Schools Differ on How They Monitor and Protect Students Online

In Pennsylvania, schools have very different standards and systems for protecting kids on classroom devices. Many resist the release of any details of those programs, citing security concerns.

by James McGinnis, Bucks County Courier Times / December 23, 2019
Shutterstock

(TNS) — The school year began with a cyberattack on the internal networks and encrypted data files at the Souderton Area School District.

Last week, police presence was increased at Holicong Middle School, part of the Central Bucks School District, after a "threatening" post on an app that promises to shield the user's identity.

Since 2016, the National School Boards Association reported 742 cybersecurity "incidents" in public schools nationwide.

Yet it can be nearly impossible to determine whether your school district is taking proper steps to protect its employees, students and the computer systems funded by taxpayers.

Schools have very different standards and systems for protecting kids on classroom devices. Many resist the release of any details of those programs, citing security concerns.

Schools are also a major target for cybercriminals. Students of all ages are increasingly online, and the National Schools Boards Association warns that the personal information of students may "fetch a high price" from those seeking to commit identity theft.

The Internet is riddled with a continuous stream of ever-changing websites featuring sexual and violent content as well as hate speech, and schools can receive little guidance on exactly what to filter from young eyes on the Internet.

Beginning Nov. 8, this news organization filed open records requests with 17 school districts in Bucks and eastern Montgomery counties. We sought access to documents showing what those districts spend on cybersecurity, what programs they used to monitor students, and what specific content was blocked on taxpayer-funded Internet servers.

On school devices, some block students and staff from using social media and streaming video on services such as Netflix.

Other schools do not.

Everyone attempts to block adult content. But some schools also choose to block categories of content labeled as "alternative beliefs," "news" or "religion."

Some block content by age group or grade level.

Some schools have systems to alert administrators when a student's search history indicates a risk to themselves or other students.

Other schools do not employ this technology.

Initially, most school districts balked at the release of any information about their cybersecurity programs, including contracts approved by school boards at public meetings.

Following an appeal to the Pennsylvania Office of Open Records, the Centennial School District released its cybersecurity contracts.

District officials said "no information contained in those documents could be used to penetrate the security of the District's computer infrastructure."

The New Hope-Solebury School District said something different.

Scott F. Radaszkiewicz, director of technology for New Hope-Solebury, agreed to release New-Hope Solebury records, so long as the name of the security program was not revealed.

"By turning over that information, we're putting the district at risk," said Radaszkiewicz. "If it's public, then someone could try to learn the weaknesses of that system in an effort to penetrate our security."

A similar agreement was reached with Abington, Bensalem, Bristol Borough, Centennial, New-Hope Solebury, Palisades, Pennridge and Pennsbury school districts.

Meanwhile, Bristol Township, Central Bucks, Morrisville and Quakertown have yet to release their records and appeals are pending with the state Office of Open Records

Aside from those records, Central Bucks also declined to answer questions about blocked content. The district urged students to delete social media apps. Records from other districts shows that they blocked students from accessing social media in the classroom.

Does Central Bucks block such content on classroom devices and Internet servers? Officials wouldn't say.

Nationwide, public schools are required by federal law to protect students online.

Enacted 19 years ago, the Children's Internet Protection Act provides discounts for schools when purchasing Internet access and equipment. Schools must also develop plans to limit access to "inappropriate material."

The federal law requires schools to protect students when using chat rooms and email. Public schools also must protect against hackers and the "unauthorized disclosure" of any personal information about students.

The NBSA's Center for Safe Schools recommends the selection of a data protection officer, who reports directly to the superintendent and school board.

On its website, the association notes that there is no fail safe solution and that districts often lack the staffing and resources to address cyberthreats.

Responding to a Right to Know request, Bristol Township released a statement by Robert Pfau, district director of information technology. Pfau said Bristol Township blocks three types of content, which he described as "mature and/or adult content ... other websites that are designated as unrated" and "information that constitutes or otherwise presents a security risk to the District."

Some districts said they don't know what they block. The system of blocked content is maintained by outside security providers, they said.

"This is probably tens of millions of websites long and we don't ever really see that list," said Robert Reichert, business affairs director for Hatboro-Horsham. "So, a web request from a laptop goes through their software out to their big list."

Funding for cybersecurity also varies by district.

Abington School District, with some 8,500 students and a $165 million budget, spent $115,212 on outside vendors providing cybersecurity, records show.

Bensalem schools, with some 6,400 students and a $154 million budget, spent $34,006, according to district records.

The Bristol Township School district, with some 6,420 students and a $144 million budget, spent $15,299, according to records released following a Right to Know request.

In addition to protecting students from mature materials, Bensalem said children and teens were prohibited from viewing content labeled as religious, shopping, social media and streaming video sites such as Netflix. Students were also blocked from visiting news providers, records show.

Bristol Borough blocked adult content, social media and gambling on school computers. However, students and staff can visit news sites. A list of "never block" sites includes BBC News, CBS News, KYW 1060 and National Public Radio.

Abington allows streaming video as well as other categories of content labeled as alternative beliefs, folklore, news, sexual education, social media, shopping and sports.

At Palisades, records show, website traffic is logged by the system when users visited sites categorized as "advocacy organizations," "alternative beliefs," "alcohol," "gambling" and "marijuana." Yet, unlike other districts, Palisades does not block access to games, shopping, social media and sports, according to its filter settings.

©2019 Bucks County Courier Times, Levittown, Pa. Distributed by Tribune Content Agency, LLC.

At UNCP, Cybersecurity is Part of a Campus Culture

Taking steps to stay safe online is a year-round effort, but every October — during National Cybersecurity Awareness Month — things are ramped up a notch. Individuals and organizations of all types stop to remind themselves about the importance of cybersecurity and of making sure that everyone has the resources they need to protect themselves online.

Ransomware in Education: How to Use Your Network to Stay Ahead of Attacks

Educational institution systems store a large amount of sensitive data, including student and employee records. They rely heavily on these systems for day-to-day operations. So any disruption or loss of access can be a game changer. But these same institutions also often have tight budgets and can’t afford to employ large security teams. That’s one reason they’re perceived as easy and lucrative targets by online adversaries.

The Future of Education

Today’s stop while exploring #TheFutureofPublicSector takes us to education and what the future will make possible for teaching and learning. So, what does the future hold for education as we know it?

Platforms & Programs