Long Island Data Breach of 15,000 Students' Data Should Send Shudders in inBloom-Wary Parents

*Tech experts not confident with data cloud security  *School boards developing discipline score to feed to colleges *Data breach is third for the Sachem district *Where does deBlasio stand on inBloom?

Not making the headlines of major media was the breach of approximately 15,000 student records in 18 elementary, middle and high schools in the Sachem school district in Suffolk County, Long Island, New York a couple of weeks ago. In fact, briefly, confidential information was posted on an external website "Sachem Unspun", as reported on the News 12 television station. A Holbrook 17 year old was arrested on November 22 in connection with the hacking of student data. For parents and other activists, this incident should serve as a matter of concern as to whether families can school systems can rest assured that student records wold be secure. That this has happened, even before the ambitious aggregation and indexing of data under inBloom, is a matter of concern for the security of future databases.

InBloom -New York is the "non-profit"'s last committed client after the pledged states originally peaked at nine states (see this article for the list of the original states). As a Statewide Longitudinal Data System (a student database) it is dictated by Obama and Arne Duncan's Race to the Top. InBloom has 400 data points, lots of private student information that could be potentially misused in leaks or hacking.

New York Board of Regents Chancellor Merryl Tisch summarily dismissed Regent Roger Tille's concerns that she was too close to Joel Klein, that it led to favoritism in the New York State Education Department's contract with Rupert Murdoch's Wireless Generation (today WG's unit tending to inBloom is renamed Amplify, as Andrea Gabor reported in "Will Rupert Murdoch's Media Empire End Up Owning Your Child's Student Data?"), the company handling inBloom; education commissioner John King dismissed no-bid contract concerns about the deal, saying that New York was under time pressure from Race to the Top deadlines. InBloom represents a big project objective of the shadowy, unaccountable Regents Fellows that set NYS education policies behind the scenes. The King-Tisch duo, deaf to parent security concerns, are being consistent with their tone of contemptuous disregard for parent, educator and student opinion on Common Core. See the videos at the right on parent and student reactions to the Common Core and their test regimen. Their tests data will be a central data point in the inBloom database.

Yet, the recent Sachem district breach was actually the third such breach of the district's student records. In fact, inBloom's own site carries a disclaimer against liability for student data safety: "[inBloom] cannot guarantee the security of the information stored…or that the information will not be intercepted when it is being transmitted.” In fact, information technology security professionals are not confident with the security of cloud storage of sensitive data, as Leonie Haimson reported in an op-ed contribution to the Daily News. Amazon is the commercial entity from which inBloom is renting the cloud storage for the data.

Is it that urgent that inBloom be imposed on the people of New York State? Consider the variety of ways that the data could be misused. From bullying to extortion, it is risky to have so much data that could be stored in clouds, information that could be exploited. We have already seen how seen how many fragile many teens are, in the face of cyber-harassment, a number of students have taken their own lives. Are taxpayers comfortable with prospect of footing legal bills when parents (understandably) sue the state or districts following breaches of student data security? And never forget how Murdoch's News of the World was engaged in scandalous hacking of people's private information, as revealed in press reports last year? See this video in which New York State superintendents themselves say that many of the 400 data points have little relation to assisting students with learning.

November 21, 2013 from SC magazine:

Data breach of Long Island school district affects thousands of students

Roughly 15,000 students enrolled in 18 Long Island elementary, middle and high schools – comprising the Sachem School District – may have had personal data compromised by an unidentified individual who posted the information on an online forum.

How many victims? Roughly 15,000.
What type of personal information? Posted on the forum was a list of 15,000 names with student ID numbers and school lunch designations, student records on 360 students who graduated Sachem High School East in 2008, and a report relating to approximately 130 students who attended Sachem High School North who were receiving instructional services in an alternate setting in the 2010-2011 year, the district confirmed.
On a separate forum, a concerned user posted about having seen medical records, doctor's letters, report cards, district registration documents that include names, addresses, dates of birth and parent information, and disciplinary records.
What happened? On separate occasions, student documents were posted on an online forum by someone who claimed the Sachem School District database had been hacked.
What was the response? Sachem School District audited its firewalls and intrusion detection systems. The website that hosted the forum has been contacted and has removed any posts containing school data. The school district is mailing letters to affected families. An investigation is ongoing with local and federal law enforcement.
Details: Sachem School District first became aware in July that school documents were being posted online. An official investigation into the schools' firewalls and intrusion detection systems revealed that a breach did not originate from the outside. Additional information was posted online in August and again a breach was not deemed to have originated from the outside. Student information was posted most recently on Nov. 8.
Quote: “The district has devoted every available resource to cooperate with and to assist law enforcement,” according to a post on the Sachem School District website. “Access to student records is an important daily internal function of any school district. This is a necessity, but can unfortunately render our data vulnerable to a determined criminal actor willing to misuse access to our systems.”

