Skip to content
Students who cyberbully may forfeit social media passwords
Naked Security Naked Security

School rule-breakers to hand over Facebook and Twitter passwords

US school students in the state of Illinois may be forced to give up their social media passwords if they're suspected of cyberbullying or of otherwise breaking school rules.

Image of high school kids courtesy of ShutterstockUS school students in the state of Illinois may be forced to hand over their Facebook or Twitter passwords if they’re suspected of cyberbullying or of otherwise breaking school rules.

That’s what at least one Illinois school district is telling parents, following a new law that mentioned social media accounts in its definition of cyberbullying and harassment.

That law went into effect on 1 January.

It requires schools to implement a policy that includes a “process to investigate whether a reported act of bullying is within the permissible scope of the district’s or school’s jurisdiction.”

But the law, by itself, doesn’t explicitly mention forfeiture of social media account login credentials.

Rather, it merely defines cyberbullying and makes harassment on Facebook, Twitter, or via other digital means a violation of the state’s school code – including bullying that takes place outside of school hours, via non-school-owned devices, and/or off of school grounds.

But as Motherboard reports, a school district located near the city of St. Louis, Illinois, has sent a letter claiming that school officials can in fact demand passwords “under certain circumstances”.

Leigh Lewis, superintendent of the Triad district, told Motherboard the district could resort to criminal charges if students don’t comply:

I would imagine that turning it over to the police would certainly be one way to go. If they didn't turn over the password, we would call our district attorneys because they would be in violation of the law. That would only be in some cases. We'd certainly look at the facts and see what we're dealing with before we make the decision.

The fact that passwords are to be demanded in the case of any rule-breaking sounds too strong. That’s the conclusion reached by Kade Crockford, director of Massachusetts’ American Civil Liberties Union.

She dubbed Illinois’s move “government overreach” and said that either the law or schools’ implementation of that law may well be unconstitutional.

Crockford told Motherboard that the ACLU is now backing legislation that would make such policies illegal in Massachusetts:

It's a tragic example of government overreach - the notion that there's a substantial difference between cyberbullying and regular bullying is confusing. Anytime a school is trying to control students' behavior outside school, it's a serious threat to their privacy and to their futures.

The law is also, likely, redundant. After all, if cyberbullying gets bad enough, law enforcement can just get at social media accounts by getting a search warrant, she said.

While the Fourth Amendment protects US citizens from unreasonable searches and seizures, it doesn’t offer protection in cases where due process has been followed, such as when the request is made under a search warrant.

As Motherboard points out, the law could also violate the Computer Fraud and Abuse Act, given that sharing passwords with unauthorized people is prohibited by terms of service of companies such as Facebook.

I can sympathize with school officials who want similar power to fight cyberbullying – something that surely must be an overwhelming, daily battle.

But isn’t the power already there to fight cyberbullying and harassment?

Yes, you have to go through the police and the court system to secure a warrant.

Going through the work to establish just cause as opposed to a school arbitrarily violating students’ privacy: that doesn’t seem like an unfair tradeoff to me.

Image of high school kids courtesy of Shutterstock.


“Law enforcement can just get at social media accounts by getting a search warrant”. Totally agree, Lisa. Authorities don’t need passwords. If circumstances warrant, they can get the information without a password. Sounds to me like there are a couple of people on this school board who get titillated over serendipitous voyeurism.


Although cyberbullying is a very bad thing for anyone to go through, its no different then regular bullying. If anyone should take these kids devices it sure be the parents and then if it keeps up, then the law should be informed.


I miss the days when you could just fight it out on the schoolyard and punishment was a bloody lip or nose and a week of detention. The best way to deal with a bully is to punch them, hard, in the nose. They’ll stop the nonsense pretty quickly. We really did have it better a few decades ago. There was no hiding behind a keyboard and a fake account. If you wanted to be a goof you had to do it face to face where consequences would be real, swift, and hard.


The thing that surprised me the most is when people verbally bullied me and I punched them in the face, they would be shocked. It was as if they thought they were the king and how dare a lowly peasant like me defend myself. Then while they were showing off their slack jaw I would continue on my way.


That was the way to handle it … only ever had one fight with a bully. Half the school turned up to watch. Cracked him a beauty right in the ‘snot box’, I was never bullied again

Keyboard warriors are spineless cowards


Absolutely agree with this. To teach bully a lesson is to show them what violence is. As he/she (In most cases he :)) is the one who spread violence at other kids at school or either on Facebook threatening them. The best way to learn him a lesson is to show how it’s to feel in on his own skin. Then he will understand what he’s doing to others and hope he’ll stop it after.

Interesting topic actually to discuss about!


The law states they are to investigate suspected activty, evne the police must go through due process, Why do they believe they are above the law? I do not condone bullying in any form however the term is INNOCENT until PROVEN not SUSPECTED of being guilty, a person must be PROVEN guilty and it is not for the “suspect” to provide proof of their guilt OR innocence it is for the officials to prove their GUILT… This society has turned everything into “GUILTY” before you prove yourself INNOCENT. They are just “making up” laws to try and facilitate their work. Nu uh! Do your job prove me guilty or get away, and no you’re not getting MY password, SHOW ME where it says I must provide YOU with evidence to convict me!


Those school folks are smoking something the case and the schools attorneys will tossed out of the first federal court that hears the case. This is not unusual behavior for Illinois after all where can you find the past four governors of the state in federal penitentiaries of course for breaking the laws they swore to uphold. I look forward to following the first case that comes up.


I agree with you, is completely illegal and if they do this how can you prove it was a student that did such criminal act when the staff of the school has access to the students accounts?

What can stop a school from impersonating students?

Doesn’t this goes against the 1st ammendment in the right for privacy?


While you have a good point, I’m not sure how the court has decided on a minor’s right to privacy. While at school, students are wards of the state;responsibility for them is then supposed to be handed off to their legal guardian(s) when they leave school property.

So just like your parent can require all login details for your accounts, so can the local school district.

Is this a good idea? No. Is it legal? Probably. However, if a child shares an account with an adult, there are definite rights being violated should that information be required of the child.


It’s seems to me they should be able to ASK for the password, just like the police could. But, if the student refuses, they need to go through law enforcement, including a warrant.

If it is deemed serious enough, they probably shouldn’t even ask, as that might tip off the student.

Demanding a password, with consequences, is clearly unconstitutional.


It sounds as weird as the whole friending the HR person you are interviewing with that was making headlines a few years ago. Before that I read HR members were asking for potential job candidates for their Facebook password.
I never did find out what happened to that practice though.


So let me get this straight.. if there’s cyber-bullying going on.. isn’t there a victim? Why not ask for proof from the victims account and deal with it accordingly?

So sick of schools thinking they are above the law and that the kids don’t have any rights. Last I checked there was no clause in the constitution that says it doesn’t apply until you turn 18.


If it’s criminal, then the police have to be notified. The school is not an investigational arm of the police. A warrant is required for this, as is any other access to personal information. Getting the information via the victims account is probably the best initial evidence. It’s all about getting a warrant, and that’s the bottom line. No matter what the age.


Oh the lame adults from today that grew not defending themselves, I was sometimes bullyed at school, all I had to do was kick some butts and it was settled, no need to have a bunch of crying babies with me to cry to mama


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!