Transcription of the episode “Student record privacy: Danger looms from police and hackers”

Amy H-L: [00:00:15] I’m Amy Halpern-Laff.

Jon M: [00:00:16] And I’m Jon Moscow. Welcome to Ethical Schools. Our guest today is Mark Lieberman, a reporter for Education Week covering technology and online learning. Recently, Mark wrote about a controversial arrangement between the school district and the sheriff’s department in Pasco County on Florida’s West Central coast. Welcome, Mark! 

Mark L: [00:00:36] Thanks so much for having me. Happy to be here. 

Jon M: [00:00:38] The Tampa Bay Times has been running stories about the Pasco County School District’s handing student records to the sheriff’s department, which uses them to “identify at risk youth who are destined to a life of crime.” What do you know at this point about what happened?

Mark L: [00:00:56] Well, yeah. So in mid-November, the Tampa Bay Times published an investigative piece following up on work that they’ve been doing more generally about the police department there and its use of predictive policing, is what it’s called, so using data and information about people in the community to make preemptive judgments about their potential for committing crimes in the future. And in some cases, even prematurely visiting these people’s homes and targeting them before there’s any evidence that they committed a crime. And so  this Tampa Bay Times article pertaining to schools specifically depicts an arrangement whereby the police department draws on data from the school district in terms of student grades, student discipline records, student absenteeism records, as well as data from the state Department of Children and Families, so that’s data on family issues that are recorded by the government. All of that combined filters into, essentially, a series of benchmarks that the police department uses to determine whether to place a particular student on a list. And that list is described in a document that the Times obtained as “a list of students who are at risk for committing future crimes.” Now it’s worth noting that until the Tampa Bay Times article was published, the existence of this list was not public knowledge. In other words, not only did the families whose students are on this list not know that their students were on the list, they didn’t even know that there was a list that their students could be on. In response to the Times investigation, both the school district and the Florida Department of Children and Families have said that they were also not aware that this list was being created. And the school district superintendent, Kurt Browning, has said that he is largely not concerned about the existence of a list because the district has already entered into an agreement with the police department that requires the police department to comply with federal law in its use of any student data that the school district deems worthy of sharing with the police departments.

Jon M: [00:03:13] About how many students are on the list as far as people know? 

Mark L: [00:03:15] The list is comprised of middle shchool and high school students in the district. There about 30,000 students in the district in total who fit into those two categories. And there are about 420 students roughly on the list. As far as I know, the police department has still not disclosed to families, whether their students are on the list. I spoke to a parent yesterday of a student in the district who said that she’s been talking with fellow parents in the district, and they’ve so far been unsuccessful in trying to find out whether their students are on the list. But yeah, so it’s about a little over 400 students.

It’s also not totally clear how long the list has existed, whether the list may have had more or fewer students at previous points. And it is clear also that according to the Tampa Bay Times, that.the police department seems to have subsequently upon, I guess finding out the Times was looking into this, seems to have made some modifications to their approach in terms of, I think kind of developing a little bit more guidelines in terms of what, how the determinations can be made of who’s on the list. But again, that’s, you know, there’s a lot of questions about that that remain, but yeah.

Jon M: [00:04:21] You mentioned very briefly some of the criteria, but could you describe them a little more as far as people know, what are the criteria or the algorithm or whatever they use to determine who should be on this list?

Mark L: [00:04:33] Absolutely. Yeah, there are quite a few, I mean, some of the most striking ones that have been highlighted in the news coverage of this, including my own report:  if a student has one D or F grade in a class, they can be placed on the list. If they’ve been absent more than three times in a quarter, they can be placed on the list. If they have been sent to the office with a disciplinary referral once in a quarter or three times in a year, they can be placed on the list. And there are numerous other factors as well in terms of, you know, if they’ve ever been arrested, if they have a history of running away, if they have ever been convicted of a crime, if they’ve ever been involved in a custody dispute between two parents. There are 16 different metrics that the Tampa Bay Times uncovered in terms of ways that students can end up on the list. And my understanding is that a student need only meet one of those metrics in order to be placed on the list.

Amy H-L: [00:05:31] And what are the possible consequences for students of being on the list?

