I think the bigger takeaway is that the law as it is is much too broad. Certainly if this kid is a repeat offender for this there should be consequences for him, but a felony? If this really is as simple as using a known password then I think some amount of responsibility should fall on the shoulders of the school. Beyond that, if nothing truly crime-worthy was done, say, stealing private information, changing grades, etc., then it seems like this should be a matter handled by the school administration rather than the state.