While generative AI can automate administrative tasks, streamline lesson planning, and free up time for student interaction, it also introduces new safety risks. Addressing the Risks of AI-enabled CSAM and Explicit Content in Education, Qoria’s global report, shows that these tools are also being exploited to produce child sexual abuse material (CSAM) and explicit imagery with alarming ease.

The weeks before the school year begins offer a critical window for district leaders to move from a reactive posture to a proactive strategy, taking strong digital safety steps before students return for the first day of school.

From the Data: Understanding the AI Digital Threat

School leaders should first understand today’s digital exploitation. Catherine Brown, Chair of the Internet Watch Foundation (IWF), says, “AI image generators have become much more sophisticated, to the point where almost anyone can make or manipulate life-like sexual or nude imagery of children at the click of a button.”

So-called "nudifying" apps have dramatically accelerated the ease with which this material is made, leading to devastating instances of grooming, distress, and bullying. The data gathered in Qoria's global survey underscores that these problems are active on school grounds today:

• Widespread Administrative Concern: An overwhelming majority of school leaders–91.4 percent in the United States, 90.5 percent in the United Kingdom, and 91.7 percent in Australia–voiced deep concerns over adult perpetrators using AI to groom students.
• Monthly On-Campus Incidents: Around a third of respondents in the U.S., the U.K., and Australia reported experiencing at least monthly incidents in which students possess, share, or request explicit, child-generated nude images.
• Younger Average Ages: The average age for these explicit content incidents is currently concentrated between 11 and 13 years old. Even more concerning, approximately 12 percent of U.S. and Australian respondents reported seeing these behaviors in children as young as 8 to 10 years old.

Despite these figures, few schools have preparation and prevention measures in place. More than 30 percent of the surveyed school leaders admitted they are unfamiliar with the common online grooming tactics that modern perpetrators use.

When school personnel do not understand the technical mechanics of the threat, early detection becomes nearly impossible.

Actionable Step 1: Empower Teachers Through Specific Safety Training

Teachers are a school's front line of defense, yet they are frequently left out of high-level technical digital safety briefings. To build an abuse-aware culture before the first bell rings, district leaders should design back-to-school professional development that addresses AI safety directly.

First, training must explicitly cover how AI changes grooming behaviors. Traditional grooming relies heavily on human text interaction over long periods. Modern AI algorithms allow bad actors to analyze massive amounts of social media data to identify vulnerable children with absolute precision. These tools can map out student interests, emotional states, and communication patterns to generate deeply persuasive, personalized messages. Staff need to know that a student's sudden emotional withdrawal or obsessive device usage could be connected to highly sophisticated online interactions.

Second, training must address the internal threat of student-generated content via nudifying apps. Whether a student acts out of thoughtless experimentation or clear intent, their developmental immaturity may blind them to the dual damage of these actions: the significant harm inflicted on the peer depicted and the severe fallout to their own relationships and future reputation. Teachers must be instructed on strict reporting protocols, understanding exactly who to contact in IT, administration, and school counseling the moment they become aware of a simulated image circulating in a peer group. This approachable guide for schools on AI-generated sexually explicit imagery from OCEPI can help with a framework for creating plans for both prevention and response.

Finally, training should acknowledge that staff safety matters, too. The Qoria report notes that there have been instances in which teachers and school staff find themselves victims of image-based manipulation through the misuse of AI technology. Treating this as a developing human resources concern builds trust and reassures educators that the district protects its entire community.

Actionable Step 2: Build Proactive Parent Awareness

The digital lives of students are happening both during the school day and when they leave school property. In fact, the risk can escalate during unsupervised time at home. Qoria's report indicates that a quarter of children are already using AI apps regularly to complete their schoolwork, meaning these tools are a constant presence in their domestic lives.

While parents might be focused on screen time and cyberbullying, AI-generated explicit content might be a blind spot. Districts can use the pre-school orientation window to actively educate parents.

A successful parent awareness campaign before the school year begins should focus on transparency and trauma-informed child-centered practical tools:

• Host Digital Literacy Orientations: Do not wait for a crisis to inform parents. Provide specific back-to-school webinars or easy-to-read guides detailing the reality of generative AI tools and the ways the school is supporting their children. Avoid alarmist language. Instead, explain the mechanics of image generators and peer-to-peer messaging apps clearly. OCEPI has a 10 Best Practices guide with a clear framework for how to structure messaging.
• Provide Parental Control Frameworks: School districts should offer concrete guidance on how families can manage devices at home. Introduce parents to reliable parental control tools and explain how to set up filtering on home networks. ConnectSafely has parent guides with clear instructions that school leaders can share with families.
• Create Clear Communication Pipelines: Parents need to know that if they discover a deeply concerning digital incident at home, the school is a safe partner rather than a punitive authority. Provide families with clear, step-by-step reporting instructions to ensure open dialogue. The Cybertipline from National Center for Missing and Exploited Children (NCMEC) is helpful to share.

Actionable Step 3: Provide Meaningful Layered Student Support

Protecting students requires a combination of clear education and protective technology. Before the school year starts, administrators must audit and align both educational and technical sides of student support.

On the educational side, digital wellness curriculum must expand far beyond plagiarism or screen-time management. When designing lessons regarding AI-generated explicit content, districts should follow the 10 best practices from the Online Child Exploitation Prevention Initiative (OCEPI).

First, curriculum developers must minimize or eliminate fear-based messages. Learning about worst-case outcomes seldom changes youth behavior because children typically believe it will not happen to them. Next, lessons should emphasize the social and emotional consequences of these behaviors. Focusing strictly on legal warnings or telling students that certain digital actions are illegal actually decreases the likelihood of reporting.

Additionally, student programming must maintain a child-centered approach. If a student is targeted by a nudifying app or an online predator, the school messaging must reassure them that they are not responsible for what happened. Shaming or blaming a student who has been manipulated only silences them.

True prevention requires active skill-building. Programs should explicitly teach how to set digital boundaries, utilize assertive communication, take screenshots as a record, and report harmful behavior. Because introducing these sensitive topics frequently prompts real-time disclosures, counselors and support staff should be on hand to receive student reports with immediate empathy and support.

IT departments have a role on the technical side. Before students arrive for the first day of school, technology teams can ensure that filtering and monitoring software are fully updated to flag searches for known nudifying applications and explicit keywords. Early detection is absolutely critical. The Qoria report emphasizes that many technologies schools already possess, including content filters, student monitoring systems, and digital wellness check-in tools, can assist in the early detection of risk.

Stepping Into the Future Together

The challenges introduced by advanced generative AI can feel daunting to already overwhelmed educators and parents. However, school and district leaders have the authority and community trust required to get ahead of these digital threats. Intentional steps during the summer to train staff, engage families, and strengthen network visibility can cultivate an environment where technology serves student learning without compromising student safety.

As the Qoria report concludes, planning for a unified community approach ensures that no individual school leader, teacher, or parent has to navigate the risk of AI-generated exploitation alone.

Resources

• Addressing the Risks of AI-Enabled CSAM and Explicit Content in Education. Quoria. 2025.
• Guidance for School-Based Professionals and School Leaders. Online Child Exploitation Prevention Initiative (OCEPI). 2025.
• Ten Best practices for Prevention Programs. Online Child Exploitation Prevention Initiative (OCEPI). 2024.
• Parent Guides from ConnectSafely. ConnectSafely.
• Cybertipline. National Center for Missing and Exploited Children (NCMEC)

Watch the video above or download/listen below.

When Charles Franklin thinks about his role as a technology leader in one of Texas's largest school districts, everything starts with security. Not because it's the most exciting topic in edtech — he'd readily admit it isn't — but because it underpins everything else the district tries to accomplish.

"Security is widespread around everything that we do," Franklin says. "Even if it's not directly related, there's always some interdependency."

His district is one of only nine in Texas to earn the Trusted Learning Environment (TLE) certification from CoSN, a rigorous credential that requires districts to document and provide evidence of their cybersecurity controls — and then recertify every two years.

The process, Franklin explains, is less about impressing a review board and more about creating institutional discipline. "It's not just that we're saying we're doing something," he says. "We're showing that we're doing it and somebody is reviewing it." That accountability structure also communicates something important to the community: the district takes student data seriously.

On the data privacy side, Franklin's team maintains a dedicated staff member focused exclusively on vendor agreements — a significant investment, but one that pays dividends. Every vendor relationship is governed by a formal data privacy agreement that scopes what data can be collected, how long it's retained, and who bears liability in the event of a breach. The district also leverages the Student Data Privacy Consortium (SDPC) and One EdTech to vet products and adopt existing agreements rather than negotiating from scratch each time.

For smaller districts without those resources, Franklin points to state-level organizations such as TETL — Texas Education Technology Leaders — as a starting point. Through those networks, districts can access templates, share best practices, and connect with peers who have already done the hard work.

Looking ahead, the district is launching a Virtual Pathways program to attract and retain students in a competitive enrollment environment, and a major data lake project designed to help administrators make smarter, evidence-based decisions across curriculum, finance, and student outcomes.

Although artificial intelligence has created many opportunities in education, such as supporting individualized learning, providing tutoring, and increasing teacher efficiency, it also poses risks for school districts. From AI slop and pink slime to harmful deepfakes and scams, district leaders and technology professionals have their hands full trying to provide students and teachers with safe AI.

Adding to those challenges now is the threat of shadow AI, which certainly sounds, well, shadowy. In reality, it’s a bit less nefarious, although it still can cause havoc for IT departments as well as school staff and students.

What Is Shadow AI?

Quite simply, shadow AI is the unmonitored use of any unauthorized AI tool or platform by teachers, staff, or students, such as generative AI chatbots or data visualization tools. Having such unvetted AI programs can open schools to the potential for data breaches and other cybersecurity vulnerabilities.

Typically, the unsanctioned use of these AI tools is unintentional, says Maurie Beasley, network/system administrator for Llano Independent School District in Texas and author of Teachers Have Bigger Fish to Fry: Tales from K12 Education/ How AI Might Help...or Maybe Not.

“It's really often ignorance,” she says, noting that when she informally asks educators in her district about their AI usage, many don’t even realize they’re accessing AI as it’s been baked into so many tools now. “They're not hiding in the closet and trying to do things they shouldn't be doing. It's just the utilization of something that they have easy access to that makes their world or their life easier that they're using without permission and not thinking about the consequences.”

“An IT person literally calls it shadow because ‘If I can't shine a light on it, it's in the shadows,’” says Jim Beasley, Llano ISD’s Director of Technology (and Maurie’s husband). “And if you're using it without my permission, that's an IT perspective.”

Jim can envision a worst-case scenario of shadow AI, such as using an open-source AI agent tool like OpenClaw that, when installed on a local machine, has unrestricted administrative-level access, allowing it to manipulate files and send emails. Such a tool on a network, especially if it exposes API keys, would present "a really big problem."

The Risk For Schools

One of the biggest risks with shadow AI for schools is the potential for data breaches, especially when the evolving aspects of AI can make for new threats and concerns.

“Right now, if there's a data leak, you stop the leak, maybe you can pull the data back in, maybe you can't, but that data, you can draw a bubble around it and say ‘This is what got out,’” says Jim. “Once a data leak gets into AI, you can't remove it. I mean, OpenAI doesn't have a way to pull that data back out. So if you leak a social security number and it gets pulled into some training data for a large language model, it's there forever potentially.”

Of course, any unmonitored access to a school or district network can create opportunities for hackers and other bad actors as well as more sophisticated cybersecurity attacks.

“Being compromised before meant somebody gets access to someone’s email, for example, and starts sending emails out on their behalf,” says Jim. “If some kind of AI gets onto my network, or somebody plugs something in it's got AI access, what does that even mean? How is that going to interact on my network? What does ransomware look like that has intelligence attached to it? My biggest goal is to retire before I have to figure that out because I don't know if I'm smart enough to figure that out.”

What Schools Can Do About Shadow AI

Obviously, as with any potential threat, the first step to protecting against shadow AI is awareness and education.

“If you don't start with education, the technology things are useless,” says Jim. “At the end of the day, it's 90% education and 10% technology, or maybe 10% technology with 5% of that being the processes that you put in place as part of that technology. And if people aren't educated, they are going to do things you cannot anticipate in ways you did not anticipate.”

Maurie encourages skepticism, even joking that she pushes her colleagues to the point of paranoia. “It's very enticing to let AI take the cognitive load,” she says. “Yeah, let it do the easy stuff and let it help you, but when it comes to the cognitive part, make sure that's still the human that's making those decisions.”

If they haven’t already, IT departments should also consider implementing guardrails around AI use, monitor usage, and once again, make users aware of the risks. Jim suggests sticking to IT 101 principles, such as ensuring employees have the least necessary permissions and tightening previously lax policies, especially concerning Chrome extensions, which are now being enhanced with AI. He also advocates spending more time checking for erroneous logins and proactively securing networks.

With how rapidly edtech is evolving and AI being added to so many platforms, school technology leaders need to be extra vigilant, and even consider re-vetting software and tools that were previously approved.

‘It’s Another IT Project’

Ultimately, dealing with shadow AI is the same as dealing with any cybersecurity threat.

“If you're in an IT department, focus on what you know how to do, have the same disaster recovery plans you've always put in place, treat AI that way, but don't ignore it, either,” says Jim. “If you ignore it and you just decide somehow it's going to take care of itself because Google's going to provide it just like they've done everything else, you're making a mistake in multi-dimensions because, A, Google can't plan for everything. And B, Google's AI doesn't do everything, so people are going to go off and use a different AI.”

“Artificial intelligence, when you look at it from an IT perspective, is the same process you've gone through with every new technology that's ever happened,” says Maurie. “You need to have a security plan in place. You need to make sure you have backups ready in case you need to restore something. It's literally just another IT project.”

AI holds tremendous promise for teaching and learning, but it also brings risks, especially when it comes to protecting students’ safety, privacy, and development. That's why the new AI Risk Assessments from Common Sense Media are a step in the right direction—and one every innovative educator should know about.

Instead of treating all AI as "good" or "bad," Common Sense offers detailed, nutrition label-style evaluations of popular AI tools. The goal: empower educators, parents, and policymakers to make smarter decisions grounded in transparency, ethics, and student well-being.

Note: Common Sense ratings are updated periodically, and you should check the website for the most current information.

What Are The Common Sense Media AI Risk Assessments?

Common Sense’s framework rates AI tools across eight guiding principles:

1. Put People First
2. Be Effective
3. Prioritize Fairness
4. Help People Connect
5. Be Trustworthy
6. Use Data Responsibly
7. Keep Kids & Teens Safe
8. Be Transparent & Accountable

Each tool is evaluated through a human-centered lens, acknowledging that technology never operates in a vacuum. People build it, people use it, and people are affected by it.

What You Should Know

Here’s how some of today’s most talked-about AI tools stack up (with risk levels based on Common Sense Media’s assessments):

• Social AI Companions — Very High Risk
  Apps such as Character.AI, Replika, and Nomi are designed to simulate emotional relationships, complete with personalities and memories. Common Sense Media deems these tools an "unacceptable risk,” citing instances in which the AI encouraged harmful behaviors, engaged in sexually explicit roleplay, and emotionally manipulated users. Educators and parents are strongly advised to restrict access to these applications for minors.
• Perplexity — High Risk
  Real-time web searches without strong filtering mechanisms make this tool a risky option in school settings. Students may be exposed to misinformation or harmful content. Proceed only with strict supervision—if at all.
• ChatGPT — Moderate Risk
  A powerful creativity booster, especially for brainstorming and writing support. However, it struggles with factual accuracy and may generate biased or inappropriate responses. Best used with close adult oversight and clearly defined learning goals.
• Gemini – Teen Experience — High Risk*
  Google's Gemini, when used through its teen-accessible experience, offers content safeguards and privacy controls. Still relatively new to education settings, it is currently aligned with responsible AI use for older students when used within platform guardrails. *At the time of initial publication, this platform was originally rated as low-risk, but recently was changed to high risk by Common Sense.
• Khanmigo — Low Risk
  Purpose-built for education by Khan Academy, Khanmigo is a standout for its student-first design, robust safety measures, and transparency. A smart choice for classrooms looking to explore AI-enhanced tutoring in a controlled environment.

Why This Matters

We can’t stick our heads in the sand and ignore AI—and frankly, we shouldn’t want to. But blind adoption is just as dangerous as blind rejection.

Common Sense’s assessments help educators:

• Choose AI tools that align with child-centered values.
• Understand hidden risks before a crisis happens.
• Build policies and classroom practices that maximize the benefits of AI while minimizing harm.

The Bottom Line

This new risk assessment framework helps educators become critical, empowered, informed users.

The future isn't about banning AI or blindly trusting it; it's about striking a balance. It's about smart navigation.

Common Sense Media just handed us a better map.

You can explore the full AI Risk Assessments here: Common Sense Media AI Ratings.

• AI Starter Kit for Teachers
• 10 Free AI Trainings and Certifications for Educators

When Dr. Shanique Worthey launched her Cyber Champions program, she had no idea just how many students would jump at the chance to participate in the digital citizenship program.

“As we began collaborating last summer for the Cyber Champions, we expected a group of 25 or so,” says Worthey, Manager of Security Awareness and Engagement for Georgia’s DeKalb County School District, which serves 92,066 students across 137 schools. “Instead, we had about 100 students immediately apply to be a part of this initiative to virtually meet monthly to talk about different topics such as cybersecurity, artificial intelligence, and being a good digital citizen.”

For her efforts, Worthey was recently recognized as Innovative Educational Technology Specialist at the Southeast Regional Leadership Summit as part of the Tech & Learning’s Innovative Leader Awards.

Worthey discusses her impressive Cyber Champions program and shares five tips to launch a similar digital citizenship program in your district.

A Winning Gameplan for Cyber Champions

Worthey launched Cyber Champions with Eric Logan, Director of Information Security, but its immediate success made the duo realize they would need reinforcements to achieve their goal.

”The numbers were definitely overwhelming,” Worthey says, adding she was thrilled when a dozen teachers volunteered their time to help. “We recruited teachers to help us facilitate virtual meetings and run small breakout rooms to dive deep into the lesson shared in the monthly meeting. We’re hoping to pay them in a future cohort, but we're not there yet. So at the moment we are relying on their enthusiasm and willingness to participate in such an initiative.”

With such a wide age range, one common digital topic was presented each time with breakout rooms providing space to scale participation by grade level.

“When I first started out, I was tweaking plans from Microsoft and Common Sense Media about AI and cybersecurity,” Worthey says. “I created a template for the teachers to align to the grade level of their group of four to six students. I wanted to celebrate, not micromanage our volunteers, so I gave them the autonomy to use their expertise in their respective fields to help students understand.”

Building Leaders—The Domino Effect

Empowering and growing leaders extended beyond the volunteer teachers. Student participants not only put in the time to learn the technology-based lessons, they actively teach others in their school community what they learn.

“They're definitely our ambassadors,” says Worthey. “They're our champions for cybersecurity and AI. They act as a liaison between us and the other students. After the monthly meeting, students are required to create their own presentation based on the information they learned with us and share it with their classmates. That’s why we call them our Cyber Champions.”

Strength in numbers proves true at DeKalb. Worthey’s team reaches out not only to peers and classmates, but shares lessons with parents, teachers, the local community and beyond.

“Some of the students may get selected to present at the PTA or during their school’s morning announcements. Some participate in monthly tech cafes for the community, where they get to present to parents and visitors,” says Worthey. “Many Cyber Champions compete in our tech fair competition, placing in their respective categories. They are highlighted outside of the school community—one was even a participant in the student panel for Tech & Learning.”

Keeping the monthly message relatable and easy to digest helps kids pass the information on to others, a proven technique for ensuring lessons land and are remembered.

“We talk about topics like privacy and reading privacy statements,” says Worthey. “We talk about using artificial intelligence—who's behind those chatbots? Ask teachers if now is an appropriate time to use AI and use it as a brainstorming partner, not for answers. We theme it to what is happening for the kids to make it relevant, so over the holidays we discussed how to shop safely online.”

Worthey promotes the continuation and expansion of the program by using the champions’ own words.

“As part of our closeout ceremony, I asked our students to create a 30-60 second video to help recruit other students,” she says. “I'm definitely enjoying watching their videos, to learn their feedback and what their thoughts are on the program.”

5 Tips to Launching Cyber Champions in your District

Worthey and Logan share tips on developing a successful Cyber Champions program to boost digital citizenship and understanding.

1. Offer Opportunities to Hone Soft Skills

Soft skills such as communication, collaboration, and presenting in front of an audience creates opportunities for students to shine and really be leaders in the field. By working on those soft skills, students will be more comfortable when looking for jobs, interviewing for college, presenting at competitions, and giving classroom reports.

2. Build Model Students

Breaking information into smaller, digestible pieces helps students easily share lessons with peers in the classroom. “When we discuss using AI in an ethical and responsible way, students can model proper behavior when using the tech and show others how to be a good digital citizen,” says Worthey.

3. Bring in Subject Matter Experts

Worthey has reached out to the local FBI office and shared with them about the Cyber Champions program, explaining that they were looking for ways to partner with the FBI to bring strategies for online security awareness to the table to share with the students.

4. Create Career Pathway Awareness

“A lot of our vendors, such as Microsoft, Google, Fortnite, and others have a lot of opportunities for training students interested in careers in cyber security and IT,” says Worthey. “It's a level of experience and knowledge that they have access to through Cyber Champions, so once they go to college or into the workforce, they are already a step ahead.”

5. Offer Volunteers a Choice of Recognition

“I created a form asking teacher-volunteers how they’d like to be rewarded for their time,” says Worthey. “Some like personal recognition — a mention at year-end celebration, some wanted items boasting the Cyber Champions logo, some preferred a district-wide news flash, while others would like a gift card.”

The Tools They Use

• Microsoft Teams
• Canva
• Common Sense Media
• Fortnight
• Google

• Innovative Leader Award

AI isn't just a buzzword, and K-12 cybersecurity isn't just about blocking threats; it's about securing data from AI-driven risks while ensuring districts retain full control. As AI adoption grows, schools must take control to prevent misuse, protect data, and enforce accountability through technology, without adding complexity.

