Chicago Public Schools (CPS) recently made a critical decision that many schools systems are making around the country: to move massive amounts of student data to a more cost-effective storage system of computer servers often referred to by technology experts as the “cloud.” On its surface, the decision seems rather benign. Cost savings…check. Ease of use…check. Streamlined services…check.
But in digging deeper, there are significant security and privacy concerns that this decision raises that present real and potential dangers to the students, teachers and administrators in CPS.
Consider just two examples among many:
You are a student using the school-provided email service. Without logging off of your email account, you decide to click on a web browser to conduct research for a school report on birth control in developing countries. Without your express consent, the commercial provider of the email service collects and stores your search history and the content of your emails. Later, you are surprised – and mortified – when you receive a targeted pop-up advertisement for reproductive services.
Or consider a student who suddenly finds himself inundated with foreign-language emails and social media messages – some harmless, but some loaded with viruses that can destroy his computer – all because of a data breach on a server in a country temporarily storing that student’s supposedly secure data.
These scenarios aren’t far-fetched. Former Secretary of Homeland Security Michael Chertoff recently warned of the threat of off-shore cloud data breaches that poorly-secured cloud hosting can make more likely. Breaches like this can happen when school districts outsource their data and related services to cloud computing companies, particularly cloud companies that focus on monetizing user data for advertising purposes.
Cloud vendors need tough vetting
There are tremendous benefits to cloud computing, not the least of which is that it promises significant savings to cash-strapped districts by allowing them to outsource their email services, data storage and collaboration technologies. Doing this cuts district costs for servers, hardware, software and technology support and permits them to invest more in key priorities like teacher salaries.
But districts moving to the cloud, like CPS, must insist on the proven security and privacy provisions that most private-sector cloud customers demand. Security risks, already visible in an Internet-connected world, are magnified in the cloud. One issue is that school employees – hired and overseen by school administrators – will no longer control school data. Cloud computing vendor employees will have access to children’s field trip photos, parent-teacher email exchanges, student and teacher dates of birth and social security numbers, and on and on. And sometimes, these employees may make use of sensitive data for their own purposes, as occurred in 2010 when a Google employee was reportedly fired for accessing a minor’s call logs, chat transcripts and contact lists.
While employee malfeasance is also a risk with school-based databases, the loss of control over those who manage school data in the cloud is a security wrinkle that schools must address. Before moving to the cloud, districts should ask cloud vendors several questions, including: Will student data be stored in countries with lower privacy requirements than the U.S.? What information is mined by advertisers? How are employees of cloud vendors with access to student data vetted and supervised? Will all information that a student flows through a third-party vendor’s platform be unavailable to advertisers? Hopefully, CPS asked these questions when choosing their cloud vendor. If they were not asked, we have to ask ourselves, why not? Our children’s privacy and data is at stake.
Privacy issues that do not arise in school-based server environments can quickly become apparent when schools resort to the cloud. In particular, cloud vendors’ mining of school data for commercial purposes can be a very unwelcome intrusion for students, parents and educators alike. Schools should demand assurances from cloud vendors that school information stored in the cloud will not be data-mined, used for targeted advertising or sold to third parties. While schools can never be sheltered entirely from commercial ads, they should not become marketing free-fire zones simply because they have opted to embrace cloud computing technology.
There are clear advantages when districts migrate to the cloud, with cost savings being a significant impetus. However, schools should not ignore new and more complicated data security and privacy issues presented by this appealing data management option. When making vendor choices, however, there is no free lunch. What is not paid for in dollars is instead paid for using the currency of our children’s private information. Do we really want to trade our children’s private lives for cheap email?
Jon Bernstein is the president and founder of The Bernstein Strategy Group, a Washington, D.C.-based education technology consultancy. Bernstein is a consultant to Safegov.org, an online forum that focuses on privacy and security issues for public sector cloud users.