By Rachael Stickland, Co-chair, Parent Coalition for Student Privacy

Until 2013, I had never heard of SXSWedu — the nerdy fusion of education and technology that descends on the city of Austin, TX every spring just before the real SXSW festival begins. That year, vulture philanthropist Bill Gates took SXSWedu by storm when he launched inBloom, yet another of his efforts to disrupt the public education system. If you’ve never heard of inBloom, back in 2012 the Bill & Melinda Gates Foundation invested over $125 million to create a private corporation with a technology platform designed to slurp up student data, store it in the cloud, to facilitate the ability of ed tech companies to use the data to develop products and services to sell back to schools.

inBloom was on my mind in 2013 because my children’s school district in Colorado, along with eight other states and districts, agreed to pilot the project using our students as guinea pigs without ever notifying or obtaining consent from parents. Reading everything I could about it at the time, I found tweets and articles coming out of SXSWedu about inBloom parties and coding competitions, and saw photos of Bill Gates taking the stage to make the case for his big data idea.

Bill Gates appearing with inBloom CEO Iwan Streichenberger on the SXSWedu 2013 stage. Credit Amy E. Price/inbloom, via Pr Newswire

But while ed tech companies were celebrating in Austin in March 2013, parents across the country became alerted and increasingly worried about how their children’s data was being captured and re-disclosed by inBloom.  They ignited a firestorm, and in a little more than a year after Gates and his plans took center stage at SXSWedu, the corporation was history.

Important questions arose from the ashes: How can our current privacy laws allow this to happen? Why aren’t our schools, and the companies they contract with, held to higher standards to protect student privacy?

With funding provided by the tech industry and the Gates Foundation, think tanks and organizations jumped in to try to control the damage by producing student privacy websites,  writing white papers,  issuing survey results, and holding various forums and meetings on the subject. In addition, these organizations, including some of the same individuals directly responsible for the inBloom fiasco, returned for the next three years to the SXSWedu stage to dissect the inBloom carcass, to try to determine what went wrong and recoup, without ever inviting any of the many parents and advocates who organized against inBloom to explain their concerns.

After the inBloom collapse, I along with some of the other parents and advocates alerted to the perilous state of student privacy created a new national organization called the Parent Coalition for Student Privacy.  In the last three years alone, over seventy new student privacy laws have been passed in thirty-six states to try to close the numerous loopholes in federal law.

We have also been busy developing privacy principles, testifying before Congress, and bringing attention to the need for  stronger protections for student data.  We are about to release a Parent Toolkit for Student Privacy, in collaboration with the Campaign for Commercial-Free Childhood.  I co-chair this organization, and this year, due to a generous donation from one of our coalition members, I was able to fly from Denver to Austin and participate in SXSWedu 2017, if only as a spectator. Over the course of three and a half days, I attended every session physically possible on the topics of data, privacy and personalized learning. While expecting to feel like a fish out of water, I had no idea just how punishing the experience would be.I’ve become accustomed to having some unpopular views when it comes to student privacy. Having attended school board and PTA meetings, testified at numerous bill hearings, and sat on a few committees and panels all dealing with the issue, my uncompromising positions often labels me as most radical person in the room. I’m okay with that. But never in my life have I felt so disenfranchised as I did at SXSWedu.

Surrounded by thousands of latte-sipping edupreneurs, technocrats, and snake-oil salesmen, my nerve endings were bombarded by words like “disrupt,” “dismantle,” “data,” “innovate,” “online,” “personalized,” “blended,” and “dollars” more times than I could count. I watched from the outside as those within this ideological echo-chamber pitched recycled ideas, swapped snazzy looking business cards, and patted each other on the back. They seemed eager to reinforce each other’s convictions that they were the smartest people in the room, because they had figured out the rules of the ed tech game.

While school board members, administrators, teachers, students and parents fight on the front lines against Common Core, high-stakes testing and data collection, we leave behind us an unattended treasure chest full of billions of taxpayer dollars just waiting to be plundered. The message at SXSWedu is loud and clear:  To win the game, hurry up and get your fair share before the research, evidence and privacy laws catch up to us!

Never was that more clear than when I attended a session called, “Insights into the next generation of EdTech Unicorns” hosted by the co-founders of EdTechXGlobal. A “unicorn” is a start-up company worth $1B or more and the co-founders, who looked like young clones of Austin Powers’ nemesis Dr. Evil, gave quite a show. They predicted edtech will produce the next unicorn because, as they claimed, the global education market is now worth $5.2 trillion (far more than the global gaming market worth only $91 billion), and proclaimed that “Digital education is the oil of [the] knowledge economy.”  You could just feel the excitement in the room.

