Illinois law allows schools to demand students' Facebook passwords

Technically Incorrect: Conceived to combat cyberbullying, a new law in Illinois may result in schools demanding social media passwords, even if the posting was not done at school or on school computers.

Chris Matyszczyk
3 min read

Technically Incorrect offers a slightly twisted take on the tech that's taken over our lives.

Should a school be allowed access to a student's Facebook password? KTVI-TV screenshot by Chris Matyszczyk/CNET

Illinois can't seem to decide whether it's the home of midwestern gentlefolk or of the most draconian humans this side of Moscow.

One of the state's newest laws, for example, may have goodness at its heart. However, it may have something else in various of its extremities.

The law, which went into effect on January 1, is designed to curb cyberbullying, but it also could encourage schools to pry into students' personal lives.

KTVI-TV reported that the law was already making some parents deeply uncomfortable. That's because one of its stipulations is troubling.

Indeed, this week Illinois parents began receiving a letter from school authorities informing them that their children's social media passwords may now have to be handed over, as part of school discipline. Motherboard reports that it obtained one of these letters. It reads, in part:

School authorities may require a student or his or her parent/guardian to provide a password or other related account information in order to gain access to his/her account or profile on a social networking website if school authorities have reasonable cause to believe that a student's account on a social networking site contains evidence that a student has violated a school disciplinary rule or procedure.

You might imagine that this stipulation only applies to school computers and activity on school premises. It does not. The schools may ask for passwords and search on the basis of any posting by a student at any time and in any place.

And who will decide what is reasonable cause? Leigh Lewis, superintendent of Triad Community Schools Unit District 2, told Motherboard that if someone didn't cooperate, there might be trouble. Not detention, criminal charges.

Those of sharp eyes and, perhaps, parenting experience, will wonder just what private information the schools might encounter as they search for their alleged evidence.

As one parent who had received the latter, Sarah Bozarth, told KTVI: "It's one thing for me to take my child's social media account in there and open it up for the teacher to look at (...) but to have to hand over your passport and personal information to your accounts to the school is just not acceptable."

I have contacted Illinois' Board of Education to ask how educators justify what seems like the potential for a considerable invasion of privacy. I will update, should I hear.

What if, in performing a search, the school discovers that a student is involved in, say, criminal activity or a sexual relationship? What if it discovers that the student has a particular medical problem?

Will it pinkie promise not to tell? I contacted Lewis to ask her views and will update, should she reply.

The whole idea of an authority being able to demand social media passwords has undergone some challenges over the last couple of years. This year, Oregon became the latest state to decide that colleges and employers would be forbidden from demanding social media usernames and passwords.

It's one thing for authorities to observe what employees, students or suspects are posting on social media. It's surely another to think that they have the automatic right to simply demand what is quite obviously personal information. In Illinois, it will all likely come down to the idea of reasonable cause. (No case has yet emerged of a school exercising its alleged right to ask for a password.)

Three years ago, however, 12-year-old Riley Stratton sued her Minnesota schools district after she claimed she'd been coerced into revealing her Facebook password. Last year, the case was settled with the Minnewaska Schools District paying Stratton $70,000. In this case, Stratton was accused of writing nasty things about her hall monitor.

Facebook's Statement of Rights and Responsibilities -- something to which all users agree (perhaps unknowingly) when signing up -- has a section 4.8. It reads: "You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account."

Clearly, cyberbullying is awful and potentially dangerous. However, where will the balance be struck between the need to find the alleged bully and the protection of someone's basic rights?