The RPi was intended to be low cost computer that kids could hack on similar to what happened with the C64 back in the day.
I'm glad it's being worked on, and I'm sure it will be better for those going through now - but if the subject of this post is in 'high school', s/he had none of that.
We had 'ICT', in which we learnt to operate Microsoft products.
The worst part about my school's IT classes was how we were supposed to officially document our progress by taking a screenshot of the work we did, printing it out, cutting it out with scissors and sticking it into our classbooks with PVA glue - like right out of primary school. The fact we were doing this right into Yr.10 just felt insulting - and surely a better demonstration of IT proficiency would be to maintain our work-logs in a purely electronic format? Isn't using a backwards format like (literally) pasted-in screenshots the antithesis of information technology?
In the UK you can do proper Computer Science in high-school at A-Level (ages 16-18), I did it myself - I'd describe it as a somewhat cut-down version of my undergraduate computer-science degree: we did briefly cover the basics of fundamental computer architecture, formal logic and logic-gates, database theory, and software development - the problem is that very few schools actually offer the subject (like 90% of schools offer ICT at A-Level, but I reckon less than 50% offer Computer Science) - and that's due to the staffing: if you can teach Computer Science for A-Level then you're going to be qualified to work as a software developer for a multiple of a typical teacher's salary. My only real criticism of A-Level Computer Science (at least when I did it) was that schools could choose between Pascal/Delphi, VB6, and Java - my school chose VB6 - possibly the worst possible choice considering both how antiquated it was (this was in the mid-2000s so VB.NET/C# were already well-established) but also, more importantly, how it's a poor tool for computer science because VB6 lacks class inheritance and instills bad habits (e.g. SQL concatenation).
When I worked at Microsoft in the US, they took part in a programme called "TEALS" where professional software engineers employed by MS and other companies (Amazon, Facebook, Google all have Seattle offices) are invited to teach high-school AP class computer science classes part time, and I understand it's proving to be quite successful. I think this system should be expanded to allow other industries to take part - I'd sure love to have given chemical engineering or architecture a try in high-school - and kids often need decent exposure to industry if they've yet to decide what they'll do at university and beyond.
No way, he could easily get his own lab in AWS and probably for not much cost since he is in Uni. Hell, buying used stuff from ebay or some other auction site and hacking those for legitimate research would also be a path. Medical devices are probably low effort, high reward.
I definitely get where he's coming from with not having peers interested in security. Message boards and chats only do so much, but there's ample knowledge out there to build a plan for how you want your life to go from this upbringing. Going to a few conventions (even alone) would probably do wonders for him in terms of making connections but those can be expensive.
Maybe we're missing something here, but I got the impression that this is an incredible time for talented people. I've learned all about hacking online - kernel hacking, remote exploits, DEP/ASLR bypass techniques, Kali Linux for penetration testing, exploit-db.com and Metasploit for inspiration, the great tutorials of corelan.be and other great minds and so much more - it's all there, readily available for free.
You don't even need a big budget to build a controlled environment - Raspberry Pi's, maybe some cheap routers and computers and you're ready to go.
What? S/He said s/he's in secondary school.
You can get certain AWS products for zero cost, for a year, but you need a .ac.uk or equivalent email address.
Fucked until Uni and not great then.