But there were also some bright moments last week.  After my very first session, a young woman sitting behind me struck up a conversation. She had just returned from six years abroad and took a job with a predictive analytics firm where she, along with others in her company, were stunned to learn the privacy laws protecting students in the U.S. were so porous as to be utterly useless. After explaining to me the limited amount of de-identified data her firm needs to identify a specific individual (e.g. only 2-3 pieces of information like a zip code and birth date), she handed me her card; she wanted to learn more about student privacy and help parents any way she can.

My second favorite moment came at a packed Starbucks on Wednesday afternoon. Sitting only inches away from the table next to me, three people — one from the Chan-Zuckerberg Initiative (CZI) — were speaking typical SXSWedutechbabble: “virtual schools” this and “personalized learning” that. I tried not to eavesdrop but I couldn’t help but overhear the person from CZI say, “2013 was all about inBloom.” Honestly, this was the first time I had heard that word uttered the entire conference. Just four years after inBloom’s rise and fall, no one speaks its name anymore, maybe out of fear that their grandiose projects may  suffer the same fate.

Overall, I’m thankful I was able to experience in person this conference that until now I’ve only read about. Now that we’ve opened the door a crack, maybe next year we can push it open a little wider. It sure would be fun to crash the party with a big group of grassroots privacy advocates. That would really keep Austin weird!

The below is  by Cheri Kiesecker and is reprinted from the Missouri Education Watchdog blog.  Among other things, this new CT bill would strip privacy protections that students currently receive and eliminate notifications of contracts that allow for the sharing of personal student information without parent consent- including breach notifications.  For more information on this bill, check out this action alert from Connecticut Alliance for Privacy in Education (or CAPE), and join their Facebook page on how you can help stop this bill from becoming law.  Here is our Testimony In Opposition to Bill 7207.

Connecticut passed a student data privacy and transparency bill, Public Act 189,  in 2016.

UPDATE (3/8/17): Chicago parents -check out Cassie’s advice at the end to find out if your child’s information was breached.

The following post is by Cassie Creswell, a Chicago parent activist from Raise Your Hand Illinois and a key member of our Parent Coalition for Student Privacy.  In January, Cassie also testified on our behalf at the Chicago hearings of the Commission for Evidence-Based Policy against overturning the ban to enable the federal government to create a comprehensive student database of personally identifiable information.

More recently, upon examining expenditure files on the Chicago Public School website,  Cassie discovered the names of hundreds of students along with the disability services they received at numerous private and parochial schools. She immediately contacted  several reporters, and though an article in the Sun-Times subsequently briefly reported on this breach,  the reporter did not mention that it was primarily private and parochial students whose data was exposed.   In addition, legal claims for special education services that CPS had originally rejected were included along with student names.  Cassie’s fuller explanation of this troubling violation of student privacy is below — as well as the fact that at least some of these schools and families have still not been alerted to the breach by CPS.

Once again, Chicago Public Schools has improperly shared sensitive student data, the Chicago Sun-Times reported on February 25th.

Medical data about students used to administer outsourced nursing services was stored on an unsecured Google doc available to anyone with the link.  And personally-identifiable information (PII) about students with Individualized Education Programs (IEPs), including their name, student identification numbers and information about services and diagnoses related to their disabilities, were included in files of detailed vendor payments posted on the district’s public website.

I discovered this latter information in the vendor payment data, while in the course of searching for information about standardized testing expenditures. The files covered seven fiscal years, 2011-2016, but were only posted on the CPS website this past summer. Noticing what appeared to be a student name and ID number listed in the file struck me as surprising and likely a privacy violation. All in all, there were more than 4500 instances in the files where students’ names appeared along with the special education services they received.

Upon closer examination, it was clear to me that there was a great deal of highly sensitive student personal information that had been disclosed, with payments made from CPS to educational service providers assigned to hundreds of students with special needs attending private schools as well as public schools. Included were the name of the students, the schools in which they were enrolled, their ID numbers, the vendors who had been hired and the services they provided according to the students’ diagnoses. The funds for the payments came from public funds routed through the students’ home districts, CPS, to fulfill requirements of the federal Individuals with Disabilities Education Act (IDEA) for spending on special education students enrolled in private schools.

This breach has since been confirmed as violating federal and state privacy laws — at least in the case of the public school students whose personal information was disclosed and likely the private school students as well.