Mark L: [00:05:36] Well, there, there are numerous, I mean, obviously the first and probably the most pressing in a sort of short term context is the very legitimate concern that there may be students on this list, in fact, there were almost certainly students on this list who have not done anything wrong. And there’s a concern that by putting them on a list that sort of attaches them to the potential for criminality that they may be disproportionately or unfairly harassed or targeted or scrutinized by law enforcement officials, both who work within the school, as well as who work in the community. You know, there are also kind of longer-term concerns about the possibility that students who are on this list may struggle afterwards to obtain job opportunities or admission to college if their placement on this list becomes known to those institutions. And there’s also a concern, that one privacy advocate raised to me, that the existence of a list like this and the secretive nature of it is one factor that sort of leads to general kind of mistrust between the student community and the adults working within the school system. And that in theory could lead to a situation in which a crime does take place on school grounds or involving school constituents. And there may be a reluctance on the part of students to, you know, if they suspect that they may have been placed on a list for something that not necessarily a fault of theirs, reluctance to share information about what took place and sort of a breakdown in trust between the adults and the students that could have consequences that sort of ripple out.

Jon M: [00:07:14] Because nobody in the public has had access to the list of names, we don’t know, for example, the ethnic and racial breakdown of the students on the list. But I think you mentioned, when we were talking earlier, that this came out in the context of the Tampa Bay Times doing a series of articles on the police, in part following up on the movements for racial justice over the summer after George Floyd’s murder. Uh, so it seems to me at any rate that it would be pretty reasonable to assume that there could well be racial disparities on this list and that Black and Latino students might be particularly targeted to be on this list. Do you have any sense of that at all? 

Mark L: [00:08:00] Nothing more than speculation. I mean, it certainly is reasonable to assume based on, I think, the patterns that have been uncovered by the Tampa Bay Times with this police department in particular, as well as the broader trends that the racial justice movements this summer kind of highlighted in terms of long-standing disparities in the treatment of people of different races by the police and by law enforcement officials in institutions. I think certainly a major concern in the absence of more specific information about even the racial demographics of the students who are on the list, I think there is considerable reason to wonder about that. And I think that advocates who have weighed in on this have raised that as one of many concerns they have about how this has been administered and sort of what potential negative consequences it can have.

Amy H-L: [00:08:47] Now that the list has been exposed, or the existence of the list, what’s happened in response?

Mark L: [00:08:55] Absolutely. Well, I mean, I think the first thing to note is there are several different potential areas of concern related to the existence of the list. I mean, one is the obvious what we kind of already touched on in terms of the possibility for racial bias, for disproportionate harassment and targeting by police of students who have not yet committed a crime. You know, there’s evidence to suggest that over policed communities in fact also tend to be communities that have more crime and there’s sort of a correlation there.

There’s also a legitimate concern that a lot of advocates have raised about the possibility that the use of student data in the creation of this list was itself a violation of federal privacy law. So the United States does not have a blanket data, privacy law, unlike many other countries, but it does have a law, the Federal Educational  Records and Privacy Act, FERPA, that puts some guard rails on the use of student data and educational records and provides parents and families with some agency in knowing how their student’s data is being used and being able to weigh in on that or even withhold it if they so choose. The experts I’ve talked to have said that at least, based on the appearance of this program, It’s clear that the use of student data on the part of the police department here is going beyond what could be described as an educational use. There are some permissions in the law for law enforcement to enter into agreements with school districts, to use student data, but only in very targeted, very specific cases – if there is an imminent threat to the community, a threat of violence, a threat to public health, if a judge weighs in on, you know, requests data on a particular student after a particular crime has been committed, but the sort of blanket use of students’ private information here, especially without the parent’s consent or even knowledge, you know, has raised very serious concerns about violation of federal privacy law.

