The curious case of the Raspberry Pi in the network closet (2019)
A story about a clandestine Raspberry Pi found in a school’s network closet prompts broader concern over insider threats and “shadow IT” devices quietly embedded in critical infrastructure. Commenters debate whether such hardware is necessarily malicious, but largely agree that unapproved devices, especially left behind by former employees, represent serious security and legal risks. The exchange branches into termination practices, network access controls (like 802.1X), and how weak physical and process controls allow small, improvised systems to become load‑bearing parts of production networks.
Context and intent of the Raspberry Pi
- Device found in a network closet, installed by a former employee at a public school, running an app called “logger.”
- Many readers infer malicious intent (persistence, surveillance, or future abuse) even if no concrete damage is shown.
- Others note it remains unclear what, if anything, was actually done with it (whistleblowing vs. credential theft vs. unused backdoor).
Employment termination and access revocation
- Strong support for immediate revocation of all digital and physical access when someone leaves, to prevent exactly this kind of persistence.
- Counter-argument: such “heavy-handed” US-style terminations may increase resentment and risk, and sacrifice the benefits of orderly handover and goodwill.
- Several comments compare US at‑will employment (instant firing/quitting) with European/Australasian models (notice periods, gardening leave, stronger protections).
- Consensus that once termination is decided, access should be cut quickly, even if employment formally continues.
Shadow IT and rogue/“load‑bearing” devices
- Multiple anecdotes of unapproved Pis, Beaglebones, laptops, and Mac minis in racks or under floors providing critical services (metrics, VPN/SSH tunnels, CI agents, IRC servers, AV bridges).
- These often arise because official IT is slow, underfunded, or unresponsive, so “temporary” workarounds become production.
- “Scream tests” (unplugging unknown hardware to see who complains) are common but risky when documentation is poor.
Network security practices & constraints
- Some advocate 802.1X, strict device approval, VLAN isolation, and treating Wi‑Fi as untrusted.
- The school setting: ~1,000 students, BYOD, 4‑person IT team, limited budget and hardware; 802.1X deemed too much overhead.
- Point made that once someone has a physical key to a network closet, many technical controls are effectively bypassed.
WiGLE, wardriving, and related tools
- Discussion of WiGLE and similar geolocation services: crowdsourced wardriving data, also collected by large mobile platforms.
- Seen as useful but not widely known outside certain communities.
Accuracy, legal follow‑up, and time context
- One commenter criticizes technical inaccuracies in the article (overstating capabilities of a microcontroller board).
- Legal outcome: reportedly handled internally in Europe; no public court case and apparently limited consequences.
- Note that the story is from 2019; HN convention is to tag older articles with their year, not to imply obsolescence.