Sponsored by itopia, this webinar, which took place on April 8, 2025, explored how districts can take charge of their cybersecurity strategy, ensuring proactive threat prevention, responsible AI adoption, and total data control, with a platform such as itopia’s SecureClass. With fully customizable access controls, SecureCless helps you determine exactly what's allowed, down to the details.

Hosted by Tech & Learning’s Content and Brand Director Christine Weiser, the discussion featured Kyle Berger, Chief Technology Officer at Grapevine-Colleyville ISD, and Jena Draper, Chief Innovation Officer at Itopia.

Watch the replay here

Key Takeaways

AI Adoption and Cybersecurity Risks: AI is rapidly being adopted in education, far exceeding that of previous technologies such as the internet or social media, however, this growth brings increased cybersecurity risks. Schools need to secure data from AI-driven threats and maintain control over their systems. “Tools have now embedded AI into their platform, sometimes with us knowing it and accepting those terms, and sometimes without us accepting or knowing those terms,” said Draper. “It has created this extreme risk for us." This necessitates continuous review and adaptation of cybersecurity strategies.

Balancing AI Adoption and Security: "AI is going to be embedded in jobs that are existing today,” said Berger. “Jobs that have always been around are adapting." Consequently, schools cannot simply block AI due to its increasing importance in preparing students for the future workforce. Instead, they must find ways to enable AI use while mitigating risks.

Threat Landscape: The threat landscape is evolving, with bad actors increasingly using AI for malicious purposes. Schools need tools and strategies to defend against these advanced threats.

Data Control: A significant focus for schools and AI should be data control. “It just comes down to what data can be shared with that AI tool, right?” said Draper. “If I'm just typing in silly things about cats or something, it doesn't really matter. But if I'm starting to put my personal information in there, whether it's knowingly or unknowingly, then that's what creates the risk.” To that extent, Itopia's SecureClass allows schools to control what data can be shared with AI tools, such as blocking copy/paste, uploads/downloads, and camera/microphone access.

Chromebook Security: A misconception exists that Chromebooks are inherently secure. However, as their use increases, so does the risk. “It's not just students that are using these devices anymore,” said Berger. “The more usage you see, the more targets and threat actors are gonna start trying to find ways to get to it.” Ensuring that your cybersecurity protection works for all devices is critical.

Fighting AI with AI: The webinar emphasized the need to use AI to fight AI threats. “We've got a massive database of over 8 billion endpoints, and we're watching these threats as they are suspicious events so that they don't become problematic for you in the future,” said Draper. “So anytime a URL has any kind of suspicious activity, we go ahead and block it with our extension in real time, and we unblock it proactively as we get information that allows us to feel that that is no longer a risk to you. So we've blocked over 18 million websites in just the last 90 days for suspicious activity around malware and phishing. This is no easy task. But securing AI and then using AI to secure it is all part of what SecureClass's underlying mission is.”

• Tech & Learning Webinars

Tim Kircher, a junior cybersecurity student at the University of South Florida, jumped at the chance to get real-world experience at the institution’s Security Operations Center (SOC).

“It opened my eyes to a lot of the opportunities and broad paths within cybersecurity,” says Kircher, who is an intern at the University of South Florida’s SOC. He adds that working at the SOC empowers him and other students. “It gives us the tools and the abilities to think outside the box and think critically while also learning the critical and technical tools of cybersecurity.”

Kircher is one of many across the country who is benefiting from an increasingly popular strategy of recruiting students to help secure school networks from the ever-increasing number of cybersecurity threats. The strategy was recently highlighted by Microsoft in a blog post on digital transformation.

The approach is a win-win that both prepares students with real-world experience and helps universities in their ongoing cybersecurity efforts, say those who have been involved with these types of SOCs.

The Benefits of Student Cybersecurity Involvement

For students like him, Kircher says getting involved with an SOC is an important opportunity to start networking in the field, in addition to learning hands-on skills. He adds that the students who work in these centers also give back to their universities.

“The beauty of our program is that we can take the burden off of our organizations that receive such a large number of security alerts,” he says.

Corey J. Lee, a security CTO at Microsoft, says he is always being asked how to get started in cybersecurity. “From my vantage point, the best place to start is in one of these security operations centers.” He adds this is because many of those hiring for cybersecurity roles, even early career roles, require applicants to have a wide range of experience with different digital threats. “Working in a security operations center, you get exposure to a large number of security domain areas, identity, email security, endpoint security, network security, etc.”

Participating in a student SOC can also help students meet the experience requirements of many jobs.

“A lot of early in career opportunities expect cybersecurity professionals to have three to five years of experience,” Lee says. “What we're seeing is if a student has been working in their student SOCs for three years, and maybe starting in high school, or they've done this throughout their career in college, they're graduating with three to four years of cybersecurity experience.”

Starting A Student-Supported SOC At Your School

Developing a student-involved SOC at your school can be all about matching students with the right roles in your cybersecurity scheme.

Ryan Irving, who manages the student SOC at the University of South Florida, says doing this involves finding the right balance.

“We want to get students exposed to real-world, hands-on events and alerts and give them the chance to investigate and triage. But we want to limit the risk to the organization as well as to the students,” he says. “So what we do here is we focus predominantly on the level one triage. So we will identify an alert from any given tool. We'll investigate it, we'll do our thing on it. We'll run it down as far as we can, and then whatever we identify via assets, users, open source intelligence on IP addresses, other investigative artifacts, things like that, we will curate that we will create a report, and we'll escalate that.”

While these types of measures are important, it’s also critical to help students who are interested in cybersecurity develop the skills they need while working at a student-led SOC. Lee notes that in his experience, oftentimes a passion for learning outshines existing knowledge.

“The talent shortage that we're dealing with right now isn't just about a deficit in humans. It's also a deficit in folks that are interested and willing to learn more and to go into some of the emerging spaces,” he says. “So I can't stress it enough that harnessing the curiosity that exists from students is an opportunity to fill gaps in security operation teams.”

• 5 Cybersecurity Tips For Schools From CISA’s Deputy Assistant Director
• Malicious QR Codes: 5 Ways To Protect Educators and Students

Ransomware and other attacks continue to be a major threat for schools. Education is an appealing target for hackers because of the level of student data school networks often contain.

A new cybersecurity report from Travelers, a cyber insurance company, found that ransomware attacks increased by 32% from Q3 to Q4 last year. Schools saw similar trends, with 82% of K-12 organizations experiencing cyber incidents during the 18-month study period, according to the 2025 State of K-12 Cybersecurity Report from the Center for Internet Security (CIS).

Randy Rose, VP of Security Operations & Intelligence at CIS, discusses the recent trends in ransomware and cybersecurity, and shares advice for how schools can continue to overcome these attacks and keep their networks and data safe.

Increase of "Malvertisement" Attacks

"Malvertisements," ransomware attacks that gain entry to school networks through malicious code hidden in advertisements, have become more common, serving as the vector for malware 63% of the time. These attacks can utilize watering hole adware attacks, in which malicious code is snuck into the ads of reputable sites that teachers or students might commonly visit from their school devices.

“These advertisers tend to be criminal actors who specialize in early entry, so they gain access to systems,” Rose says. “Typically, what ends up happening is they rent ad space, usually through a third party.”

Newspaper ad space can be sold multiple times by various reputable companies but eventually, someone sells the space accidentally to a hacker.

“So a couple of layers down, you end up with a criminal actor who's buying that ad space, and they're putting malicious code into those ads,” Rose says. “When you visit that website, your browser, which is building the website on the fly, is actually executing code that's in that advertisement. That code is looking for a vulnerability in your browser or on your local system.”

The Rise of Ransomware Groups

The Travelers report highlights the emergence of 55 new ransomware groups in 2024. Many of these hacker groups were supported by nation-state resources, while others were more loosely affiliated groups of cyber outlaws with complementary skill sets.

“Ransomware in particular, it's hard to pin down specifically who's doing what, because the actors that are associated with one group might not have a particular loyalty to that group, and they might operate under multiple ransomware organizations at a time,” Rose says. “If I'm one of those initial access brokers, and I'm really good at gaining access into networks, I might sell my access to four or five different ransomware affiliates.”

Personalized Ransom Demands

When hacking groups obtain sensitive information about students and teachers they don’t always just threaten the school or district.

“We've seen with a couple of ransomware groups where they specifically target teachers and students' parents, and go after them to try to get them to put pressure on the schools to pay,” Rose says. “When they go after the stakeholders, that's a triple extortion attempt.”

In addition, human vulnerability is often targeted in the initial attacks. According to the CIS report, cyber threat actors target human behavior 45% more often than technical vulnerabilities.

Keeping Networks Safe

Rose recommends schools follow the CIS Community Defense Model resource. While he knows that funding are tight, basic security measures can go a long way.

“If you put just essential security controls in place, you offset your risk by 90%,” he says. “Even as threats are becoming more sophisticated, you're really setting yourself up for success by focusing on the simple tasks.”

In addition to action such as making sure there is an offline backup of data and that all apps are regularly updated, culture is important, particularly a culture that doesn’t stigmatize reports of potential hacks. ​​

“Some of the best chief information security officers and IT directors that we know really have a no judgment, no punishment policy,” he says. These technology school leaders let their stakeholders know they can “come to us and share the things that are going on, and we'll work it together," he adds. "You're not going to get in trouble for highlighting a security issue with us.”

• 5 Cybersecurity Tips For Schools From CISA’s Deputy Assistant Director
• Hackers Are After Student Data. Here’s Why

The threat from AI for students goes well beyond cheating, says Yasmin London, global online safety expert at Qoria and a former member of the New South Wales Police Force in Australia.

Increasingly at U.S. schools and beyond, AI is being used by predators to manipulate children. Students are also using AI generate inappropriate images of other classmates or staff members. For a recent report, Qoria, a company that specializes in child digital safety and wellbeing products, surveyed 600 schools across North America, UK, Australia, and New Zealand.

Some key findings include:

• 91.4% of U.S. respondents are concerned about online predators using AI to groom students.
• Children are possessing, requesting and sharing nude content online at just 11-13 years old: 67.6% of U.S. respondents are seeing this behavior, with Snapchat being the top platform of choice.
• Parents are not educated/engaged: 70.6% of U.S. respondents said there is a lack of awareness amongst parents when it comes to AI and explicit content.

The report demonstrates that schools are worried about this issue but don’t yet have the resources to respond.

“There was a lot of concern, but not a lot of knowledge,” London says.

Here’s a closer look at the threats around AI grooming and other AI concerns, and what schools can do about it.

AI Grooming and Other Sex Crimes: Potential Dangers to Avoid

The same way scammers use AI to make their phishing schemes more efficient and effective, sexual predators online can use AI to harm children, London says. She adds that schools should be aware of how predators might use AI to target a victim, how they might use AI to gain the trust of a victim, how they might fill a need, and then how they might manipulate and isolate them.

According to the Qoria report, AI can help predators target students by analyzing data, recognizing patterns in their behavior, and then using AI to create fake and convincing personas. AI can also generate fake information about people close to the child to cause distrust and lead the child to become isolated, making them more vulnerable. Additionally, deepfakes can be used to blackmail children with the threat of releasing potentially embarrassing information.

In that same vein, deepfake technology can be used by students to harass other students and staff by creating fake explicit images of them.

These are just some of the nefarious ways AI technology can be used in a harmful and abusive manner. Another example is de-aging AI tools.

“So I could put in a picture of me. I'm 42 years old, and it will change my appearance to be a 10-year-old,” London says. “The use of AI to manipulate children's images in a lot of different contexts is definitely a concern.”

Preventing Nefarious AI Use

London shares several steps schools can take to limit the threat to students from this type of AI use.

Using technology correctly. London says individual schools and districts should review their filters and monitoring systems to make sure they’re appropriate for modern contexts. “Some of them can be quite basic. Some can result in over-blocking, and that can be problematic,” she says. She adds schools want a filter that can pick up on contextual alerts. “Language that a young person might be using that might not necessarily [be] flag[ed] as being explicit, but once you have an understanding about how a predator might talk to a child that might be something that is picked up.”

Educating parents. Schools understand that students need to be educated on these topics but sometimes they forget about parents. “A really key finding from this report was that 70% of schools said that a lack of parental awareness around AI and explicit content and predators was a key barrier,” London says. “And what we also found is that only 44% of the schools or districts proactively engaged parents in educational nights or shared information. So that's a really easy win.” She adds this education does not need to be onerous. “It could be sharing some regular communications around some risks and working with experts in the area such as local police.”

Sharing parental controls with parents. “A lot of schools and districts can share things like parental control tools as well. That will help parents not just manage their children's time, but also the sort of content that they're accessing,” London says. “When they use a parental control tool, they're able to see where their child has been blocked from. That information is really great to start a conversation around”

Educating staff. Staff education was also identified in the Qoria report as a key need around this issue. London says there are low-budget, high-impact steps schools can take such as having a local university cybersecurity expert speak about the dangers of AI or forming working groups around these topics. She adds, “When staff has good knowledge and they have a strength-based approach to tools like AI that has a knock-on effect when it comes to things like help-seeking.”

• Guarding Your District Against AI Deepfakes, Including Porn
• From Social Media to School Halls: Understanding and Preventing Cyberbullying

Don’t underestimate student talent, says Jay James, the Security Operations Center (SOC) Director at Auburn University, who built the center at Auburn over the last decade. Part of the center's mission is to employee students to help with cybersecurity as a way of strengthening the efficacy of the SOC but also providing students with hands-on experience in the field.

Creating a SOC to respond to increasing attacks on schools and universities was one of the strategies Microsoft highlighted in its recent cyber threat intelligence brief Cyber Signals.

Here are James’ tips for putting students at the center of the SOC at your institution.

Staffing Your Security Operations Center (SOC) With Students: Establishing Scope

As any cybersecurity professional knows, one of the big challenges of creating a SOC is resources. Before you even start, you want to think about how you are going to direct the limited resources you have, James says.

To do this, he advises really asking yourself why you are creating the center. “Is it for more compliance reasons -- where you have to make sure that you have a SOC in place? Are you trying to look for certain threats? Are you trying to protect certain types of data?” he says. Once you’ve identified that “why,” you can prioritize resources.

The next step is developing your specific metrics for success, James says. He adds that if you’re trying to sell the idea of a SOC at your institution, the student and education component can be really appealing to various stakeholders.

Building Student Roles

For the student component, you need to also build a program that is specific to students.

“So when you hire a student, they're in a program where they can thoroughly get trained in cybersecurity basics, how to be a SOC analyst, and how to really thrive in the work that they're going to be doing in the SOC,” James says.

He adds that you also want to develop specific student-centered employee training for new student hires. “Having a specialized training program for students is going to be necessary because they're getting up to speed pretty quickly and they're also learning how to work in a professional environment, something that a lot of the students have not had the opportunity to do,” he says.

Complementing The Curriculum

Work that students do in the SOC at Auburn is not directly linked to their degrees or a graduation requirement, but James works with professors in relevant fields so he knows what skills students have and how students can build on these while working at the SOC.

“We understand what they're learning in the class, and we provide additional training,” he says. “It’s a win-win. We’re getting these very brilliant students that are able to support us and keep the campus more secure but they are also gaining hands-on skills that would be much harder for them to get if they were not in the program.”

Students also get the opportunity to work on projects of their choosing, gaining valuable experience in the process. “As long as they’re doing their day-to-day triage of security alerts and incidents, we give them the opportunity to focus on a project that would help support us, but it's also a great resume builder for them," James says.

Recruiting Students To SOC

When you first start working with students at a SOC, James says you may have to devote more time to recruitment, which was the case in his experience. He advises connecting with the departments in which cybersecurity classes are housed in your university for help with recruitment.

Reaching out to student organizations can also be effective.

“If there is a hacking club or if there is a women in business or minorities in business and/or women in technology, or minorities in technology club, all of those types of organizations have students that you can pull from,” he says. “After it's established, and after students start to experience the benefits of the SOC, they start selling it for you.”

• Malicious QR Codes: 5 Ways To Protect Educators and Students5
• Cybersecurity Tips from CoSN’s CEO and a Digital Security Expert

QR codes have become more common in and beyond education. Teachers use these instead of printed handouts and many are regularly placed on fliers advertising university or school events. So it shouldn’t be a surprise that hackers have begun looking for ways to exploit QR codes.

One way they do this is by hanging fraudulent QR code links in real life or by including malicious QR codes in gifs or as part of fliers sent in emails. Since spam blockers have more trouble recognizing images, and because it's common for school announcements to include QR codes, this is a particular concern for education.

Over the past year, Microsoft Defender for Office 365 blocked more than 15,000 emails per day targeting the educator sector with malicious QR codes. Microsoft highlighted the threat of malicious QR codes in its latest cyber threat intelligence brief, Cyber Signals.

Jay James, the Security Operations Center (SOC) Director at Auburn University, and Corey Lee, Security Chief and Technology Officer at Microsoft, both share tips for ways in which classroom educators, administrators, and students can help limit the threat posed by malicious QR codes.

1. Avoiding Malicious QR Codes: Slow Down

Lee says one important step to avoiding unintentionally opening a malicious link through a QR code is just taking a moment to examine the source of the QR code.

“It sounds cliché, but really slowing down to speed up is one consideration,” he says, adding that he knows it's challenging with everything that is going on for educators during the day, but it’s important to remember. “We think most QR codes are scanned and clicked because things are just so fast-paced.”

2. Apply Lessons From Other Cybersecurity Training

Required cybersecurity training in many educational settings have taught us to recognize potential phishing attacks. James says these same lessons apply to potentially recognizing a malicious QR code.

After you’ve slowed down to assess the source of the QR code, start looking for the same warning signs that might make you suspicious of a link. You might ask yourself, “Is this something I’m supposed to receive?” James says. If the school president or principal doesn’t usually email you, maybe that’s your first sign something is suspect.

You should also ask, “Is this something that I'm getting from a sense of urgency?” James says, since a requirement that the user act quickly is often part of phishing attempts.

3. Report Things You’re Unsure About

As with standard phishing emails, when it comes to QR codes sometimes educators may be unsure of the source. Legitimate emails often seem strange and phishing attempts may look pretty good.

“If you are an educator, faculty, or staff, feel free to report things to your cybersecurity team or your technology team because they would love to hear about it even if it's a false-positive," James says. "We'd rather get more reports than less and clear up any questions that you may have."

4. Evolve Your Cybersecurity Training To Include QR Codes

Lee says some organizations have been using the same cybersecurity training for some time. These trainings need to evolve to focus on the latest threats and/or the latest vectors bad guys use to trick users, including malicious QR codes, which also will continue to evolve.

In addition to updating these trainings, Lee recommends institutions run phishing simulations and provide targeted training. The idea is to test your school community using similar tactics that a bad actor might use. “Then, based on how the user did, we're going to provide them targeted training,” Lee says.

5. Get Students Involved

Awareness training around the potential for malicious QR code use and other cybersecurity lessons should be extended to students as well, both Lee and James say. They also say students can help combat bad actors.

James employs students in his SOC. The students get real-world job experience of the type they might obtain in an internship and James is able to tap into a rich talent pool. He says getting students evolved was "a game changer."

He adds, “Don't underestimate the talent that they can bring to the table to help secure our organizations.”

• Best Free QR Code Sites for Teachers
• 5 Cybersecurity Tips For Schools From CISA’s Deputy Assistant Director

How Vulnerable are Schools to Malicious Intrusion?

As educational technology use grows, so too do cybersecurity risks of being breached and hacked. Schools and districts become more vulnerable with more technology being used, especially with the emergence of artificial intelligence.

Jena Draper, Chief Innovation Officer at itopia, discusses two hugely intrusive culprits: phishing and malware.

Malware and phishing attempts are constant, an almost relentless assault on the security of a school and its inhabitants. Students, teachers, administrators, and even some families can be subjected to these data attacks and breaches. According to itopia, over the past 90 days there have been more than 15 million malware attempts made on schools alone. This alarming number shows that student data is constantly under siege and needs to be protected at all times.

“Data privacy is adjacent to cybersecurity,” says Draper. “What we do is we have a number of databases as well as our own AI crawlers, and we actively look at over 1 billion domains in real time. If we see even one event of suspicious activity (which has a bunch of different classifications), we block it automatically. In the past 90 days, we have actively blocked 15.961 million malware threats.”

Millions of sites are working to embed malicious software into school systems on a regular basis, either through malware or phishing attacks, which involve tricking users into providing security access. But how much of this is known to regular internet users?

“This is not normal consumer information,” says Draper. “The reason why I bring this up, as far as the data points, is that the average consumer, the average school district, the average normal human, does not know about this. We know our data is out there. We know there’s some kind of risk. But we don’t really know how hackers are using our data, how they’re getting to us, and how they are using AI to improve their abilities to access [that information].”

So there are unseen digital threats all around us. In an age where everything is connected and everything is digital, how do we begin to protect ourselves?

“Districts need to move from reactive to proactive,” Draper says. “The consensus across all the districts I’ve interviewed in the last couple of months is we have a lot of tools, and we need to start consolidating. Not only do all these tools have a cost associated with them, but there’s also time associated as well. We don’t have the time to manage all these tools and look at the data and hopefully figure out whether a site or a program is a real threat or not.”

Why are Data Breaches So Frequent?

It is no secret that technology has flooded into the educational space unlike ever before. With the advent of various forms of technology, there also came with it new ways for hackers to steal data and commit heinous acts.

“COVID amplified our technology use,” says Draper. “So much money flooded into edtech because of the ESSER dollars. It was the perfect catalyst for cybersecurity to go nuts. It accelerated how many vendors and tools were out there, but it also created so many surfaces and endpoints for hackers to get into.”

Because of the plethora of new programs and devices being introduced to education, focusing on cybersecurity is even more important than ever. We may not see the danger clearly, but it is there and it is constantly working against us. We must remain vigilant in protecting the information of our students, our teachers, and ourselves.

What Can School Districts Do to Protect Themselves?

School districts cannot shy away from using technology in the classroom, but with the threats looming in regard to information safety, the question of protection is more important now than ever.

"School districts aiming to strengthen cybersecurity should start by assessing their risk and readiness,” Draper says. “The Cybersecurity Rubric (CR) by the Cybersecurity Coalition for Education (CC4E), is a great tool for evaluating their posture against NIST categories. Macs and Windows need more layers of protection and are costlier to secure than Chromebooks, which primarily require Google Workspace for Education and an added threat detection layer. Considering cybersecurity expenses in device refresh plans can significantly impact district budgets."

