Teachers, education and technology companies, students, and parents were tossed into a digital storm when COVID-19 hit two years ago. They had to quickly shift to remote learning on a grand scale, which amplified weaknesses in student data privacy protections that were already a problem before the pandemic.
By many accounts, as most U.S. students have been back in the classroom this academic year, school systems and tech and education companies have applied the lessons learned and bolstered student data privacy.
鈥�69传媒 and districts needed to pivot really hard and really quickly when the pandemic first hit,鈥� said Linette Attai, the president of PlayWell LLC, a data privacy consulting firm. 鈥淭here are two things we really learned over the last two years. One is that schools can be more agile than we ever imagined. They really rose to the occasion. The other is that technology changes constantly, but the norms and rules for protecting student data remain firm.鈥�
But vulnerabilities clearly remain. In late March of this year, it came to light that the personal data of 820,000 current and former students in the New York City school system were compromised because of a security breach at Illuminate Education, an Irvine, Calif.-based student data vendor.
鈥淭here are so many issues鈥� with the protection of student data generally, said Leonie Haimson, the co-chair of the Parent Coalition for Student Privacy. 鈥淭he pandemic has given a lot of companies access to student data that has not been sufficiently protected.鈥�
A massive breach of student data in the Big Apple shows more work needs to be done
In the New York City breach, a hacker gained access to student names, birthdates, and data on such characteristics as special education, English-language learner, and free or reduced-price meal status on platforms operated by Illuminate Education, according to news reports. The vendor did not collect students鈥� Social Security numbers or family income information, the reports noted.
Officials with the New York City Department of Education told local news outlets that Illuminate Education had failed to encrypt data on its classroom management, scheduling, and pupil data platforms as required by the contract between the company and the school system.
The platforms were out of service for a week in January. Teachers had to record grades the old-fashioned way and it was harder to track students who might have been exposed to COVID-19, the New York Post reported.
Illuminate Education, in response to an email query, acknowledged that some personal information in the New York City system was subject to 鈥渦nauthorized access.鈥�
鈥淭here is no evidence of any fraudulent or illegal activity related to this incident,鈥� the company said in an email to Education Week. 鈥淭he security of the data we have in our care is one of our highest priorities, and we have already taken important steps to help prevent this from happening again.鈥�
Jim Siegl, a senior technologist with the youth and education privacy team at Future of Privacy Forum, a Washington, D.C., think tank, said that the New York City district鈥檚 access to the Illuminate system was disrupted for almost three weeks.
The school system was entrusting its information to one of the bigger data service providers in the K-12 marketplace, and that will inevitably offer some lessons in student privacy, he said.
鈥淭he district can outsource the work, but it can鈥檛 outsource the responsibility,鈥� said Siegl, who is a former technology strategist for the Fairfax County, Va., public schools, the largest district in the state.
鈥業t鈥檚 not just the technology department [that is] responsible. It鈥檚 everybody鈥檚 job鈥�
Student data privacy encompasses a broad range of considerations, from students鈥� own smartphones, to classroom applications discovered and embraced by teachers, to district-level data systems, to state testing programs.
鈥淭here鈥檚 not just one thing that people should do to ensure data privacy,鈥� said Keith Krueger, the chief executive officer of the Consortium for School Networking, or CoSN, which serves school district technology directors across the country. 鈥淚t鈥檚 not just the technology department [that is] responsible. It鈥檚 the superintendent, the curriculum office, the professional development trainers. It鈥檚 everybody鈥檚 job.鈥�
Siegl agreed.
鈥淭he pandemic was an accelerator of education technology,鈥� he said. 鈥淓veryone had to react very quickly. Most district [personnel] went home on a Friday [two years ago] and found out that come the next Monday, they had to be virtual.鈥�
Parents who had varying levels of engagement with their children鈥檚 education and the technology used by districts 鈥渟uddenly had that technology right across the kitchen table from them,鈥� Siegl said.
Districts, schools, and often individual teachers were quickly embracing new online apps, sometimes bypassing normal district or school approval processes meant to ensure student data privacy.
The number of education tools and applications accessed per month by school districts increased from 952 just before the pandemic to 1,327 soon after, according to statistics from LearnPlatform Inc., a Raleigh, N.C.-based firm. By last school year, the figure had increased to 1,449.
