It was supposed to be operational six months ago, part of Florida鈥檚 wide-ranging effort to prevent the next school shooting: a sprawling new database that would merge people鈥檚 social media posts with millions of records on individuals who have been bullied, placed in foster care, committed a crime, or even been mentioned in unverified tips made to law enforcement.
The plan, however, has sputtered, an Education Week investigation found.
The two biggest reasons: bureaucratic delays, plus concerns over exactly how much sensitive information can legally be shared in the way lawmakers envisioned.
Documents obtained by Education Week via open-records requests show that over the past year, state agencies have discussed the possibility of sharing a breathtaking amount of data. That included more than 2.5 million records related to Floridians who received involuntary psychiatric examinations, records for over 9 million people placed in foster care, diagnosis and treatment records for substance abusers, unverified criminal reports of suspicious activity, reports on students who were bullied and harassed because of their race or sexual orientation, and more.
A data template provided by the Florida Department of Education in response to an open-records request suggests the scope of the database has since been narrowed, the result of worries that sharing some of those records might violate state and federal privacy laws. Officials from the department have not provided substantive responses to multiple requests over several weeks for information and clarification.
Nor have state education officials responded substantively to multiple requests to clarify the status of their effort to hire a company to monitor Floridians鈥� social media posts for possible threats. Earlier this year, the department scrapped and then restarted its bid process on the initiative, despite already being months behind a state-imposed deadline.
As the nation鈥檚 most aggressive attempt to date to expand digital surveillance in the name of school safety has run into hurdles, Republican Gov. Ron DeSantis has fumed. In February, he part of an executive order demanding that the data repository be up and running by Aug. 1, before the start of the new school year.
Privacy advocates, however, say that kind of demand for immediate action, without a full consideration of the potentially harmful implications of such powerful surveillance tools, is what caused Florida鈥檚 troubles from the start.
鈥淚t was never a good idea to try to implement a database this big, in this time frame,鈥� said Amelia Vance, the director of education privacy at the Future of Privacy Forum, a Washington think tank that has been closely tracking Florida鈥檚 response to the Parkland shooting. 鈥淭he lack of forethought and consideration for what this will mean for individual children is really troubling.鈥�
Widespread Data Collection
Education Week鈥檚 investigation found that across the country, social media and related monitoring services used by schools are generating vast torrents of information鈥攕ome of which is alarming, but much of which is ambiguous, irrelevant, or ridiculous.
The Future of Privacy Forum is one of 40 organizations to sign on to a set of 鈥溾�� that warns of the dangers of such widespread data collection and surveillance in the name of school safety.
The concerns are exponentially more pronounced in Florida, thanks to an oft-overlooked provision of the Marjory Stoneman Douglas High School Public Safety Act, passed last year in the wake of the Parkland school shooting.
The law mandates that the state departments of education and law enforcement coordinate to develop a 鈥渃entralized integrated data repository鈥� that provides access to 鈥渢imely, complete, and accurate information鈥� from a variety of state agencies, plus social media.
To figure out what data should be included, the state education department surveyed more than a half-dozen Florida agencies, as well as a few school districts, according to documents obtained by Education Week.
The department outlined scenarios it said might indicate a potential school shooter, despite the lack of clarity in the field as to whether any such profile can be considered reliable. In a request sent to multiple state agencies, the department said it wanted to know about any data that might show feelings of anger and persecution; a desire for revenge; a history of substance abuse, violence, or mental illness; school disciplinary problems; and access to weapons. The agencies were asked to describe the records in their possession that might help identify such potential warning signs, as well as any legal barriers to sharing that information.
The scope of the data discussed in the responses from state agencies was eyebrow-raising:
- The Florida Department of Law Enforcement cited numerous relevant databases it administers, maintains, or has access to. One of them, known as InSite, is 鈥渕eant to be the state鈥檚 criminal intelligence information sharing platform鈥� and includes suspicious activity reports, tips, and other information that needs to be verified before law enforcement agencies can rely upon it.
- The state鈥檚 child welfare department described records covering 9 million people since 2004, including foster-care placement information and data collected by child protective services investigators. The information could be shared into the data repository, the department wrote, so long as the only other agencies involved were the departments of education, juvenile justice, and law enforcement.
- Florida鈥檚 Baker Act Reporting Center said it had more than 2.5 million records of involuntary psychiatric examinations done since 2000. It was also generating data on petitions and orders for involuntary psychiatric placements. But HIPAA, the nation鈥檚 main health-information privacy law, likely precludes release of such information, the center wrote.
- The state Department of Children & Families said it had more than 5.6 million records on 3.3 million distinct clients, covering 鈥渟ubstance abuse and mental health outcome, demographic, and service data,鈥� as well as client treatment records. HIPAA would likely restrict sharing, the department wrote, as would state statute鈥攑ossibly unless the Stoneman Douglas Public Safety Act was amended.
- Florida鈥檚 Department of Juvenile Justice sounded an optimistic note about its ability to share information on the 422,000 youth in its database, including details of their offenses committed and supervision received.
- The Florida Department of Education likewise cited a wide range of potential data: 69传媒鈥� course schedules. Their participation in scholarship and dropout-prevention programs. Whether they鈥檝e ever been homeless. Their immunization status. Possibly the Individualized Education Plans of students in special education, and any history of restraint and seclusion. Whether a student had ever been bullied or harassed based on their protected status, such as disability, race, or religion.
