Episode 14.
In an earlier episode I made the rather obvious observations that schools are filled with
children.
Because so many of the IT users in schools are in fact children, which is a population
deserving special protections, several wide ranging national laws in the United States
provide guidance and direction to school and technology leaders when they design policies
and procedures related to IT use.
Anyone who seeks to work as an IT professional in a school must be aware not only of the
requirements of these laws, but also the rationale behind them.
Most IT professionals are familiar with the need to keep data secure.
In some industries this is necessary for regulatory purposes, and in all industries it's necessary
to protect proprietary information and to protect clients information.
In schools the importance of privacy takes on special importance because of the age of
the individuals about whom information is being kept and because of the nature of the
information that is being kept.
The Family Educational Rights and Privacy Act, or FERPA, is the law in the United States
which is intended to safeguard sensitive information about children and other students.
FERPA defines who is allowed to access information that is kept by the school and the conditions
under which the information must be stored.
The law does specify the rights of students and their parents if the students are under
18 years of age, as well as the steps school officials are expected to take to protect
students information.
Those whose privacy or rights have been violated can file a complaint with the United States
Department of Education and legal action is possible.
To ensure they comply with FERPA requirements, most schools require all employees, including
IT professionals, to attend training in which local expectations are described.
They also protect the school by having employees acknowledge they have received training.
While schools may interpret FERPA differently, there seems to be agreement, at least in the
dozens of FERPA trainings I have attended, that FERPA protects a wide range of information
including that which school employees learn accidentally.
For example, if a school employee who sees a friend in the store says, hey, I saw Johnny
get into fight at school today and he was suspended, that has been a violation of FERPA.
They identified a student and they shared the information about the behavior and the
consequences of it and the recipient of that information was not entitled to know it, nor
were the many people who may have overheard it entitled to hear that information.
IT professionals have an unusual level of access to classrooms and data.
When they're sitting at a computer in a classroom, they are really a fly on the wall.
Teachers and students largely proceed as if there is no one else there.
They gain an unfiltered view of classroom actions, interactions, and some of what they
observe is protected by FERPA.
IT professionals have access to data systems as well that contain protected data.
While the student information system should have protections to prevent a technician from
accessing grades, a teacher may ask for help resolving a technology issue when they are
logged on to the student information system and working on their grade book.
What we observe as IT technicians when working on data systems or working in classrooms must
be kept confidential.
The teacher who shows their grade book to an IT technician while they are getting help
is violating FERPA.
The IT technician who does not share anything they learn when they see that information
or does not treat the student differently has not violated FERPA.
They have minimized the damage it's done when the original violation and they have
not violated FERPA themselves which both protects the privacy of the students and minimizes
the liability due to the original violation.
There are exceptions of course.
If you learn about a potentially unsafe or troubling situation then you do have an obligation
to report that but of course you are going to report that to school personnel and not
to just anybody on the street.
Now the projectors are found in almost every classroom and those tend to be connected to
the single device assigned to the teacher.
It's not uncommon for the teacher's grade book to be displayed accidentally when a projector
is turned on and when the grade book is open.
While most teachers are aware of the potential and will close their grade books, sometimes
they just forget.
Many technicians have questions that they will ask before they turn on a projector and
they try to make it a joke.
One of my former colleagues would always ask, what's going to be on the screen when I turn
this on?
I'm not going to be giving away the winning lottery numbers am I?
And then when that joke attires him he would switch it to something like, I'd hate to show
anyone your secret cookie recipe.
That habit prevented him from being the cause of sensitive data being exposed and it also
served as a reminder that everyone should be aware of this potential situation.
The Children's Internet Privacy Protection Act has been a law in the United States since
1998.
The intent of the law is to protect the privacy and the personal information of children.
Thus it requires publishers of websites that collect user information to have parental consent
for those under 13 years of age.
This is a law that leads social media companies to restrict children from accessing their platforms.
Of course it's very difficult to enforce age restrictions but the terms of service
and the privacy statements of companies that maintain web platforms, especially those that
facilitate interaction among users, do reflect the requirements of this law.
Because of the Children's Online Privacy Act, most schools, especially those enrolling
students younger than 13, have procedures for identifying the online platforms that can
be used by teachers.
