FreeNow and the Borrowed Password
Two seniors, Ana and Dev, built FreeNow, a web app that tells students which classmates are free during each period. Ana's friend, an office aide, lent them her student portal password for one afternoon. They scripted a scrape over that lunch period and pulled the schedules of all 1,240 students, including period-by-period room codes. The codes expose services: RSC is the resource room, COUN is counseling, NUR is the nurse. The data sit in a public Firebase Realtime Database whose rules are read true and write true, and four other students have the admin link. Forty classmates are beta testing. The district student information system terms of service prohibit automated access, and the student handbook prohibits sharing credentials. The regional hackathon is in nine days, and its Impact category asks teams to show real user data. Ana and Dev plan to publish the app, list it in their college applications, and describe it at the CS showcase. Their teacher learns all of this on a Friday afternoon.
1. Sort the problems in this scenario by severity, and classify each as legal, policy, or ethical.
Read the worked answer
Severity roughly tracks irreversibility and who is harmed. Most serious is the public database: 1,240 minors' schedules, with room codes that disclose disability and counseling status, readable and writable by anyone on the internet. That is an active data exposure and potentially a reportable breach under district policy and state student-data law; it must be closed before any pedagogical conversation. Next is the unauthorized access: an aide's credentials were used to reach a system whose terms of service forbid automated access and whose acceptable-use policy forbids credential sharing. Whether or not anyone prosecutes, this is not a gray area, because the account holder did not authorize this specific use and the records she was trusted to see were copied. Third is the plan to publish and to present the work as a college achievement without disclosing provenance. FERPA binds the district, not the students, so the teacher's duty is to escalate to the administrator who owns compliance rather than adjudicate FERPA personally. The students' ethical failure is separable: they had a legitimate idea and chose a shortcut that used a friend and 1,240 uninvolved people as means.
2. Give the action plan with sequencing, and say what the students may still do about the hackathon.
Read the worked answer
Immediately: set the Firebase rules to deny all reads and writes, export nothing to personal devices, and delete the schedule data, sending the principal a screenshot of the closed rules. Same day: report to the administrator responsible for student records, name the aide's account so her password can be reset, and notify the district so it can decide whether breach notification is required; that decision is the district's, not the teacher's. Within the week: meet the two students with a written account of what happened, separate the technical work from the conduct, and refer the conduct through the handbook process. For the hackathon they can still enter. Rebuild the demo on a synthetic dataset of 1,200 generated students with no real names or service codes, keep only free or busy, and write a one-page privacy design explaining the earlier failure and the fix. That is a stronger Impact submission than stolen data, and it is honest. Read the category rules carefully: real user data means real usage, not real records, so a small opt-in pilot with signed consent and a school-approved feed is achievable in nine days if they ask now. What they may not do is submit quietly and hope.
3. How should the teacher grade this, and what should the class learn from it?
Read the worked answer
Grade the computing separately from the conduct. The scheduling algorithm, the match logic, and the interface can earn full credit; the data-acquisition decisions earn none, and a required ethics impact assessment replaces that portion of the grade. Teach the lesson without humiliating the two students: present an anonymized version and have teams complete a structured analysis covering stakeholders, data strictly necessary to the function, who consented, what happens if the database is public, and what a regulator would ask. Then have them redesign FreeNow to meet the same user need using only free-or-busy booleans, an official roster feed, and opt-in enrollment. Name the professional standards explicitly: the ACM Code's avoid-harm, respect-privacy, and comprehensive-evaluation principles. Close with the honest observation that the shortcut was available because the legitimate route was slow, that the legitimate route is slow for reasons, and that choosing it under deadline is what distinguishes a professional from an enthusiastic amateur. The conduct referral still proceeds; a good lesson does not substitute for accountability.