New and Emerging Threats to Student & Teacher Data Privacy

On May 6, the NY Post revealed that about two million students in NY State alone may have had their privacy violated by the massive Illuminate data breach; students in CT and CO were also affected.

This is an update from reporting in The Journal, based on FOILed records from NYSED that found at least one million students affected, across 24 school districts and 18 charter schools in New York, plus one Board of Cooperative Educational Service.

The NY State Education Dept. and the NYC DOE needs to do a far better job protecting personal student data and complying with the NY State Student privacy law 2D, which was passed in 2014, and to minimize the sharing of student data, ensuring strict security standards including encryption, and requiring that vendors delete it as soon as possible and at the very least when students graduate, none of which happened here.

Illuminate has reported that the hackers accessed a "database storing some information in the unencrypted format", according to The Record news site, and that the data may have included student and parent names, email addresses, grades, attendance, birth dates, ID numbers, genders, race and ethnicity, languages spoken at home, Title I and disability status and more.  Data from the records of students in Colorado and Connecticut may also have been breached.

Two weekends ago, Leonie Haimson, co-chair of the Parent Coalition for Student Privacy, and Doug Levin, Co-Founder and National Director of K12 Security Information Exchange and a national expert on student data breaches, gave presentations at the Network for Public Education national conference in Philadelphia, in which we discussed the Illuminate Breach and the how districts and schools can better protect the privacy of their students and teachers.

Please follow the following links for videos of this session, separated into Part I and Part II, along with questions and comments from the audience.

Time sensitive! Check out letter to DOE & SED on NYC's Contract for Excellence "plan" and send your own comments by Jan. 17!

Check out the letter below from the Education Law Center, Alliance for Quality Education and Class Size Matters on the inadequate DOE proposed Contract for Excellence plan for the current school year, which is not aligned with the law, as well as the faulty schedule of hearings and public comment which take place long after the funding has already been spent.  

Please send your own letter to DOE and the State officials in charge of approving or rejecting the plan no later than Jan. 17, by clicking here. 

If you prefer to send in your own comments separately, the DOE C4E proposed “plan” is posted here, and the address to send comments to is ContractsForExcellence@schools.nyc.gov

 _____

January 13, 2022

To the NYC Department of Education and NY State Education Department officials in charge of NYC’s proposed Contracts for Excellence plan for the 2021-2022 school year:

We have great concerns about DOE’s failure to allocate a single penny out of its targeted funds towards class size reduction in their proposed plan, even though in 2003, the State’s highest court in the Campaign for Fiscal Equity case said that class sizes in NYC schools were a systemic problem that robbed NYC students of their constitutional right to a sound, basic education.  Class size reduction is one of only a handful of reforms proven to provide real equity by narrowing the achievement/opportunity gap between racial and economic groups.  Smaller classes have been shown to result in higher test scores, better grades, more engaged students, and fewer disciplinary referrals – especially for those students who need help the most.  And yet class sizes in the NYC public schools have increased since the Court of Appeals issued this decision.

We also question why the DOE claims that they received no more C4E funds this year, given that NYC schools are receiving  $530 million in additional state foundation aid during SY 2021-22, increasing to $1.3 billion annually over next three years, to fulfill the goals of the CFE lawsuit. 

We oppose the fact that DOE has informed principals that if they choose to use these funds in the category of class size reduction, they can be used to maintain current class sizes or limit class size increases.  Maintaining and/or minimizing increases in class size would not provide any progress towards the smaller classes that NYC students need and deserve, according to the state’s highest court. 

Another persistent problem with the DOE’s plan is their insistence that they can use these funds to supplant or fill in holes created by the city’s own tax levy cuts, as stated in their proposed plan and their budget allocation memo, even though supplanting is specifically prohibited in the C4E law.  Again, it would make no sense to allow state funds to be used where the city itself has made budget cuts, which would also mean no progress or improvement in terms of providing equitable learning conditions for NYC students.  If the State is allowing the city to use these funds to supplant its own support for staffing or for other critical programs, the State should specify the language in the C4E law or the regulations which would allow this.

Finally, the timing of public hearings and comments occurs too late in the year to make any difference, and the state’s approval process of the proposed plan is meaningless since these funds have long been spent. The DOE must be required to hold hearings and schedule the public comment period in the spring, with the submission of the plan by July 1, to ensure that there is meaningful public input into the spending of these funds, and that the plan complies with the language and the intent of the C4E law. 