And just this past week, the US House Education Committee chair, Bobby Scott, representative from Virginia, wrote a three-page letter to the United States Department of Education calling for an investigation into the existence of the list and implications in terms of student privacy. I’ve talked to some experts who have said that investigations like this often tend to take a very long time, often tend to be fairly untransparent in terms of the public’s ability to understand what’s proceeding and what’s being done and usually result in the Department encouraging the district to comply with its recommendations and warning that if it doesn’t, there will be more severe consequences, the most severe, which would be for the Department to revoke some or all of the districts’ federal funding. I don’t believe that this has ever happened with a privacy case so it seems fairly unlikely would happen here, but that is something that has been raised as a concern or something that warrants further investigation. 

There’s also been a significant and fairly predictable, I suppose, outcry from the community. The parent teacher association has weighed in, subsequent meeting between the school community and the school administrators. I’ve talked to a couple of parents who have said that they’re, like I said, trying to find out if their students are on it on the list. You know, I talked to one parent who said that she has a friend whose son has really been struggling during remote learning during the pandemic and normally is a high academic achiever, but was really falling behind on his classes because of internet access issues and just kind of general fatigue with screen time and all of that. And that person is worried. My student gets a bad grade because of these unusual circumstances, on top of the challenge that that already presents for the family and the stress and the frustration that the existence of the list adds.

Another layer to that, in terms of the possibility that their student may be placed on a list of potential criminals despite no evidence that they have any aspiration to do so. So in terms of the school district’s and the police department’s response, the police department largely has tried to sort of characterize the program, the existence of the list, as an effort to target support and intervention efforts within the school district. So they pointed to a handful of anecdotal examples of kind of fishing trips or other kind of social efforts that were made to reach students who were deemed at risk, but that they largely have not substantively answered for the 82-page document the Tampa Bay Times published, which indicates very clearly that the existence of the list is designed to alert the police to the possibility of future crimes taking place. The school district, like I said, at the beginning, the superintendent of the school distric said that he was not aware that this list was being created. So far, he has said that he is not especially concerned about it, I think I mentioned, because the district does have an agreement with the police department that I reviewed that allows for data to be shared and requires that the police department comply with federal law. Thus far, there hasn’t been much substantive comment from anyone in the administration, that I’ve seen at least, reacting to the possibility that the law may have been broken and that students may have been improperly targeted.

So this is very much remains an ongoing situation. I would be surprised if the parent or community outcry just goes away. And obviously there are federal lawmakers who are paying attention to it at least to one extent or the other, so it’s certainly possible there will be more developments, but that’s kind of the gist of what’s taken place so far.

Jon M: [00:14:35] I mean, it seems pretty incredible that they would claim that they’re abiding by federal law by denying parents access to information about whether their child is on a list, especially if the purported purpose of the list is to provide fishing trips and other kinds of support. But I just wanted to go back and make clear that the language that we were talking about earlier is language, as I understand it, from the police department, where they say to “identify at-risk youth who are destined to a life of crime.” That seems like particularly striking language.

Mark L: [00:15:15] Absolutely. And I mean, I think it’s telling that the privacy advocates who’ve been asked to weigh in on this, both in my reporting ended the Tampa Bay Times reporting, which kicked this all off. They’ve been pretty clear that what they’ve seen in this case is remarkable and kind of beyond what they are used to seeing in terms of concerns about federal privacy law being violated or skirted or misunderstood. One privacy expert, you know, I asked her, is it possible that this is a widespread practice that we just don’t know about and that families all around the country should be concerned? And from her expert perspective, she told me she doesn’t think this is something that is taking place everywhere. But at the same time, I do think it is an important reminder that there is a lot we don’t know about how data is being used, where it’s being shared and for what purpose, and there are very high stakes to that. And I think this, this story, extreme as it may be in terms of other cases that have cropped up in the past, does really highlight the urgency and the potential risks to students of data being shared or used potentially improperly.

Amy H-L: [00:16:20] What are some of the ethical questions that this list raises for teachers?

