory attendance laws.
21. Possession of any weapon as defined by Act of 1995 of 1995 to include, but not limited to, any knife, cutting instrument, cutting tool, nunchaku, firearm, shotgun, rifle and any other tool, instrument, or implement capable of inflicting serious bodily injury.
22. Possession, use of any incendiary devises to include but not be limited to lighters or matches.
23. Collection of money in school or on school property, or at any school sponsored event, by a student for personal benefit.
S.R.R. 5b (emphasis original).
Notwithstanding the lack of any reference to computers in the Exclusion from School provision of the School Code, the School District hangs its hat on Item 18: "Violation of any local, state or federal law[.]" S.R.R. 5b. Student was not charged or convicted of a violation of any law. However, the School District believes the lack of any law enforcement action against Student is of no consequence to the application of Item 18. It believes that hacking into a computer is a substantive violation of the Pennsylvania Crimes Code, giving it grounds to suspend or expel Student, and it chose the latter. There are several flaws in the School District's position.
First, the District's reading of Item 18 in the Exclusion from School provision is unsupportable. To use a "violation" to sanction a student, there must be a prosecution by a law enforcement authority. That is the only way to establish a "violation of law." Item 18 did not say " conduct that violates law" could lead to suspension or expulsion. It stated "violation." Because the fact of a violation of the Pennsylvania Crimes Code by Student has never been established, Item 18 did not authorize the School District to expel Student.
Student argues that the School Board lacked jurisdiction to determine whether he violated Section 7611(a)(2) and (3) of the Pennsylvania Crimes Code, 18 Pa.C.S. § 7611(a)(2), (3), which makes it unlawful for a person to intentionally and without authorization access or alter any computer network, or provide another person with a password to a computer network. The majority has inexplicably omitted this issue.
Second, the School District's reading of Item 18 is so expansive it renders the point of the Student Code, i.e., communication of the rules to students, meaningless. The School District's reading would give the District authority to expel a student who is seen jaywalking, even though that student never receives a citation for this misadventure or pays a fine. It would be enough, apparently, for the School District to rely on the statement of a witness who saw the deed or to extract a confession from the scofflaw student. No one can read the Student Code and understand that jaywalking, or not filing taxes on time, will lead to any expulsion from school.
In the introduction to the Student Code, the District's Superintendent explained that the publication of the Student Code was "intended . . . [to meet] the legal requirements of Section 12.3(C) of the Pennsylvania Code, which requires that the District adopt these provisions, and distribute copies to both students and parents." S.R.R. 3b. The reference is to 22 Pa. Code § 12.3(c), which states:
(c) Each governing board shall adopt a code of student conduct that includes policies governing student discipline and a listing of students' rights and responsibilities as outlined in this chapter. This conduct code shall be published and distributed to students and parents or guardians. Copies of the code shall also be available in each school library.
(emphasis added). This regulation was promulgated pursuant to the State Board of Education's broad authority to "establish standards governing the educational program of the Commonwealth." Section 2603-B(a) of the Act of March 10, 1949, P.L. 30, added by the Act of March 30, 1988, P.L. 321, as amended, 24 P.S. § 26-2603-B(a).
Third, the School District's reading of Item 18 conflicts with the provision in the Student Code that using a school computer "in an illegal manner" will result, at most, in a 10-day suspension. The School District has the general Exclusion from School provision trumping the very specific provision in the School Code on what happens when a student uses a computer "in an illegal manner," which is the opposite of what should occur. When a general provision is in conflict with a special provision and the conflict is irreconcilable, the special provision shall be construed as an exception to the general provision. Section 1933 of the Statutory Construction Act of 1972, 1 Pa.C.S. § 1933. See also Hamilton v. Unionville-Chadds Ford School District, 552 Pa. 245, 249, 714 A.2d 1012, 1014 (1998) (stating that the rules of statutory construction apply to the interpretation of school policies). It is not even clear there is a conflict because the two provisions can be read together. The Exclusion from School provision authorizes suspensions or expulsions for violations of law; the specific provision on using school computers "in an illegal manner" clarifies that the sanction will be a suspension. The School District simply reads the Exclusion from School provision in a vacuum.
In short, I do not believe the School District's expulsion of Student was authorized by Item 18 of the Expulsion from School provision. The majority also relies on prefatory language to the Appendix, which states that "individual cases may warrant the modification of penalties." S.R.R. 10b. I disagree that this statement authorized the expulsion of Student.
Again, the rules of statutory construction provide direction. Section 1921(a) of the Statutory Construction Act of 1972, 1 Pa.C.S. § 1921(a), provides that "[e]very statute shall be construed, if possible, to give effect to all its provisions." Stated otherwise, every provision of a statute is presumed to be intended for some purpose and may not be reduced by interpretation to mere surplusage. Philadelphia Correctional Officers Association v. Pennsylvania Labor Relations Board, 667 A.2d 459, 462 (Pa.Cmwlth.1995).
Applying these principles here, the majority would have one sentence in a preamble render the very specific disciplinary provisions that have been published and distributed to the student body and parents mere surplusage. Further, the School District's reading of "modification" is overly broad. "Modification" suggests a tinkering with the sanction the District has publicized, such as increasing the length of the suspension, not a wholesale disregard of an unequivocal statement. More importantly, the majority gives the School District a pass on its obligation to inform students and their families, in writing, of what conduct is expected in schools and what happens when expectations are not met.
School boards have broad discretion in determining school disciplinary policies, and courts are not inclined to interfere with such matters unless it is apparent that the school board action was arbitrary, capricious and prejudicial to the public interest. Flynn-Scarcella v. Pocono Mountain School District, 745 A.2d 117, 120 (Pa.Cmwlth.2000). However, a school board must operate within statutory and constitutional restraints. 22 Pa. Code § 12.3(a). One such restraint imposed by the State Board of Education is to require school districts to give students and their parents notification of student conduct rules. To reach that end, a school board must adopt a code of student conduct; publish and distribute the code to students and parents; and define and publish the types of offenses that could lead to exclusion from school, whether by suspension or expulsion. 22 Pa. Code §§ 12.3(c), 12.6(a).
The regulation states, in pertinent part:
(a) The governing board has the authority to make reasonable and necessary rules governing the conduct of students in school. The rulemaking power, however, is not unlimited; it must operate within statutory and constitutional restraints.
22 Pa. Code § 12.3(a) (emphasis added).
See n. 5, supra, for the text of 22 Pa. Code § 12.3(c). The regulation at Section 12.6(a) mandates that a school board "shall define and publish the types of offenses that would lead to exclusion from school." 22 Pa. Code § 12.6(a).
The regulation requires a school district to communicate the rules to students to avoid surprise. The regulation is frustrated when a school district purports to reserve to itself unbridled discretion to disregard the express and specific terms of its Student Code. The preamble to the Appendix cannot nullify what follows in the Appendix. However, lest there be any question about the meaning of the preamble, it was resolved by the Student Planner, which provides for a maximum 10-day loss of computer privileges and an in-school suspension.
At a minimum, the School District should provide some standards for when it will exercise discretion to deviate from its published norm, such as, for example, where student safety is an issue.
For the foregoing reasons, I believe the School Board abused its discretion by ignoring its own stated policy and arbitrarily expelling Student. Flynn-Scarcella, 745 A.2d at 120. I would reverse the order of the trial court and the adjudication of the School Board expelling Student from school. Any other result renders the publication of the Student Code an empty exercise.
I agree with the majority that the School District's Superintendent did not commingle her prosecutorial and adjudicative functions.