Klein ISD student accused of orchestrating cyberattack that disrupted STAAR test

HARRIS COUNTY, Texas – An 18-year-old Klein Forest High School student is currently wanted by police for allegedly being responsible for cyberattacks that disrupted STAAR testing for thousands of students in the district.

Keontra Lamont Kenemore is charged with electronic access interference, a third-degree felony. A warrant was issued for his arrest Thursday, and he was not taken into custody, according to records.

Kenemore allegedly used his school-issued Chromebook to access websites that initiated distributed denial-of-service (DDoS) attacks, causing significant internet disruption during the district’s state-mandated testing (STAAR) in April.

On April 16, Klein Forest High School’s testing coordinator began experiencing problems with internet service during the STAAR test, court records show.

The IT department investigated and found that the district was under a DDoS attack.

“It’s like having the fire alarm sounded simultaneously and continuously in all the schools in the Klein ISD school district for several hours,” said Nigel Neilsen, owner of local IT company Nickel Idealtek Inc.

The internet outages affected all campuses across the district and affected about 3,000 students during their STAAR tests on April 16, the first day of testing in English (ELA1/Reading). Students were locked out and had to pause and restart their essays and multiple-choice test answers due to the online attack, records show.

“It’s a really simple attack. It probably only cost him about $20,” Neilsen said. “It literally takes about five minutes.”

The next day, April 17, records show that 700 students across the district were excluded from testing and had to retake their STAAR tests entirely due to the online disruption.

On the third day of testing, April 18, Klein ISD IT experienced service interruptions at Klein Forest High School, impacting the district’s online testing.

A total of 6,981 students were tested on April 16, and another 17,298 students were tested on April 17. According to the documents, 24,279 students were affected by the district’s internet service outages on both days.

When questioned by the school administration, Kenemore reportedly said he knew the reason for this meeting. He then admitted to having accessed the websites from which the DDoS attacks were carried out on several occasions.

Neilsen compared the attack to a flash mob that fills a restaurant with no intention of eating or buying anything, and those who want to eat there are unable to do so because the restaurant is full.

“(Users) would have received timeout notifications in the web browser. It would have been a 404 error saying, ‘Oh, sorry, something went wrong,'” he said.

After using a link-creating site that can capture the IP addresses of all users who click on it, Kenemore allegedly used that information on a network stress-testing website that appears to be hosted in Sweden, records show. The site lacked the protections of legitimate tools and is likely only used in a malicious environment, Neilsen said.

“This would have been a deliberate action as he used two different tools to determine the school district’s public IP address and then had to manually copy and paste it into the attacking website,” he said.

No one answered the door at Kenemore’s current address Monday night, but a family member told KPRC 2’s Bryce Newberry by phone that he claimed it was an accident and that he was expelled from school and would not be able to graduate.

According to court documents, investigators believe it was intentional.

Records indicate Klein ISD’s accountability rating with the Texas Education Agency may be affected. The TEA was closed Monday for a holiday and did not respond to KPRC 2’s request for comment.

Klein ISD acknowledged KPRC 2’s request for comment Monday evening, but the district was closed for the holiday and a spokesperson said a response may not be available until Tuesday.