As it stands, year after year, the DOE has ignored the input of parents and teachers on this issue.  Every year that the DOE’s surveys have been administered, smaller classes have been the top priority of K12 parents when asked what changes they would like to see in their children’s schools. According to a UFT teacher survey, 99% NYC teachers responded that class size reduction would be an effective reform to improve NYC schools, far outstripping any other proposal.  And yet DOE refuses to follow through on a critical reform that we know for sure would lead to improved student outcomes, especially for children of color, English Language Learners, students with disabilities and those from low-income families.

 

Yours sincerely, 

 

Leonie Haimson, Executive Director, Class Size Matters

Wendy Lecker, Senior Attorney, Education Law Center

Marina Marcou-O'Malley, Policy Director, Alliance for Quality Education

DOE using GoGuardian and other surveillance programs, without notifying parents or providing them info required by law

NYC parents: please contact us at info@studentprivacymatters.org if your child has GoGuardian or another surveillance app installed on their laptop, either directly or through G-Suite.   If you're not sure, instructions on how you can tell are below.  And please contact us if you're concerned about this issue in general.

GoGuardian is a controversial surveillance spyware program that can be installed on student laptops or tablets, and if not configured properly, can actually allow teachers and administrators to spy into their homes without their knowledge or consent, as happened last year in Chicago. 

According to Wikipedia " GoGuardian can collect information about any activity when users are logged onto their accounts, including data originating from a student's webcam, microphone, keyboard, and screen, along with historical data such as browsing history. This collection can be performed whether students connect from school-provided or personally-owned devices."

The use of this program has greatly expanded during the pandemic. Bloomberg News recently reported that DOE has " signed a similar contract with the company, bringing GoGuardian's potential reach to more than 23 million students."   

GoGuardian is sold by a company called Liminex.  However, after I FOILed the State Comptroller's office for any contracts between the DOE and GoGuardian and Liminex, they replied they couldn't find any such contract -- though they only receive contracts over $100,000. According to Checkbook NYC, DOE has paid over $150,000 to Liminex in recent years,  with $51,000 spent between January and August of this year.

When asked by a PEP member about whether they had a contract with GoGuardian, the DOE replied this way:

The DOE was able to Centrally make this product available to all schools through the Enterprise G-Suite/Google Workspace license at no cost to school nor to families. However, some schools have purchased/used this product locally.

On a NYCDOE Google for Education site maintained by Google, GoGuardian is listed under the category of "G-suite extenders", along with other surveillance programs, like Securly and Gaggle.

The lack of transparency and parent notification about their use of GoGuardian appears to be the DOE's attempt to evade the state student privacy law, Education Law § 2-d, which requires that districts that allow companies  access to personal student data must have a contract addendum that provides specific privacy and security protections for that data, called a Parent Bill of Rights, and this addendum is supposed to be posted on the district website.  Individual schools are not supposed to be allowed to sign up and use any such programs without going through the same legal process.

None of these addendums are posted for GoGuardian, Securly, Gaggle, or G-Suite for that matter, and most parents probably don't know if these programs are installed on their children's laptops or not.

On the DOE website, there is a very incomplete  list of vendors/contracts with their posted Parent Bill of Rights ; the DOE has signed up for literally hundreds of other such data-gathering programs without making that info available to parents, so we really have no idea how this personal information is being used and/or protected.

Last year, Sen. Brad Hoylman sent a letter to DOE about their lack of compliance with the state student privacy law; since then, the situation seems to have gotten even worse.

Here are instructions on how to tell what programs are operating in the background on a Mac;  here are the instructions for a computer using Windows.  Finally, here is  GoGuardian's explanation on how to check if their app is being used.

Yesterday's hearings and our critique of DOE's reopening plan: too little Covid testing; too much standardized testing

Update:  Here is the just-posted transcript of the hearings.

 Joint hearings of the City Council Education and Health Committees were held yesterday on DOE's school reopening plan. The assorted officials who testified, including Chancellor Meisha Porter and Dr. Dave Chokshi, NYC Health Department Commissioner, did not appear to reassure many of the Council Members that their plan was well-thought out or strong enough to ensure student safety.

What was also depressing is that the public testimony was dominated by anti-vaxxer teachers, who also called out and disrupted the hearings several times.  News reports about the proceedings are here  and here

Above is the video of Michael Horwitz, providing abbreviated remarks on behalf of Class Size Matters.  The video of the entire session is here.   

Here and embedded below is our full testimony with our detailed critique of DOE's school reopening plan. 

Disappointing 2017 results released from literacy coach initiative- but is DOE hiding even more recent findings?

On Thursday, Leslie Brody of the Wall Street Journal reported that the first year results of the DOE literacy coach program were a bust, as the 2^nd graders at schools with these full time teacher coaches tested no better after nearly a year than similar students in other schools with no coaches. 