Source: sachem.edu, “Regarding the theft of student data,” Nov. 19, 2013

The bipartisan "Moms Against Duncan" Facebook group ("a NONPARTISAN, NONPOLITICAL, PRO-PUBLIC EDUCATION, ANTI-COMMON CORE place for parents to connect, find local groups and actively fight for their children" --caps in original) had this statement in recent weeks. It gets to concerns about the ultimate governmental and commercial uses of student personal data:

As the co-founder of MAD (Moms Against Duncan) we are linking groups of parents all over this country together. Our ultimate goal is a 10% standardized test opt out rate in every school K-8. We will corrupt the data so it is useless. No school scores, no teacher scores, no student scores. No databases, no prison planning data, no economic development data. Pearson, Gates and Duncan can kiss our multicolored backsides. Our children are NOT data. We want all this wasted money back in the hands of our teachers.

Patrick Sullivan, noted for his civic integrity on New York City's Panel for Educational Policy, drew attention this week to how the New York State School Boards Association is planning to develop an "inBloom score" on student to inform colleges on how students behaved in school. The school board's plan is troubling, because many students grow up to be responsible and academically proficient in college, despite having discipline issues in their school careers as minors. It is for this issue that student discipline records until recently have been sealed, off-limits after graduation.

deBlasio, Which Side Are You On?
[Postscript: NYC Public School Parents has a piece on the opposition in Chicago against the inBloom system. Leonie Haimson wrote on how Herricks Superintendent John Bierwith reported that all the Nassau superintendents are solidly against inBloom, “I don’t think there’s a person in Nassau County who thinks InBloom is a good idea." . So, how do things stand for next year in New York City? "Which Side Are You On?" Will de Blasio's chancellor support or oppose inBloom? Also, will deBlasio disband the private arm working inside of New York City education that Haimson referred to, Fund for Public Schools, that just in last year received $1.8 million from the Gates Foundation? We do not need the continuation of private, unaccountable operations setting government policy.

USDE Deprives Your Child's Privacy; inBloom, Education Technology and the Murdoch-Klein Connection: A Son-of-Frankenstein B-movie Sequel?

Business and education blogger Andrea Gabor addresses Amplify [nee Wireless] story parts that the New York Times omitted from its story.

Aside from the filling in gaps there are reminders about the personal legacy of Sharren Bates going back to the creation of NYCDOE's ARIS system.

But first, let's note an important post today at Stop Common Core on Arne Duncan, the Common Core State Standards and Data mining:

SIXTHINGS THE US DEPT OF EDUCATION DID TO DEPRIVE YOUR CHILD OF PRIVACY

Key excerpts:

The story of Common Core and data mining begins as most stories do, with a huge, unmet need.

Self-appointed “stakeholder” know-it-alls at the federal level (also at state, corporate, and even university levels) determined that they had the right, and the need, for open access to personal student data– more so than they already had.

They needed state school systems to voluntarily agree to common data corestandards AND to common learning standards tomake data comparisons easy.

So, without waiting around for a proper vote, they did it. The CEDS (Common Education Data Standards) were created by the same people who created and copyrighted Common Core: the Council of Chief State School Officers (CCSSO). No surprise.

. . . .

SIX SNEAKY THINGS THE U.S. DEPARTMENT OF EDUCATION DID TO DEPRIVE YOUR CHILD OF PRIVACY:

1. Sneaky Thing Number One: It bribed the states with ARRA Stimulus monies to build 50 linkable, twinlike State Longitudinal Database Systems (SLDS). This act created a virtual national database.

These SLDS’s had to be interoperable within states and outside states with a State Interoperability Framework. Utah, for example, accepted $9.6 million to create Utah’s SLDS. Think about it. All states have an SLDS, and they are built to be interoperable. How is this not a de facto national database?

2. Sneaky Thing Number Two: It altered the (previously privacy-protective) federal FERPA (Family Educational Rights Privacy Act) law to make access to personally identifiable student data –including biological and behavioral data– “legal”.

So now, the act of requiring parental consent (to share personally identifiable information) has been reduced from a requirement to just a “best practice” according to the altered federal FERPA regulations.

. . . .

