Education Week - April 13, 2022 - 7

learner, and free or reduced-price meal status on platforms
operated by Illuminate Education, according to
news reports. The vendor did not collect students' Social
Security numbers or family income information,
the reports noted.
Officials with the New York City Department of
Education told local news outlets that Illuminate
Education had failed to encrypt data on its classroom
management, scheduling, and pupil data platforms
as required by the contract between the company and
the school system.
The platforms were out of service for a week in January.
Teachers had to record grades the old-fashioned
way and it was harder to track students who might
have been exposed to COVID-19, the New York Post
reported.
Illuminate Education, in response to an email query,
acknowledged that some personal information in the
New York City system was subject to " unauthorized
access. "
" There is no evidence of any fraudulent or illegal activity
related to this incident, " the company said in an
email to Education Week. " The security of the data we
have in our care is one of our highest priorities, and we
have already taken important steps to help prevent this
from happening again. "
Jim Siegl, a senior technologist with the youth and
education privacy team at Future of Privacy Forum, a
Washington, D.C., think tank, said that the New York
City district's access to the Illuminate system was disrupted
for almost three weeks.
The school system was entrusting its information
to one of the bigger data service providers in the K-12
marketplace, and that will inevitably offer some lessons
in student privacy, he said.
" The district can outsource the work, but it can't outsource
the responsibility, " said Siegl, who is a former
technology strategist for the Fairfax County, Va., public
schools, the largest district in the state.
'It's not just the technology department [that
is] responsible. It's everybody's job'
Student data privacy encompasses a broad range of
considerations, from students' own smartphones, to
classroom applications discovered and embraced by
teachers, to district-level data systems, to state testing
programs.
" There's not just one thing that people should do
to ensure data privacy, " said Keith Krueger, the chief
executive officer of the Consortium for School Networking,
or CoSN, which serves school district technology
directors across the country. " It's not just the
technology department [that is] responsible. It's the
superintendent, the curriculum office, the professional
development trainers. It's everybody's job. "
Siegl agreed.
" The pandemic was an accelerator of education technology, "
he said. " Everyone had to react very quickly.
Most district [personnel] went home on a Friday [two
years ago] and found out that come the next Monday,
they had to be virtual. "
Parents who had varying levels of engagement with
their children's education and the technology used by
districts " suddenly had that technology right across the
kitchen table from them, " Siegl said.
Districts, schools, and often individual teachers were
quickly embracing new online apps, sometimes bypassing
normal district or school approval processes meant
to ensure student data privacy.
The number of education tools and applications accessed
per month by school districts increased from
952 just before the pandemic to 1,327 soon after, according
to statistics from LearnPlatform Inc., a Raleigh,
N.C.-based firm. By last school year, the figure
had increased to 1,449.
" There were a large number of very well-intentioned
companies that offered educational tools at the beginning
of the pandemic, " Siegl said.
Haimson, of the Parent Coalition for Student Pri " The
pandemic
has given a lot
of companies
access to
student data
that has
not been
sufficiently
protected. "
LEONIE HAIMSON
Co-chair of the Parent
Coalition for Student Privacy
vacy, said her group is concerned about " the explosion
of apps " used in schools, saying that " parents aren't
being informed about what data is being collected by
private companies, how it is being used, and how it is
being protected. "
" Even in states where there are privacy laws on the
books, they're not being enforced, " she said.
New cybersecurity measures to protect
privacy of student data
Still, lawmakers are weighing or passing measures
aimed at providing greater protections.
A CoSN report released in January highlighted a
range of federal and state legislative measures aimed
at boosting cybersecurity in the nation's schools.
These include the federal K-12 Cybersecurity Act of
2021, signed into law by President Joe Biden in October.
It directs the Department of Homeland Security's
Cybersecurity and Infrastructure Security Agency to
" study the cybersecurity risks facing elementary and
secondary schools and develop recommendations
that include cybersecurity guidelines designed to assist
schools in facing those risks. " The measure also
requires the agency to create an online training toolkit
for schools.
The massive federal infrastructure bill signed by the
president in November may provide a more concrete
improvement to cybersecurity in schools. It provides
a $1 billion grant program for state and local governments
to be used to secure networks, assess cybersecurity
vulnerabilities, and bolster the workforce dedicated
to improving cybersecurity.
The CoSN report also notes that 30 states passed
measures last year designed to strengthen cybersecurity,
either directly or indirectly, in K-12 and higher
education.
" The proliferation of education cybersecurity bills and
laws in 2021 is no surprise given the serious and persistent
attacks on schools and other education entities and
Technology Counts 2022 | 7
Education Week - April 13, 2022

Table of Contents for the Digital Edition of Education Week - April 13, 2022