And yet the DOE plans to keep on expanding this program, and to spend nearly $90 million on it next year:

 A major push by New York City to help poor children in public schools learn to read by assigning literacy coaches to their teachers had no impact on second-graders’ progress, according to a study of its first year.

The city Department of Education conducted the evaluation, but its officials said Thursday it was too early to judge the initiative. They said they would strengthen the program while boosting annual funding to $89 million, from $75 million….

This evaluation tested second-graders in schools that had literacy coaches, and compared their results with peers in similar city schools that had no coaches. The report found that both groups of students were behind in skills in October 2016 and fell further behind expectations by May 2017.

Each group gained an average of four months of skills, when they should have gained seven months. At the end of second grade, students in schools with coaches on average performed at the level expected in the second month of second grade, on a measure known as the Gates-MacGinitie Reading Test. It covered decoding skills, word knowledge and comprehension.

This program is really the only major DOE initiative focused on boosting learning in elementary schools, aside from the expansion of preK, as the mayor went back on his campaign promises to reduce class size.

Like the Renewal program for struggling schools, this initiative was launched by Chancellor Farina with great fanfare, based on her theory of education that the only thing that really matters is providing more professional development to teachers.  Teachers cannot have too much training, according to Farina, and the Renewal program featured more and more PD for teachers and principals, with the total program (along with wrap-around services) costing about $187 million last year, according to the Independent Budget Office, with disappointing results.  Many schools on the Renewal list have now closed, without ever getting a chance to reduce class size.  Those that did feature small classes saw a significantly better chance of success, and many of them have left the program, as I pointed out in my testimony on Renewal schools last year.

Similarly, for all schools, Farina altered the use of the 20 minutes a day that teachers had devoted to providing small group instruction to struggling learners to yet more teacher PD.

Farina's near exclusive focus on PD was accompanied by a belief, as she often expressed it at Town hall meetings when parents complained about the huge size of their kids’ classes, that her concern was not that classes were too large, but they were too small. Perhaps as a result of this single-minded devotion in favor of spending time and funds on PD to the exclusion of reducing class size, NYC NAEP scores have stalled in most areas, and actually declined in 4th grade math since.

I previously wrote about the literacy program last year here; and predicted it wouldn’t work, based on the past record of an expensive program in which Chancellor Klein hired literacy coaches in all elementary schools during the first phase of Children’s First, presumably at the advice of Carmen Farina who was Deputy Chancellor at the time.  This program similarly led to little or no gains in reading, according to the NAEPs, and was given up after a few years. 

Now with Farina gone, and with these mediocre results, one would hope for a new direction at DOE, yet Josh Wallack, the Deputy Chancellor, is quoted as saying full speed ahead:

Department of Education Deputy Chancellor Josh Wallack said he had confidence in the coaches, their training and principal buy-in. He noted that some schools showed real improvements.

“We think we are on the right track,” he said. “We know we have a lot of work to do.”

Skeptics of the initiative have long argued it would be better to reduce class size, add services for the disabled and require a stronger focus on phonics, which teaches children to sound out letters as a primary way to identify words.

The department has expanded the literacy initiative yearly, and will dispatch about 500 coaches this fall,  [out of 661 elementary schools] with every elementary school getting a coach or additional attention.

 After I read the Wall Street Journal article, I asked for and received a copy of this evaluation from DOE which is now posted here. I was surprised to discover that it is not really a formal evaluation, but a mere eleven slide power point, larded with inspirational quotes and with only one slide devoted to the test results. 

That slide shows that the 2^nd graders tested in November and May in both “current and future ULit schools [those with literacy coaches] started behind in reading and fell further behind” . 

There are also survey results showing that while coaches reported that they spent the greatest amount of time with classroom teachers “co-planning”, teachers themselves wanted instead “More support in working with struggling readers.”

The DOE deck ends this way:

 “We hope to see reading gains in the coming years

• ·       As coaches deepen their knowledge base and craft

• ·       As teachers and schools benefit from multiple years of coaching.”

(Strangely, this comment omits mention of the students who one would hope would be the main beneficiaries of the program.)

What I hadn’t originally noticed from the Wall St. Journal story was the comparative analysis of test score gains (or losses) was based on assessments that these students took more than a year ago, in October 2016 and then in May of 2017.  Why would DOE wait till August 2018 to release this analysis? 

More importantly, where are the more recent results?  Surely there must be new data including the scores of  2^nd and 3^rd graders from October 2017 and May of 2018.  A statistical analysis could be done in a matter of  hours or at most days to see if there was any evidence of improved results, especially as they already have a pre-selected comparison group of students at similar schools.  