The records include descriptions of services along with the students’ names and schools that would clearly be considered highly confidential. Some descriptions related to academic services (e.g. “Direct Instruction – Reading, Writing and Math”) or speech and language therapy; others were even more sensitive, for example:

• “direct therapeutic activities to address sensory processing and regulation emotional regulation [sic] fine motor”
• “direct session once a week focusing on anxiety mood and social skills”
• “direct services to develop strategies to work through anxiety other issues that interfere with her learning”
• “Instruction by School Psychologist according to Special Education Service Plan”

In addition, the names and student id numbers of homeless CPS students were included in some of the earlier vendor payment files because of payments related to fee waivers.

The list of the 50 private and parochial schools and three school consortia whose student information was breached is below.

Or you can can click here to see a list of these schools with the number of instances for each one.

The vendor payment files also included instances of payments made to cover services mandated as the result of a due process hearing settlements. (Such a hearing is held when parents request a state-level resolution of a dispute over services for students with disabilities.) These included student names, case number and description of services (e.g. “[name redacted] – ISBE CASE NO. 20XX-00XX per order the district shall fund psychological evaluation services rendered [dates redacted]”)

Although the Sun-Times article quotes CPS officials saying that “affected families will be notified by CPS, ” I reached out to some of the schools, and they had not yet received notification as of Friday, March 3rd.

These are not the first student data breaches CPS has had this year. This past fall, a CPS employee was fired for unauthorized sharing of personal information of more than 28,000 students with a charter management organization, which then used the data for marketing.

Prior breaches (as documented here) in the last decade include:

• May 2015:  4000 students had their names, addresses, phone numbers, disability status and other personal information inadvertently shared with vendors responding to a district RFP for transportation management software.
• December 2013: Data from 2000 students who participated in a free vision examination program was viewable on the City of Chicago website for several months.
• May 2009: Files containing student records including photos, test scores, social security numbers and the results of psychological tests were found in an alley dumpster.With more and more use of information technology in and out of the classroom, there’s been a rapid increase in the amount of data tied to individual students that is collected and stored by the district and third-party organizations.

Dozens of software and hardware vendors have products in use in the Chicago Public Schools. Payments to vendors of ed tech software alone have totaled at least $80 million in the last five years.  The data generated by ed tech software is almost always tied to a student’s personally identifiable information.

Regardless of the significance of the information shared about any individual student in this breach, the apparent negligence with which the district has treated confidential student data in these most recent breaches brings up significant questions:  What care is being taken to protect student privacy and comply with federal and state privacy laws? Who is looking out for our kids to ensure that these violations don’t recur repeatedly?

Parents and students should be justifiably concerned about how secure student data is. Taxpayers should be concerned about what legal liability the district is opening itself up to in an era of big data.

*****

Advice for parents whose children’s data may have breached

If your child is/was enrolled at a Chicago private school and receiving services for a disability paid for by CPS to a private vendor of proportionate share services since fall of 2012, then your child’s  data may have been breached.

CPS says they will contact the family of every child whose data was exposed. We recommend calling the CPS Law Department to ask: 773-553-1700  Also, contact your school administrator; they may not have been notified yet of this breach.

You can also file complaints with the ACLU of IL, the IL Attorney General—including their civil rights bureau and disability rights bureau, and the CPS Inspector General.

If your child has only been enrolled in CPS, it is unlikely their information was part of this vendor payment data breach. One exception is if you had a due process settlement with CPS in which they agreed to cover services. In that case, it would be a good idea to contact your advocate or lawyer if you had one to notify them that this information may have been shared publicly. They should have advice for you. — Cassie Creswell

Following Cassie Creswell’s testimony on behalf of our Coalition on January 5, 2017 to the Commission on Evidence-Based Policy, the Commission sent her some follow-up questions.  Here are her responses.

10 February 2017

Commission on Evidence-Based Policymaking

Washington, DC

 

Dear Commission Members:

Thank you for requesting additional information about the Parent Coalition on Student Privacy’s position on unit record systems. Below we address all three of the Commission’s follow-up questions:

• Can you please clarify whether your objection is to unit record systems for elementary and secondary school students or if you also object to unit record systems for postsecondary students?

See the discussion of this issue below.

• You argue for local control of student data and specifically for parental and teacher data stewardship. At what point should adult students in postsecondary education become the stewards of their own data?

The control of their data should pass to post-secondary students when they become adults, as occurs currently in Federal law.

