An unidentified system technician for the Arlington public schools has been cleared of wrongdoing in making emails between teacher Chuck Coughlin and Principal Stavroula Bouris available following an investigation involving the town manager, town counsel, the police chief and the School Committee attorney.

---

---

 

Susan Lovelace, chairwoman of the Arlington School Committee, released a report dated Aug. 8 that says the technician was acting within her job responsibilities and that there was no security breach to the system, because the person who gained access to the e-mail system is an authorized system administrator who was performing assigned responsibilities.

"I am writing to inform you that the Superintendent and the School Committee received a report on August 8th concerning the independent investigation on how emails between Principal Bouris and Mr. Coughlin were obtained," Lovelace told YourArlington.

"All five professionals involved in this investigation: the attorney for the school district, the town's attorney, the Chief of Police,the Town Manager and the Superintendent have concurred that the emails were obtained legally.

"As Chair of the School Committee, I trust that our appointed officials and attorneys have thoroughly studied the facts, conducted a professional investigation and concluded that there was 'no security breach to the system and this was an authorized systemadministrator who accessed the school email system, and the subject emails on said system, in the course of performing her assigned responsibilities.'

"I have decided to share the report in a continued effort to put an end to the false accusations that are being spread and doing damageto our district. It is vital that the public know that our computer network is safe and secure."

Report on e-mail access in full

The Aug. 8 report to Superintendent Nate Levenson from School Committee attorney Alan S. Miller, titled "Report Concerning Access of Emails," says, in full:

"On June 10, 2007, you asked me to conduct an investigation concerning potential inappropriate conduct on behalf of Stavroula Bouris and Chuck Coughlin which came to your attention on June 7, 2007 when you received copies of emails exchanged between them.

 

"You also requested that I investigate whether there was inappropriate conduct in the manner in which the emails were accessed. I have completed the report on Mr. Coughlin, and the report with regard to Ms. Bouris will be completed after she returns from Greece on August 9.

"The issue with regard to the access of emails is an extremely important one.I understand the concern among staff, Town officials and the public concerning potential invasion of what, for the most part, were intended to be private communications.

 

"Although the ArlingtonPublic Schools’ Acceptable Use policies state that emails in the Arlington system are public records and that there should be no expectation of privacy, it is my understanding that computer use or emails are not routinely monitored but are accessed when there is reason to believe that there might be misuse. I conclude, based on my investigation, that the access of the emails in question was both legal and appropriate.

 

{mospagebreak title=An account of the events} 

 

"Based upon discussions with relevant individuals, I believe that the following is an accurate account of the events:

"On or about June 5, 2007, an anonymous typewritten note was left under the door of the 'Individual, who is the Network Technician for the Arlington Public Schools. The 'Individual’s' job responsibilities as described by Steven Mazzola, the Chief Technology Officer for the Town of Arlington, include monitoring the security and integrity of the school’s computer system.

 

"In that capacity she is in possession of an administrative password which permits her complete access to the computer and email systems. The anonymous note, according to the 'Individual,' stated that teachers at the Ottoson Middle School were concerned that the relationship between Ms. Bouris and Mr. Coughlin was having an adverse effect on the school environment.

 

"They were also concerned that they had been used by Mr. Coughlin and Ms. Bouris in the public dispute concerning the renewal of Ms. Bouris’ contract. The anonymous note also said that there were emails between the two that would demonstrate the inappropriate relationship between Mr. Coughlin and Ms. Bouris.

"It is important to note that the manner in which the emails were accessed does not alter the appropriateness of the conduct of Ms. Bouris or Mr. Coughlin.

"Although the identity of the 'Individual' will be obvious to some, because I have found no wrongdoing, the name is not included in this report.

"According to the 'Individual,' her first reaction was that she wanted nothing to do with the issue, and she crumpled up and threw away the note.

 

"Several days later as she heard gossip continue in the School, she became concerned that she was abdicating her responsibilities by not following through on the concern regarding potentially inappropriate emails. Therefore, the 'Individual' used her administrative password and accessed emails between Ms. Bouris and Mr. Coughlin, printed out some and gave them to the Superintendent on June 7, 2007.

"On June 11, 2007, four days after receiving the emails from the 'Individual,' an envelope was left anonymously on the chair in the Superintendent’s office. The envelope contained emails between Mr. Coughlin and Ms. Bouris which were sent from their private, non-school email account(s).

 

"The 'Individual' vehemently denies any role in accessing or delivering those emails. It is my understanding that the private, non-school emails can only be accessed by utilizing the password from those private accounts.

 

"I am unaware of any information suggesting that someone used the Arlington system to access these private email account(s). Should such information come to your attention, it should be investigated immediately.

 

"If the private email account(s) were accessed by a person without authorization from the owners of the account(s), it may have been an illegal activity. Without any evidence that Town computers were used to access the private account(s), it would be a private matter for Mr. Coughlin and Ms. Bouris to pursue.

"Town Meeting recently adopted a bylaw amendment that placed oversight responsibilities of the Town’s information technology systems and the school’s administrative (not academic) technology systems under the Town Manager effective July 1, 2007.

 

"The only school IT position reassigned to the new combined department under the jurisdiction of the Town Manager is the Director’s position. The separate Director of Town Technology and Director of School Technology positions were combined into one position overseeing both functions.

"While the events involving these emails, including the access of the school emails by the 'Individual,' occurred prior to the Town Manager taking over oversight responsibilities, Arlington Town Manager, Brian Sullivan, had several conversations with me expressing his need to know who accessed the school’s email system and how they accessed it to determine whether or not there was any security issue with the system.