• Best Cybersecurity Lessons and Activities for K-12 Education
• Cybersecurity in the Classroom: What Teachers Can Do

The 2024 State Edtech trends survey from SETDA reveals state edtech leaders are increasingly focused on AI but remain concerned about cybersecurity and connectivity issues.

SETDA, a nonprofit organization representing state and territory edtech leaders, recently released its annual state edtech trends report. While there were few surprises in the report, Julia Fallon, executive director of SETDA, says it paints a clearer picture of where edtech is from the perspective of state edtech leaders.

Here are the top 2024 edtech trends that emerged in the report.

1. States Are Issuing AI Policies

AI was the second-biggest priority for state leaders, trailing only cybersecurity. The survey also showed that states are getting more serious about their response to AI.

For last year’s survey, the number of respondents who said their state had developed a guidance for AI in education was a mere 2%. This year that number grew dramatically to 59%. States such as Washington and California led the charge with AI policies, but now more than 20 states have official policies.

Fallon expects even more states to issue guidance by the end of the school year. She notes that these policies need to be flexible. For example, Washington has had several iterations of its policy as AI is evolving.

“It's not just a static policy. It's literally going to be an evolving policy as they work through things, or new things come on the scene when it comes to the AI space,” Fallon says.

2. Cybersecurity Remains The Biggest Priority

AI may get more headlines but cybersecurity remains the No. 1 concern among state educator leaders.

“It’s the nerd toast,” Fallon says. “It’s the stuff that the IT folks are really always very concerned about. But unless you're impacted by a cybersecurity breach or something [similar] you're probably not thinking about it very much, even though everybody plays a part in mitigation.”

Despite how serious the issue of cybersecurity is, fewer state leaders believe their state is providing sufficient funding to support cybersecurity efforts compared to previous years the survey was conducted.

Fallon says state education leaders should look for areas in which they can support schools and districts in cybersecurity mitigation efforts, particularly rural and underfunded districts. This will look different in different contexts yet may include helping smaller districts contract the work of a cybersecurity specialist or providing support at the state level, she adds.

3. Home Connectivity Remains Top Unmet Need

Home internet connectivity for students and their families was the top unmet need across states. This was followed closely by funding concerns as federal pandemic funds expire this fall.

“People really need to understand why home access is still a thing,” Fallon says. “A lot of people are thinking, 'Well, the pandemic's done, or at least mostly over, and we're all back kind of in the world.'”

As educators well know, internet access for students remains vital as ever for homework, research, communication with teachers and peers, and more. Fallon says educators should continue to reinforce the need to other stakeholders, and state leaders should be reminded of how critical it is to continue providing internet accessibility to students.

4. State Office of Educational Technology Are On The Rise

The percentage of state leaders who reported that their state has an office of educational technology increased by 10 percentage points over the past two years (from 55% to 65%). Fallon says states should continue to add these positions.

“The National Edtech plan, which was launched in January of 2024 by the U.S. Department of Education, recommends that states have an Office of Edtech,” Fallon says. The plan also called for districts to have someone coordinating edtech initiatives.

This head of this office can change because of who is elected governor, so continuity can be a challenge during an election year. Nonetheless, Fallon says the key for these positions to be successful is to provide meaningful individualized guidance to districts rather than any kind of blanket approach, which tends not be applicable in different contexts.

• Building An AI-Friendly Infrastructure in Schools
• Creating a Responsible AI Policy: Top 10 Things to Know

As we send our children to school, we provide them with varying levels of data that, if left unchecked, could cause unnecessary problems for students late on in life. Plenty of ways are available to try and protect information, but should schools be collecting and holding onto that much data in the first place?

Beverly Miller, Assistant Director of Schools for Administration/Chief Technology Officer for Greeneville City Schools in Greeneville, Tennessee, and recent winner of a Tech & Learning Innovative Leader Award for Best Implementation of Data Privacy, discusses how much student information schools should keep and the questions we should be asking about collection policies.

‘Why Are We Collecting So Much Data?’

Thousands of students attend hundreds of schools every year, and each one has data collected in some way in the process. Miller saw this practice as a disservice to students and wondered whether schools should be collecting all of the data that they do.

“As a forty-year technologist, about 15 years ago, I really started to become concerned about the massive amounts of information that we had on both students and the adults who work in a school district,” says Miller. “Long before the real focus on data security and data privacy became such an industry focus, we started working in my little school district in the Appalachian mountains of Tennessee. I started assembling a team of district leaders and district employees. We started by conducting a paper data records inventory. What I became immediately concerned with is the records we had.”

Gathering information on students and teachers isn’t out of the ordinary for a school or an educational system, but Miller took issue with what kinds of data schools were collecting and how long they were holding onto it.

“Along the way, what I started to realize was that we had social security numbers on people all throughout our community because so many had graduated from the Greenville City school system (including our existing students),” she says. “So I really started digging at that time saying ‘Why in the world do we even collect student’s social security numbers?’”

A Two-Pronged Approach to Data Security

Collecting data for a school might not be alarming, but keeping it forever might pose a significant risk to anyone who has attended or is attending that school. The same goes for former and current employees.

To protect both former and current students and staff, Miller led a district-wide initiative to limit access to critical data and bolster security.

“[Our school] became one of the very first schools to completely eliminate student social security numbers,” Miller says. “We went so far as to delete them electronically. We no longer ask parents for that information. But then we went back through all of those historical paper records and shredded all instances of the social security numbers coming up. It just put the district and the individuals at such risk. We made sure that if we were ever breached that the data would include only the absolute minimal data that we needed on people.”

The district also partnered with Scribbles Software to convert roughly 50 years of paper records into a digital system, only accessible in a secure cloud. This streamlined the records management process and made it easier for designated staff to find what they were looking for quickly, and significantly improved security by eliminating the concerns that come with paper-based records systems, such as data being accessed by unauthorized personnel.

The multiple security measures embedded into the cloud-based system also reduces the likelihood of sensitive information falling into the wrong hands. Both of the initiatives above are examples of how Miller’s proactive approach is ensuring student and district data remains private and secure.

Using Data Mitigation to Reduce Risk

As technology continues to evolve, our information becomes more susceptible to breaches everyday. Yet no matter where your school is, controlling the data you keep can be an attainable goal.

“Even though we’re a small rural community school district in eastern Tennessee, I think we have built a model that could very well be replicated and scaled up or down based on school district size,” Miller says, noting her two-pronged approach. “From this point forward, we will have this process in place. It’s just a matter of how dedicated people would be in order to take care of the data. I think of things from a corporate standpoint. People always have a need or use for [information], so they’re always going to find a way to dig information out of you. But from a school standpoint, where things like ransomware attacks are so rampant, having less information to give would actually be more helpful.”

Personal information needs to be protected no matter what. With a template like this in place, students can learn in peace without fearing their data will fall into the wrong hands.

• Innovative Leader Awards
• Keeping Student and Teacher Data Safe and Secure

Data security is a big concern with the amount of technology being introduced to schools in recent years. Knowing how to keep information safe and secure is important, but how can that happen with so many advances in technology being made on a regular basis?

Christine Jones, Coordinator of Educational Technology for the Palmdale School District in California and recent winner of a Tech & Learning Innovative Leader Award for Best Implementation of Data Privacy during the Denver Regional Leadership Summit, discusses the ways she has upgraded data safety practices in her school and how educators can keep student and teacher data safe from outside threats.

Data Threats Are Not New

When it comes to protecting students’ data in and out of school, the threats they are exposed to are not a new occurrence. Breaches in security have been happening for years.

“Our district, back in 2016-2017, had a ransomware attack. That was shortly after I joined the district and it was not a pretty sight,” says Jones. “It was a moment where we realized that our security had been set up for physical events very well. We had offsite [areas] where our records were being kept. There were multiple locations in anticipation of fire, earthquakes, and that kind of thing. But we hadn’t done an excellent job of thinking about a digital attack or event.”

On the heels of this event, Jones and the district made a concerted effort to improve cybersecurity efforts.

The Influx of Apps and the Need for Data Privacy Agreements

Previously, computer security was a simple addition of one or two programs to thwart outside interference. Many programs that were used on computers were known to be safe. However, with the ever-growing influx of programs, data is increasingly at risk.

“The risk is higher because everything is installed digitally or comes from the internet, and you’re loading everything up into the cloud,” Jones says. “The bigger issue started happening when a lot of these apps started requiring accounts. You had to have an account to participate or to play. It took a little time to understand what was happening, how that data was being transferred to the application and how it might be used. And that’s when I started carefully reading their policies and their agreements and wondering [what’s happening with our data?]”

Many people tend to sign up for a service or give our information without a second thought. This kind of behavior can put their data at serious risk. But there are some regulations in place meant to safeguard that information.

“In California, we became aware of the NDPA, the National Data Privacy Agreement, and so we started to take a closer look at that and at the same time CITE, California IT and Education, started to lead the charge for how carefully we look at the programs we’re adopting,” says Jones.

As a result, Jones has developed a curated list of “Approved” resources that can be found on the district website that helps to guide staff to digital resources that have been reviewed and have been deemed “high quality.” To receive this designation the resources must have current data privacy agreements (DPAs) in place with the district, have appropriate fully ad-free content for students, and are not connected to social media, blogs, or any other type of social sharing.

The list is updated monthly as DPAs are updated. New resources may be added and current resources may be removed if any fail to adhere to district guidelines.

Implementing Security Measures at the Cost of Convenience

Keeping student information safe is critical, and to do so means making access to devices more challenging.

“We just implemented multifactor authentication this past school year, and we did get some pushback,” says Jones. “So we gave them multiple ways to authenticate. One was through YubiKey. The positives with this method is that you’re the only person with access to the USB device. The negative was that the physical device could be left at home or misplaced. Using MFA, teachers could authenticate with their devices. I’d say that 90% of our staff choose to do it through their phone or their iPad because they found it simpler.”

Even though it might take a little while longer to log into an account or access some sensitive information, having MFA implemented can be the difference between keeping your data safe, and leaving your data wide open for a breach.

Tools Jones Uses

• Classlink
• YubiKey

• Innovative Leader Awards
• Gamifying Cybersecurity Training

Cybersecurity is no game, unless you visit the district of Tech & Learning Innovative Leadership Award winner Eva Mendoza.

Chief Information Technology Officer at San Antonio ISD, serving 45,000 students in 70 schools, Mendoza is known for creative attempts to teach cybersecurity, such as her popular “Phish Market” poster and PSA-video contest with winner’s artwork appearing as the lock screen on the district’s chromebooks and school monitors. She also offers a PD version of a popular television game show.

“It’s standard ‘Family Feud’ with a cybersecurity theme,” says Mendoza, who was honored for her efforts during a Tech & Learning regional leadership summit. “We follow the basic rules of the game, where a hundred people are surveyed and participant teams guess the most common responses. We just happen to have a hundred people on our IT staff, so it worked out great.”

Surveys are created with simple Google docs or Microsoft forms, free options that any district budget can handle.

“We send out a survey, asking questions such as, ‘What is the most commonly used password?’” Mendoza says. “Then we take the game around to different targeted departments because of the data they handle, and get some volunteers to make up two teams. We usually try to gamify anything within HR and finance. It’s just really engaging when you add in competition.”

Mendoza finds this style of engagement helps important info sink in, both for participating game contestants and the audience.

“So we might say, ‘We asked one hundred people, what are the most commonly used passwords? And the responses come — ‘1234’ or ‘pet’s name,’ ‘year of birth,’ all of these things that people do, but are super easy to guess or find,” she says. “There will be some funny responses and then ‘Survey says— ‘ and the results can be eye-opening. We want to hit them with that real-world shock. ‘Oh, wow — we all do that or know someone who does.’”

Some of the answers are entertaining, such as during the real show, which keeps the audience attentive rather than the dynamic of zoning out, too often seen in PD sessions. Mendoza then has the principal or a tech director give a short one liner of actual information, enough to drive home the lesson without ruining the fun and engagement of the activity.

“We created it within PowerPoint, using the graphics and theme song. It took a little bit of tweaking, but now that it's established, we can take it around to our different departments to take part in the game,” she says. “I personally think cybersecurity's super cool and fun, but you know, not all my colleagues across the district may feel that way. Sometimes people think it's a little intimidating or they think ‘It isn’t part of my work.’ Cyber safety is a shared responsibility. We all play a part in it and we want them to learn and understand the important role they play in cybersecurity.”

Gamification Isn’t Just For Students

Most school districts in Texas are required to have cybersecurity training approved by the state.

“These were often formal, traditional, sometimes boring videos that we were required to watch,” says Mendoza. “If you can reach beyond that traditional training, however, you can make a serious impact.”

It doesn’t matter how secure and advanced your system is if it is made vulnerable by those using it. This can be a real problem when human error leads to leaks of sensitive student data such as social security numbers, grades, health matters, personal phone numbers and addresses, and other family information.

“With cybersecurity, the No. 1 way people hack into systems is to hack the person, not the technology,” says Mendoza. “They go after those without cyber awareness, capitalizing on human error and carelessness. We need to ensure educators and staff realize the threats that are out there and that they are one of the most important parts of the strategy to keep our environment safe for our students.”

This sort of fun exploration of cybersecurity can even be a unique way to engage students in assemblies, cheering on teacher teams while learning.

“Hackers don't care if a target is a six-year-old, it is just an account to get in,” says Mendoza. “Kids need to learn just as much as our staff. Our students are growing up in a digital age from day one. Even if you're itty bitty, you have a digital footprint, and you need to learn to stay safe and how to protect your data. We did a little lesson with all K through 12. Some of the feedback we got from the teachers were stories of ‘My Roblox account was hacked and they took all my points.’ They are in their own world, but that could be so much bigger if they're not taught early and are ready for the future.”

Tips When Creating Your Own Cybersecurity Training Games

Create real-life activities. Mendoza says, “We did a tabletop exercise to take staff through a full-day scenario of what it’s like when you go through a ransomware attack. For example, 9:13 a.m., teachers complaining ‘I can’t log in or get to my email.’ How are you going to get through the day without no system? What happens if somebody picks up their kid early, what happens at dismissal? Now extrapolate that into a system down for three to five days. It was meant to be an exercise for staff, but it turned into a great resource for us to document and make a plan of everything schools would need from us and the central office to get by. Suddenly, it comes full circle and we have staff saying, ‘I couldn't make that connection, that my clicking a phishing link could lead to the whole district being down for five days.’ We were able to make it real for them.

Share the why. “A lot of the time we have processes for the vetting process on technology or digital tools,” says Mendoza. “Sometimes applications or softwares are denied. Educators see something on social media, a blog or a seemingly helpful app, and don't really understand why— ‘It’s free! I don't see why!’ It comes down to data privacy and protection. We have to read all the terms and conditions. At the end of the day, the ‘No’ is for the students and for our staff so we can be into a good digital environment.

Focus on the people. “Having the people part of your strategy is so important,” says Mendoza. “You have your processes, you have your technology, all your cybersecurity systems and solutions. But you need that people piece to make sure that your cybersecurity posture is strong.”

• Innovative Leader Awards
• How Gamifying Education Brings Out the Best In Students

Cybersecurity attacks on schools across the U.S. are increasing in frequency.

“They are a target-rich but resource-poor environment that really houses incredibly sensitive information about some of our most vulnerable populations,” says Trent Frazier, Deputy Assistant Director of The Cybersecurity and Infrastructure Security Agency (CISA), a component of the U.S. Department of Homeland Security.

When these attacks are successful and student data becomes compromised, it can be held for ransom but is also doubly valuable to cyber criminals because students generally have pristine credit records and are not worried about identity theft.

Cybersecurity is now the No. 1 concern among school leaders. However, the good news is that there are simple and inexpensive steps that can be taken that will have a huge positive impact on cybersecurity, Frazier says. He offers the following cybersecurity tips.

1. Don’t Get Overwhelmed  

When they hear about the rising number of cyber attacks, those untrained in cybersecurity can get the mistaken sense that there’s nothing to be done.

“They view this as an almost insurmountable challenge, that to take on cyber security means getting a second degree and becoming a cybersecurity professional,” Frazier says.

In reality, the most effective forms of cyber protection are generally simple, common sense, good cybersecurity best practices with which most of us are already familiar. He notes that while there are more complex attacks occurring, the majority are still simple efforts that involve basic tasks, such as cracking a weak password.

By removing the low-hanging fruit in cybersecurity systems, schools can really beef up their protections. “If we're taking steps to address those things, we're making it harder for our adversaries and forcing them to go to the much more challenging, and frankly much more expensive, types of attacks across all of our infrastructure communities,” he says.

2. Do The Little Things 

Keeping with the idea that small steps can have a big impact on cybersecurity, Frazier points to Secure Our World, a recent PSA developed by CISA aimed at schools and other organizations that offers four easy-to-implement tips:

• Recognize and report phishing
• Use strong passwords
• Turn on multifactor authentication
• Update software

3. Utilize CISA Resources  

District technology leaders should be aware that there are many CISA resources for schools.

“We have regional staff throughout the country that can assist you in assessing vulnerabilities within your system,” Frazier says.

These staff members can help school leaders prioritize and plan how to best invest in and build more robust cybersecurity systems. “We've developed what we call our Cybersecurity Performance Goals, which is really a tool that's essential in helping to prioritize where you want to make investments, and then ultimately start to make those investments, and grow over time,” Frazier says.

Additionally, CISA has its Cybersecurity for K-12 Education resource, which offers a variety of tips for schools. “Applying those two resources and engaging with our folks is going be a really important tool to help you identify what the long-term sustainable approach to the program that you need to design ultimately will look like," Frazier says.

4. Consider Adding a Full-Time Cybersecurity Resource 

A recent CoSN report found that 66% of K-12 districts do not have a full-time cybersecurity resource.

Adding this type of full-time staff member is a step districts should consider, but it’s not always about hiring someone new. Often, existing IT staff members can be trained in the fundamentals of good cybersecurity.

“Once you do that, those individuals can oftentimes make a lot of progress in helping you build the basics of your cybersecurity program,” Frazier says. “Once you've reached a certain posture, then it becomes meaningful to start to look for the more highly credentialed cybersecurity professionals who are going to be able to in implement even more advanced mitigation measures within your program.”

But, once again, schools don't have to undertake this process alone. “I highly encourage both schools and school districts to think about where they can partner with local government and state government agencies who may be able to also provide them with capabilities," Frazier says.

5. Cybersecurity Is A Team Sport

Frazier says it's also important for school leaders to realize cybersecurity is everyone’s responsibility, and that includes students, staff, teachers, and parents.

“Oftentimes someone will say, ‘Well, that's the IT Department's problem,' or, 'That's the state's problem or the Federal Government's problem,' or, 'It's the service provider's problem.' It's really critical that schools understand cybersecurity is entirely a team sport,” Frazier says. “No one is capable of adequately defending [alone] from all of the various threats that we see today. It has to be integrated and we all have our part to play.”

• Hackers Are After Student Data. Here’s Why
• 5 Cybersecurity Tips from CoSN’s CEO and a Digital Security Expert

Last fall, the parents of students at Westfield High School in New Jersey received a disturbing message from Principal Mary Asfendis.

“I am writing to make you aware of a situation that resulted in widespread misinformation and resulted in significant worry and concern amongst the student body of Westfield High School,” Asfendis wrote, according to reports in local media. “Earlier today, students brought to our attention that some of our students had used Artificial Intelligence to create pornographic images from original photos. There was a great deal of concern about who had images created of them and if they were shared. At this time, we believe that any created images have been deleted and are not being circulated.”

The incident resulted in some of the victims’ parents pursuing legal action, and edtech experts say it should serve as a wake-up call to districts across the U.S. After all, the threat of students using a photo of classmates to create AI-generated deepfakes of them engaged in pornographic acts is no longer hypothetical — nor are other potential disruptive uses of AI deepfakes in the school setting.

“I'm concerned that schools are getting caught off guard by the rising use of AI to deepfake,” says Doug Levin, co-founder and national director of the K12 Security Information eXchange, a nonprofit dedicated to protecting K-12 schools from emerging cybersecurity threats. Levin adds that while much of the conversation around AI has focused on its potential and drawbacks in the classroom, he’s worried about adversarial AI use “creating all sorts of havoc in school systems because [they] haven’t ever considered whether or not something like this can happen.”

Chris Aviles, an educator, has similar concerns. “The reality is every school district is ten minutes away from potentially something like this rocking their school community,” says Aviles, who also is the president of Garden State Esports.

Here is what you need to know about the threat of AI deepfakes in the school setting, including deepfake porn.

Deepfake AI and Potential For Problems 

Aviles says the incident at Westfield High School drove home the extent of deepfake threats. “The reality is, I don't think folks generally know how easy that is to do with AI,” he says. “We're at the point where it takes absolutely no talent. You do a Google search, you have a picture of somebody, you upload it, and it spits out pictures and in some cases actual videos of the person. We see it happening to celebrities. And we see it happening to movie stars.”

Deepfake porn of students generated by other students is perhaps the most disturbing use of the technology, but it has the potential to be disruptive in other ways. In the past, school social media accounts have been hacked to put words in the mouths of school leaders saying things they never said, Levin says, but AI is amplifying these more traditional-style pranks.

“When it's an actual video of the superintendent, or what appears to be the superintendent, that's a whole other thing,” Levin says. “I think schools really need to understand this is coming and figure out how they're going to respond and set expectations and disciplines around this. I'm not sure right now the rules ever foresaw anything like this happening."

Planning For Deepfakes  

Aviles agrees with Levin that the first step in mitigating the threat from deepfakes is awareness.

“The best way to prevent it is to get out ahead of it and make sure everybody knows that, ‘Hey, we know this is a thing that could happen, and here's what's going to happen if it does,’” he says.

This includes making sure students are aware of the consequences of creating harmful deepfakes, including criminal charges that can result from creating deepfake porn.

“This should be taught in health classes or technology or digital citizenship classes [so students] understand, No. 1, what happens to the victims of this," Aviles says.

Next, all students should be educated about the intense harm making these types of deepfake videos can also cause the creators, and how in some instances producing these can result in potentially life-ruining lawsuits and criminal charges, including possession of child pornography, Aviles says.