鈥淭here were a large number of very well-intentioned companies that offered educational tools at the beginning of the pandemic,鈥� Siegl said.
Haimson, of the Parent Coalition for Student Privacy, said her group is concerned about 鈥渢he explosion of apps鈥� used in schools, saying that 鈥減arents aren鈥檛 being informed about what data is being collected by private companies, how it is being used, and how it is being protected.鈥�
鈥淓ven in states where there are privacy laws on the books, they鈥檙e not being enforced,鈥� she said.
New cybersecurity measures to protect privacy of student data
Still, lawmakers are weighing or passing measures aimed at providing greater protections.
A CoSN report released in January highlighted a range of federal and state legislative measures aimed at boosting cybersecurity in the nation鈥檚 schools. These include the federal K-12 Cybersecurity Act of 2021, signed into law by President Joe Biden in October. It directs the Department of Homeland Security鈥檚 Cybersecurity and Infrastructure Security Agency to 鈥渟tudy the cybersecurity risks facing elementary and secondary schools and develop recommendations that include cybersecurity guidelines designed to assist schools in facing those risks.鈥� The measure also requires the agency to create an online training toolkit for schools.
The massive federal infrastructure bill signed by the president in November may provide a more concrete improvement to cybersecurity in schools. It provides a $1 billion grant program for state and local governments to be used to secure networks, assess cybersecurity vulnerabilities, and bolster the workforce dedicated to improving cybersecurity.
The pandemic has given a lot of companies access to student data that has not been sufficiently protected.
The CoSN report also notes that 30 states passed measures last year designed to strengthen cybersecurity, either directly or indirectly, in K-12 and higher education.
鈥淭he proliferation of education cybersecurity bills and laws in 2021 is no surprise given the serious and persistent attacks on schools and other education entities and the massive operational and privacy consequences the attacks leave behind,鈥� the CoSN report said.
A privacy seal of approval for districts follows a rigorous application process
One area where CoSN is trying to promote stronger protections of student data privacy at the school district level is with its Trusted Learning Environment Seal program. It was developed with the input of 28 school systems nationwide and AASA, The School Superintendents Association, the Association of School Business Officials International, and ASCD, formerly known as the Association for Supervision and Curriculum Development.
The TLE seal program requires an extensive application process focused on five areas of school district practice鈥攍eadership, business, data security, professional development, and the classroom.
Krueger says the process is valid for two years and encourages best practices.
鈥淚t really gives you a roadmap to get to continuous improvement,鈥� he said.
The Rockingham County Public 69传媒, an 11,900-student rural district in the Shenandoah Valley of Virginia, earned the TLE distinction in June 2021.
Oskar Scheikl, the superintendent and a former teacher and technology director in the district, said the current tech director, Kevin Perkins, came to him with the idea of applying for the TLE seal.
Perkins said that with the pandemic, 鈥渁ll of a sudden we are [shifting] over to digital resources. They require student data. There is authentication. Teachers are able to track student progress. We want to make sure we were positioning ourselves to protect student data as best we could.鈥�
Teachers are used to taking advantage of free offers, he said, so some were signing up for classroom apps without going through the district鈥檚 vetting process.
鈥淲e have to take a pause and say, 鈥楬ey, wait,鈥欌�� Perkins said. The district developed a digital resources request process. It also created a 14-page agreement for technology vendors. And the district tests its own staff members by sending fake phishing emails, such as one that tells employees that the district has signed them up for COVID-19 prevention training.
鈥淭o sign in, please use your email address and your network password,鈥� one such email stated.
鈥淭he first campaign had a 30 percent click rate,鈥� said Perkins. 鈥淣ow it鈥檚 down to about 10 percent. One of the components of the TLE process is cybersecurity. Our people need to be aware that when you are online, you have to be careful.鈥�
Scheikl said that while he has tech credentials that relatively few other superintendents have鈥攁n advanced degree in cybersecurity and service as the district鈥檚 technology chief鈥攖hose aren鈥檛 the most important characteristics for a superintendent to have for effective student data privacy.
Instead, it is a commitment from top district leadership to effective data privacy strategies at all levels, he said.
鈥淚nevitably, you are going to wish you had a plan in place,鈥� Scheikl said. 鈥淪omething [challenging] is going to happen, and when you have a framework in place, it makes it easier.鈥�
