As the Sheldon High School teacher logged on to her classroom computer, she didn't know that every keystroke of her password was being secretly recorded.
In an effort to improve their grade-point averages, three students reportedly obtained a keystroke recording device and software to help them hack into the school computer system. They began changing their grades to A's and altering discipline records last May, and they were caught in October, according to officials.
The three students, who have been expelled, were arraigned this month on felony charges of unauthorized access into a computer system. If convicted, they face up to three years in custody.
"These are bright kids, usually the brightest, but they don't realize they are breaking the law," said Andrew Prestage, who advises California school districts on computer security.
But Jay Foley, who heads a San Diego-based advocacy group for victims of identity theft, is not sympathetic.
"Today's high school computer hackers may be tomorrow's master identity thieves," said Foley, co-executive director of Identity Theft Resource Center.
In what Prestage, Foley and others say is a new and worrisome trend, students are increasingly hacking into school computers, with stakes rising beyond phony grades to compromised personal information such as Social Security numbers.
"There has been a doubling over the past two years, and we expect that to continue," said Prestage, who works for the state-funded Fiscal Crisis & Management Assistance Team.
In the Sacramento area, four incidents at three high schools have been reported in the Elk Grove and Natomas school districts during the past seven months. Seven students have been implicated and four have been arraigned.
Confidential information - such as grades, home addresses and Social Security numbers of more than 94,000 students and employees - was compromised, officials from both school districts said.
A Natomas High 17-year-old has been arraigned and another Natomas High student, also 17, is to be arraigned Monday in juvenile court on felony computer crimes. The Bee is not naming the students because they are minors.
And last week, a 17-year-old senior at Laguna Creek High School in Elk Grove was suspended in a grade-changing scheme.
His case will be handed over to the Sacramento County District Attorney's Office next week for a review of possible charges, said Steven Ladd, superintendent of the Elk Grove Unified School District.
The increase in school hacking began about two years ago when districts started posting grades and other information on the Internet, consultant Phil Scrivano said. He works with Prestage at the state agency, which has advised about 200 school districts, including Elk Grove, in the past three years on hacking, transportation and fiscal problems.
Statewide, the numbers of reported school hackings might be deceiving, he said. "A lot more is going on that isn't reported.
"Just like you don't leave keys in the teachers' cars, you don't leave servers of the administrative systems on the same networks as student computers," Scrivano said.
The three Sheldon students, ages 15, 16, and 17, and a 17-year-old Laguna Creek senior, who was expelled in February, are accused of using hacking devices and software to break into the schools' computer system.
The Laguna Creek senior who was suspended is accused of misusing a password and a log-on a teacher provided him for another purpose. No charges have been filed.
The two arraigned 17-year-olds from Natomas High School obtained an administrator's password from a careless staff member, officials said.
According to investigative reports in the Sheldon case, the hacking resulted in the changing of at least 12 grades and the students left a trail of computer messages.
"You changed it to an A-, right? An A+ is too obvious for my parents," wrote one of the students in computer records obtained by police.
At Laguna Creek, the suspended senior is accused of changing the grades of about three dozen students.
At Natomas, the two students are accused of changing their grades to A's, but they inadvertently changed the grades of each of the district's 18,697 students, said Natomas Unified School District student coordinator Rick Rezinas. Then, they deleted all the files in an attempt to cover their tracks, he said.
After the files were deleted the computer crashed, which led investigators to the students. The deleted files were recovered from a backup system.
Since then, the boys' parents have reimbursed the district about $500 each, which covered the district losses, Rezinas said.
Parents of the Sheldon students were asked to reimburse the school district $67,000 to recover the cost of notifying those whose personal information had been compromised and for investigating the hacking.
Dale S. Wilson, who represents the 16-year-old Sheldon student, said the $67,000 in restitution is excessive.
"Restitution is going to be the tail that wags the dog in this case," he said.
The Sheldon students and their parents face such a high restitution because the district was required by law to mail notices to everyone, said Jim Elliott, a spokesman for the Elk Grove school district.
"More than 70,000 current and former students had their Social Security numbers compromised," Elliott said of the Laguna Creek and Sheldon incidents. Another 6,000 district employees had their names and Social Security numbers compromised after the Laguna Creek incident.
"There was a lot of concern but no reports of identity theft or abuse of the information," Elliott said.
As the teenagers face suspensions and expulsions for breaking school rules, some officials are concerned about the criminal prosecutions that could send the high school students to jail.
"These are respectful, college-bound kids," said Dan I. Salinger, an attorney representing the 15-year-old Sheldon student.
"They didn't act with maliciousness," he said.
Elk Grove district officials said the most recent incident involves a lower level of criminal sophistication compared to the two previous incidents because the student was given the password.
"Changing a grade is not a crime. The kid has a good history and we're trying to be sensitive to the impact this could have on his future," Elliott said.
But Deputy District Attorney Sue Wilson, who is handling the cases, disagreed.
"Anytime a person accesses, uses or deletes data without permission, that is a crime," Wilson said.
Seven students have been implicated in four incidents of hacking at three high schools over the past seven months.
October: Three Sheldon High School students are accused of hacking into the school computer system using a keystroke recording device, software and other computer equipment. Multiple breaches, which began last May, compromised personal information such as home addresses and Social Security numbers of 70,000 current and former students and 10 teachers. Three students, ages 15, 16 and 17, have been arraigned.
February: A Laguna Creek High School student is accused of using hacking software to break into the school computer system. More than 6,000 district employees had personal information compromised. The investigation of a 17-year-old student is continuing.
March: Two Natomas High School students are accused of unauthorized use of a staff member's password. The grades of 18,697 students were changed and then deleted. The grades were restored from a computer backup system. One 17-year-old student has been arraigned this month. Another 17-year-old student is to be arraigned Monday.
May: A Laguna Creek High student is accused of unauthorized use of a staff member's password. More than 36 students have grades changed. The school district is expected to turn over the case to the District Attorney's Office next week.