Finally, Aviles says that legally many cases of deepfake porn are prosecuted with revenge porn laws, however, school leaders should consider creating their own policies addressing their response above and beyond legal ramifications, if they haven't already. \

“Beyond referring it to police for criminal charges, in my mind this is worthy of expulsion,” he says.

• UN Research Sheds Light On AI Bias
• How Often Are Students Submitting AI Papers? Frequently, Says New Data

With the rise of innovations such as generative AI, IT leaders face increasingly complex challenges in the effort to protect student safety and digital wellbeing.

During a recent webinar presentation sponsored by Linewize, Logan Joiner, Network Analyst for Richland School District in Washington, and Terrisa Reeves, Territory Directory for Linewize, discussed exploring practical solutions and empowering IT teams for success in the evolving world of edtech.

The discussion delved into how IT leaders can address challenges including the need for granularity in filtering, parental concerns and support, and the impact of generative AI tools to student safety.

Watch the webinar on demand

Key Takeaways

Currently, K-12 IT leaders everywhere are being asked to meet a host of increasingly complex challenges in the effort to protect student safety and digital wellbeing.

“One challenge we all face today is the capacity of our technology to address these growing needs,” said Reeves.

In particular, Reeves said that three challenges IT leaders are facing include:

1. Granularity and flexibility in filtering - In this area of challenge, Reeves cited new sites popping up everyday, VPNs and proxies, legacy URL filtering, and filtering distractors as a few key pain points.

“It’s like Whack-a-mole to keep up with students who are using VPNs and proxies to get around filters,” said Reeves.

Joiner discussed how much of his day is spent monitoring Linewize for these situations, and then using the tools at his disposal to handle any issues.

“We’re allowing parents to be involved, but we’re enabling districts to manage the process,” said Reeves.

2. Parental engagement & partnership - “Our parents are seeking to be more active and have more control over what their children are accessing online,” said Reeves. “We want to put safeguards in place.”

Reeves noted that within this area, the focus is on involving parents/guardians in keeping students safe online, parents actively wanting support from schools, and how schools are seeking better ways to communicate with parents.

“It’s as simple as parents want to know,” said Joiner, who added that he and his team worked with Linewize to build a great communication plan for connecting with families.

3. The rise of generative AI - “Districts across the country are taking different stances on how they’re managing generative AI,” said Reeves, noting that the main challenges are striking a balance with AI, understanding that not all AI tools are the same, and exploring the need for AI strategy.

Logan discussed how his district only allows AI at the high school level, noting that teachers can use Linewize tools to block AI as they see fit. “Our district goal is to build good digital citizenship with students and teach them how to use tools the right way,” he said.

Reeves and Joiner then discussed the full Linewize ecosystem of digital school safety tools.

For more information, visit Linewize.

The Tech & Learning Regional Leadership Summit is a unique opportunity for educators from various backgrounds to come together for a collective purpose: to find uncommon solutions to common challenges. Educational leaders not only have the chance to network as well as innovate and create solutions, they also are given a voice to share strategies they have tried in their schools or districts.

The Connors Center in Dover, Massachusetts, provided a beautifully lush backdrop of trees and grass that held fast against the ongoing conversation between educators, edtech partners, and other attendees about the advent of technology in schools. As part of a professional learning experience, those in attendance were tasked with creating an action plan based on the various activities they would take part in throughout the day.

Getting Our Feet Wet 

Throughout the summit, there was a concentrated focus on AI, which was bolstered by a fearless and entertaining introduction made by Carl Hooker, the emcee for the event. After being split into teams, attendees were tasked with coming up with a two-minute presentation that encapsulated one action plan to be incorporated in the next school year.

Throughout the day, while some attendees made time for one-on-one meetings with vendor partners, others participated in roundtable discussions based on common educational challenges that were facilitated by experts in multiple fields.

The roundtable talks covered subjects that impacted educators, students, and parents, and included:

• AI Media and Literacy
• Personalized Learning Coaching
• Creating a Personal Wellness Plan
• Integrating Technology into the MTSS Structure
• PD In the Age of AI
• Addressing Chronic Absenteeism
• Data Privacy and Cybersecurity

Chronic Absenteeism Prevention 

An in-depth conversation about chronic absenteeism was led by Michael Hale, Director of College, Career, and Citizenship at Casco Bay High School in Portland, ME. Hale divulged the alarming rate at which high school students who miss school regularly are prone to miss graduation: 30%! Hale also elaborated on other potential detrimental effects of chronic absenteeism, such as diminished health and low future employment prospects.

In order to address the issue of chronic absenteeism, Hale discussed how his district employs a multi-tiered support system designed to help and incentivize regular attendance for students. The system involves support, prevention, and intervention if necessary, designed to help eliminate obstacles keeping students from attending school.

Implementing AI Across a District

Kerry Gallagher, Assistant Principal of Teaching and Learning for St. John's Prep in Danvers, MA, and Kelley Papa, Instructional Coach at St. John’s Prep, discussed how their district prepared a comprehensive plan to integrate artificial intelligence in a way that helps foster an accepting culture among students, teachers, and parents. The process acts as a cycle that will constantly gauge the opinions of all participants to know what direction to take with AI.

Gallagher presented an action plan that worked with existing school policy. The plan is designed to evolve as the needs of the students and educators evolve. The main idea behind the process is not only to educate students, teachers, and parents on the potential of AI, but also to demystify AI from the established reputation it garnered through early media coverage. Approaching AI with understanding makes its use more palatable, and Gallagher and Papa have paved the way for a roadmap for the ever-changing landscape AI in education.

Gamifying Schools, Looking Forward to What’s Cool 

Dan Ryder, Director of Design and Innovation for Community Regional Charter School, presented a game-based and human-centered problem-solving model to help reimagine how to tackle educational challenges. The presentation was accompanied by a brief activity in which participants divided groups of two, learned about game-play styles, and ultimately, each created a game that their partner would enjoy playing.

After the presentation, attendees were given the opportunity to get an advanced look at cutting-edge technology companies. This provided some quality time with industry innovators to get a glimpse of what the future of educational technology could look like.

Artificial Amateurs are Absolutely Amazing 

Once the day reached its final moments, the original teams organized at the beginning of the summit reconvened and, equipped with the knowledge gained throughout the day, created endearing proposals for introducing AI to a school. Some groups had used AI tools to craft and sing unique songs about the benefits of students and teachers using AI. Other groups used AI to create artworks to emphasize the helpfulness of artificial intelligence.

Innovative and Celebrated 

After the team presentations, Tech & Learning recognized the innovative leaders in attendance for their achievements. The Innovative Leader Award winners were:

Innovative District Instructional Tech Specialist: Russell Levendusky

Innovative Director of Design and Innovation: Dan Ryder

Innovative Assistant Principal: Kerry Gallagher

Best Example of Virtual Learning: Jacqueline Gardy

Tech & Learning Regional Leadership Summits offer a wonderful opportunity to collaborate with passionate educators from across the nation. Whether organizing unique solutions to complex and ongoing challenges, or being on the cutting edge of the edtech space, the connections made and time spent here become indispensable in helping to further educational endeavors for students, teachers, and parents.

It is no secret that artificial intelligence is slowly permeating all aspects of society. Education is no outlier, with both students and teachers finding ways to implement AI into the classroom. Students have been using it to help spur their creativity in many subjects, while teachers are finding new ways to have AI supplement and even write lesson plans.

With the push to integrate AI in schools, questions may arise about how safe it is to use AI platforms, especially with children involved. While it is scary to think about potential threats that may crop up due to AI, there are also ways to help mitigate the impact or prevent it altogether.

How Vulnerable Are Students and Teachers?

More connected devices are being used in schools, and that can create multiple entry points for cyber attacks. AI platforms make those entry points harder to lock down.

Shad McGaha, Chief Technology Officer for Belton ISD in Texas, believes that cyber criminals are inevitably growing alongside AI.

“Cybercriminals are themselves utilizing AI to create advanced malware, highly targeted phishing campaigns, and social engineering tactics that are harder to spot,” McGaha says. “These AI-augmented attacks require a more robust defense.”

Schools are veritable treasure troves of information for students and teachers, and McGaha states that cyber criminals are evolving with their technology while average individuals don’t know enough about how to protect themselves from cyber attacks.

Why Cybersecurity is Important in Education

With the increasing amount of ways AI can be used in education, keeping sensitive information protected is of equal importance. Personal information is valued highly by businesses and individuals, and AI can create pathways to this information in ways that we have yet to consider. However, implementing AI to help combat cybersecurity threats can help keep such information safe, such as an evolving antivirus program set to discover and deal with new threats.

Schools may soon consider hiring AI specialists to help mold the infrastructure of the institution to better serve students and teachers. Having a professional who is dedicated to teaching an AI platform to look for, identify, and eliminate virtual threats, can help save schools money and time.

On a smaller scale, AI may also be used to monitor student interaction and behavior. More students are connected with social media than ever before, and this can lead to unwanted forms of communication such as cyberbullying. AI programs may be able to help students understand how to navigate these situations by providing them with examples of what to do when faced with bullying.

How to Improve Cybersecurity in Schools in Regards to AI 

McGaha suggests that there are various ways we can focus on cybersecurity in our schools, and AI can be a partner in that.

“AI can surpass traditional rule-based security systems by analyzing huge volumes of network and user data for anomalies that could signal a breach attempt,” he says. “It learns to detect even new types of attacks with more speed and accuracy.”

AI can also react faster than a human to an attack. “AI-driven systems don't just detect threats, they can automatically take actions to contain them,” says McGaha. “This could mean isolating infected devices, quarantining suspicious files, or alerting IT staff in real time. Speed is key in preventing a minor incident from escalating into a full-blown security crisis.”

Another point of focus is to improve threat response when incidents happen.

“Consider how AI can enhance detection speed and automated response actions,” MdGaha says. “Define clear incident escalation procedures that include both IT staff and AI tools. Data backup, offline storage. … Ensure essential data has secure backups that are isolated from the main network should a compromise occur.”

Protecting our students from cyber breaches and other digital threats is more important than ever. Now, with an ever growing amount of tech in our schools, having a cybersecurity specialist that can navigate AI will be critical to protect teachers and students while keeping the focus on education.

• Creating A Comprehensive Cybersecurity Plan For Schools
• Cybersecurity in the Classroom: What Teachers Can Do

When people think about student data at K-12 schools being compromised, they tend to envision things such as test scores and grades being shared publicly.

While that type of information getting out is unfortunate, it’s minor compared to other problems a data breach can cause students.

“What has surprised people is that students themselves can be valuable targets for financial reasons,” says Doug Levin, co-founder and national director of the K12 Security Information eXchange, a nonprofit dedicated to protecting K-12 schools from emerging cybersecurity threats.

“Students, particularly younger students, have pristine credit and tax records,” he says, which make an enticing target.

This also makes students especially vulnerable to identity theft crimes that can occur after a school becomes the victim of a successful cyberattack. The value of student personal data is part of the reason school cyberattacks are increasingly common. In one 2023 survey of school IT leaders, 80% said their school was hit by ransomware attacks in the past year.

School IT leaders have devoted greater resources and efforts to preventing these attacks with staff training and more stringent security requirements, such as two-factor authentication. But the dangers an attack poses to students, and the role students need to play in order to help protect school networks, still isn’t always fully appreciated, Levin says.

Why Cyber Criminals Target Student Data  

In addition to pristine credit records, students are at greater risk when their identities are stolen because nobody checks their spending activity.

“They don't have anyone watching their credit records, and as a result, they can end up being abused for years until a student maybe applies for a college loan or tries to rent an apartment or buy a car,” Levin says. “Unfortunately, we have seen instances with students as young as first grade being subject to identity theft arising directly from a school cyber security incident.”

Multiple Ways For Student Data to Be Compromised  

Just because a school network requires two-factor authentication for staff, it doesn’t mean that its network is safe from hackers. Even though student accounts don’t have the same rights and privileges as teacher and staff login accounts, there have been instances in which educators have unintentionally shared sensitive student data in environments that students can access, which can poise major risks, Levin says.

“If a threat actor was able to guess or somehow get the login information for a student account, they are able to then get to sensitive data and exfiltrate it, and either abuse that information or try to extort the school district to keep it from being abused,” he says.

Another way student data can become compromised is through scams that target students directly.

“One of the more frequent ones we've seen has been fake employment offers,” Levin says. These often take the form of a great job offer that is contingent on the student providing various forms of personal information for processing purposes. When students fall for this, their personal data can be compromised.

How Students Can Help Protect Their Own Data 

“People have started to realize that educating staff about phishing scams and raising their cybersecurity awareness is important because the way so many of these attacks against school systems are successful is via phishing employees,” Levin says. “But students themselves are potentially a vector for these sorts of attacks against school districts and they're also at risk themselves, and this highlights that they need to be an audience for these trainings themselves.” He adds this training should happen at a young age for students as children are getting online earlier and earlier.

Levin also makes it clear that he doesn’t believe protecting student data should be up to schools alone. Edtech companies should provide more data protection for all student-facing products out of the box, he says, “so we don’t need more expensive licenses to get core security features that we need to protect our school communities.”

In general, education also needs more funding to address cybersecurity and student data privacy concerns.

“Schools do need more resources and support and help from state and also the federal government,” Levin says. “It's important that folks understand this isn't an individual school system issue. This is a sector-wide issue, and we really need more support and help from the government.”

• 5 Cybersecurity Tips from CoSN’s CEO and a Digital Security Expert
• School Cyberattacks: How the FBI Works to Protect School Districts

When it comes to selecting edtech that protects student privacy, few districts are earning high marks. 

Recent research conducted by Internet Safety Labs, a nonprofit that advocates for software safety, concluded that 78% of required or recommended school apps were “very high risk” in terms of privacy, and 79% of the apps collected student location data. The research looked at 663 U.S. schools and analyzed 1,357 commonly required or recommended school apps.

The findings were particularly troubling for schools in socioeconomically challenged areas. Even though these schools generally used less technology overall, the ones observed had the highest rate of “unsafe apps with digital ads," and "apps with behavioral ads."

“We originally surmised that the lower the number of apps, the safer it would be, except they kind of blew that out of the water because they had some of the lowest numbers of technologies but unfortunately those technologies were more likely to have ads,” says Lisa LeVasseur, executive director and research director for Internet Safety Labs.

Despite this bleak overall picture, there is good news. Recommended strategies for better protecting student privacy are available, and some are free, LeVasseur says. 

Free and Immediate Steps Schools Can Take To Better Protect Student Privacy  

LeVasseur knows that school budgets can vary widely. “We understand that a lot of these school districts are very small -- we looked at one where the superintendent was the webmaster,” LeVasseur says. 

That’s why Internet Safety Labs has recommendations that don’t require funding. These include limiting the overall amount of tech tools used in a district -- even though this recent study didn’t necessarily see a connection between less recommended apps and better student privacy protection, LeVasseur says. 

“We still say practice minimization," she says. "We found on average schools were recommending 20 apps or technologies.” LaVasseur adds this is inherently a lot for students and their parents to manage, and using fewer apps makes monitoring to meet privacy standards easier. 

In addition, LaVasseur and Internet Safety Labs recommend districts do the following: 

• Verify technology COPPA Safe Harbor Certified. This can be done through the FTC’s Safe Harbor site as well as others, including iKeepSafe.org, my.privo.com, and KidSafesealcom.  
• Examine website risks using the EFF’s Privacy Badger, or The Markup’s Blacklight tools
•  Examine apps using Internet Safety Labs’ App Microscope Tool  

What Schools With More Time and Funds Can Do 

LeVasseur says every school should plan to develop a technology vetting process and recognize that they need a process for “off the shelf” tools in addition to any existing processes they might have in place for licensed technology. 

“We saw some schools with procedures where if you wanted to recommend something as a teacher, you had to submit it to a process and it had to be approved before a teacher could do that. That’s very good practice,” LeVasseur says. 

Beyond having a school vetting process in place, schools with funding available should create a dedicated software management position specifically to look at these technologies. 

"The gold standard, we would say, is to have a dedicated resource who is endowed with the power to produce the process and manage the vetting process,” LeVasseur says. “It's a unique skill set. It's not hardware procurement. This is more software vendor management, creating criteria for safety for privacy and security, and other considerations.” 

LeVasseur believes these positions will start to be added in districts going forward. “I think we're going to see this more and more, especially with the increase in school hacking going on. These things go a little bit hand-in-glove because that person could be educated to watch over and mandate both privacy and security requirements.” 

• Creating A Comprehensive Cybersecurity Plan For Schools
• 4 Cybersecurity Tips for Schools

Shad McGaha, Chief Technology Office for Belton ISD in Texas, has a simple principle that guides the work that he and his technology staff do in the district. 

“Anything affecting education in our classrooms takes top priority,” he says. This mantra served as McGaha’s north star as he implemented a district-wide cybersecurity plan that includes regular staff training and more secure storage solutions. For this and other efforts, McGaha was recently honored with an Innovative CTO Award as part of Tech & Learning’s Innovative Leader Awards during the Regional Leadership Summit in Baltimore.

McGaha was drawn to education due to a longtime love of working with kids. “From my early days as a camp counselor to volunteering at Sunday school, I found joy in helping young minds grow,” he says. “During college, I landed a job at the afterschool program in my local YMCA, where I continued to learn and contribute. While I knew teaching wasn’t my calling, I discovered another passion: technology. Computers, networks, and electronics fascinated me. So, I pursued a degree in Business Computer Information Systems. After graduating, my first role was as a desktop technician at a local school. Over time, I climbed the ladder.” 

He adds, “What brings me the greatest fulfillment is knowing that our daily work directly impacts the teachers and students in our district.” 

Below McGaha shares the strategies that have made Belton ISD’s district-wide cybersecurity plan so successful. 

Building a Comprehensive Cybersecurity Plan for Schools: Phishing Awareness Campaigns and Staff Training 

One of McGaha's first initiatives focused on threat identification. “We implemented regular phishing awareness campaigns to educate all staff members about recognizing and avoiding phishing attempts,” McGaha says. “Additionally, comprehensive training sessions were conducted to enhance their cybersecurity awareness.” 

Rather than being one and done, these efforts are ongoing. “We prioritize continuous education and training by conducting workshops, webinars, and awareness campaigns for staff, students, and parents,” he says. “Robust password policies encourage strong, unique passwords and multifactor authentication. Regularly applying security patches keeps our systems up-to-date.” 

Staffing Study, Incident Response Plan, and More 

Early in the process, McGaha conducted a thorough staffing study to assess the adequacy of the current network staff. “This analysis helped identify any gaps or areas for improvement in our cybersecurity team,” he says. 

He then collaborated with that team to develop a detailed incident response plan that outlines clear procedures for handling security incidents promptly and effectively. He also looked beyond the district for additional support.

“We engaged a consultant who worked closely with us to create a comprehensive cybersecurity plan. This plan addresses risk management, threat mitigation, and proactive measures,” McGaha says. 

Secure Data Storage

McGaha and his team recognized the need to replace outdated backup hardware and software. “As part of our upgrade, we invested in Dell hardware, known for its reliability and performance,” he says. “Our choice for backup software fell on Rubrik, a robust solution that offers efficient data protection and management. Rubrik not only streamlines backups but also provides seamless integration with cloud storage.”

This integrated approach adds an extra layer of protection. “By combining these upgrades, we’ve significantly bolstered our storage system’s security, ensuring data integrity and availability,” he says. 

Data Privacy Agreement Standardization 

Data privacy is increasingly important given how many learning apps are used. McGaha’s cybersecurity plan recognizes this. 

“We established a standard data privacy agreement for all software used within our district. This ensures that privacy and data protection are prioritized consistently across applications and platforms,” he says. 

In addition, the district established a software vetting committee responsible for examining any new software proposed for use within the district. “This process ensures that only secure and reliable tools are adopted,” McGaha says. 

More On This Vetting Process for New Tools 

The process of vetting new technology is comprehensive. “First, we conduct a needs assessment to understand specific educational goals and challenges,” McGaha says. “Next, we meticulously research and evaluate potential solutions, considering factors like functionality, ease of use, and support. Security and data privacy are top priorities, ensuring compliance with relevant regulations.” 

Once a tool passes through this phase, the district pilots the technology with features, gathering feedback on usability and impact. “Finally, we carefully weigh the costs and benefits, assessing the technology’s long-term viability,” McGaha says. “Establishing a feedback loop ensures continuous improvement, enhancing teaching and learning experiences.” 

• 5 Cybersecurity Tips from CoSN’s CEO and a Digital Security Expert
• School Cyberattacks: How the FBI Works to Protect School Districts
• 4 Cybersecurity Tips for Schools

With the upswing in hacking and ransomware attacks on schools and other educational institutions, it is essential for educators to ensure their data is secure. As some school districts have seen significant data loss due to such activities, such preparation minimizes risks that no one can afford. 

Problems with ransomware attacks and corrupted cloud accounts have also seen several of my colleagues lose data. It’s distressing and often can be costly to recover.

Educators should consider the following for backing up their data:

5 Quick Tips for Backing Up Your School Data

1. Follow the 3-2-1 rule for data backup. Have at least three backups of your data, using at least two different media with one offsite. Those backups should be stored in at least two physical locations. For instance, one copy at home and another at the office. Or maybe on external hard drives. A third might be stored on the cloud, either a personal or an institutional account, although remember that cloud accounts are not 100% reliable and should not be your only backup. Backups should also be on at least two different types of media. External hard drives, flash drives, and optical disks are all potential options along with cloud backups. 
2. If possible, automate the backup process so you don’t have to remember to manually start it. At the end of each semester or term, it is a wise idea to create a complete backup. Label that backup and set it aside as an archival record for that semester. 
3. Make sure you invest in high-quality external hard drives for your archival backups. Many systems include password protection or encryption on the hard drives. Encrypting your data provides an additional layer of protection. If you have large amounts of data, you might want to consider a cloud-based backup service. 
4. Test your backups. Make sure each backup is complete and successful by recovering at least a couple of files from each backup. Backups are of no value if one is unable to recover the data. 
5. Take extra care with any data that includes personally identifiable information (PII). One might consider adding password protection to documents including any PII, especially regarding students. 

