How Pranking An Online Calendar Almost Sent This Student To Prison

It began, as these stories tend to, with an enthusiastic prankster and a little knowledge of the internet. It ended, fortunately, with a modest legal battle and a lenient judge. In the middle, it put a kid in jail on Christmas eve, 2014. Ryan Pickren, the Georgia Tech student at the heart of this saga, shared his story today on Facebook, and it’s as much a cautionary tale about overzealous reactions to online attacks as it is about the danger of pranks.

The setting is a friendly rivalry between the University of Georgia and the Georgia Institute of Technology. The rivalry even as a name: “Clean, Old-Fashioned Hate“, and a weirdly extensive entry on Wikipedia. Pickren, a Georgia Tech student whose grandfather also attended the school, was poking around the University of Georgia website the week before Thanksgiving when he made a striking discovery.

The UGA master calendar was unsecured, and with a simple POST command, he was able to add an event that read “Get Ass Kicked By GT” at the time of the rivalry football game. A couple weeks passed, seemingly without incident.

Here’s what happened next, in Pickren’s words

With apologies to Arthur C. Clarke, to anyone sufficiently ignorant of technology, all actions on computers are indistinguishable from hacking.

The arrest made local news, and Pickren’s sister set up a page to collect funds for legal fees. Pickren was fortunate, and was sent into a “pretrial diversion program,” where he did a year of community service helping a non-profit with cybersecurity. Good, clean, cybersecurity.

The entire tale, which shifts tragically from lighthearted to legal disaster, is available in a public post on Pickren’s Facebook page. Read it in full. It fortunately has a happy ending for Pickren, but if the consequences are so high and the ease of triggering them is so low, perhaps Georgia and other jurisdictions could reconsider computer laws and penalties as currently written.