6th Grader Expelled for 3 Months after Zoom provided inaccurate IP address info

McGruber writes: On one day in February, 11-year-old Malachi Battle was not feeling well, so he stayed home sick and attended his 6th grade classes virtually via Zoom. Strange things started happening. In one class, Malachi said he heard an unknown person yell a racial slur. Teachers said other unidentified people were trying to get into their virtual classrooms. Two days later, Malachi was suspended, accused of repeatedly trying to log into Zoom classes with threatening phrases and racial slurs in lieu of his name

Malachi’s lawyers say Gwinnett County Public Schools accused him based on an inaccurate list of students’ Internet Protocol addresses from Zoom, a problem that could repeat elsewhere since the company’s online sessions are replacing classrooms for millions of students amid the coronavirus pandemic. Chris Gilliard, a fellow with the Technology and Social Change Project of the Harvard Kennedy School Shorenstein Center on Media, Politics and Public Policy, had not heard of a situation similar to Malachi’s but said “it’s hugely unlikely that this is the first time” a student had been disciplined based on questionable data from Zoom.

During the “Zoom bombing” attempts, Malachi had already logged into the classes under his regular name, according to his appeal.

The school district retrieved from Zoom a list of the names and IP addresses in each waiting room, Malachi’s legal team said. The Zoom bombers’ public IP addresses matched Malachi’s — but four other students who did not appear to be Zoom bombers were also listed as having Malachi’s public IP address, an impossibility since they were not in the same house, said Scott Moulton, a Woodstock-based forensics expert hired by the attorney working on Malachi’s case.

Moulton said the school district’s technology employee who investigated should have been able to tell that many of the IP addresses in the Zoom report were wrong.

“I would have at least picked up the phone and called Zoom before hanging the life of an 11-year-old kid based on a log that looks like an error,” Moulton said.

The Zoom bombers’ local IP addresses, which identify the exact device being used, did not match Malachi’s, according to the log his attorneys provided. Nor did the local IP addresses match any of the possible sequences available under the configuration of the router in Malachi’s house, Moulton said. There were no other routers or devices in the house that could have used those local IP addresses, Moulton said.