Implementing a thorough and effective data backup plan is crucial to safeguard your data against loss due to hardware failure, cyberattacks, or accidental deletion. By combining local and off-site backup solutions, automating the backup process, and regularly verifying the integrity of backups, individuals can ensure their data remains secure and recoverable. 

It’s important to evaluate your specific needs and resources to select the most appropriate backup methods and tools. Remember, the goal of a backup strategy is not just to preserve data but to enable efficient recovery when needed, ensuring minimal disruptions to one’s work and personal life.

• 6 Steps to Remove Social Security Numbers from Student Data
• How to Implement a Systemic Approach to Student Data Security and Privacy

The ClassLink Cybersecurity Rubric for Education is a tool created by a coalition of experts using the National Institute of Standards and Technology (NIST) Framework, as well as other cybersecurity and privacy standards. Making sure to take into account the unique needs of education, the rubric provides school districts with the tools to self-assess their cybersecurity program.

The Cybersecurity Rubric for Education is free but educators can go a step further and take the certification course to earn a credential as a Certified Cybersecurity Rubric Evaluator (CCRE).

Cybersecurity Rubric: Getting Started 

I found getting started with the Cybersecurity Rubric (CR) very straightforward. Since I am already a ClassLink user, I accessed the training by logging into my ClassLink account and clicking on the “ClassLink Academy” app. If you are not a ClassLink customer go to the Cybersecurity Rubric home page to read about the initiative and download the rubric. To further improve your skills, create a free CR Academy account to access the free training to best utilize the CR, or purchase the Certified Cybersecurity Rubric Evaluator (CCRE) training and exam.

Once my account was set, I started with the first course, “Learning How to Use the Cybersecurity Rubric.” This self-guided training lasts for approximately 2½ hours, with topics on cybersecurity awareness and evaluations, the rubric’s maturity levels, and how to do a self-evaluation for your school system. I completed the units and then was able to take the survey to earn a certificate to show I understood the CR and could use it to do self-evaluations. This certificate can be shared on your social feeds, such as LinkedIn.

I also took their more comprehensive course (approx. 3½ hrs.) to become a Certified Cybersecurity Rubric Evaluator (CCRE). This certification is more comprehensive and also has an exam at the end. It allows CCREs to provide third-party evaluations to school systems for a fee.

 Cybersecurity Rubric: Best Features 

ClassLink has created the Cybersecurity Coalition for Education, a collection of experts to develop the rubric and certification courses. They took the NIST Framework and distilled it down to a more workable and understandable form so school districts can best evaluate their cybersecurity postures. I found the rubric easy to understand, but I highly recommend you go through the free training on how to use it for best results. 

I like the learning management system they have for the training modules, which is well laid out and easy to navigate. Since the training is self-paced, I could easily pick up where I left off. ClassLlink also provides training for all of their products, since I am a user I found this extra free training a big plus. 

The CCR and CCRE training was very comprehensive. ClassLink uses a variety of techniques to deliver training, including video and interactive assessments. I was able to easily go back and review the content using the menus they listed on the left of each module.

Cybersecurity Rubric: Pricing 

The Cybersecurity Rubric for Education and the training on how to use it for self-evaluation are free and can be found on their Cybersecurity Rubric website.  

I also have gone through the training for certification as a Certified Cybersecurity Rubric Evaluator (CCRE). This training and access to the evaluation cost $99. Once I take and pass the assessment, I will have the credential to provide paid services using the rubric as a CCRE. This training gives me the knowledge and tools to assess other districts' cybersecurity programs and provide them with a report and next steps to help them improve. This certification comes with a credential and is good for three years. 

Cybersecurity Rubric: Key Takeaways 

Over time I have looked at many tools for assessing and improving cybersecurity. Some of the solutions were very comprehensive, but not completely relevant to my particular situation in a school district. Others were so complicated and technical that I found completion cumbersome and confusing. 

ClassLink has taken one of the best, the NIST Framework, and put together both a tool and training that meets the specific needs of a school district technology leader. I applaud them for seeing the need and providing a solution that is well thought out and easy to implement. 

• Educator Edtech Review: Walkabouts

The Federal Trade Commission recently announced that it is updating COPPA (Children’s Online Privacy Protection Act). Many of the proposed changes are aimed at better protecting student data by requiring technology providers to take a bigger role in that effort, as well as limiting the ability to monetize student information.

Data privacy rules are generally outdated. COPPA became law in 2000 and hasn’t been updated since. When enacted, COPPA made it illegal for websites and online services to collect personal information from children under 13 without parents’ verifiable consent.

This isn’t to say that there are no student data privacy laws on the books since then. In 2016, California passed the Student Online Personal Information Protection Act (SOPIPA), which started an avalanche of student data privacy legislation across the country. Only a year after it took effect, 22 states had adopted all or parts of the law. 

All this to say that student data privacy has played out on a national scale as a big game of chicken. The federal government hasn’t acted, wondering what states will do, and states are looking for guidance from the feds. It’s set up a very interesting landscape for this issue, especially as technology in schools -- especially emerging ones such as AR, VR, and AI – have grown in the classroom. 

Be it state or federal, all laws are outdated for the current edtech landscape in which students and educators operate. This also means it is long past due for an update.

Key Proposed COPPA Updates 

After the FTC announced it was considering revisions to COPPA, it received more than 175,000 comments in response. Stakeholders included parents, educators, industry members, researchers, and others.

According to the FTC, here is a recap of the key proposed changes and what each means: 

• Requiring separate opt-in consent for third-party disclosures. This means that the default settings for edtech platforms and products would automatically be set to “no sharing” for students, and parents would have to specifically opt in to share or allow data to be shared with third-party advertisers. 
• Limiting the “support for internal operations” exception. Currently, edtech companies can collect information if it’s for internal business operations. The FTC wants to limit this going forward, as well as have companies post detailed disclosures on how any collected data is used or shared any with advertisers.
• Limiting companies’ nudging of kids to stay online. This is pretty straightforward–companies wouldn’t be allowed to use certain COPPA exceptions to send push notifications to encourage kids to keep using edtech products or platforms. This would also include getting parental consent to even send push notifications.  
• Limiting data retention. The FTC proposal would limit how long edtech companies could retain student data to essentially the time the student is actively using the product or platform, and not do anything with the data afterward. Also data retention policies would have to be clearly disclosed and publicly available. 
• Codifying edtech guidance. As the edtech industry has grown exponentially since COPPA was first enacted, this would formalize FTC guidance and safeguards, such as in cases when schools and districts allow edtech companies to collect student data for school-authorized purposes and not resale to advertisers. 
• Increasing accountability for Safe Harbor programs. This would increase transparency and accountability of COPPA’s Safe Harbor programs, including public disclosure of membership lists. 
• Strengthening data security requirements. This would focus on generally creating more stringent rules and safeguards that edtech companies have to follow when dealing with student data. 
• A change to the definition of “personal information” to include biometric identifiers. This would include protecting students’ biometric information collected by edtech companies, such as thumbprints, facial recognition patterns, retinal scans, etc. 

These proposals all have major implications for districts and providers. For example, codifying edtech guidance is very vague, and how this rule is interpreted and applied could change how schools operate in very big ways. 

These proposed rules are nowhere near finished. In fact, the FTC published the Notice of Proposed Rulemaking, which incorporates much of the feedback from the initial review process. 

If you are interested in commenting on the proposed rules, file it at  https://www.regulations.gov by following the instructions on the web-based form. Write “COPPA Rule Review, Project No. P195404” on any comment. Public comment on the proposed changes must be received by March 11, 2024. 

Why is the FTC Leading Proposed Changes? 

It is interesting to see the updates to COPPA coming through an agency rather than legislatively. Although not uncommon, it certainly shows a doubt in legislation making it through both Congressional chambers and receiving the President’s signature. Rulemaking is one way to try and update what can be agreed upon while sorting out the more controversial challenges. 

Upon the announcement of FTC changes, Senators Bill Cassidy (R-LA) and Edward Markey (D-MA) released a joint statement that applauded the FTC’s proposed updates but also stated that this effort should not be considered a replacement for congressional action. 

The Senators also noted that they wish to quickly pass the Children and Teens’ Online Privacy Protection Act (COPPA 2.0) “to prioritize the well-being of our children,” adding, “Inaction is not an option.” 

The Senate has expressed more interest in student privacy bills, yet none have passed the full Senate or been introduced in the House. The FTC taking this step will likely lead to at least some modernization of privacy rules before Congress can act.

• Best Student Data Privacy Practices for Schools
• 5 Tips for Creating a Data Privacy Day in Your School

Saline Area Schools in Michigan has many students with special needs as well as students enrolled in adult education and life-skills programs. The district recently updated safety alerts district-wide to ensure important announcements about school lockdowns or tornado warnings, which are common in the region, are effectively communicated to all students, no matter their auditory and visual needs. 

“We needed to make sure that we had something that could reach everybody under all circumstances,” says Jay Grossman, the district's director of technology. To do that required addressing diverse student needs with effective technology and communication. 

Here’s some of the best practices for increasing safety accessibility that Grossman learned in the process. 

Provide Various Visual and Auditory Options  

Grossman used InformaCast to create an accessible alert system. The district also utilized speakers from Network Design, some of which come with a three-strobe light alert system. The district also developed a color-coded emergency strobe light system. 

"Blue means all clear, red means a lockdown. But if you're colorblind and can't discern that, then you also are trained that if the left light is on, it’s a lockdown, right light, it’s not,” Grossman says. 

Text messages will also appear on various screens, providing students with instructions, while auditory signs provide students who can’t see with verbal cues blurted from emergency speakers. 

These alerts also take into account unique situations students might find themselves in while at school. For instance, the district has some spaces that are potentially loud enough to drown out the sound of an alert, including welding rooms and various music rooms. All these unique situations have been taken into account. 

“In the welding rooms, what we've done is run conduits down above the welding stations and place the strobe lights right above their heads, so that when they're down working with their helmets, and welding, at least out of their peripheral they’ll see some sort of flash going off to indicate ‘Oh, hey, something is going on,’” Grossman says.  

Test Tech and Get Teacher & Student Feedback 

Once you have an inclusive alert system in place, it’s important to educate faculty and students on how it all works. Students need to learn, for example, that the left light indicates a lockdown while the right means all clear. 

It's also important for district leaders to obtain school community feedback once new alert systems are implemented, Grossman says. 

For example, during the drill and feedback portion of the implementation process, Grossman and his team learned the proper alert volume for different spaces. Because the district is using speakers that have individual volume controls, they were able to make sure each area had the appropriate volume. 

“So if a teacher said, ‘They didn't hear it, because the class was loud, or they were in a hallway,' something like that, or 'They heard something soft or muffled,' we could bump it up,” he says. “Or if it's in a quiet room that's always quiet, maybe we don't have it blasting at 10.” 

• Exploring the Essential Elements of Inclusive Technology Systems
• Virtual ASL Interpreters: 5 Tips for Using Technology to Improve Accessibility

The online video and social media behemoth YouTube is not only a repository for millions of free videos, but also the second-most visited website worldwide. 

For educators to make the most of YouTube, they first have to screen out content that’s inappropriate—or simply not educational. Then the task becomes finding and curating engaging and relevant educational videos. Fortunately, YouTube learning channels feature thousands of educational (and often fun or quirky) videos on every possible academic subject. 

The following safe-viewing tips and best YouTube channels will help teachers take advantage of the fantastic free educational videos YouTube provides.

How to Watch YouTube Videos Safely

YouTube restricted mode
In restricted mode, YouTube search filters out potentially inappropriate videos and automatically hides comments below videos. Click on your account icon to find the restricted mode toggle setting at the bottom of the menu.  

Safe Share TV
Create a “SafeView” video simply by entering the video URL of any YouTube or Vimeo video. Then watch videos free of ads and distractions. Includes editing function to trim videos to any length and the ability to share directly to Google Classroom. 

VideoLink
Enter a YouTube video URL in the search box, and VideoLink generates an ad-free, safe URL that can be shared easily via QR code, Facebook, Twitter, LinkedIn, Pinterest, and other social media apps. Includes the ability to quickly edit the title, background color, length, and other features.

The Best YouTube Channels for Teaching

TeachEngineering
What’s better than a free standards-aligned digital library chock full of engineering and design-thinking topics? How about brief, engaging videos to demonstrate principles ranging from solar power to drifting continents to musical images? From the nonprofit TeachEngineering and the University of Colorado Boulder, these videos are lively, fun, and highly educational. Use videos as stand-alone mini lessons or combine them with TeachEngineering’ free lessons on its website.  

Learn Bright Videos
A wide variety of diverse educational videos, from four to twenty minutes in length. Topics include history, science, math, nature, art, astronomy, geology, and more. If you’re not sure how to choose from among the hundreds of videos, check out the playlists, where you’ll find content arranged according to topic. The playlist of narrated videos featuring American Sign Language are ideal for Deaf viewers.   

The Brain Scoop
Led by Emily Graslie, the “Chief Curiosity Correspondent” of Chicago’s Field Museum, The Brain Scoop’s videos feature stunning live footage of animals in the Amazon, the joy of cooking with bugs, as well as investigations of museum exhibits, from mummies to dinosaurs to fishes. Have you ever wondered how a museum prepares its animal exhibits? That’s covered too!

KLT (Kids Learning Tubeshop)
Kids love music, which has long been associated with activating learning centers in the brain. KLT’s educational videos combine knowledge with catchy tunes and singing. Will your students learn more? Maybe, maybe not. But they will definitely pay more attention! Subjects sung about include the adorable tiny sea slug, the geography of Michigan, astronomy, produce, and more.  

Art for Kids Hub
Goofy and delightful, the family-run Art for Kids Hub won’t share the secrets of Renaissance painters, Cubism, or Expressionism. What it will do is show kids, in line-by-line action, how to draw fun characters, whether familiar or strange and hilarious (cartoon avocado toast, anyone?). Rest assured that the drawing instruction provided is top notch as well as entertaining.  

Khan Academy Kids
The renowned education nonprofit Khan Academy populates its Khan Academy Kids YouTube channel with hundreds of videos aimed at kids aged 2-8 that explore subjects such as literacy, math, art, phonics, and dinosaurs.  To narrow down the topics, browse playlists including Halloween Learning Fun, Baby Animal Storytime, Colors, or Reading Comprehension, to name a few. 

Vihart
Super fun and eccentric videos about music and math, with appeal to kids of all ages. Using animated sketches and slightly sardonic narration, Vihart turns math topics such as the many flavors of infinity, visual multiplication, or a Möbius strip into weirdly engaging videos.

CrashCourse
Crash Course offers more than 32 free courses on subjects including literature, philosophy, organic chemistry, world history, biology, theater, and ecology. Each topic comprises dozens of videos, delivered with a breezy tone that nonetheless dig deep into the specifics, whether it’s “How We Make Memories” or “Venice and the Ottoman Empire.”

SciShow
With more than six million subscribers, it’s clear that SciShow’s science videos go beyond basics into the realm of the unexpected. Browse videos with curiosity-provoking titles such as “5 Beautifully Complex Ways to Fly,” “Do You Need a Copper Pot?” or “Without Volcanoes, Earth Might be Dead.” Playlists feature topics including COVID-19 updates, historic women in science, the Apollo moon missions, and many other compelling subjects.

Numberphile
With nearly four million subscribers, Numberphile is one of the top YouTube math teaching channels. Down-to-earth video journalist Brady Haran can turn any student into a math lover, with hundreds of entertaining and educational videos exploring the scientific way to cut a cake or perplexing paperclips. Great fun. 

Veritasium
Cool STEM videos that will have you wondering what the fatal flaw of math is and what the longest-running evolution experiment tells us. Be sure to check your reasoning skills with the Test Yourself! Playlist, featuring physics and biology experiments. 

• 6 Ways To Access YouTube Videos Even If They're Blocked at School
• Flip vs Padlet: What is the best video tool for your class 
• Best Free AI Image Generators 

How prepared is your school for the unexpected? A recent high-profile event at the White House with K-12 administrators and cybersecurity professionals highlighted the importance of protecting schools against ransomware and other hacks. 

Sandra Paul, Director of Information Technology and Operations for the Township of Union Public Schools in New Jersey, discusses incident response plans versus disaster recovery plans and how both can keep students, educators, and their personal information safe while also helping schools to recover from cybersecurity breaches and quickly return to the important business of learning.

Incident Response Plans vs. Disaster Recovery Plans: Prepare for the Unexpected 

Cyber threats and attacks on educational institutions are making the news daily. For example, the University of Michigan, which serves 50,000 students, recently faced the challenge of kicking off the fall semester sans internet for several days after having to cut connections following a significant cybersecurity incident. Access to services such as financial aid, research materials, courses, and other resources necessary for a smooth start created a tough environment for everyone. 

These types of cyber attacks are hardly confined to the university level, with more than 120 school districts already suffering ransomware attacks this year, which provoke concerns over private information and put the identities of minors at risk. Private details such as grades, medical records, behavioral information, documented home issues, and financial information are typically compromised. 

Having plans to prepare for and overcome potential risks is key.

“The primary focus of an incident response plan is a collection of the processes and procedures that a school district follows if there is a cybersecurity breach/incident,” says Paul. “This type of plan is a response to an incident that caused a disruption of business and educational services leading to a disaster. In a disaster recovery plan, the primary focus is business continuity for the school district if there is an interruption of business and education services. This plan is implemented when there is a stoppage or halting of services.”

This two-pronged approach can reduce risk and give administrators a clear path to finding their way through an incident without wasting precious time formulating a response.

“Districts need both plans to systematically resolve or prevent technological issues that can be caused by outside and/or inside incidents, including natural disasters,” says Paul.

Disaster Recovery Plan: 3 Best Practices 

1. Have major stakeholders involved in the development of plans. By doing so, it creates support and buy-in for the district, and can also prevent any delays when time is of essence. In addition, it ensures communication is clear and understood, as any potential areas of confusion will be hammered out during the plan’s creation. 
2. Avoid complacency. Those involved need to keep updated and practice the plan. Coordinated response exercises via simulated scenarios with key personnel in the form of tabletop assessments can offer an opportunity for a walkthrough to see if the plan works and makes sense in real-world conditions. 
3. Communication is crucial, as is detailed documentation. Keeping records of results of tabletop assessments can help tweak a plan to be even more effective and usable. Post-incident, clear and specific documentation can help solve issues in the present and prevent future repeat situations. 

Pull Together a Community and a Plan 

Clearly, a response plan for these sort of emergencies requires a specific skill set and background knowledge. CIO/tech directors are trained and keep abreast of the latest development regarding the tools and strategies to keep schools and their students and educators safe. However, the implementation of these plans are not–and should not be–a solo effort. 

“These plans should be developed by CIO/tech directors because there are several resources that will be called upon if any of these plans are to be implemented,” says Paul. “This includes technology service companies, cybersecurity insurance carriers, district security and safety personnel, community emergency management office, district IT, business and administrative personnel, school legal advisors, school board members, etc.” 

As anyone involved in education knows, support for plans not only involves a united front in deciding how emergency scenarios will be handled, but how developing plans and the various aspects within those plans will fit into an often tight budget.

“These plans require financial and IT equipment resources that will have to be approved by the school board and community members,” notes Paul. 

Smoothing the pathway throughout the process by including all stakeholders can avoid political hiccups that could lead to delays or leave schools vulnerable while points of any plan are debated.

5 Phases of the NIST Cybersecurity Framework 

The National Institute of Standards and Technology has created a framework which can help create an Incident Recovery Plan. 

1. Identify — Determine your district’s critical functions and what cybersecurity risks could disrupt those functions. 
2. Protect — Define safeguards needed to prioritize the elements necessary to deliver a school’s critical infrastructure services. 
3. Detect — Monitor in a continuous manner to quickly discover unusual activities which could be tied to a potential threat. 
4. Respond — Once detected, implement measures to accommodate and adjust to the threat or incident without hindering the daily business of learning.
5. Recover — Create a strategic plan to restore systems that might have been compromised or damaged. Consider lessons learned and tweak existing plans to help better protect from future threats.  

• White House Hosts School Districts Large and Small at Event Unveiling New K-12 Cybersecurity Initiative
• An Hour-By-Hour Account of One District’s Cyber Attack Nightmare

First Lady Jill Biden, Secretary of Education Miguel Cardona, and Secretary of Homeland Security Alejandro Mayorkas recently hosted a White House event to highlight a new initiative to bolster cybersecurity in the nation’s schools. They were joined by representatives of government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), FCC, and the FBI, as well as tech companies, national organizations such as the State Educational Technology Directors Association (SETDA), and school districts large and small. 

Among those in attendance was Frank Pileiro, tech director for the Public Schools of Linwood, New Jersey, a smaller district with roughly 830 students pre-K through eighth grade. "I was really honored. I received a 'save the date' email from Erin Mote of Project Unicorn and InnovateEDU. The official invitation from the First Lady came a few days later. I was surprised to be invited -- I’m sure they wanted to have representation from different sized districts,” says Pileiro. “In total, there were about 200 people in the East Room. Including myself, there were only 15 tech directors and CIOs from around the country.”

Coordinating Cybersecurity Efforts 

The administration’s new cybersecurity initiative includes a proposed three-year pilot program providing up to $200 million to strengthen cyber defenses in K-12 schools and libraries, and the establishment by the U.S. Department of Education of a Government Coordinating Council (GCC) that will coordinate cybersecurity activities, policy, and communications among a broad array of federal, state, local, tribal, and territorial education leaders. According to a White House statement, the GCC aims to foster formal, ongoing collaboration between all levels of government and the education sector in “preparing for, responding to, and recovering from cybersecurity attacks.”   

Pileiro welcomes this coordinating initiative, citing the many government agencies and departments that can come into play in response to cyber security threats. “There's just so many layers,” he says. “They need something to coordinate all that, to help them with intelligence and getting information out to us, which they're really good about. CISA sends out bulletins. They will even go so far that if they see a trend happening, they will pick up the phone and call you, which I think is terrific.”

Working with the Department of Education, CISA has also released the second in a series of guidance documents to assist educational leaders in building and sustaining core digital infrastructure for learning. 

Cybersecurity Threats Exist For Every School District, No Matter the Size 

Other activities were held in conjunction with the White House event. 

