The Punishment Hacker

Noah was making a lot of money for a high school student, and it was all thanks to the Punishment Planner app. Every student was given a small tablet loaded with school-related apps. One of the apps was called "Punishment Planner".

When students would get in trouble, a teacher would enter in an offense. Some offenses would result in a punishment, while others might result in demerits that would eventually add up to a punishment. The punishments were chosen by an algorithm. The goal was to be objective and remove favoritism from the process as much as was possible.

One of the punishments that students could receive was corporal punishment, which was administered with a wooden paddle. A few male teachers were responsible for administering corporal punishment, and they rotated the responsibility on a schedule.

When a student was assigned corporal punishment, the app would tell them where to go and when. When they received their punishment, the app would automatically update a database indicating that their punishment had been completed.

Noah discovered an interesting little oversight though. It seemed that the system alerted the teacher who would be administering corporal punishment that a student was being sent to him, but it didn't actually disclose the identity of that student. The teacher wouldn't know until the student arrived.

As far as Noah could tell, this wasn't an intentional feature. It was something that the company contracted to build the app just neglected to include. This wasn't a problem though because the teacher administering the punishment would use an NFC receiver on the student's tablet to confirm the punishment.

Noah was an amateur programmer, and he was quite good at it. He discovered another weakness of the system. Because corporal punishment wasn't the only punishment that could be assigned, it had its own database table. The corporal_punishment table had a foreign key referencing the punishment table.

Tracking was done on the punishment table. When the type specified was corporal punishment, then an entry was created in the corporal_punishment table. When the corporal punishment was administered, that table was updated, and then a stored procedure ran to update the punishment table.

Noah found that he could get database access with the username "user" and no password because the contractors hadn't bothered setting up security on user accounts. He didn't have admin access, but the user level access allowed him to execute DML statements.

After hours of exploring how the database worked, Noah had a shocking realization. With clever use of SQL statements, he could make it so that the person who receives corporal punishment could be different from the person who was assigned the punishment and who would be credited for it being completed.

This meant it was possible to get students to take the place of other students for corporal punishment. Noah immediately realized the potential to make money from this. Students could pay for someone else to take a paddling on their behalf, and Noah would get a cut of the transactions.

He soon had this system running like a well-oiled machine. The school district was awkwardly situated in such a way that it encompassed parts of an affluent neighborhood as well as a working class neighborhood. This meant there were students who had enough money to pay someone else to take their punishments, as well as students who were desperate to earn some extra money.

One day, Noah was checking on the website he had built to monitor for activity. It was nearing Spring break. This was bad news for Noah since he would be without a lucrative source of income for that week, but it also meant he had more earning potential the week before the break. Students were more restless then, and therefore more likely to earn punishments.

As Noah expected, the paddles were having quite a busy day today. One bid in particular got his attention. Some rich student was offering $250 for someone to take their place for eight swats. That was a pretty generous offer in total but eight swats was also on the high end.

Noah would get a small cut if someone accepted that offer, but the person who actually took that paddling would get a lot more. Noah wanted more money for himself. Before his usually cowardly mind could convince him otherwise, he quickly accepted the bid himself. He didn't want just a cut. He wanted the whole $250.

When he thought of how bad eight swats was going to be, he immediately changed his mind, but it was too late. He had specifically prevented users from backing out by writing a stored procedure that would change the assignee of the punishment to the person who accepted the bid if they missed their appointment. This would result in extra punishment being assigned to the person who backed out, on top of what they had already agreed to.

Noah had an appointment for 4:00pm. He reported to Mr. Sorenson's classroom on time. Mr. Sorenson was surprised to see him. "When I heard someone was due for eight swats, I assumed it was a serious troublemaker," he said. "I never imagined it would be you!".

Mr. Sorenson didn't ask what Noah had done. He just scanned his tablet. Teachers administering these punishments weren't allowed to. This was to help them remain objective. He sighed. "Well, let's get this butt of yours heated up. Bend over my desk."

Noah glanced at the large wooden paddle that Mr. Sorenson was picking up. It had a sensor on the handle as well as on the tip. These sensors ensured that the paddle was being swung with enough force. They didn't want teachers going too soft on students. This is why only male teachers administered these punishments.

Noah removed his wallet from his back pocket and bent over the desk, gripping the far side with his hands. He was grateful at least that the school wasn't allowed to have him remove clothing for a paddling. His jeans would provide a good deal of protection, but this would still be very painful.

Mr. Sorenson wasted no time as all. As soon as Noah was bent over, the tall broad-shouldered teacher slammed the paddle against Noah's butt hard. Noah gasped at how painful it was. He had taken paddlings before but he was still shocked at how much it could hurt.

The second swat had him in tears. By the fifth swat, he was sobbing and screaming at the top of his lungs. He felt like he was having an out of body experience by the time the eighth and final swat landed. He jumped up and clutched his butt. $250 was nice but that had not been worth it.

"Alright, this punishment has been recorded," said Mr. Sorenson as he scanned Noah's tablet again and handed it back to him. "You're good to go now. Spring Break is coming up, so at least you will be safe from being paddled then. That should give you time for your butt to recover from the one I just gave you."

As Noah left, he thought about the paddling he had just received. He wondered who it was meant for, and what that person had done. He wondered about the circumstances of this mystery offender. Were they one of the rich kids, or were they simply terrified of such a huge punishment that they desperately offered as much money as they could scrape together? Noah didn't know, but what he did know was that he was now $250 richer. It might not have been worth the pain, but $250 is $250.