One has to wonder if the folks at DOE waited to see the latest scores, but since they didn’t show better results omitted them from this summary and will wait for yet another year, hoping for better news to provide from the third year of the initiative.  If they wait until the fourth year of the program to deliver those results, it will have already cost city taxpayers about $300 million on a cumulative basis.

I have FOILed for any more thorough evaluation of the program, as well as more recent data from the schools with literacy coaches, and/or any analyses based on them.  Let’s see what data,  if any, DOE provides.

Send in your comments today to the state on how they need to enforce the student privacy law; and how NYC DOE violates it in many ways

Only two more NYSED student privacy forums remain: tonight, Friday June 15, in Albany and in Queens at Aviation HS in Long Island City on Monday, June 18th;  more info here.
I urge anyone who can attend to do so.

In any case, please send in your comments ASAP to PrivacyForumComment@nysed.gov; the deadline is also Monday, June 18th.  Here is a sample message:

The NY student privacy law, Section 2-D, was passed in 2014, more than four years ago, and yet the state has made very little progress in implementing or enforcing this law.  The NY Parent Bill of Privacy Rights as written needs to be expanded to require full transparency from districts and schools, including the posting of all contracts with vendors or other organizations that gain access to personal student information, prohibiting contractors from making further redisclosures to third parties without parental consent; and including far more rigorous security standards to prevent breaches, ransomware and other growing risks to children's privacy.  

The current Parent Bill of Rights also lacks any mention of the critical legal rights parents have to protect their children's privacy under four important federal student privacy federal laws, including the Individuals with Disabilities Education Act  (IDEA) the National School Lunch Act (NSLA), the Children's Online Privacy Protection Act (COPPA) and the Protection of Pupil Rights Amendment (PPRA).

NYSED  must also do far better in enforcing the law.  The NYC DOE currently violates students privacy in several ways, including making personal student information available to charter schools for marketing purposes; and failing to include any mention of the Parent Bill of Privacy rights in its contracts with vendors, as the state law requires.  The DOE currently shares a great deal of personal student information with CBOs, including students' sexual preferences, without parental knowledge and allows the College Board to ask students' personal questions before the administration of the PSAT and SAT exams, without prior parental consent -- which violates at least three federal student privacy laws, according to recent guidance from the US Department of Education: FERPA, PPRA and IDEA.  

Finally, I urge you to appoint a Stakeholder Data Privacy oversight board, as SED promised to do in 2009 in return for a federal grant, which would provide critical ongoing public oversight into the collection of personal student data by the state and districts, as well as their privacy-enhancing policies and practices. 

Yours sincerely, [name, address, email]

My testimony from last Tuesday's student privacy forum in Manhattan is below.  In it, I explain in more detail all the problems with the state's lack of enforcement mentioned above and more.  Please feel free to quote from any of this if you like.  It took me over two years to access any contracts from DOE, and what I have found so far is quite startling. thanks Leonie

What is City Hall trying to hide? See their decision memo blacking out why they refused to align the school capacity formula with smaller classes

Yesterday, the DOE announced changes to its Freedom of Information guidelines, stating that from now on, they will attempt to more accurately estimate when they will provide the documents requested, including "the approximate date, which must be reasonable under the circumstances, when the request will be granted or denied."

The current practice is that every month or so, the DOE’s legal office sends you a boilerplate email saying they are still looking for the document, but “due to the volume and complexity of requests” it will take another month “to respond substantively to your request.”  Then the next month goes by, and you get the exact same message again.

I currently have four FOIL requests outstanding for over a year, including the Renewal school’s class size reduction efforts and funding for this purpose, technology spending by DOE between 2011 and 2015, the cost of charter school facility upgrades and leases charter leases and facility upgrades between FY 2014 and FY 2016, and the names of the private organizations receiving student personal information and the legal agreements on how this data will be used and shared. 

All these requests were filed in April 2016 and I am still waiting; nearly a  year and a half later, for a substantive response.

Despite de Blasio’s campaign promises that he would reform the FOIL process and respond in a more timely fashion, the response time is now worse than ever, and DOE remains the least transparent city agency in response time according to this Chalkbeat analysis.   (See also the section on Transparency in the KidsPAC report card in which the Mayor got an "F".)

The current wait times and continual postponements of a substantive response are a violation of law, since they represent a “constructive denial” according to Robert Freeman of the NY Open Government Committee and other experts.  Whether or not this new procedure will mean that the DOE will respond any more speedily to FOIL requests is completely unknown.  I remain skeptical. The new policy was instituted as a result of a lawsuit by the NY Post, so perhaps if the DOE doesn’t shape up their act, they will have to go back to court.  