“Edtech companies convened there the day before the event,” says Pileiro. “And many of them took a pledge called Secure by Design, which is a cybersecurity pledge that encourages the solution-providers to prioritize cyber security in their products and their practices to reduce the burden on the K to 12 districts.”

The event also included breakout panels, during which attendees could share information and gain insights from peers. 

“Being in the room was just great, being able to meet people from everywhere. It makes me proud to just be part of the conversation and to be able to take what I've learned back to my school district and share it with my colleagues,” says Pileiro. “I think collaboration and what they're saying at the federal level is very encouraging because they want to collaborate, they want to see what's happening and they want to provide help.”

Other concrete takeaways from the event that Pileiro cites include the availability of free training from edtech companies, guidebooks and best practices from Google and others, and $20 million in grants from Amazon Web Services for K-to-12 cyber security.

“So the one thing that I took away, especially, is we all have the same problems, just at different scales,” says Pileiro. “And I was really happy to see that the federal government is taking some action, because [the threat] is ever present and it's growing.”

• 4 Cybersecurity Tips for Schools
• Cybersecurity in the Classroom: What Teachers Can Do

The first sign something was wrong came courtesy of an alert that Joel Handler received notifying him that his district’s Student Information System (SIS) was offline. It was 8:35 p.m. on April 11, 2021, and Hillsborough Township Public Schools’ spring break was coming to an end.

After receiving the alert, Handler, the district’s director of technology, and one of his staff members started trying to determine what was wrong with VPN access from their home computers. 

At 9:15 p.m. the SIS came online and it was instantly clear that the district had a bigger problem than a web outage on its hands. Instead of the normal homesite, there was a message from hackers. The word “Ryuk,” the name of ransomware software inspired by a character in a popular manga series, was in the center of the screen, and in the bottom right corner of the screen were the cryptic words, “balance of a shadow universe.” 

What followed was a whirlwind 24+ hour period during which Handler and his staff tried to work with law enforcement and school leaders to protect student information, minimize disruptions to teaching, and learn how to better prepare for the future. 

Ever since this harrowing experience, Handler has shared the story in the hopes it will help other districts better prepare for the increasing risk of cyberattacks. 

Here is an hour-by-hour look at how one district survived a cyberattack. 

Before The Cyber Attack 

Hillsborough Township Public Schools’ is a Central New Jersey suburban district with 7,350 students and 1,000 staff members spread across nine schools. At the time of the attack, Handler’s IT staff consisted of two systems engineers, one systems integrator, and one SIS database manager, as well as five field repair technicians. On the education side, the district had one technology integration coordinator and nine tech coaches. 

During The Attack

9:15 p.m., April 11: Panic Mode! 

Googling “Ryuk,” Handler learns it is ransomware software. “We start panicking,” Handler says. They start to try and assess the damage, but no school server is working and they worry that engaging any through VPN with their home computers will infect their home computers as well. 

9:43 p.m., April 11: Sounding The Alarm

A little more than a half-hour into the crisis, Handler gets on the phone with the district’s business administrator and superintendent to bring them up to speed. The extent of the hack is still unclear at this point. 

10-11 p.m., April 11: Pleas for Help and Damage Control

“We’re basically reaching out for help,” Handler says. “We don’t really know what to do to stop this.” Handler starts calling law enforcement agencies, including the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), the Multi-State Information Sharing Analysis Center (MS-ISAC), and the FBI, but since it is Sunday night, no one is answering. The state police do pick up and give him numbers for cybersecurity divisions and experts to call but when he does he still only gets voicemails. “Nobody’s there,” he says. 

Meanwhile, the superintendent has started contacting Board of Education representatives, union leadership, and preparing community communications. The Business Administrator also calls the district’s cyber insurance policy holder and makes sure all the district’s bank accounts are frozen in case the hackers have gained access. 

Team members begin to worry that the digitized HVAC systems at the schools might be compromised. “No one really thinks about this,” he says. “But all of our facilities, they're all interconnected. So are they attacking our schools with the intent to do physical damage?” 

(Thankfully, this fear would turn out to be unfounded.) 

12:15 a.m., April 12: Shut it Down

After a series of meetings with school officials, Handler hears from MS-ISAC and they advise him to shut down everything he can. “We went into the school, myself and one of my operations guys who lives in town, and we physically shut down our server, and that was one of the most eerie sounds I've ever heard.” 

12:48 a.m., April 12: No School 

School for April 12 is canceled and because all the digital tools the district uses are potentially compromised, thus virtual school is not an option. 

1 a.m., April 12: Final Meeting of the Night/Early Morning

The district’s operations team holds its final meeting of the night and makes plans to further assess and address the damage for the following day. 

6 a.m., April 12: Operations Team Meeting 

A message from the hackers on the server has been found saying they will be in touch shortly. 

6 a.m. to 11 p.m., April 12: Starting to Figure Out What Happened 

Throughout the day, Handler and other school employees begin to start the recovery process. It’s determined that the hackers have not accessed personal devices connected to the school’s servers, but district-wide password resets are initiated. The district decides that the next day of school will be a virtual day, and Handler and his team are figuring out things as they go. 

April 13-April 16: Virtual School and Analysis 

The operations team focuses on an attack analysis and restore process. Restoration is a slow process that takes place server-by-server, and each server is hardened from a cybersecurity standpoint as it is reconnected. 

April 19: In-Person School Resumes and Return to Normalcy

In-person school resumes and most services are fully restored. Handler and his team had determined early on, within the first 24 hours, that they had a stable full backup, so there was no need to consider paying the ransom to recover school data. 

After The Attack

Lessons Learned 

The process was long, difficult, and more multifaceted than could be summarized in this story but as operations returned to normalcy, Handler says they learned a number of important lessons – including ones you’d expect and others that are more surprising. 

“As a tech director, I was in the middle of three different entities,” Handlers says. Law enforcement agencies were looking at the attack as a crime scene and didn’t want him to erase any data that could be helpful in tracking the origins of the attack. 

Next, “My superintendent, the board of ed, they were like, ‘Let’s get the kids back in school,’” he says. “Finally, you had your business administrator and cyber insurance firm and they’re all like, ‘Get us back up and running without spending any money.’” 

Educators who have the misfortune of finding themselves in this situation should, “Expect the unexpected,” Handler says. He adds it is vital to have a point person in charge of updating staff and the community, to let the IT team focus on fixing the problem. 

Cause of The Outbreak And Changes Going Forward 

“A student account was compromised on a gaming site or something out there,” Handler says. The student used their school login and username for that site and when it got compromised, the hackers used that information to log into the student’s school account. From there, they were able to infiltrate the system. 

Since the attack, Hillsborough Township Public Schools has implemented a number of new updates to its cybersecurity procedures, including multifactor authentication requirements for all staff, implementation of endpoint detection and response, more phishing training efforts, and many other new interventions. 

However, Handler also knows it’s important to have a plan for if these efforts fail, as no cybersecurity system is foolproof. Having set procedures in place ahead of time for when a district is the victim of a successful cyberattack can lessen the fog of war Handler and his district experienced.  

“There's a lot of good stuff out there that talks about how to prevent ransomware attacks,” Handler says. “There’s no good playbooks out there for as the attack is happening.” 

And as Handler knows from experience, you don’t want to be searching for those playbooks after hackers have successfully stormed the gates and are inside your network. 

To share your feedback and ideas on this article, consider joining our Tech & Learning online community here.

• 5 Cybersecurity Tips from CoSN’s CEO and a Digital Security Expert
• 4 Cybersecurity Tips for Schools

With the ever-increasing presence of technology in our classrooms and our daily lives, it is more important than ever for teachers to be aware of the risks associated with using technology with students. We need to understand the potential perils as well as the safeguards and what to do if there is a security breach. 

These essential topics can open opportunities to support critical thinkers and problem solvers. Fortunately, there are tremendous resources available to you online.

One of the best sites for educators is Common Sense Education, which offers many free resources to support us as teachers, students, and the community. Before diving into any other site, it would be worth reviewing their research, lessons, and other resources. 

Many aspects of cybersecurity need to be considered, however, there are three significant areas worth focusing on for your classroom.

Classroom Cybersecurity: Password Protection 

One of the most important things you can do to protect yourself from cybersecurity threats is to create strong passwords that are at least 12 characters long and include a mix of upper and lowercase letters, numbers, and symbols. In addition, you should create unique passwords for each account you have. To keep your passwords safe, you can use a password manager or write them down in a safe place. 

There are excellent resources to support teaching about password safety:

• Sphero lessons teach the fundamentals of password creation while using the Sphero BOLT. Minimal coding knowledge is needed to create robust opportunities for students to explore password safety and other aspects of cybersecurity. 
• Cyber.Org has ways to test our password strength and many lessons to enrich our understanding of cybersecurity. 
• Nearpod's 21st Century Skills Program has additional content that a district can purchase to highlight all aspects of digital literacy, including password protection. 

Think Before You Click 

Phishing scams are a common way for hackers to steal personal information. Phishing emails often look as if they are from legitimate companies. Still, these are designed to trick you into clicking on a malicious link or downloading a virus. A simple pause and examination before we click can help keep us safe. 

There are so many fun ways to help our students practice these skills, including:

• Be Internet Awesome offers excellent activities, slide decks, and games for your upper elementary students. The games are fun and engaging enough that students will be excited to share what they learn with one another. 
• EverFi has an entire unit on digital wellness that will take your students through every aspect of their digital wellness. Lesson 4 explores identifying threats and helps them learn more about passwords. 
• CIAS uses CyBear characters and card games to teach all about cybersecurity. Request your free classroom pack of cards and print these tremendous offline activities to teach about cyber attacks and safety. 

Using Technology for Good 

Students need strong support when engaging online with others. As we teach character education, SEL, and DEI, we must support students' social media use. 

Students need to know essential terms such as bystander, upstander, and ally. While much teaching in the past has focused on what not to do online, we have the opportunity to help students see the potential that our online presence can do to bring social good. 

Exploring our online world in the classroom can seem daunting, but there are so many incredible resources available, including:

• StopBullying.gov is a great place to help us understand the warning signs and give us a toolkit to share with students to help protect them. 
• DigCit Institute offers month-long celebrations during which students and teachers share all the great ways they use technology for good. Check out their month-long #GlobalStudentShowcase recordings from April 2023 and follow them on social media for more opportunities to learn and participate. 
• Butter is a movie that your students will be on the edge of their seats while watching. It tackles mental health, suicide, and bullying in an engaging film. Then, check out the free curriculum created by Lisa Highfill, one of the Hyperdocs creators, to engage your students on these complex topics. 

To share your feedback and ideas on this article, consider joining our Tech & Learning online community here.

• Best Cybersecurity Lessons and Activities for K-12 Education
• 4 Cybersecurity Tips for Schools

“For the last five years, cybersecurity has been the No. 1 concern, and it’s increasing in anxiety each year,” says Keith Krueger, CEO of the Consortium for School Networking (CoSN). “School districts are the No. 1 target for ransomware.” 

Drawing on CoSN’s recent 2023 State of EdTech Leadership survey, and in conjunction with Amy McLaughlin, CoSN’s cybersecurity subject matter expert, Krueger recently shared tips for school leaders around cybersecurity. 

Fortunately, there is plenty of cybersecurity help for school districts in the form of resources, potential collaboration, and little changes that can have a big impact. 

1. School Cybersecurity Tips: Backup Information Offline and Offsite

The 2023 State of EdTech Leadership survey found 65 percent of school districts are backing up all their data on an offsite location that is not connected to the internet. 

Krueger believes this is a good start but he also sees "the cup is almost half empty" side of that stat. “[It] means that a third of school districts aren't doing that most essential kind of a backup,” he says.  

2.  Patch Everything  

The first step McLaughlin says every district should take is to patch everything in a timely manner. “I can't believe I've been doing this for 20 years and I have to say this, people still don't patch their stuff timely,” she says. “This is one of the simplest things to do. Patch every month, every device on time, and don't forget the stuff that you're not working with, every minute. Things like routers, switches, and firewalls also need patches and firmware upgrades.” 

3. Utilize Two-Factor Authentication  

McLaughlin’s next piece of advice for a security measure that can pay immediate cybersecurity dividends is to install two-factor authentication. 

“It is not the silver bullet, but it is a significant increase in security,” she says. “It makes it so much harder for somebody to compromise your account when they phish credentials on it.” 

Sixty-one percent of respondents to the CoSN survey said they require two-factor authentication. While McLaughlin would like to see that number rise, the trend is moving in the right direction. Last year only 40 percent of respondents required two-factor authentication. 

4.  Don't Reinvent The Wheel

State education departments have resources available and Homeland Security tracks and publishes information about cybersecurity attacks on schools. CoSN also offers a primer for schools looking to ensure they are following cybersecurity best practices. 

“It's probably the kind of thing that most school districts will read it and say, ‘Yeah, we're doing almost all those things,’ but it reminds you of what to do if you're not doing all those things,” says McLaughlin.  

5.  Change the Culture  

“The tendency is to think that well, cybersecurity is only the responsibility of the people who have technology in their title, and that's not the case,” Krueger says. 

The culture around cybersecurity needs to change so that all school leaders are thinking about it and it becomes a priority for superintendents and school boards. 

“They have to understand that cybersecurity isn't a technical problem that you dump on the IT department. It's an organizational challenge for the whole organization, and it needs funding,” McLaughlin says.  “Implementing multifactor authentication isn't difficult, technically. None of this is horribly difficult, technically. But the hard part is getting the organizational culture to not just accept but to embrace that this is an important element for taking care of the organization.”

• School Cyberattacks: How the FBI Works to Protect School Districts
• 4 Cybersecurity Tips for Schools

The definition ‘at risk’ is typically assigned to a school or district that has not been able to meet the accountability standards outlined by the state and the U.S. Department of Education. 

However, there is another factor putting our schools at risk that has nothing to do with student performance and everything to do with society at large. As of this publication, there have been 13 school shootings in the U.S. in 2023. That is an average of 4.3 shootings each month this year. If this rate continues, by the end of 2023, the number of school shootings will be 52. 

In my hometown of Nashville, a small private school located in a quiet older neighborhood of Nashville away from the hustle and bustle of downtown experienced the worst tragedy a school can experience. A former student entered the school with the intention to kill. The Head of the School confronted the armed intruder only to meet her death, along with the custodian and a substitute teacher who came to her aid. Three children lost their lives as well. 

A month has passed, and the journals are now being released containing the innermost thoughts of the person who committed this travesty. And the bottom line is she was a troubled soul. 

School Shootings Continue to Rise 

This event adds Nashville to the growing list of cities experiencing school shootings. The Center for Homeland Defense and Security has mapped out school shootings since 1970. 

It is a tragedy looking at these numbers and realizing that we’ve lost more than 368 children and teenagers in our public schools due to school shootings, and over 1,000 have been injured. The very place where students should feel the safest, they are murdered in cold blood. 

No state is immune from these events, and the historical data suggest the situations of the shootings vary tremendously. Regardless of which state you review, what doesn't change is the use of a gun. Many argue that gun control can solve this problem in our country, while others point to the rising mental health challenges. 

Each side has valid points. Although the Second Amendment of the U.S. Constitution calls for the right to bear arms, it doesn’t say -- nor was the intent of our forefathers -- to bear military-grade assault weapons. The term ‘bear arms’ describes the right to carry weapons for non-military purposes. States such as Michigan, California, Colorado, Wyoming, and Washington have strengthened their gun laws in the past two years. Yet only 10 states have laws restricting assault weapons. Giffords Law Center maintains a scorecard of state gun laws and allows users to compare state legislation.  

School Mental Health Support Stretched Thin 

Gun regulation isn’t the only solution. We really must try to support better mental health. The increase in substance abuse, depression, and anxiety prompted the World Health Organization to release a brief on mental health outlining the challenges and the resources available and required to address the crisis. Dr. Garrett Rossi offers commentary in the Psychiatric Times, sharing his opinion of barriers to resolution, including the increased challenges in treating patients with mental illness -- just last month, a patient shot other patients in a waiting room of a mental health provider in Atlanta. 

Schools haven’t prioritized counseling programs or services over the years, which has increased the student-to-counselor ratio and impacted mental health supports. The American School Counselor Association data suggests that more than 50% of schools are over ratio, meaning counselors serve more than 250 students per counselor. Indeed, the average ratio today is 408 students to one counselor. 

Our poor efforts and progress in gun control and mental health support create an opportunity for more shootings and other criminal acts in our schools. Now is the time to assess regulation on gun control, especially assault weapons, and to acknowledge that we are not serving our students well in support of their mental health needs. The sooner we pay attention to these issues nationwide, the sooner we can reduce the risk to our student’s safety at school. 

• How One District’s Mental Health Program is Saving Millions & Helping Students
• Building A Multi-Tiered System of Supports (MTSS) Framework for Mental Health

To share your feedback and ideas on this article, consider joining our Tech & Learning online community here

Cybersecurity continues to be a concern for all, with everyone from small businesses to major corporations and even governments on high alert, fighting the good fight to keep what’s private, private. 

On the surface, it might seem that a young learner would be the last one to need to worry about securing their tech — not a lot of hacking of fridge-destined finger paint masterpieces or “my cat sat on a mat” stylings of literary work and intellectual property. 

What isn’t such a cute concept is the amount of personal and sensitive information kept within a district’s system. Holding a data privacy day to bring awareness to this important topic is a great way to encourage safe use of tech.

Union School District in San Jose has a data privacy day, organized by Lisa DeLapo, Director of Information & Instructional Technology, to help students, staff, and families better protect their online presence.

Start Digital and Data Privacy Ed Early 

As with most subjects, early intervention ensures students build good habits from the beginning. When started early, self-awareness of data safety can become as second nature as putting a bike helmet on before hitting the pedals.

“As soon as students are using technology, they should learn about digital privacy,” says DeLapo, who was recently honored as Innovative Technology Director during Tech & Learning’s Northern California Regional Leadership Summit. “Kids are clean slates when it comes to their personal information, which also makes them a target by cyber criminals. COPPA protects kids under 13 years old, but learners have to know how to make sure their information does not get into the wrong hands.”

DeLapo, known as “the digital privacy lady” in the halls of Union, loves when lessons learned stick.

“When I teach in classes, they will make comments about private versus public information— such as when they build a website, they don't put their names or other personally identifiable info on it,” DeLapo says. “It's like music to my ears!”

Invest a Little, Save a Lot 

Unlike adults, identity security isn’t something most parents and guardians would think to keep tabs on for children. As such, typically obvious red flags might fly under the radar and not be caught until the damage is already done. Keeping students safe and secure, whether tucked in their desks, in the lunchroom, or in their digital future, is paramount. 

“While many public school districts are under-funded, digital privacy still must be protected,” says DeLapo. “The cost of that data being released to the public—or worse— to criminals who may use it for their monetary gain, is far more costly. School districts can always use CITE's privacy services to ensure their schools and teachers are using applications and services that are legally bound to protect student data. It has to be part of the app-vetting process to ensure student information is not sold to other parties.”

5 Tips for Creating a Data Privacy Day in Your School 

• Keep it simple. Kids need to understand what digital privacy is in general, so they know what they are protecting.
• Get students to participate in the creation of the day so they are involved in making it an engaging topic for their peers.
• Keep it short. Don't bore your audience with too much information.
• Stickers for participation! “We created our own sticker for students to show off on the case of their school-issued devices,” says DeLapo. “This raises excitement and helps to spread the word.”
• Ask parents and other adults in your community for help. "You never know who can help with good ideas and info," says DeLapo.

• 4 Cybersecurity Tips for Schools
• Best Cybersecurity Lessons & Activities for K-12 Education

As technology director of Barre USD in Vermont, Emmanuel Ajanma has led the movement to revamp the district's cybersecurity. These efforts earned him the award for Best Implementation of Data Privacy & Security at a recent Tech & Learning Regional Leadership Summit in Maryland.  

A former Catholic priest, Ajanma began his career in education teaching in parochial schools and found that he wanted to teach full-time. “If we are to secure our future, we do it through educating the young ones because they are the leaders of tomorrow,” he says.  

Ajanma, a native of Nigeria, was drawn to technology in particular because he saw years ago that it would become increasingly intertwined with learning. “Everything we do in the classroom and everything we ask, we are relying more and more on technology,” he says. 

That’s part of the reason cybersecurity is so important because when there is a breach in a school district these days, learning can grind to a halt. Ajanma shares some of his advice for securing school networks. 

1. Cybersecurity Tips for Schools: Add Segmentation 

One initial cybersecurity step everyone should take is to implement segmentation, says Ajanma. “That is the very first project that I did as a technology director,” he says. 

This divides a network into semi-independent segments protected by firewalls, which can limit the damage in the event of a security breach in one of the segments. “It wouldn’t spread if something happens at the high school or the middle school, or at the central office or wherever it is. It will be limited to a particular segment of our network,” he says. 

This is such an important step that Ajanma’s advice is, “Do it yesterday.”

2. Make School Stakeholders Aware Cybersecurity is Everyone’s Responsibility 

Another key in a successful school cybersecurity program is getting buy-in from teachers, students, administrators, parents, and anyone and everyone who interacts with school devices or the school network.  

“Cybersecurity is not only a technology department issue, it's all hands on deck,” Ajanma says. To get help from all stakeholders, Ajanma works with the school board to create cybersecurity policies based on best practices. 

However, having good policies is only the first part of the equation. “You need folks to actually know what the policies are and practice those policies,” he says. 

To ensure that, Ajanma has launched online cybersecurity training modules for all staff, which helps ensure they not only know the policies but help the technology department stay vigilant in regard to cybersecurity. 

3. Implement Multifactor Authentication 

Another step Ajanma recommends is multifactor authentication, a two-step or greater login process that requires the user to do more than just enter a password. 

While multifactor authentication has been Cybersecurity 101 for years now, many school districts still do not require it, and technology directors often face pushback when they try to launch the programs. Ajanma’s department was able to avoid this by sharing stories about cybersecurity breaches, including one that happened in a neighboring district, which highlighted the risk for educators at Barre USD. 

“This is not something that is only happening in New York City or in California, it can happen here in Vermont, it can happen in every district,” he says. Ajanma is also intentional about linking news of hacks to information on prevention solutions and strategies. 

