Password leak slows the school’s scrolling

On Sept. 23, the Milton Area School District IT department discovered the district’s private Wi-Fi password was leaked to around 300 high school students.

The district leadership team, including principals, directors and other administrators, all have their own password to access the school’s Wi-Fi. Teachers and students are not provided the password.

According to Network Administrator Mr. Duane Gemberling, it is unknown how the password was leaked this time. He added this happens around once a year.

He said in past incidents, a password written on a whiteboard for a guest or trainer was not erased.

“We have also had instances where a user that has the password is using the same Apple account for their phone that their son or daughter is on, and the password transfers through the Apple account,” said Mr. Gemberling.

He added that this was the biggest leak he has seen in Milton, with previous situations involving 30 to 40 student devices. According to Mr. Gemberling, this could be from more students sharing this password with others or possibly the short-staffed IT department not catching the issue immediately.

Mr. Gemberling said that the password getting out is a big issue because the school district only has a fixed amount of internet bandwidth. He explained by comparing bandwidth to a pipe.

“We have a pipe only so big and everybody that wants a little piece of the internet is using this [a small piece] of it. So, as you get hundreds of extra people on there trying to use the internet, it can’t all get through that pipe,” said Mr. Gemberling.

As people are using the internet to do high bandwidth activities that are not educational, like watching YouTube or playing games, students who are trying to use educational sites are having reduced or even no internet access, he added. Mr. Gemberling said the password breach did not cost the district extra money.

Mr. Gemberling added it also did not result in any security risk due it being a guest password leaked. The network was blocked from directly accessing the school’s computers and servers.

According to Mr. Gemberling, to fix the issue he “removed the leaked password from the guest network and updated all WAPs (wireless access points) throughout the building/district. Once the WAPs were updated they no longer permitted the devices to access the network since they no longer had a valid password.”

Mr. Gemberling added that the issue was frustrating but not difficult to fix.

No disciplinary consequences were given to students that accessed the password, said Co-Principal Mr. Andrew Rantz.

“I would have to handle [this type of incident] on an individual basis,” Mr. Rantz added. “Students should not have the Guest Wi-Fi password.”