3. Sneaky Thing Number Three: The US Department of Education partnered with private groups, including the CCSSO (that’s the Council of Chief State School Officers –copyright holders on Common Core–) to collect student data nationally.

The CCSSO, or “Superintendents’ Club” as I like to call it, is a private group with no accountability to voters. This makes it in-valid and un-American, as far as governance goes. The CCSSO has a stated mission: to disaggregate student data. Disaggregate means to take away anonymity.

. . . .

4. Sneaky Thing Number Four: It used private-public partnerships to promote data linking among agencies. The Data Quality Campaign is one example. The National Data Collection Model is another example. The Common Educational Data Standards is another example.

. . . .

5. Sneaky Thing Number Five: The Department of Ed created grants for Common Core testing and then mandated that those testing groups synchronize their tests, report fully and often to the U.S. Department of Education, share student-level data, and produce “all student-level data in a manner consistent with an industry-recognized open-licensed interoperability standard that is approved by the Department”.

So federally funded Common Core tests require Common data interoperability standards.

Check out that Cooperative Agreement document here.

. . . .

6. Sneaky Thing Number Six: The Department of Education directly lied to the American Society of News Editors. In a June 2013 speech given to the American Society of News Editors, Secretary Duncan mocked the concerns of parents and educators who are fighting Common Core and its related student data mining:

“A new set of standards — rigorous, high-quality learning standards, developed and led by a group of governors and state education chiefs — are under attack as a federal takeover of the schools. And your role in sorting out truth from nonsense is really important… They make.. outlandish claims. They say that the Common Core calls for federal collection of student data. For the record, we are not allowed to, and we won’t. And let’s not even get into the really wacky stuff: mind control, robots, and biometric brain mapping. This work is interesting, but frankly, not that interesting.”

Despite what the state school board and the federal Department of Education claim, corporations do know that Common Core and student data mining are interdependent.

CEO of Escholar Shawn Bay spoke at a recent White House event called “Datapalooza.” He said (see his speech on this video, at about minute 9:15) that Common Core “is the glue that actually ties everything together” for student data collection.

And President Obama himself has called his educational and data related reforms so huge that they are “cradle to career” -affecting reforms. Secretary Duncan now refers to the reforms not as “K-12″ but as “p-12″ meaning preschool/prenatal. These reforms affect the most vulnerable, but not in a positive way, and certainly not with voters’ knowledge and consent.

. . . .

Go to the original Stop Common Core article for the analysis of the Six Things, further drawn out.

Key excerpts from the Gabor blogpost on inBloom:

"inBloom, Education Technology and the Murdoch-Klein Connection: A Son-of-Frankenstein B-movie Sequel?"  Posted on October 8, 2013

by aagabor

Last Sunday’s New York Times ran a fascinating story on the controversy surrounding inBloom, which promises to serve as a one-stop warehouse-in-the-cloud for student data, but which many educators and parents worry might compromise the privacy of kids in grades K-12. Like a number of major education-reform ventures, this one was launched by a group of funders led by the Bill and Melinda Gates Foundation.

Now that most states have signed onto the Common Core State Standards, which will use computerized assessments, the allure of creating a central repository of student data is more compelling than ever.  The NYT lays out the potential benefits of the inBloom system, including the ability to store large amounts of student information and provide tools for analyzing the data–information that will be available not only to educators, but also to education-technology developers who can tailor products to student and school needs. The article also explores the privacy concerns raised by the easy access that large numbers of companies will have to a vast array of information, ranging from academic achievement to disciplinary problems, for potentially tens of millions of students.

The story touches, though only obliquely, on important questions about the balance-of-power between commercial vendors and public schools and school districts, which inBloom is supposed to facilitate.

But one of the most intriguing aspects of the story is one that the NYT does not address at all. No where does the NYT mention that the operating system for inBloom is being developed by the Amplify division (formerly Wireless Generation) of Rupert Murdoch’sNews Corp. This is a striking omission given that that the NYT is the paper of record in New York City where the CEO of Amplify/Wireless Generation, Joel Klein, recently served as schools chancellor. And this despite the fact that New York is one of only three states out of an original nine that, according to the article, “continues to pursue the service.”

In a brief phone conversation, Natasha Singer, the author of the article, explained that the aim of her story was to focus on “one small district in Colorado” and how technology and privacy concerns associated with inBloom play out in an area with much fewer resources than New York City. She also noted that, as is often the case, much was cut from her original story during the editing process.

inBloom itself seems eager to downplay News Corp./Wireless Generation’s involvement, in the venture, even though it was a key partner in the Shared Learning Collaborative, which gave rise to inBloom. (inBloom was launched earlier this year with $100 million in funding.)  Although a March press release announced that Wireless Generation would be one of 24 software providers, the  “partner” and “provider” tabs on the company’s website lists 21 providers, but NOT Wireless Generation or Amplify.