• Would your concerns about the intrusiveness of a student-unit record system be mitigated if the data were only maintained without personal identifiers that could be used to track an individual student, and if there were statutory protections that guaranteed that the data could only be used for aggregate, statistical analysis?

No, because data can easily be re-identified. If only aggregate data is used, only aggregate data should be collected.

We have significant reservations about the creation of any universal unit record system for students, whether for elementary, secondary or post-secondary students.

Elementary and secondary student unit record systems present a particular set of risks because the majority of information in a child’s K12 educational record should not be made “permanent.” Childhood is a time of growth, experimentation and development; and mistakes and challenges should not be part of a record that could follow one into adulthood and hamper a child’s chance of future success.

A unit record system for post-secondary education does not present an identical set of concerns. Students in post-secondary institutions do expect that some aspects of their transcript, including grades and credits, will persist into adulthood with the expectation of being  shared with employers and other educational institutions—with their consent. Yet other contents of their education records should never be made public.

Records from these years may also contain sensitive information about immigration status, counseling records, mental and physical health and disabilities, etc. At the age of 18, control of the record is transferred from a parent or guardian to the students themselves, but, crucially, privacy controls are still maintained.

We have several concerns about the need for and use of any universal post-secondary unit record system:

1. The efficacy of methods to de-identify or anonymize personally-identifiable data is questionable. De-identified data can often be re-identified and exposed.[1]
2. The government should not have access to a comprehensive database for all post-secondary students as this information could be easily abused for political or immigration reasons.  This is especially of concern given the current political climate. The Home Office in Great Britain has now requested access to a similar government student database for the purposes of “immigration control” that was promised to only be used for research.[2]
3. Once the federal government starts collecting post-secondary data, this could easily lead to a creeping expansion of data collection from K12 institutions and districts.
4. The quality of research based on large-scale correlational studies is of greatly varying quality[3] and does not justify the risks of universal tracking.
5. Large amounts of data used for the purposes of evaluating post-secondary institutions’ effectiveness are already available, including the Department of Education’s College Scorecard, the Mobility Report Card Project—a collaboration of the US Treasury and the Department of Education, and the privately-run National Student Clearinghouse.
6. Extensive regulations have already been implemented to ensure that post-secondary institutions are protecting student’s long-term financial interests, e.g. Negotiated Rulemaking on Gainful Employment implemented in Fall 2014.

We acknowledge that given the investment of taxpayer funds that support institutions of higher education, the federal government has a strong practical interest to make certain that those funds are being used efficiently and effectively.

We do not, however, think that a universal student record system created and administered by the federal government is a necessary component of fulfilling that interest and duty.

The federal government spends billions of dollars in medical research and health care as well, and yet there has been no proposal that we know of for the federal government to collect the personal health data for every person in the United States.

We support only the use of aggregated student data for the evaluation of postsecondary institutions. The collection of such data must include asking for consent for participation from either a parent/guardian or the students themselves if over the age of 18. Clear, transparent information about how any data is to be used and who it may be shared with must be presented before asking for consent. And, there should be no financial benefit or loss contingent on granting the consent.

We continue to urge the Commission to recommend against the creation of any universal federal student unit record system.

On behalf of the Parent Coalition for Student Privacy,

Sincerely,

Cassandre Creswell, PhD

Co-executive director

Raise Your Hand Action

Chicago IL

_____

[1] See, for example, the research of Latanya Sweeney on identifiability.

[2] “The Home Office are turning teachers into immigration officers” G. Bhattacharyya. Politics.co.uk.

[3] See discussion from a variety of fields (medicine, psychology and linguistics) in “Data dredging, bias, or confounding.” Smith, G.D. and S. Ebrahim. BMJ. 2002; “Why Most Published Research Findings Are False.” Ioannidis, J. P. A. PLOS Medicine. 2005; “False-Positive Psychology: Undisclosed Flexibility in Data Collection and Analysis Allows Presenting Anything as Significant.” Simmons, J.P., L.D. Nelson and U. Simonsohn. Psychological Science. 2011; and “Linguistic Diversity and Traffic Accidents: Lessons from Statistical Studies of Cultural Traits.” PLoS ONE. 2013. Roberts S. and J. Winters.

 

Thanks to Cassie Creswell who testified on behalf of the Parent Coalition for Student Privacy and Raise Your Hand at the Commission for Evidence-based Policymaking (CEP) hearing in Chicago on January 5, 2017.

Please read Cassie’s powerful testimony opposing the creation of a comprehensive federal student database here and below.

CEP Midwest Hearing Testimony – Creswell