edtechstrats

Parents/students do not have a private right of action under applicable federal law (FERPA). The US Dept of Education could theoretically hold the school district to account, but that would be extraordinary (speaking of the current context, but also historically).

I track US public school cybersecurity incidents and this represents a change in tack for ransomware attackers vis-a-vis schools. Clark County (Las Vegas) is only 1 of 3 school districts since the start of the school year compromised with ransomware alongside the exfilitration of student/employee data. The others include Fairfax County (VA) and Haywood County (NC). Overall, I count 35 instances of ransomware (K-12 districts) for all of 2020; 15 of those publicly disclosed since August 1, 2020.

https://k12cybersecure.com/map

PS The latest incident, with commentary from the district superintendent: "Got to work this morning, powered up my computer and the first message I got was you’ve been encrypted. Basically, you know, the same old thing…you’ll have to pay us in bitcoin, we’re holding your data ransom, you need to contact this email address."

https://www.kalb.com/2020/10/02/cyber-incident-affects-avoye...

Today Show piece available here: https://www.today.com/video/inside-the-facial-recognition-te...

They left Wi-Fi enabled on their cell phones, which automatically connected to the school network when within range. IT staff then associated the log-ins with individual students - allowing them to be identified and caught. Original article (via Washington Post): "A black principal, four white teens and the ‘senior prank’ that became a hate crime"

URL: https://www.washingtonpost.com/graphics/2019/local/teen-graf...

Related: "Florida Plan for a Huge Database to Stop School Shootings Hits Delays, Legal Questions" https://www.edweek.org/ew/articles/2019/05/30/florida-plan-f...

Best example I am aware of is from Penn Manor SD in PA, but others exist.

[1] https://opensource.com/education/14/9/interview-charlie-reis...

[2] https://lancasteronline.com/opinion/editorials/penn-manor-s-...

[3] https://technology.pennmanor.net/open-source-in-school/

They boys are clearly tech-savvy to a degree (they build their own PCs, mined crypto, understood Windows user permissions, etc.), but I seriously doubt that they would or could have broken into the district's systems without two things: 1/ an admin password left on a sticky note and 2/ clear text storage of other user passwords in an excel file published in a shared folder on the first machine they accessed (a public machine in the middle school library!). Other issues: old user accounts left still active; no review of access logs or logs of server usage (which would have spotted Monero mining). Note: the boys reported that passwords on sticky notes was routine throughout the district (and how they got access to the security cameras, too).

Other students tipped off school administrators when a network filtering bypass devised by one of the two boys went viral across the district.

I first profiled the story of one of the two boys at https://k12cybersecure.com/blog/moths-to-a-flame/. AMA.

More context for this story here: https://www.pogowasright.org/back-to-school-revolt-in-spring...