4.  Be Proactive Rather Than Reactive  

Ajanma uses tools to monitor the school network for any anomalies or strange behavior, plus he holds regular tabletop exercises with his staff and tries to get school leaders involved in drills. 

In addition, Ajanma tries to be forward-thinking in recognizing new threats and advises others to do the same. For instance, he is starting to look at the ways ChatGPT and other AI language models with the capability to generate code might create malicious software. 

“I don't want to wait until it's happened,” he says. “I'm trying to be proactive.” 

• Building CTE Pathways Between Schools and Local Businesses
• School Cyberattacks: How the FBI Works to Protect School Districts

To share your feedback and ideas on this article, consider joining our Tech & Learning online community here

EntrySign made an appearance at BETT 2023 this year as an ideal education sign-in and visitor management system.

The EntrySign system has been built with education in mind so boosting security and safeguarding students are at the forefront of the features here. Everyone who visits the site can sign in and sign out easily, without the need for staff to play a part in the process. 

Consequently, visitor access can be managed safely but also monitored, allowing you to collect all the information that is needed for the safest possible experience. For example, you can use QR codes that are time sensitive, allowing specific invitees to have access for a specified period only. This can mean saving money by negating the need to offer physical passes, instead allowing visitors to use their own devices, with their unique codes, to gain access.

That said, there is still a traditional NFC card or fob reader so those entering the school regularly can do so without the need to use their device or having to spend any time entering information -- simply tap and go.

Other useful features include instant fire evacuations, documentation tracking, date tracking, infection control with automatic sanitizing and temperature checking, MIS integration, and more. Usefully, the EntrySign system can send automatic email confirmations to guests as well as offer custom attachments to suit individual needs. 

Various physical units are available to suit the needs and the space of the institutions in question. This is a very comprehensive system that can be scaled to fit the needs of your education space.

Check out the best of BETT 2023 here.

LapSafe Smart Lockers were at BETT 2023 and shown to be the future of locker-based storage for laptops in education buildings. With smart digital access and built-in charging, this is the way lockers are supposed to be.

The idea is to offer a locker system that houses all your education institution's laptops in an easily accessible space that is also super secure. Not only that, but this setup is also powered, so when a student or educator comes to take a laptop out, it should be charged and ready to go.

These lockers can help with security and space efficiency as well as eliminate the need of lugging chargers or having cables all over the school floors. Since the lockers charge the laptops, anyone can remove, use, and return a device before needing a charge.

Everything is automated and runs through a central touchscreen control panel. Consequently, the service is up and running 24/7 -- making it a great option for colleges and universities. 

With more than 15 years of experience and 15,000+ bays up and running around the world, LapSafe Smart Lockers is a company that knows what it is doing. As such, you get a lifetime warranty for parts and labor with any purchased product. 

A range of varying locker sizes and shapes is available, some even packing wheels to allow you to move units between rooms or buildings. Many work on a loan basis and prices can vary based on your needs.

Check out the Best of BETT 2023 here.

Well into 2023, it is disheartening to know that K-12 institutions continue to be one of the primary targets of cybersecurity attacks. Cyberattacks such as DDoS, phishing, data breaches, password attacks, man-in-middle attack, and malware on school districts have resulted in monetary losses, the need for additional recovery resources, and loss of instruction time.

While all types of cyberattacks are increasing in districts, for the first time, ransomware incidents were the most frequently disclosed incident type in 2022, with percentages rising from 12% in 2020 to 62% in 2022, according to the Emsisoft 2022 report. School districts hit by ransomware in 2022 represented 1,981 schools, almost double the number of K-12 schools potentially compromised in 2021. In addition, ransomware groups successfully exfiltrated data from U.S. schools at a rate of two-thirds in 2022, up from half that number in 2021. 

“We must ensure that our K-12 schools are better prepared to confront a complex threat environment,” says Jen Easterly, Director of CISA, the U.S. Cybersecurity and Infrastructure Security Agency, which is partnering with K-12 to bolster security. “As K-12 institutions employ technology to make education more accessible and effective, malicious cyber actors are working to exploit vulnerabilities in these systems, threatening our nation’s ability to educate our children.” 

Ransomware Attacks on the Rise 

Ransomware has the potential to access and exploit the sensitive data in K-12 institutions, including student records and other personally identifiable information, financial aid and transaction data, and healthcare information. As such, districts are continually at high risk. For example, bad actors recently released health records for about 2,000 current and former LAUSD students, publishing it on the dark web. 

With the increase in classroom technology and personal digital data, district leaders and IT professionals need to acknowledge that ransomware will continue to be an evolving cybersecurity threat. It is typically seen as easy big money for many bad actors, as they understand that districts are more willing to pay a ransom than undertake a long recovery process with educational and administrative consequences. 

Currently, many districts don’t have significant resources or budgets focused on cybersecurity, with an estimated less than 2% of operating budget allocated for staffing, training, and software. The State of EdTech District Leadership 2022 highlights that more than half of the IT professionals (52%) said their schools lack adequate staffing to support and protect teachers, while 77% of districts reported not having a full-time employee dedicated to network security. 

In addition, often unintentional, and non-malicious human errors are the top reason for school cyber attacks. Focusing on daily operations, staff and teachers are too quick to respond to phishing attempts, suspicious links, and unsecured access networks. With easily hacked passwords, unsecured devices, and software available with one click, accessing user data is an easy lift for hackers.

Cybersecurity Help and Resources 

Cybersecurity will keep edtech leaders up at night; however, many resources and organizations support the work done in school districts through educational programs, policies and initiatives, and training. Two organizations committed to cybersecurity and education are CoSN and the National Cryptologic Foundation. 

As a premier membership organization designed to meet the needs of K-12 education technology leaders, CoSN supports cybersecurity initiatives in many school districts. At the federal level, they are campaigning along with other organizations for FCC to expand E-rate eligibility for basic firewalls to include all current firewalls and related features without requiring cost allocations. 

CoSN recently released the Blaschke Report, a cybersecurity primer for any K-12 school district. This report identifies five actions a school system IT staff might take to defend IT infrastructure better, including: 

• Training
• Technical expertise 
• Network security 
• Sustainability plans 
• Leadership buy-in and funding 

Keith Krueger, CEO of CoSN, recommends that along with the actions in the report, K-12 organizations take a district-wide approach to cybersecurity by focusing on user education, increasing internal human capacity, and understanding what is at risk regarding cyberattacks. 

The National Cryptologic Foundation focuses on a community approach to reach youth with vital cybersecurity concepts and tools. They provide the education community various resources including cybersecurity curriculum guidelines and the Outsmart Cybersecurity Collection, which guides students to build their foundation of data care principles and practices. Also available are interactive cybersecurity games and podcasts that provide expert advice. They also partner with Teach Cyber to offer pathways for students to explore careers in cybersecurity. 

“You don’t have to have a background in cybersecurity to teach our youth and provide future opportunities in the cybersecurity space,” says Dr. Alisha Jordan, Director of Education for the National Cryptologic Foundation. She recommends that any educator interested in learning more should sign up for an account and newsletter on their website.

What’s Ahead in Cybersecurity 

With the avenues of attack growing, districts cannot rely on outdated methods to stay secure. The 2022 CiSA report recommends that districts explore several strategies to  meet the increased demands of the cyber risk landscape, including: 

• Making all employees part of the district’s security defense
• Keeping patches up-to-date  
• Restricting unnecessary access 
• Implementing multi-factor authentication 
• Following industry best practices 

Educators also need to stay abreast of cybersecurity trends. For example, cybercriminal gangs and sophisticated advanced persistent threat (APT) groups are actively recruiting AI and ML specialists who design malware that can evade current-generation threat-detection systems. While developing these AI capabilities is a lengthy process,  they already can facilitate easy and undetectable network access with malware-free intrusions and valid credentials.

In addition, cyber criminals have tapped into the highly popular ChatGPT AI to refine malware, personalize phishing emails, and finely tune computations to steal highly sought access credentials.

On the plus side, we are seeing some noteworthy cybersecurity developments. Leading cybersecurity vendors such as AWS, Google, and Microsoft are prioritizing investment in AI and ML research and development in response to increasingly complex threats. 

AI may also be a game changer for districts against cyber attacks, with its potential to help build automated security systems, support natural language processing, refine face detection, and be a part of predictive threat- detection systems. 

While not a substitute for committed experienced IT personnel, robust infrastructures, and knowledgeable users, AI technology will soon be able to help districts fight the good fight in regard to cybersecurity.

The best student cloud data storage options for 2023 are more varied now than ever, and with plenty of free choices, it's become tougher to decide which is the right one for you. Since most students have different needs, this guide aims to clarify the variations between the best choices so you can find the right option to serve your storage needs.

While physical storage on a hard drive or USB stick has its merits, using the cloud is fast becoming the first choice of most students for data storage. One of the main reasons is that there is a lot of it for free right now. But another factor is the ability to access that data from most devices and locations -- no need to remember that drive or to carry it about with you.

The downside? If you don't have an internet connection you won't be able to get at that data. Some say solid state is more secure, however, in most cases the larger data storage services offer so many layers of security, your data is likely safer than in your pocket.

You may already have one of the best laptops for students or best tablets for students and simply want to expand that storage. Or perhaps have access from more than those devices alone. Whatever your need, these are the best student cloud data storage options out there right now.

• Best tablets for students
• Best tablets for teachers

Best Student Cloud Data Storage Options

1. Google Drive: Best student cloud data storage overall

Google Drive is the cloud storage solution from one of the biggest data names on the planet. While that could raise a snooping red flag for some security-conscious students, aside from automated tracking of your words, the actual data should be super secure protected by all the power Google affords.

The free storage amount is generous with 15GB as soon as you sign up. Since this is part of Google, you will already have access to this if you have a Gmail account. Then, should you want more space, you can pick a wide selection of capacity amounts -- all reasonably priced -- right up to a massive 5TB of space.

While there is encryption during transit and rest, making your data super secure, this is still a U.S.-based company, so your data could be accessed by the government if needed. You have two-factor authentication, if you need, plus a super easy-to-use drag-and-drop interface that feels simple no matter which device you're accessing it from.

This also integrates with Google Drive, Sheets, Slides, and more, so you can easily access all your data and share it very simply if you already use those services.

2. Dropbox: Best for high-capacity storage

Dropbox is one of the original cloud storage services, so it has been working on perfecting its service for a long time. As such, you can expect lots of security for your data with heavy encryptions. This also means the integrations and user menus are very well-refined and intuitive.

Free storage is available, but at 2GB it's not the most generous. Where Dropbox stands out is the affordability of its larger storage capacity options, with a massive 5TB costing just $15.99 per month. Sharing with other users, even those who don't have Dropbox, couldn't be easier, making this an ideal choice if that's something you plan to do a lot.

This not only works across a host of devices but integrates well with apps that allow you to use this like another drive on your device -- and with lots of offline storage options you can access content anytime if needed too.

3. Microsoft OneDrive: Best for Office integration

Microsoft OneDrive is a good choice if you're already invested in the Microsoft ecosystem. This is because it works really well with all the Microsoft apps, allowing you to access all your documents from one place, anywhere you are. It also means a generous 5GB of storage with a free account.

But this stands out with its storage inclusion for Microsoft 365 users who get a massive 1TB of storage as part of the deal -- which extends to a whopping 6TB for family accounts. 

While this works best with Microsoft devices, as it comes built-in, you can also use it on Mac, iOS, Android, and more. Everything is encrypted to protect your files, however, the Personal Vault feature is particularly helpful as this lets you place certain files in a locked folder that you need to go through two-factor authentication to access.

4. Apple iCloud: Best for Mac and iOS users

The Apple iCloud is a great option for Mac and iOS users thanks to excellent integration across those operating systems and a very generous 10GB of free storage space. The downside? You won't be able to use this on Android, so if that's you're mobile platform you might as well scroll on.

For everyone else, the iCloud offers encryption security for data at rest as well as in transit. You also have the option to expand storage, up to 2TB, at very reasonably priced rates. Plus, if you take out a plan, there are lots of Apple extras thrown in including Apple TV+, Apple Music, Apple Arcade, Apple Fitness+, and Apple News+ -- depending on which plan you choose.

If you've got an iPhone this is a great way to automatically have all your photos updated. And for files created on Apple devices, this helps with easy access across devices as well as sharing. 

5. IDrive: Excellent for bulk storage deals

IDrive is a fantastic option if you want to make a saving on large storage capacities by paying up front. As such, this offers some of the best rates for up to 5TB of storage at annual rates -- plus, you can save up to 50% by using student discounts. This does mean there are no monthly plan options, but since that's not what this option is all about, that shouldn't be an issue.

You do get a massive 10GB of storage for free, so it's well worth a try. And affordable doesn't mean unsafe as you have full encryption of your data end-to-end. Just don't expect a lot of other third-party integrations or the best upload and download speeds out there.

The focus on student privacy has grown in recent years and for good reason. As consumers, we want to know that the banks, retailers and other organizations that we do business with aren’t misusing or reselling our data. The same goes for schools, which have always gathered, stored and shared student data. Unlike paper, which can be locked in a file, digital data is generally more prone to misuse by “bad actors” that may steal it and use it illegally. 

But where the banking industry has built up a level of confidence for consumers who log into their accounts online or via an app and know that those institutions won’t misuse their data, school districts are still working to establish this level of trust and confidence. Most understand the responsibility that they have to keep their students’ data secure, but they don’t always recognize that security must also ensure privacy. For example, a district may have an extremely secure system, but it could be unknowingly misusing and/or sharing data inappropriately (e.g., with outside vendors or partners). 

It’s also important that districts distinguish between information security and cybersecurity. The former is focused on high-level, overall protection of information and ensures that information systems aren’t used in an unauthorized manner. It includes the policies and procedures related to security. 

Cybersecurity, on the other hand, relates to the technical, hands-on aspect of protecting and preventing damage to electronic resources. Where cybersecurity is certainly part of information security, the latter also includes application security and protection of the infrastructure itself. 

Confidentiality, Integrity & Availability (CIA Triad): 4 Good Starting Points 

When creating what we refer to as the “confidentiality, integrity and availability” (CIA) triad, districts must factor in the myriad different aspects of security. Here are four ways to get started down the right path: 

1. Reduce the number of applications in use on campus. Rather than letting teachers and administrators find and use applications on their own, develop a process for “approving” applications for use within the district. This will help reduce the number of disparate solutions that are being used and give IT and other stakeholders more control over what kind of data is being shared and who has access to it. Give users access to a list of approved applications and make it easy for them to find, implement and begin using those solutions. 
2. Work with vendors that understand the value of privacy and security. They say you’re only as strong as your weakest link, and this definitely holds true in the technology space. Your technology partners should share your vigilance for protecting the privacy of your students’ data. If they don’t, then find another partner. For example, as a fully unified school-home communications platform, ParentSquare is only accessible with a username and password. The platform stores and protects account information on a secured server behind a firewall and uses encryption/security software to safeguard the confidentiality of any personal information that it collects.
3. Make it real for teachers, students, and parents. People will take both security and privacy to heart when they can relate to the potential threats and the damage that they can inflict. For example, when we’re trying to impress upon our staff the significance of password clarity, using different passwords for different sites, and using multifactor authentication wherever possible, we’ll use an example like a retail credit card breach to support our points. We’re all consumers and know that using the same login and password across dozens of sites is a bad idea. We try to explain it to them in ways that make the situation more personal; that helps bridge that gap a bit.  
4. Get your leadership involved. Make sure your leadership understands that it’s ultimately accountable for everything that happens within its school district—security and privacy included. If there's a major incident of any kind in a school district, it's the superintendent who will be on the news trying to address and explain it. Also, leadership can play a key role in establishing the risk tolerance for their districts and helping everyone better understand that privacy, security, and data aren’t just “techie things.” 

Start Small and Continue to Build 

As much as everyone has been talking about privacy and security in recent years, there’s still a large percentage of small districts around the country that aren’t thinking about it because they’ve yet to experience a data breach, no one in their community has expressed concern, or they live in a state without a state law mandating they take proactive measures. 

We talk to a lot of districts that don’t realize how much data is being shared with vendors and outside parties. Other schools feel like they just don't have the capacity or the resources to handle the issue properly, so security and privacy get tabled for another day. It’s important to keep in mind that all districts house information which is highly valuable to bad actors. No district is immune from attack. For all school districts, no matter their size, location, technological skills, or budget, it's a matter of when a security incident or data breach occurs, not if. 

For districts that don't know where to start, reach out to your peers and other organizations. CoSN, with resources such as the Trusted Learning Environment, along with the Student Data Privacy Consortium (SDPC) are good starting points. 

Using these resources, you can start with just one or two initiatives and gradually begin building the framework for a privacy program in your district.

• How School Social Media Accounts Put Student Privacy at Risk
• School Ransomware Attacks: 5 Tips to Prevent & Survive

U.S. schools and districts routinely share student photos and names on public school social media accounts, new research from the American Educational Research Association reveals. 

The study’s authors estimate that more than 4.9 million posts have included identifiable images of students on public Facebook pages, and about 726,000 of those posts are thought to identify one or more students by their first and last names. 

The common media release forms many parents sign at the beginning of the year often don’t explicitly include social media. In addition, many educators and parents are unaware of the potentially harmful ways in which student images and names from social media posts can be used, says a co-author of the study, Joshua M. Rosenberg.

“This study, we hope, is a constructive warning,” says Rosenberg, an assistant professor of STEM education at the University of Tennessee, Knoxville. “This is not meant to say all educational social media use is bad or dangerous, or that there's any high degree of risk associated with a single post. It's more saying that in aggregate, and over time, there's some potentially serious downsides that come from sharing this much personally identifiable information in a publicly accessible way.” 

Student Privacy: Serious Downsides to Public Posts 

The dangers of schools posting student names and pictures on social media fall broadly under three categories, Rosenberg says. 

1) Companies and governments accessing the data

“We know that foreign and domestic governments access public social media data,” Rosenberg says. “What do they use that for? We don't really know. But in many cases, it's for things that we know adults don't like, and they wouldn't like for their children to be wrapped up in.” 

For example, there are companies that collect public social media posts and other public internet data and compile it into a database that law enforcement agencies can use to probabilistically identify suspects for crimes. “This is an example where it's probably not illegal, but it's the kind of thing that parents and kids probably wouldn't like if a photo that was shared on a school or district page ended up in a database used by one of these policing companies to identify possible suspects in a crime,” says Rosenberg. 

2) People seeking images of children 

“There's data from Australia that suggests that around half of the images shared on child pedophilia websites came from public sources,” Rosenberg says. “These photos could end up being collected and presented in such a way that they look very different, and they are used for very creepy, and potentially really damaging purposes.” 

3) Individual risk

“We've heard many anecdotal stories of kids in custody disputes, in which one parent looks on the social media pages of their child's school or district to try to find out where they are, so that they can try to find that child and possibly do things that run counter to some custody agreement or some protection order,” Rosenberg says. “There's also the risk of stalking of individual kids. We have anecdotes of this.” 

How Schools and Parents Can Be Safer with Social Media Use 

The first step to better protect student privacy is for school leaders and parents to start thinking more about potential risks, Rosenberg says. Unlike personal social media accounts, school accounts are always public and often have many more followers than an individual user would. School accounts can also place students in specific geographic areas in ways even public personal social media accounts don’t. 

Rosenberg advises school leaders to make their school and district accounts private, though he acknowledges this has downsides, including less visibility for posts and more administrative work approving followers to the account. “That single step alone would prevent the large-scale collection of these data for purposes that are hard to anticipate at this point,” he says. “Another change we suggest making is to not post photos that readily identify students' faces.”

He also suggests never posting students’ full names, and instead posting only their first name or only their first name and last initial.  

Finally, Rosenberg advises school leaders to review their media release policy and make sure it is current. “From a study that is ongoing, we found that less than 20% of [school media release policies] mention social media explicitly,” he says. “So a lot of these media release policies were written for a different era when social media use wasn't ubiquitous.” 

Parents should also read these types of releases carefully and talk with their children’s educators. “I would encourage parents and students to ask questions about how schools and districts are sharing this kind of content,” he says. 

The goal of the research is to spark broader conversations around this issue and serve as a warning. “It is definitely not a criticism of educational leaders,” Rosenberg says. “Myself and my colleagues have all shared information about ourselves, and family members on social media. And so we see this more as a constructive dialogue that we hope to start where we can slowly nudge ourselves and others into using social media in a way that doesn't have as many potential downsides for student privacy.” 

• What is Digital Wellness? How One School Implements It
• 4 Ways To Prevent Cyberbullying
• 6 Tips for Protecting Student Data Privacy

Educators today have a dizzying array of learning apps from which to choose. 

A recent report from Lightspeed Systems finds that most school districts have more than 2,000 apps in use, but 300 apps account for 99 percent of school usage. 

The sheer number of apps used in schools can present a challenge to chief technology officers and school IT teams tasked with protecting school data and student data privacy. 

However, technology can also help protect student privacy. Jim Farmer, chief technology officer at Fayette County Schools in Georgia, says he and colleagues including Sarah MacDonald, information systems and data manager, Matt Jackson, coordinator of digital and media services, and Matt Smithson, network analyst, were able to protect student privacy in their district with smart use of privacy technology and good old-fashioned district education and outreach. 

Vet Apps For Data Privacy and Rigor  

The technology and curriculum departments at Fayette County Schools worked closely together to establish how technology would be vetted. 

“There's been this conversation for quite a few years now about trying to help people understand the importance of our students' information, and where it's going, and how it's being used,” Farmer says. That conversation extended beyond privacy to quality. “From a curriculum standpoint, obviously we want to make sure our kids are getting the proper rigor, and [apps are] standards-based and vetted by our coordinators, and by our teachers, appropriately.” 

Each app now goes through a standardized digital resource approval process. "Teachers work within their school and with their leadership to submit a request for a digital resource," Farmer says. "Once the principal or designee approves the request it then moves forward in the process to the district office. The district team is made up of the curriculum and technology department personnel. A rubric is used to evaluate the resource from multiple perspectives by the technology team safety, security, data policies, sharing, advertising, etc."