Mark L: [00:16:25] There’s a tough question about, obviously some of the metrics in the document that determine whether students end up on this list are things that teachers have control over — students’ grades, students’ disciplinary records. We also know there’s abundant research, typically in the case of discipline, that suggests that there is widespread racial bias in terms of how discipline is administered within schools by teachers and school staff, that this disproportionally targets Black students, other students of color, and beyond that, uh, existence of a list like this. When you, when you understand that giving your student a D, just meant to be a marker of academic progress or lack thereof, you know, could lead to them being put on a list that identifies them as a future criminal. I think there is a real concern that the existence of the list puts teachers in a difficult bind. There is no easy, easy answer. I mean, obviously you wouldn’t want a teacher to be massaging the grades to lower their own standards in terms of academic performance or whatever, but at the same time, you don’t want to think that a teacher’s work in the classroom ought to be influenced by the possibility of those grades being used for a purpose well beyond their actual meaning. I mean, it’s an angle that I actually, I really have not explored in great detail yet. And I think it is kind of important. And again, you know, we don’t know whether this list will continue to exist or in what form or to what extent. But in the meantime, it certainly is a legitimate question to ask: “How does this affect the way that teachers and school workers think about their treatment of students?” You know, I would just wrap up by saying, I think while the existence of a list like this may not be the ideal prompt for it, I do think it is a reminder of the importance and the consequences that teachers’ and school workers’ interactions with and decisions about students can have that reverberate well beyond whatever their intentions may be. And I think it would probably is important to keep that at the forefront. You know, these are public servants whose job is incredibly consequential in terms of shaping the country. And so I think it’s certainly worth raising that and probably exploring it even further than I have in my reporting.

Jon M: [00:18:38] So I understand that this list may come, in part, as a response to the Parkland shooting. The Secret Service has said that the best protection against school shootings is the development of an atmosphere of trust among students and staff in a school. You referred to this briefly before, but can you talk a little bit about what impact do you think this list has on the development of trust within a school?

Mark L: [00:19:03] Well, absolutely. I’m glad you raised that because not just in this instance, but in many cases, the horrific and high profile school shootings of the last decade, whether it’s Parkland in Florida or Newtown in Connecticut, have really prompted significant and concerted efforts on the part of school districts to figure out ways to prevent further incidents like this. And one of the ways they’ve turned to doing that is with the use of technology. And we can maybe talk about that later. Things like facial recognition that have been very controversial and similar to what you just talked about are not necessarily deemed the most effective ways to prevent future violence in the school. But similarly, yes, I mean, this is a case where the police department has cited the Parkland shooting as evidence of the importance of a program like this. And I think there is a real legitimate concern among people who work in schools, particularly in an area not far from where one of these really high profile incidents happened that, you know, when something like that does happen, there’s a very understandable human instinct to find ways to prevent that and to turn to quick solutions to those problems. But as you mentioned, the consequences of some of those quick solutions can be different than what they’re intended to do. And I think in this case, you know, the expert I talked to, like I said, was kind of giving me an example of if there is some sort of crime that takes place in a school, it is important for that baseline, that foundation of trust, to exist between the adults and the students, so that the students feel comfortable sharing what happened fully transparently and the police or law enforcement can do their work subsequently.

So, you know, when you do have a situation, particularly with the kind of preemptive nature of this list here, where students can be on the list simply for, you know, if they have a really severe strain of the flu for three days  in a semester or something, or they had a bad day and snapped at the teacher and got a little referral one time, it doesn’t bode well in terms of the students’ comfort level with adults in the building if they are aware that even a minor human transgression like that could be construed as the first step in a trajectory that leads to criminality.

Jon M: [00:21:30] Yeah. I can imagine that, I mean, you’re talking about if a crime has been committed, but I can imagine that if students know that any number of things can get someone on a list, and they know that a friend of theirs has, you know, is perhaps engaging behavior that seems strange, they’re going to be perhaps even more conflicted than they might otherwise have been to tell an adult that there’s some strange behavior going on. Whereas on the one hand they might think, “OK, this could escalate and become something really serious,” on the other hand, they could be saying, “oh, I’m going to be turning my friend into the cops.”

But I wanted to follow up on what you just were saying about facial recognition. You’ve written about the fact that the New York State Education Department gave a grant to the Lockport school district for facial recognition. What’s happened with that situation?