When I was on vacation in the middle of August,  I did receive a substantive response to one of my FOILs – this time one I filed to the Mayor’s office.  On April 10, 2016, I asked for the decision memo from the Mayor's office about their decision  to accept or reject the thirteen recommendations of the Blue Book Working group . This working group, appointed by the Chancellor and co-chaired by Lorraine Grillo, the head of the School Construction Authority, had recommended in December 2014 that the DOE align the school capacity formula to the smaller class sizes in their original Contract for Excellence class size reduction plan

The City sat on these recommendations for more than six months, and finally in July 2015, in the middle of summer, announced that they would accept seven of the 13 but reject six others, including what many members said was the most important one: to align the capacity formula with smaller class sizes.  There were several articles about this rejection, including in Chalkbeat and WNYC Schoolbook , DNAinfo, and on my blog here  and here.

The city’s decision not to align the school capacity formula is also an important factor cited  in our class size complaint to the state, filed in July; (see p. 13 of the complaint) , providing yet more evidence of the city’s violation of the Contract for Excellence law, which requires NYC to lower class size and to align its school construction plan with its class size reduction plan. To this day, no one from City Hall has explained their reasons for rejection this proposal -- though members of the Working Group have repeatedly asked for them to do so. 

The final decision memo from the Mayor’s office that I finally received in August is dated May 28, 2015, and is almost entirely blacked out.   The only info that is legible pertains to which recommendations they accepted, with all the explanations for the basis for their decisions redacted.  They even blacked out any mention of the six recommendations they rejected.

The other interesting aspect of the decision memo is how it was signed off on by many high- level staff -- including the Deputy Mayor, the Corporation Counsel, the Chief of Staff, Emma Wolfe, and Dean Fulehain, head of OMB, but no one from the DOE or SCA, which is peculiar given how the issue pertains to the way school capacity will be measured. 

The Mayor’s office FOIL determination letter that I received along with the memo claims the redactions were made because of the exception to FOIL listed under Public Officers Law Section 87(2)(g):

Documents exempted from release include:

(g) are inter-agency or intra-agency materials which are not:
   i. statistical or factual tabulations or data;
   ii. instructions to staff that affect the public;
   iii. final agency policy or determinations;

Yet though this decision memo does pertain to intra-agency communications, it is also a "final agency policy or determination."  

It also presumably cited facts to explain and rationalize the decisions made.  If there were no facts cited to explain the decisions made,  this would even be worse.  Below is my appeal letter to the state, making these points with relevant evidence from previous court decisions and asking them to provide a cleaner copy.

_________________________

Henry Berger, Records Appeals Office

foilappeal@cityhall.nyc.gov

RE: ID #2016-002-00063

Dear Mr. Berger:

I am appealing the decision to redact nearly the entire City Hall decision memo dated May 28, 2015, that approved or rejected certain proposals on reforming the school capacity formula; this letter is attached.

 

The FOIL determination letter that I received along with the memo stated that the redactions were made because of exceptions listed under Public Officers Law Section 87(2)(g):

Documents exempted from release include:

(g) are inter-agency or intra-agency materials which are not:
   i. statistical or factual tabulations or data;
   ii. instructions to staff that affect the public;
   iii. final agency policy or determinations… 

Yet though this decision memo does include intra-agency communications, it is also a "final agency policy or determination."   It also presumably included at least some facts to explain and rationalize the determinations made, which should not have been redacted.

See also  these relevant legal cases, granting access to such documents, from the Committee on Open Government website:

New York Times Co. v. City of New York Fire Dep't, 4 N.Y.3d 477, 796 N.Y.S.2d 302 (2005) (held, dispatch calls made over Fire Department's internal communications system concerning response to September 11 terrorist attacks are disclosable "to the extent they consist of factual statements or instructions affecting the public"),,,,

Miller v. Hewlett-Woodmere Union Free School District, N.Y.L.J., May 16, 1990 (Sup. Ct., Nassau County, 1990) (granting access to records of final decision denying request to change schools); Rold v. Coughlin, 142 Misc.2d 877, 538 N.Y.S.2d 896, (Sup. Ct. 1989) (granting access to inmate health care records as factual data and final agency determinations);

I urge you to reconsider and remove these redactions that related to these determinations as:

1- this is a final decision memo; and 2- presumably the explanations contained at least some facts.

This appeal is filed within 23 business days from the day I received the redacted memo.

Yours,

Leonie Haimson

Executive Director

Class Size Matters

leoniehaimson@gmail.com

917-435-9329