For New Yorkers, inBloom may seem like something of a son-of-Frankenstein B-movie sequel (non-New Yorkers will want to know why…) inBloom traces its roots to a technological lemon. Several years ago, IBM and Wireless Generation developed ARIS(Achievement Reporting and Innovation System), a portal for the New York City Department of Education, which was widely seen as a failure.

Then Cisco began building a rival prototype portal that the company offered to the NYCDOE and that many teachers and principals said was much more useful than ARIS; but the city killed the project in August of 2010.  At the time, officials at the NYCDOE said that when work on the Cisco portal fell behind schedule, the education department pieced together an in-house version and took over the professional training that Cisco had been providing for schools that were part of the much ballyhooed innovation-zone (or izone) initiative. More recently, NYCDOE insiders have said that the department pulled the plug because of investments it had already made in ARIS, which came to total about $100 million.

The Murdoch connection, then and now

 In 2011, The Daily News disclosed that Wireless Generation was poised to win a no-bid $27 million contract to build an ARIS-like portal for New York State as part of the requirements for the state’s Race-to-the-Top bid. Joel Klein had just left his post as schools chancellor to become CEO of Wireless Generation. (The company noted that it had been in talks with the state long before Klein officially departed the NYCDOE for News Corp. in November of 2010.)

Following the hacking scandal at News of the World, a News Corp.-owned British tabloid, New York State declined to approve the Wireless Generation contract.

But by then, the Gates Foundation had already announced plans to help fund and develop the data-collection platform that would become inBloom and that would have a Wireless Generation-developed operating system. At the time, Sharren Bates, the official who had “launch(ed)” and “led” NYCDOE’s ARIS, was working as a Senior Program Officer at the Gates Foundation. Earlier this year Bates became the chief product officer for inBloom.

Much of the NYT’s story focuses on the privacy concerns of both Coloradans and New Yorkers (including the indefatigable Leonie Haimson of Class Size Matters, one of the leading crusaders for children’s privacy rights) about inBloom’s plans to store student information in the “cloud” (on Amazon’s cloud servers, it turns out, though this is not mentioned in the NYT) and to allow private companies access to that data.

These concerns include the fact that new laws no longer require states to obtain a parent’s permission before sharing information in a child’s records:

“Recent changes in the regulation of a federal education privacy law have also helped the industry. That law, the Family Educational Rights and Privacy Act, required schools to obtain parental permission before sharing information in their children’s educational records. The updated rules permit schools to share student data, without notifying parents, with companies to which they have outsourced core functions like scheduling or data management.”

  .  .  .  .

And while information gleaned from individual students is supposed to provide the vital information need to develop and hone products, schools will pay dearly not only for the products that are made possible by inBloom, but for using the portal itself. As Leonie Haimson notes, starting in 2015, inBloom says it will charge states and districts between $2 and $5 per student each year for storing data on the site.

Nor do technology companies need inBloom in order to innovate and “customize” software. As part of New York City’s technological push during the Klein years, the city purchased masses of software for online learning. As the largest urban education market, that presented a unique opportunity to examine, and customize products to, the needs of city kids. Yet, one of the major complaints about the NYCDOE portal and the education software available to New York City public schools was that most software developers did nothing—and the NYCDOE did not use its clout to force them—to tailor programs, which were originally designed for the home-school market, for the needs of inner-city kids.

Common sense suggests that states and school districts should be championing both the educational and privacy interests of their students—especially if they want to benefit from the technology synergies of products like inBloom. But that doesn’t seem to be happening—at least not without considerable public pressure—in part because of the close ties between government officials and industry.

Consider the strange case of Louisiana, where Joel Klein’s former NYCDOE deputy, John White, is the superintendent of schools. This article describes a remarkable string of email exchanges among White, Amplify/Wireless Generation, the Gates Foundation and New Schools for New Orleans, a leading charter-school gatekeeper. It shows how the close ties among state officials and the private sector led Louisiana to become one of the first to give inBloom access to all of its student’s data. Four months later, following widespread protests, Louisiana removed the kids’ information from the inBloom database.

Meanwhile, during the last legislative session, the New York State legislature failed to pass bills that would have protected student privacy.