A teacher may find they're not allowed to have students logging on to and using an interesting
new tool until the terms of service have been reviewed by the school leaders and they conclude
it's reasonable to allow access and the publishers of the site align with local policies and
procedures related to data protection.
In 2000, the United States federal government passed the Children's Internet Protection
Act which is intended to protect children from indecent information on the internet.
It's also intended to prevent personal information about students from becoming available online.
Specifically, the Children's Internet Protection Act requires schools that receive e-rate funds
to install and maintain filters that restrict access to inappropriate content and it requires
steps be taken to protect youngsters when using email, chat, and similar tools.
The Children's Internet Protection Act does allow the filter to be disabled when only
adults will be using a network but that's rarely done in schools as children are hardly
ever absent from the school when adults are there.
School IT professionals can be expected to participate in the planning undertaken to
ensure the school complies with the Children's Internet Protection Act.
They will review policy and procedures to ensure internet filters are configured and
operational.
Email and chat is only available to the users for whom it's been permitted under local
policy.
They manage firewalls and otherwise protect children when they're using the school's
IT systems.
This planning takes on special importance when the systems are being updated or older devices
are being replaced.
Of course, IT professionals are also expected to monitor the systems to ensure they're
using and to define steps that they will take when the systems fail.
Another often overlooked aspect of IT in schools is students' exposure to advertisements.
Many sources of online information used in schools including mainstream media and journalism
sites, the sites of professional organizations and edited periodicals, and especially social
media sites like YouTube are funded by advertisements.
When students access the information on these sites, they're also being exposed to advertisements.
Some educators and students, parents and others will object to this exposure for several reasons.
First, it can be seen to be a commercialization of the students.
Students are required to attend school and they have little choice over the lessons and
the material that they use.
By directing them to information sources that are advertisement rich, teachers may be seen
as exploiting the students.
Second, some products may be unsuitable for children, especially in schools.
And even if the products aren't unsuitable, they may lead to distractions or they may
otherwise contribute to difficult situations in classrooms.
IT professionals may be asked to minimize students' access to advertisements when at
school.
This may include installing and configuring software or web browser extensions that block
advertisements.
In addition, IT professionals may be asked to support faculty as they embed media in
virtual classrooms or otherwise minimize students' exposure to advertisements.
Regardless of the nature of the organizations in which they work, all IT professionals
are familiar with the importance of network and data security.
This is a lesson that's taught in preparation programs in all organizations implement data
security practices.
IT professionals working in schools should also promote data security, but they must
make sure that their actions align with the decision-making hierarchies in schools and
the accepted policy and procedure, especially those related to younger users.
Schools are places where IT professionals and others are very likely to find passwords
taped on sticky notes attached to computers.
This is becoming less common, but it's still more common than it should be.
In some schools where I have worked, technicians and other IT professionals were encouraged
to remove those sticky notes, but that was not only with the knowledge and the support
of the school administrators.
Another common practice is for teachers to keep a list of their students' usernames
and passwords.
Ostensibly, this is done to reduce troubleshooting when passwords are forgotten, but there are
other strategies whereby passwords can be recovered without the potential of them being
discovered and used for nefarious purposes.
Let me explain a situation I dealt with when I managed IT in schools.
The teachers at Springfield Middle School insisted their students provide their teachers
with their passwords for the school network.
One teacher kept this list taped inside the door of the cabinet next to their desk.
One afternoon, the students noticed the teacher had left the door open and the passwords were
in plain sight.
They memorized some of them and logged on to other students' accounts.
An IT technician noticed students behaving suspiciously near a computer after school
and noted it.
A little investigation found that those students had been logged on as another student and
had sent some emails.
It did not take much detective work to trace the origins of the email to the school's
IP address and the student whose account had been used to send the email was on a trip
with the sports team.
The IT technicians reported the suspicious activity of the students who were questions
and admitted that they had sent those messages.
This is unquestionably a data breach.
The question of the degree to which the teacher was responsible for it is interesting.
It can be argued that the students were old enough to remember their own passwords so
there was no reason for the teacher to have them.
If the teacher did have reason to keep them, which seems dubious to me, then it can be
argued that they were negligent for not keeping them more secure.