- And a handful of school districts responded with a wide range of information that might be relevant, including information on student health services, disciplinary histories, and survey responses. State and federal data-privacy laws could, however, be a barrier to sharing much of that information, the districts wrote.
Critics expressed alarm at the state鈥檚 approach, saying it appeared driven by narrow concern for what was legal, with little apparent consideration for what was appropriate and ethical.
鈥淚t sounds like a fishing expedition for information about Floridians,鈥� said Rachel Levinson-Waldman, a lawyer with the liberty and national security program at the Brennan Center for Justice at the New York University law school.
Far-Reaching Approach
Officials from the state education department did not respond substantively to requests for an interview or more detailed information.
A 鈥渄ata template鈥� spreadsheet, dated July 30, 2018, and provided by the education department, suggests that officials settled on a somewhat more limited range of data to populate the state鈥檚 initial data repository.
Among the information outlined in the template:
- Data from the state education department on a wide range of behavioral and disciplinary incidents, including gang involvement, alcohol or drug possession, physical attacks, sexual assaults, and vandalism.
- Information from the state education department on students identified as victims of bullying and harassment based on their protected status.
- A wide range of criminal history information, including the InSite activity reports for which law enforcement requires further verification.
- Information from the Florida Department of Children and Families on individuals鈥� histories of foster care placement.
State officials proposed that the system would be accessible to each Florida school district鈥檚 threat assessment team. In order to make the effort legal under the federal Family Educational Rights and Privacy Act, or FERPA, the teams鈥� members would need to be designated as 鈥渟chool officials.鈥�
Liberal use of the 鈥渟chool officials鈥� exception to FERPA in a wide variety of other contexts has prompted criticism from privacy advocates. Earlier this year, U.S. Education Secretary Betsy DeVos and the federal education department sought tothat must be met in order for law-enforcement officials鈥攊ncluding the school resource officers who are often part of districts鈥� threat assessment teams鈥攖o be classified in this way.
The current status of Florida鈥檚 effort to stand up its new centralized integrated data repository is unclear. State education officials did not provide more detailed information in response to multiple requests for clarification.
Experts who manage and study other such integrated data systems around the country have previously expressed concern about Florida鈥檚 far-reaching approach, telling Education Week last year that such systems should not be used for surveillance.
Privacy advocates also worry that data ostensibly collected for the purpose of helping children may now be used to monitor and punish them.
鈥淭his could deter people from reporting bullying, harassment, and substance abuse problems,鈥� said Vance of the Future of Privacy Forum. 鈥淚t undermines basic privacy principles, and it could undermine the trust that people need to have in government programs.鈥�
Social Media Monitoring
Further complicating matters, all the state records identified for inclusion in Florida鈥檚 new data repository are required to be merged with information generated by monitoring social media statewide.
To date, though, Florida鈥檚 process for selecting a vendor to provide that service has been rife with problems.
In its 鈥淚ntent to Negotiate鈥� document, first released last August, the state education department said it wanted a service that could provide around-the-clock, real-time monitoring of sites including Twitter, Facebook, Instagram, YouTube, Google+, Vimeo, and Tumblr. The department also said it wanted the ability to target searches using specific keywords and geographic areas.
The purpose, state education officials wrote, was 鈥渢o help school districts monitor threats of violence against students, employees, and schools,鈥� as well as 鈥渟igns of bullying, thoughts of suicide, and other issues regarding a student鈥檚 well-being.鈥�
Eight companies submitted initial bids. One promised 鈥渞eal-time situational awareness鈥� of active-shooter situations. Another touted its leadership team鈥檚 experience 鈥渟erving the U.S. Government in intelligence gathering, active monitoring, analytics, and near-perfect actionable intelligence to keep our children and communities safe.鈥�
The state education department announced Dec. 10 that it would award a contract worth an estimated $4.5 million over six years to a company called Abacode. Officials liked that the company was looking ahead to new threats on the horizon.
鈥淚magine if a malicious actor took over a school鈥檚 information page or cloned the school principal鈥檚 account and promulgated disinformation for the purpose of spreading panic or staging a physical attack,鈥� Abacode wrote in its bid.
Less than two weeks after the award was announced, however, a company called Social Sentinel, which already claims hundreds of K-12 school districts as clients, (including 15 in Florida) protested the decision, in part because unclear language in the state education department鈥檚 initial invitation to negotiate led respondents to quote prices that were calculated in dramatically different ways.
The state responded by cancelling its award to Abacode and announcing its intent to rebid the project. Social Sentinel protested that, too. The urgency of preventing the next Parkland meant it should immediately get the state contract, the company argued, because it is 鈥渢he national leader on social media monitoring for school safety鈥� and was already in use by 鈥渉undreds of school districts in 30 states,鈥� including 15 in Florida.
During an administrative hearing, a judge disagreed. The state education department鈥檚 decision to 鈥渃ut its losses鈥� was reasonable under the circumstances, Judge Robert E. Meale wrote. The move to rebid the contract could proceed.
State education officials did not respond to multiple requests to clarify the current status of the bid process.
