Kent School faces class action suit following IT breach

KENT — Kent School is facing a proposed class action suit filed on behalf of 70 current and former students whose personal photographs and video files were allegedly illegally accessed, viewed, copied, and retained by a former senior school IT employee.

Typically, a class-action lawsuit is started by filing a complaint that names at least one representative, and that representative files the lawsuit on behalf of the entire proposed class of plaintiffs.

The case was filed Tuesday, Feb. 11, in Torrington Superior Court by three former students—Hannah Kent, of Halifax, Nova Scotia, Olivia Leary, of Goshen, Conn., and Natalie Hudson, of Sharon, Conn.—and all others “similarly situated.”

The complaint asserts that “highly private and personal photographs (including photographs of a sexual and intimate nature), videos and communications” were accessed without their consent by Daniel Clery, former network and systems administrator at Kent School.

The complaint alleges that a state police search of computers belonging to Clery, revealed “3,670 personal image files that either belong to or depict current and former Kent School students” as well as screenshots of text messages and emails.

A private cybersecurity firm hired by Kent School reportedly found that Clery accessed and copied 81 persons’ personal files, both of students and former employees of the school. Of these, 79 were female.

Clery, of Brookfield, was arrested in June on two counts of first-degree computer crime, according to the complaint and is next due in the state Superior Court in Waterbury on March 20. His case is statutorily sealed.

The women are represented in their case against Kent School by David S. Golub and Jennifer B. Goldstein of Silver Golub & Teitell.

The lawsuit seeks to hold Kent School responsible for failing to oversee and supervise the employee, failing to establish a system to monitor access to the school computer network and students’ personal devices, and failing to protect students’ privacy over a period of four years.

The lawsuit alleges that Kent School ignored a complaint filed in 2022 by an employee who discovered that her computer had been accessed. In spring or summer of that year, the staff member asked Clery for help with a computer she had been issued by Kent School.

The complaint states she left the room while he was working on the laptop and, when she returned, found him looking at photos filed in her private Google account. He quickly closed the screen, according to the complaint. She reported his behavior to her supervisor, but it is believed no action was taken.

The complaint reports about eight months later, the same staff member was approached by Clery, who told her he was checking the school’s antivirus software and that he needed to access her laptop.

After he left her office, she received an email on her Kent School account notifying her that a software product called RClone had been granted permission to access her Google account, according to the complaint.

She contacted Michael Siepmann, head of the school’s IT department, to inquire about the software. RClone is a command-line program to sync files and directories to and from different cloud storage providers, the complaint states.

When Siepmann questioned Clery, he was told that Clery used RClone to transfer the school’s antivirus program and had “accidentally” reconfigured RClone to access the staff member’s Google account.

Later that day, Clery again approached the woman, saying he had to access her computer, according to the complaint. This time, she stood beside him as he worked and noticed a gallery of her vacation photos on his phone. When she reported this, the school “belatedly initiated an interior investigation,” the complaint states.

Clery’s employment was terminated in February 2023.

The school subsequently hired Vancord, an information and cybersecurity firm, to examine Clery’s work. The Vancord examination concluded that Clery used the Kent School system to systematically target female students to find and upload pictures saved on their personal computers from 2019 until 2023.

The lawsuit seeks damages “in excess of $15,000” from Kent School for its alleged negligence, invasion of privacy, computer privacy violations, recklessness and negligent infliction of emotional distress.