HARRIS COUNTY, Texas – An 18-year-old student at Klein Forest High School is currently wanted by police after they say he was responsible for cyber attacks that disrupted STAAR testing for thousands of students in the district.
Keontra Lamont Kenemore is accused of electronic access interference, which is a third-degree felony. A warrant for his arrest was filed Thursday and records show he hasn’t been taken into custody.
Kenemore allegedly used his school-issued Chromebook to access sites that initiated Distributed Denial of Service (DDoS) attacks, causing major internet disruptions during State Mandated Testing (STAAR) in the district back in April.
On April 16, the Klein Forest High School testing coordinator started having internet service issues during the STAAR testing, according to court records.
The IT department investigated and found the district was experiencing a DDoS attack.
“This is like pulling the fire alarm in all schools in the Klein ISD school district at the same time and continuously for a number of hours,” said Nigel Neilsen, who owns local IT company Nickel Idealtek Inc.
The internet disruptions affected all campuses district-wide and about 3,000 students on their STAAR tests on April 16, which was the first day of the English Language Arts (ELA1/Reading) test. Students were locked out and had to stop and restart their writing essays and multiple choice test answer due to the online attack, records show.
“This is a really easy attack to perform. It probably only cost him about $20,” Neilsen said. “Literally, you can do it in about five minutes.”
The next day, April 17, 700 students were locked out of testing across the district and had to completely retake their STAAR tests due to the online disruption, according to records.
On the third day of testing, April 18, Klein ISD IT received service interruptions at Klein Forest High School, which affected the district’s online testing.
In total, 6,981 students tested on April 16, with an additional 17,298 students testing on April 17. The number of students impacted by the disruptions to the district’s internet service across both days was 24,279, according to the documents.
When questioned by school administrators, Kenemore allegedly said he knew why they were having the meeting, before admitting to accessing the websites used to send the DDoS attacks on multiple occasions.
Neilsen compared the attack to a flash mob filling a restaurant, with no intention of dining or buying, leaving those who want to eat there unable to because it’s full.
“(Users) would have had timeout notices on the web browser. It would have been a 404 error saying, ‘Oh, sorry, something has gone wrong’,” he said.
After utilizing a link creator site that can collect the IP addresses of anyone who clicks on it, Kenemore allegedly used that information on a network stress tester site that appears to be hosted in Sweden, records show. The site didn’t have any safeguards of legitimate tools and is likely only used in a malicious environment, Neilsen said.
“This would have been a deliberate action because he utilized two different tools to identify the public IP address of the school district and then he would have had to manually copy and paste that into the attacking website,” he said.
At Kenemore’s current address, no one came to the door on Monday evening, but a family member told KPRC 2′s Bryce Newberry over the phone he claimed it was an accident, that he was expelled and unable to graduate.
Investigators claim it was intentional in court records.
Klein ISD’s Accountability Rating from the Texas Education Agency could be impacted, records show. The TEA referred KPRC 2 to the district for any questions related to the cyber attack saying, “the TEA does not operate cybersecurity for Klein ISD or any other Texas public school system.”
Klein ISD acknowledged KPRC 2′s request for comment on Monday evening, but the district was closed for the holiday and a spokesperson said a response may not come until Tuesday. The following Tuesday however, the district was sent specific questions by our Bryce Newberry, but the district has refused to answer them.