How hidden data on your kids’ smartphones can get them in trouble at school

The School District of Lee County will search your kid’s phone if there’s a question about safety and security. That rule is spelled out in the 2023-2024 student code of conduct.

What’s not clear is how deep the district and local law enforcement can go into the phone, and more importantly, what they can do with data they find. Data you—and your kids—may not have known was there.

What is the cache?

Many of you have a lot of cache in your pocket, and you don’t even know it.

We’re not talking about your money, we’re talking about content stored deep in your smartphone. Cybersecurity experts say the cache collects snippets of data from different websites and apps on your phone—anything that loads onto a page, even if you scroll right by it. This allows websites and apps to load faster, but that information can still be used to judge you.

That’s what happened to Lee County fifth grader Daniel Marquez.

“The court finds beyond a reasonable doubt that the youth did make a threat to conduct a mass shooting,” said Lee County Judge Carolyn Swift.

A confusing and devastating verdict for 11-year-old Daniel and his family.

“I don’t understand that,” said Daniel’s father Dereck Marquez.

When Daniel was 10 years old and a fifth grader at Patriot Elementary School, he sent a friend private texts he described, under oath, as a joke about a scam involving money and guns, followed by a reference to a school event.

Prosecutor Scott Miller: “The punch line of your joke was it that the firearms, that was punchline?”
Daniel Marquez: “No, it was that I scammed someone.”
Prosecutor Scott Miller: “OK, so what made the firearm, what made it funny?”
Daniel Marquez: “That it was expensive because I scammed my friend for a lot of money.”

Prosecutor Scott Miller argued Daniel’s texts were really a threat inspired by the mass school shooting in Uvalde, and the texts alone were enough to convict.

Fast-forward 400 days.

Miller presents something new: images from news coverage of Uvalde and Parkland that he says were found on Daniel’s phone. But are these cached images of violent school shootings a smoking gun?

“It absolutely goes to his state of mind because these images were on his phone,” said Miller.

But Jennifer Kircikyan, digital forensics expert for the Lee County Sheriff’s Office, admitted to Daniel’s attorney Alex Saiz that she couldn’t determine if Daniel ever saw those cached images.

Saiz: “So that just means they were at some point on the phone, but not necessarily kept by Mr. Marquez, is that correct?”
Kircikyan: “Correct.”
Saiz: “Do you know if these… can these come up from news alerts on apps or do they have to be individually accessed by the defendant?”
Kircikyan: “No, they can come up from almost anything. These specifically, I believe, were YouTube and Google, just Google. I don’t want to say Google searches, but just a Google page.”

Cybersecurity experts weigh in

Cybersecurity expert Craig Peterson isn’t involved in the case but watched the trial, evaluated the evidence and arrived at an alarming conclusion: He wondered whether the prosecutor and judge even understood the technology they were presenting and evaluating.

“I’m shocked that any of the so-called evidence that was presented would lead anyone to believe that beyond a reasonable doubt, that’s the judge’s words, this kid was guilty, because there’s no hard evidence of any of that,” said Peterson.

“The only way you can actually judge whether something happened, is if you have all of the information, and not only have the information but understand the information.” Craig Peterson, Cybersecurity expert

The Uvalde and Parkland school shootings were major local and national news headlines when Daniel’s phone was confiscated by LCSO, which Peterson says explains why the images would be featured on Google and YouTube and cached on Daniel’s phone. With a little detective work, he believes law enforcement would have found those images on your kid’s phone, too. And that’s not necessarily a bad thing.

“Why didn’t they go in there and see how many kids were interested in knowing about the shooting that happened three days prior to this, right? How many of these other kids would have the exact same types of things on their phones? I would guess that it’s close to 100%,” said Peterson.

John Benkert is a data security strategist in Fort Myers. He spent 20 years in intelligence with the United States Air Force and seven years at the NSA, where he earned the National Scientific Achievement Award for Technological Innovations in Data Security. Benkert says judges need greater technological literacy to decide what is valid evidence and admissible.

“Our legal system, we depend on jurors, or judges or attorneys who aren’t technically savvy.” John Benkert, Data Security Strategist

“Our legal system, we depend on jurors, or judges or attorneys who aren’t technically savvy. And so, if you tell someone, a layman, those things, you may say, ‘Oh my gosh, 100%, then he did it, or she did it.’ But if you tell a technical person like me that, I’m gonna go, ‘Well, wait a minute, you know, how was that gathered?'”

The answer to that question remains unclear in Daniel’s case, but Benkert says Daniel’s story should inspire serious conversations with your kids about what they do on their phones, especially since you don’t have easy access to their cache.

“You can’t go into my cache, I can’t go into your cache without tools and forensic tools and spending a lot of money,” said Benkert.

But the school district has the resources and authority to do so.

Executive Director of Safety, Security and Emergency Management David Newlan warns that the School District of Lee County has a strict code of conduct. It says, in part, “display of weapons or inappropriate messages, pictures or images on one’s cellular phone or electronic device that cause a disruption to the safe operation of school” will lead to a “consult with law enforcement.”

We know Daniel got more than a consult.

The code is vague, offering the district and local law enforcement considerable discretion in deciding if your kids get in trouble.

Benkert also cautions the cache in anyone’s phone can be compromised.

“You can give me your computer, and I can make an exact duplicate of it, and I can then change dates on files, which people don’t know that you can do, and there’s no way for you or any forensic investigator to ever detect that,” said Benkert. “I can send you something that you don’t even have to click on, that then, you know, downloads a little file onto your phone. So that’s the problem with some of this stuff: We take it at face value and say, ‘You’re an expert, you must be telling the truth, and this is how it happened.’ But, in reality, I can change all of that with 15 minutes with your device.”

Cybersecurity experts say the best way to protect your kids is to not give them phones and unrestricted access to texting, social media and the internet. I reached out to the State Attorney’s Office and the Lee County Sheriff’s Office for comment. SAO won’t comment, and LCSO didn’t respond.

Join in on the conversation here.