Indeed, New York has a history of making hasty education decisions. It was one of the first states to push through a new “common core”-focused standardized test last spring. Theassessments were rushed through before teachers had any meaningful training in the new standards and before students had much exposure to them. The result was much anguish on the part of students, families and teachers; a huge drop in test scores without much apparent benefit; as well as an open rebellion by principals.

 .  .  .  .

Click the link for the complete "inBloom, Education Technology and the Murdoch-Klein Connection: A Son-of-Frankenstein B-movie Sequel?" article.

Persons, companies profiting from Common Core implementation

From Atlanta Journal-Constitution: Maureen Downey, "Common Core as a brand name. Who is making money off the new standards?"

Millions are being made on Common Core, but it’s not likely parents can figure who’s making that money, or how much a particular school system is spending specifically because of the new standards, since instructional material has always cost plenty and a lot of the “new” stuff isn’t necessarily new.

There is a long list of companies selling what school districts in Georgia and the rest of the country are buying. Education officials in Georgia say most of the money spent on Common Core would have been spent anyway. Teachers participated in professional development before Common Core, and districts have always spent money on books and other learning materials.

. . .

A book can be considered “aligned to Common Core” if it is among those recommended by the group of business leaders, educators and higher education officials who wrote the new standards.

Being a Common Core book could mean stronger sales. Lynda Bradley, co-owner of BMI Educational Services, Inc. — a sort of book middleman that allows districts to order large quantities of different books from a single source — noted that sales of one book, “A Boy, A Dog and a Frog” by Mercer Mayer, took off after it was recommended as a Common Core book.

“The publishers look at the list and say, ‘Oh, good, we can charge more,’ ” Bradley said. “A lot of them have done that, and that puts us in a bind. The inventory vanishes, and the price goes up.”

Ravitch, Mar. 17, 2013
Rupert Murdoch Wins Contract to Develop Common Core Tests

Amplify, the company owned by Rupert Murdoch, won a $12.5 million contract to develop formative assessments for Common Core tests. The award was made by the Smarter Balanced Assessment Consortium, one of two groups funded by the Obama administration to create national tests, administered online. Joel Klein runs Murdoch’s Amplify division.

When Murdoch purchased Wireless Generation in the fall of 2010, he said:

“When it comes to K through 12 education, we see a $500 billion sector in the U.S. alone that is waiting desperately to be transformed by big breakthroughs that extend the reach of great teaching,” said News Corporation Chairman and CEO, Rupert Murdoch. “Wireless Generation is at the forefront of individualized, technology-based learning that is poised to revolutionize public education for a new generation of students.”

And see this more recent post at Ravitch's blog, Klein’s Amplify Tablets Crack the $17 Billion Market.

The biased interests in Moskowitz - Klein connection

Read Juan Gonzalez' piece in the Daily News, February 26, 2010
"Moskowitz asks Klein to expand charters; Dept. of Education closes schools to make room"
about charter school entrepreneur Eva Moskowitz's cozy relationship with New York City Schools Chancellor Joel Klein:

On Oct. 3, 2008, Eva Moskowitz, a former city councilwoman and head of four charter schools in Harlem, e-mailed schools Chancellor Joel Klein for help.

Moskowitz wanted more space to expand her Harlem Success academies and she had two specific public school buildings in mind.

"Those schools are ps194 and ps241," she wrote to Klein. "It would be extremely helpful to move quickly on."

Less than two months later, the Department of Education announced plans to phase out those schools and use the space to expand two Harlem Success academies.

The note was among 125 e-mails between Moskowitz and the chancellor the Daily News obtained under a Freedom of Information request.

Read more: http://www.nydailynews.com/ny_local/education/2010/02/26/2010-02-26_all_eva_had_to_do_was_ask_after_email_doe_planned_to_expand_charters.html#ixzz0gqfcmnom

READ MORE: CLICK ON THE ABOVE LINK - THIS IS WHAT THE EMAILS ARE ABOUT.

Eva Moskowitz / Joel Klein all hours email gabfest

. . . emails to Klein and to other familiar personalities in DoE, Inc. --e.g., John White.

Her scores of emails have been acquired by the New York Daily News under a Freedom of Information Law request.

They demonstrate a hand-in-hand relationship between a private education entrepreneur (Harlem Success Academy boss Eva Moskowitz) and a public official (NYC Schools Chancellor Joel Klein).

Click to this Norm Scott blogpost for the link to the email exchange archive.

Moskowitz apparently had a special inside relationship with Klein. She was able to streamline her objectives, with his help at circumventing Tweed underlings that were not the most cooperative.