 

{mospagebreak title=Town counsel interviews individual} 

 

"With my concurrence, the 'Individual' agreed to be interviewed by John Maher, Arlington Town Counsel.

"Based upon the interview and the description of the 'Individual’s' job responsibilities provided by the IT Director, Mr. Maher concurs with my conclusion that the 'Individual' was acting within her job responsibilities.

 

"It is also clear from the facts that there was no security breach to the system as this was an authorized system administrator who accessed the school email system, and the subject emails on said system, in the course of performing her assigned responsibilities.

"It is my understanding that you did not share the emails with anyone but me until approximately July 13, 2007, after Mr. Coughlin contacted individual School Committee members concerning his plight and characterized the emails as harmless. At that time, and at the request of School Committee members, you provided the emails to them.

"I have also discussed the matter of the emails accessed on the school’s email system with Chief Fred Ryan of the Arlington Police Department, and he concurs with Mr. Maher’s and my conclusion that, based upon the facts as presented and known to date, the 'Individual' did nothing illegal or inappropriate.

 

"I have received an email from Chief Ryan on August 6, 2007 in which he quotes Chapter 266, Section 120 (f) of the Massachusetts General Laws -- Unauthorized access to computer systems; penalties. He states:

"'As you can see, a key element of the crime is access 'without authorization.' I have consulted with Middlesex County Assistant District Attorney Michael Fabbri and he advises that given the fact pattern you describe the only way one could argue a violation of c.266 s.120F is if the individual only had limited access to the system for very specific purposes that did not include the viewing and printing of the emails of others. If this person had been given prior authorization to view and print emails, there clearly is no criminal violation.

"'Bottom line is, assuming the information you provided in your message below is true, it is my opinion that no crime has occurred.'"

 

"(The email exchange between Chief Ryan and me is attached to this report.)

"For the reasons set forth above, I have concluded that the 'Individual' committed no wrongful act and was merely carrying out her job responsibilities. Thus, it would appear that no further action on this matter is required.

"If I can be of any further help in this matter, please let me know.

 

{mospagebreak title=Opinion of Fred Ryan, town police chief} 

 

-------------------
From: Fred Ryan [mailto: This e-mail address is being protected from spambots. You need JavaScript enabled to view it ]
Sent: Mon 8/6/2007 4:05 PM
To: Alan Miller
Cc: John Maher
Subject: Computer Access

Mr. Miller - the only relevant state criminal statute governing access
to computer systems that I am aware of is Massachusetts General Law

c.266 s.120F Unauthorized Access to Computer Systems (pasted below):
PART IV. CRIMES, PUNISHMENTS AND PROCEEDINGS IN CRIMINAL CASES

TITLE I. CRIMES AND PUNISHMENTS

CHAPTER 266. CRIMES AGAINST PROPERTY

Chapter 266: Section 120F. Unauthorized access to computer system;
penalties

"Section 120F. Whoever, without authorization, knowingly accesses a computer system by any means, or after gaining access to a computer system by any means knows that such access is not authorized and fails to terminate such access, shall be punished by imprisonment in the house of correction for not more than thirty days or by a fine of not more than one thousand dollars, or both.

The requirement of a password or other authentication to gain access shall constitute notice that access is limited to authorized users."

As you can see, a key element of the crime is access "without authorization". I have consulted with Middlesex County Assistant District Attorney Michael Fabbri and he advises that given the fact pattern you describe the only way one could argue a violation of c.266 s.120F is if the individual only had limited access to the system for very specific purposes that did not include the viewing and printing of the emails of others. If this person had been given prior authorization to view and print emails, there clearly is no criminal violation.

Bottom line is, assuming the information you provided in your message below is true, it is my opinion that no crime has occurred.

Frederick Ryan
Chief of Police
Arlington, MA.

 -----Original Message----
From: Alan Miller [mailto: This e-mail address is being protected from spambots. You need JavaScript enabled to view it ]
Sent: Friday, August 03, 2007 4:12 PM
To: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
Subject:

Chief of Police Fred Ryan
Arlington Police Department
Arlington, MA


 Dear Chief Ryan:

 This is to confirm our telephone conversation this afternoon in which I asked your thoughts concerning my opinion that
there was no illegal activity engaged in by a member of the Arlington School system based upon the following facts:

The individual in question is one of the individuals with the responsibility to protect both the security and the integrity of the
Arlington Schools' computer system. As such, the individual has an "administrative password" which permits the individual to access any email account in the Arlington School system.

In response to an anonymous note left under the individual's office door complaining that a teacher and his principal were having an
improper relationship which was poisoning the work environment in their school and were using the school email to further that relationship, the individual accessed their email accounts. The individual found what was considered to be improper use, printed up some of the emails and gave them to the Superintendent of Schools.

My conclusion was that the individual's conduct was appropriate in fulfilling the individual's job responsibilities and did not constitute
an illegal intrusion into the computer system. Your thoughts as to my conclusion would be most appreciated

Thank you for your help.

Alan S. Miller

---

A controversial series of events:

Privacy cited as release of e-mails delayed  (July 31) 

Probe incomplete; School Committee meeting put off  (July 25) 

Source of memos feared teachers were being used, attorney in probe says  (July 21)

E-mails between Ottoson principal, teacher probed  (July 15) 

School Committee approves 2-year contract for Ottoson principal, sets series of goals  (April 11)

New pact establishes Bouris as principal (April 5) 

Public speaks at March 27 School Committee meeting (March 31) 

Hundreds turn out to support Ottoson principal (March 27) 

No confidence in Levenson? (March 10)

---