Understand The Tech Being Used in Your District  

The next step was assessing what tech was being used in the district. To do this, the Fayette IT team deployed Lightspeed Systems tools that provided analytics on technology use by students and teachers. “There were some obvious concerns,” Farmer says. “We found a lot of apps that we didn't pay for, [and] that the curriculum department didn't pay for.” 

The district quickly established plans to shore up the security involved with this technology use. Going forward, student information has only been shared in apps that have been vetted and approved from a privacy and curriculum perspective. 

Establish Tech Request Procedures and Focus On Rostered Technology  

The district has established standardized policies for educators to request permission to use new tech tools. Any app or platform that requires students to provide their names or other identifying information is not permitted. 

“As long as it's not using a student name and email, and the teacher is getting good use out of it because it's engaging and interactive, then that's more of a curriculum piece,” Farmer says. “We don't really have a problem with that, but if they're signing in, and they're being rostered in any way, then that's where the bar has to be met for us.” 

Communicate the Importance of Data Privacy Initiatives  

Four or five years ago educators may have been able to incorporate whatever technology they wanted into classes but school privacy breaches have become far more common and awareness of safety issues has risen. Consequently, school leaders have had to be more restrictive in the types of edtech tools they permit. 

To build educator support, it’s very important to make the reasons for this change clear. “If we just start saying, ‘Nope, we're not using that,’ we're gonna get a lot of pushback,” Farmer says. “So we've been doing a lot of communication and leadership meetings, we've been doing a lot of communication with principals, and then they re-communicate that out to their staff at staff meetings.” 

He adds, “If you think you're doing enough communication, do it 10 times more and you still won't be doing enough.” 

• 6 Tips for Protecting Student Data Privacy
• School Ransomware Attacks: 5 Tips to Prevent & Survive

School safety, security, and communication has never been more critically important, with most school districts spending large portions of budgets to invest in technology designed to ensure that people and property are well-protected and well-connected. Consequently, the planning process for any technology project needs to visualize and anticipate how the new solution will integrate with existing systems.

Facility surveillance camera systems, physical security controls, communication platforms, rapid notification solutions, visitor management, and emergency alert systems are all integral parts of the Greeneville City School (GCS) District security fabric. Careful planning and thoughtful integration must be strategic and deliberate to be effective and efficient.

How We Have Integrated Security Systems 

GCS currently has more than 300 security cameras strategically placed in the six physical school buildings of the district. In addition, the district has an online school and partners with a neighboring district to run a unique online career and technical school. 

When looking for a surveillance camera solution, the district invested in the Avigilon system, which is interoperable with the physical security system, so it has eliminated the need for countless physical keys that can be difficult to manage and hard to track. Each district employee currently utilizes an ID badge to manage physical access to buildings and classrooms. 

When a need arose to facilitate rapid emergency messages to both internal and external stakeholders including local emergency officials, interoperability was a key consideration. Ultimately, the solution identified and adopted by GCS (the Rave Panic Button) was compatible with other key systems, such as the Audio Enhancement EPIC classroom and school communication platform, which itself replaced aging intercom and bell systems throughout the district. 

The ability to quickly communicate with parents, guardians, and employees is key to the overall success of GCS. Thanks to proper planning and platform integration, the district can seamlessly share important information with ease and speed via the PowerSchool student management system and the SwiftK12 rapid communication system.

Best Practices for Vetting Products for Interoperability 

When faced with the daunting task of choosing the right solution for any school safety or security issue, the following should be considered: 

• After identifying the best-in-class solutions, seek out practitioners who made the decision to purchase each product and ask them why they chose it and what surprises they faced during implementation. 
• Ask each vendor/solution provider being considered to complete a functionality matrix developed by your team. This will help the team compare and contrast solutions. This practice will also help you identify any missing functionality that might hinder the overall plan for integration and project success.  
• Look for open architecture platforms when available. One example would be to determine if existing cameras can be incorporated into a new video surveillance system or if purchasing all new cameras would be required. This could be a substantial factor in the total project cost.  
• Always make efforts to determine the total cost of ownership. Oftentimes, a solution can present as most cost-effective until the long-term costs are factored into the total equation. Subsequent licensure costs, upgrade protection, and other sometimes unidentified costs can quickly add up and exceed the project budget. 
• When developing the procurement documents including the request for proposal, make sure to leave vendors some autonomy to specify technologies that might not have even existed during the development of the project scope. After all, the best thing about technology is that it changes daily. Additionally, the worst thing about technology is that it changes daily. Make sure your project documents and plans are also scalable and flexible to ensure the best solution can be identified, secured, and deployed. 

An effective system is one whose new and innovative solutions merge seamlessly with existing systems to provide a solution that is greater than the sum of its parts. This practice will serve to build and maintain the confidence of taxpayers and other external stakeholders as they entrust the school district with the community’s most precious resources – children! 

• Securing & Future-Proofing Your School IT
• 6 Steps to Remove Social Security Numbers from Student Data

At about 6:30 in the morning on a Monday last year, Brad Stewart got a text informing him that a principal of one of Lufkin ISD’s schools couldn’t log into the system. 

After Stewart, the chief technology officer of the Texas district, got to his office, he learned the problem was much more extensive than that one principal’s inability to log in. 

On the previous Friday evening hackers based in the Netherlands had gained control of four of the district’s security camera servers, and with that access, moved and encrypted district data all weekend. By Monday morning all the district’s virtual servers had been encrypted, essentially shutting down everything that relied on technology. The hackers were asking for $1.5 million dollars in bitcoin to restore the stolen data. 

“When you take an entire network down, you lose things like time clocks, you lose things like air conditioning, you lose a way to check students in and out, you lose grades,” Stewart says. “Everything was down. It really left us paralyzed.” 

Stewart and his team were able to restore basic services within a couple of weeks and worked tirelessly over the next six months to get most everything back online and to ensure the district would be less vulnerable in the future. For these efforts, Stewart was given an award for Best Implementation of Data Privacy at the Tech & Learning Innovative Leader Awards in Texas.  

Ever since his district’s ransomware attack experience, Stewart, who is the Texas Computer Education Association Area 7 director, has been sharing the story so other districts can avoid going through what his district experienced. 

1. School Ransomware Attack: Get 24-Hour Protection  

Many districts don’t have the funding to have a staff member monitor servers 24 hours per day to prevent a ransomware attack. Hackers know this, which is why they tend to target schools on weekends and holidays, Stewart says. 

To stop such attacks, Stewart recommends hiring a 24/7 monitoring service so someone can always spot strange activity. “If I had known they were starting to make changes that Friday night, which would have shown up with 24/7 monitoring, we could have pulled the plug and prevented everything,” Stewart says. “I've actually given the people that run that service the ability that if we see a ripple, anything, pull the plug, let's figure it out in the morning.” 

2. Make Sure You Have Strong Backups 

Once you have 24-hour protection, the next step to preventing and overcoming a ransomware attack is backing up data.  “Make sure you have good backups, whether that's in the cloud or off-site, or if it's a second site,” Stewart says. 

In addition to having quality system backups in place, Stewart recommends regular testing to ensure those systems are secure, working, and up to date. 

3. Harden Your Network's Defenses

 “Strengthen passwords, make sure that you have a good firewall in place,” Stewart says. Moving to two-factor authentication for all with access to the network is another way to provide extra protection, and something Lufkin ISD had not done prior to becoming a ransomware attack victim. 

Staff members might push back against some of these changes, but the educators in Stewart’s district learned the hard way why such precautions are necessary. “You let people go with no internet for two months, and they'll do just about anything you tell them to do after that,” he says. 

4. Be Aware of What’s Stored on Your Network 

Prior to the ransomware attack some departments at Lufkin ISD had been storing data digitally without proper encryption. “Accounting had stuff that shouldn't have been on their desktop,” Stewart says. “HR was keeping people's information that had social security numbers and stuff in it.” 

Stewart advises having conversations with department heads about the types of information that is being stored and then figuring out how to keep that information safe. Doing this before a ransomware attack can ultimately save time and money. “We ended up having to give a credit monitoring service to every employee in our district due to the fact that someone had left those files on there,” he says. 

5. Have a Hardcopy of a Ransomware Response Plan  

“You need to have a disaster recovery plan for anything--it could be for fire, flood, hurricane, and a ransomware attack,” Stewart says. The recovery plan for a ransomware attack should include contacts at your insurance company, the name of a cybersecurity lawyer who is picked out in advance, and a plan to notify the appropriate law enforcement agencies. This document should make clear the district’s priorities and who should be called first, Stewart says. 

It’s also vital for ransomware preparation that you go old school and print this plan. “It needs to be paper,” Stewart says. “It's stupid to have a digital one because you're not gonna be able to get to it.”  

• 5 Ways to Boost School Cybersecurity
• Campus Cybersecurity Tips & Resources

The early days of the pandemic ushered in a Wild West era for student digital privacy. Scores of online platforms started offering products for free and it was not always clear how student data would be handled. 

Kimberly Ramos, a technology instructional coach at the North Kingstown School Department in Rhode Island, realized early on this could be a problem. Working with the district’s IT director and systems administration, she helped form a student data privacy plan to establish effective systems for vetting new tech tools and fielding requests from educators to use others. 

For these efforts and others, Ramos was recognized with an Innovative Leader Award for Best Implementation of Data Privacy during Tech & Learning’s recent Northeast Regional Leadership Summit.

From her experiences, Ramos has developed tips and best practices for vetting digital tools. 

Standardizing the Process  

To protect student data, Ramos and colleagues implemented a vetting process that asks several key questions about each new tech tool, including whether the tool is of high instructional quality, whether it is in compliance with state and federal data laws, and if there is an approved budget to pay for it. The district also partners with other districts on a standard student data privacy agreement that many tech companies have already signed. 

“We also have an approval process that we created for teachers who really want to stick with something that they were using before, or something that they found,” Ramos says. (See workflow graphic the district uses below

Educators can request a new tool through a Google form and then Ramos or a member of her team will work with them on answering questions about the new technology, including whether there is a privacy agreement with the company on file and how the tool will be utilized. For example, teachers will be asked, “Are other people in your grade, or your content area, going to use it, or are you the only one?” Ramos says, adding equity is also a point of emphasis. “If you're in fifth grade in one school, and then you go to fifth grade in another school, they should be using the same tools and platforms, so that everybody has a similar experience.” 

The Vetting Process Should be Ongoing  

School leaders should also understand that the vetting process for tech tools is ongoing and the usage of these tools should constantly be evaluated for educational efficacy. During summer break Ramos analyzes the data surrounding each app the district uses. “For example, ‘Alright well, we had licenses for 4,000 kids, how many are actually using it this year?’ So the data will tell us if it's worth purchasing again,” she says. 

The data can also help answer questions about which groups of students should get licenses. “Is it just a middle school and high school thing? Or is it just an elementary school thing?” she says. 

Getting Teacher Buy-In  

When rolling out new vetting tools for digital technology it’s important to get teachers to understand the need for such vetting. “Don't be heavy-handed about it,” Ramos advises. “You need to give the ‘why’ as well as the ‘what.’” 

Taking a personal approach can also help. “Rather than just sending an email, setting a deadline, and saying, ‘Okay, this is what's happening,’ I like to go to faculty meetings in every building,” Ramos says. 

She’ll work with teachers during planning time and offer to help as much as she can. In addition to sending instructions, she’ll offer one-on-one meetings with teachers or to come to classrooms to work with them and their students. “I think being approachable and being flexible are the keys to that, and just making sure that people know that there's a bigger reason behind this,” Ramos says. “We're not doing this to be difficult, we're doing this because we need to protect our students.” 

• 6 Tips for Protecting Student Data Privacy
• 5 Tips for IT Leadership From an Award-Winning Director of Technology

Digital literacy and ease of use for teachers and students are important components of creating secure digital collaboration, say Drew Lane and Mary Schlegelmilch. 

Lane, executive director of ICT at Shawnee Mission School District in Kansas, and Schlegelmilch, business development manager at Cisco, spoke with Dr. Kecia Ray during a recent Tech & Learning webinar sponsored by Cisco. 

Watch the on-demand version here. 

Key Takeaways  

Plan on Planning 

When developing secure collaboration systems in a district, having a planning process that prioritizes flexibility is important. 

“The act of planning itself is probably as important as the plan itself,” Lane said. “No matter what plan you develop, it will change as soon as you put it in place. As soon as it is tested, it will change and you will need to respond to that change.” 

He added, “No plan survives first contact with the enemy. Who would have ever thought supply chain issues would be such a factor in the execution of your plans? So that's required creative thinking.” 

Keeping this in mind, Lane’s district now plans five years out rather than seven, which allows for more flexibility. 

Use The Right Tech Tools 

Finding the correct use of your technology tools is as important as the quality of the tools themselves. 

“Technology is a tool and like all tools you need to use it for the right thing,” Lane said. “If you use a hammer to fix a windshield, you don't get a repaired windshield.” 

For example, the forced remote learning of 2020 and parts of 2021 were more challenging than many expected, Lane said. However, schools learned from the experience and know better how to use available edtech tools for both in-person and virtual learning going forward. “If we're ever in a position where we have to do a version 2.0, it will be better than version 1.0 was because we will take the lessons learned,” Lane said. 

Give Teachers The Support They Need to Focus on Teaching 

Schlegelmilch has spent time over the past two-plus years working with teachers on developing good tech pedagogy. “What I learned is that teachers really want to do what they do best, which is teach, but they also want to communicate,” she said. 

To support both these goals, teachers need access to a secure network and the right tools for communication and collaboration such as easy-to-use video chat options. When technology is difficult to use for students or teachers, utilization tends to be low. “I always say, ‘Make it easy for teachers. Make it even easier for students,’” Schlegelmilch said

Realize That Secure Collaboration is Linked to Digital Citizenship 

The Shawnee Mission School District was able to navigate remote learning and incorporate more technology without putting its students or teachers at risk from data breaches. Even though the district has avoided being hacked, school leaders learned during the pandemic that they need to do more work around digital literacy education for all school stakeholders. “Secure collaboration leads to greater digital literacy,” Lane said. “It is symbiotic. In that sense. You have to have one living with the other to get the full benefit. People didn't necessarily realize until they were using secure collaboration that insecure collaboration and cybersecurity was a threat to them at an individual level.” 

District leaders are now devoting resources to ensure educators understand cybersecurity basics and its role in protecting their district’s network or networks. “We do have a responsibility if we intend to remain masters of technology and not the other way around to be digitally literate enough to understand the limitations of things like identity access management controls,” Lane said. “You have to understand how a bad actor could get into my space against my wishes, and what actions are available for me to take as a teacher to prevent that. I think that there is some water there for us to carry as educators and I think there always will be.”

Define Security and Innovate 

It can also help to clarify what secure collaboration involves for your district. Lane said that for his district it means if they’re working with a tech platform their IT department understands the way the district’s data is stored. “They know where that data rests,” he said. “They know that that data is encrypted when it's in transit. And they know that that data is in good hands when it's decrypted and presented to your internal customer.” 

Schlegelmilch said that secure tech tools that foster collaboration can help teachers continue to use technology to innovate education. “Coming out of this pandemic, I always say this is the time to truly reimagine education,” she said. “This is not the time to go back to the old normal of what we had. This is the time where we start thinking differently.” 

• Tech & Learning Webinars

How can schools create the infrastructure that supports the equitable and safe use of technology in schools today -- and in the future? 

During a recent Tech & Learning roundtable, Sandra Paul, director of IT for Township of Union Public Schools in New Jersey, and Rob Dickson, CIO for Wichita Public Schools in Kansas, discussed best practices on how school districts could implement the tools and systems to ensure IT is safe, accessible, and easy to manage. The webinar was hosted by Dr. Kecia Ray and sponsored by Microsoft. 

View the on-demand version of the talk here. 

Access Anywhere and Everywhere  

Providing students equitable and safe access to technology goes well beyond the classroom today. “We've accepted as a society that our kids are going to be multi-medium connectors,” Dickson said. “Before, when we thought about learning, we kept it in the confines of that classroom, or we kept it in the confines of that district.” 

Paul agreed. “When it comes to equity, the biggest thing is we've changed the whole concept of instruction and learning,” she said. “It's no longer boxed into a school district or in the four walls of the classroom. It's gone out into the community and beyond.” 

Education technology leaders now need to think about the tech that is available in each student and teacher’s home and what kind of support the district can provide for effective and secure use of that technology. 

Limits On Use 

In her district, Paul said she provided student access to educational materials but not to everything on the internet. “My whole idea was to make sure that the students get what they need, but also make sure that whatever device they're using has the filtering, or has the ability to give them what they need on an instructional site,” she said. For instance, parents were not able to check their personal emails on a school device. “We had to do workshops for parents that explained a Chromebook is not a laptop, or an iPad, or cell phone,” Paul said. 

Dickson also employs filters on school-issued devices to help keep students and the school’s network secure. However, he will loosen certain restrictions with students and staff members who he knows are knowledgeable about how they are using a given device. “If I've trained a student or a staff member on something, I’ll allow them to go a little bit further than I typically would the standard user,” he said. 

Privacy Concerns 

Dickson discussed how there is more awareness of data privacy in Europe and more restrictions on the way data can be gathered and used. However, more U.S. states are beginning to focus on data and the need to protect data that can be used to identify students – even if it’s not explicitly sharing a student’s name. 

Paul said that leaving student security and safety up to technology directors alone is a mistake and that laws surrounding student privacy and safety need to be updated. Not only do directors have to try and protect student data but they have to help students steer a safe course while using devices that are increasingly controlled by algorithms that might prey on their insecurities by doing things such as reinforcing worries about weight or appearance. “Everybody was in a rush to give out these devices, not realizing that there is a side of it that we need to definitely step back and take a look at because the laws have not caught up,” she said. 

Guarding Against Cyber Attacks 

School IT infrastructures continue to increasingly be targets of attacks from hackers. 

“It's a matter of when not if it's going to happen,” Paul said of cyberattacks. “We, as directors, try to be preventative. We try to educate and inform everyone that's a part of the entire instructional and learning process.” 

In addition to providing advice on how to protect school information, IT directors also try to inform educators about protecting their own personal information. Dickson’s district has moved all staff to two-factor authentication. “That’s non-negotiable,” he said. 

Other Steps Districts Can Take to Protect Themselves 

Paul advised those who are new technology leaders to connect with others in the field. “Reach out to your colleagues in the next district, your next state,” she said. “Reach out and join some national organizations. COSN has been amazing.” 

Dickson is working with other tech directors in Kansas to share best practices and knowledge. “We're going to start creating peer groups where we review one another's processes and procedures,” he said. “There are some things that are very inexpensive that you can put in place to help.” 

In addition, Dickson said that his district is working with Microsoft to help protect student data by providing secure platforms and help the district respond if an incident were to occur. “If something were to happen, let's say a data breach or data leak, I can contact Microsoft and have one of the largest entities in technology in the world helping me to remediate that,” he said. 

• Recent Tech & Learning Webinars

Preventing cyberbullying is increasingly critical for education as students spend more and more time online. 

“We live in a world now where bullying doesn’t begin and end with school bells,” says Chad A. Rose, director of Mizzou Ed Bully Prevention Lab at the University of Missouri. “It encompasses a kid’s entire life.”

Rose shared the following suggestions for educators who want to help prevent cyberbullying at their schools. 

1. Preventing Cyberbullying: Recognize That It’s a School Problem Even if It happens Outside of School  

Bullying, of any kind, is defined as an imbalance of physical or emotional power, intent to cause physical or emotional harm, and behavior that is repeated or likely to be repeated, Rose says. Unlike traditional in-person bullying, cyberbullying does not necessarily occur on school grounds or even during school hours. As a result, it can be seen as an issue that is outside of school, even though cyberbullying has the potential to impact every aspect of a child’s life and education. 

“I think it’s always a school issue,” Rose says. If educators acknowledge this, they can do more to prevent it and support and protect their students in their digital interactions. 

2. Preventing Cyberbullying: Teach Digital Citizenship 

A key to protecting students from cyberbullying is to teach digital citizenship in elementary school, Rose says. These lessons should focus on the following:  

• Safety - Students should learn the basics of online safety, including not giving out personal information such as their name or address
• Choice - Students should be reminded that posting something online is a choice and that stopping and thinking before posting or sharing can often prevent an unfortunate incident
• Permanence - Students need to learn that things that you post online are permanent, Rose says, as even apps that claim to delete data often keep that data stored 

While school digital citizenship programs often do a good job with teaching online safety, Rose says more needs to be done to teach students about the other two key aspects, particularly that items posted online can be there forever. “I don’t think kids quite understand permanence,” he says.  

3. Preventing Cyberbullying: Working with Cyberbullies on SEL and Empathy  

When educators discover one of their students is a perpetrator of cyberbullying they are limited in how they can respond. “You can’t tell a kid that, ‘Hey, I’m confiscating your phone that your parents paid a thousand dollars for,’” Rose says. However, educators can and should work to form a connection with parents. “Before anything happens, we should have a nice form of communication between parents and schools,” he says. That way parents of both cyberbullies and their victims can be enlisted to help find solutions. 

Students who engage in cyberbullying should be given extra social and emotional learning lessons. One strategy is to build empathy by having the student and a facilitator talk through a story that is similar to the real-life situation that is occurring, and then delve into the student’s thoughts and feelings in relation to that story. If the student says they wouldn’t care if someone did that to them, an educator can teach them about empathy by explaining that other students might care. 

4. Preventing Cyberbullying: Don’t Suggest Students Stop Using Technology  

A common piece of advice for the victims of cyberbullying is to stop using the platform on which the bullying is taking place, however, that may not be the best approach. “We used to tell kids if someone is mistreating you, delete the app,” Rose says. “I’ve long said that we can’t just tell them to socially remove themselves.” For example, Rose says you wouldn’t tell a child to stop playing basketball if they were getting bullied on the court. 

Increasingly, online spaces fulfill a similar function in children’s lives, and simply withdrawing from social media isn’t a valid option. Instead, educators need to understand the causes of bullying and work with students to develop online strategies to mitigate the impact. "Digital citizenship should be embedded in the daily curriculum, especially in environments that include high usage of electronic devices," Rose says. "This includes teaching students about the safety, choice, and permanency of interacting online."

• Study: Popular Students Are Not Always Well-liked
• Former U.S. Poet Laureate Juan Felipe Herrera: Using Poetry to Support SEL