Home/Local/Campbell County Schools IT Technician Resigns After Alleged Cryptocurrency Mining Scheme Using System Resources | Lafollette

Local

Campbell County Schools IT Technician Resigns After Alleged Cryptocurrency Mining Scheme Using System Resources | Lafollette

Lina Portman4 weeks ago

7 3 minutes read

Campbell County Schools IT technician Adam Lawson resigned recently after allegedly engaging in a months-long cryptocurrency mining scheme using school system resources, according to a risk assessment report from Constangy, Brooks, Smith & Prophete LLP.

“The summary of the report is that Constangy found no evidence that student or employee data was compromised or disclosed in any way,” said Director of Schools Jennifer Fields. “It was positive, but Constangy found evidence that an employee used school system technology for personal gain and that employee has since resigned.”

Fields addressed the school board about the incident during the monthly school board meeting Tuesday evening.

“The best news from the report is that there was no data breach,” said school board attorney Chris McCarty. “If there had been evidence of a data breach – student and employee information was leaked – they would have informed us about it and also guided us through the next steps, but there was no absolutely no evidence of a data breach. So at this point, with the employee's resignation, the case is closed.

Before discussing the matter, the school board voted to waive attorney-client privilege regarding the topic so that it could be discussed openly.

“As soon as Ms. Fields and her team were made aware of a possible problem, it was immediately reported to the carrier, immediately reported, and they began to manage it,” McCarty said. “The employee has been suspended, pending further investigation, and I understand that when he was summoned this week to speak about it, he simply resigned. Yes, sir. He has not returned to work after this has been reported to the carrier.”

McCarty sent LaFollette Press Constangy's risk assessment report.

“In March 2024, CCSS (Campbell County School System) became aware that one of its network administrators may have misused CCSS resources,” according to the report. “During a student testing day, a student contacted CCSS technical administrators to report an issue with their testing software. While investigating the issue on the CCSS laptop the student, a network administrator discovered that the TOR browser was running on the student's laptop. The administrator then investigated a staff computer and also discovered TOR running in the background. .

Tor Browser prioritizes privacy and anonymity on the Internet.

“The network administrator began to investigate further and, on March 19, 2024, discovered that the TOR Browser was deployed via Active Directory,” according to the report. “The deployment was traced to a hidden folder on the Active Directory server, but by the time the network administrator found the root path of the TOR browser, the hidden folder was deleted. The network administrator extracted the logs surrounding the hidden folder and discovered another “

The school system reported the incident to Great American Insurance Group, its cyber carrier, on March 19, according to the report, and was referred to Constangy.

Constangy retained the services of Kroll, a digital investigation company.

“Kroll conducted a forensic investigation into the CCSS network,” according to the report. “Kroll collected forensic images of CCSS servers as well as computers used by Mr. Lawson during his employment. The computers used by Mr. Lawson were encrypted with BitLocker, which Kroll was ultimately able to bypass. Through the investigation, Kroll determined the following timeline of events. Beginning in May 2023, Mr. Lawson began taking notes on the cryptocurrency mining process. In July 2023, Kroll observed the deployment of a miner for. Monero on CCSS Systems “My Info” which contained setup details and wallet information for Monero mining In December 2023, during the CCSS holiday, Mr. Lawson continued to prepare for activation. of mining The services were set up to manage mining from December 2023 until March 20, 2024, when CCSS removed the task. a file or folder by Mr. Lawson apart from creating a folder containing the data mining software to be deployed on a CCSS domain controller. Obviously, Mr. Lawson's actions were solely aimed at operating a Monero mining project using CCSS systems.