Mark L: [00:22:27] Absolutely. So, you know, like I said, that was an instance where, following the fatal shooting of students in Newtown, Connecticut in 2012, Lockport district in New York began considering security measures it could take to prevent something like that happening there. One of the measures they actually went for was taking some grant money from the State for a contract with a security company that provides facial recognition tools, the idea being the facial recognition software has a database of criminals. Crucially, the company claimed at least, the actual students in the building would not be in this database. It would  only be outside people in the community. And that therefore, if there were an intruder in the building, there would be a way to identify them quickly as such and prevent a calamity. But this effort has drawn some scrutiny because it was one of the kind of highest profile and most visible examples of a school district going after software like this, sort of coming at around the same time as there began to be increasing research-based evidence that facial recognition software has a tendency to perpetuate racial bias, sort of a refrain we often hear that algorithms are built by people and people bring their biases to anything they do, and so algorithms often tend to reflect the biases of the people who build them. And these of course can be very unconscious, but the result is that these systems tend to misidentify women and people of color far more frequently than they do men. And so anyway, so there’s been an increasing consensus among policymakers, as well as even among some of the producers of this technology, that its use in some of these scenarios ought to be limited. You know, there’ve been been kind of a slew of laws at the state level that have either dramatically restricted or even banned the use of facial recognition software as a law enforcement tool. There have been some bills proffered at the national level to implement a similar ban or even expand the band beyond law enforcement nationwide. Those have not gone anywhere so far.

But in New York, essentially what happened was the use of the software was activated, I believe, last January. And it prompted a lawsuit from the ACLU. The lawsuit was actually directed at the State Education Department for its decision to approve the use of the software. That lawsuit is actually still ongoing. But in the meantime, the state legislature in New York, both houses, passed a bill that was signed, right at the end of last year by the governor, that imposes a temporary moratorium on the use of facial recognition in schools specifically, in the state until July, 2022, and requires the State Department of Education to undergo a thorough review of facial recognition as a tool that schools can use, to report back on sort of its findings there. So the Lockport district has, since deactivated its system. 

The superintendent there has maintained that the system was thoughtfully applied and that the concerns about bias and potential issues with it are either unfounded or unfairly magnified by critics of it. That’s essentially what happened.

Amy H-L: [00:25:56] During the pandemic, a lot of students are learning remotely. What are the concerns about collection of data from Zoom and some of these other video conferencing platforms?

Mark L: [00:26:08] Absolutely. A lot of them, I think, are still, those concerns are still concretizing in terms of exactly what the issues are. Because, as with everything related to the shift to remote learning, that took place for basically all schools around the country in March. It was incredibly abrupt. There was not a lot of time to prepare and there was an urgent need to replace the in person learning experience with something. And many schools, not all, but many schools around the country had probably not done as much work and advanced planning on that kind of contingency as they could have. And that’s a consequence, I think, of resources, staffing, as much as the will or desire, but regardless, the situation was that many schools entered into, you know, either started using technology tools they hadn’t previously used or quickly entered into contracts with new technology providers. And in some cases may have done so at the expense of thoughtfully developing a contract or thoughtfully asking all of the questions that ought to be asked in terms of how the data will be used, what it will be used for, whether it will comply with federal privacy laws, and all of that. It was a particularly tough to manage this early on in the pandemic when you had situations that, I remember talking to someone who was a technology officer for a district in Virginia, and she told me that the district had a contract laid out with one of the video conference providers. I forget which one it was, but they had a situation where some of their teachers, kind of in their personal life, had already started using a different one and were comfortable with it. I think that one was Zoom. And so some of the teachers kind of ad hoc just started using it, and that raised some red flags in terms of the version they were using may not have had adequate protections in place to ensure that students data was being kept safe. Now, I mean, the specifics of kind of the concerns about., I think are still unfolding. I mean, there were concerns early on that LinkedIn profiles attached to the Zoom platform, were providing people with information about people they were communicating with without the opposite parties’ knowledge. There were certainly concerns about unwanted visitors to video conference rooms, concerns that were significant enough for the FBI to weigh in on several occasions about that. I believe there were also concerns, early on more so perhaps, about the possibility that some of these recorded meetings that were taking place in the school context could end up published online somewhere accessible to the public, you know, putting students’ data at risk. And beyond that, I mean, these technologies, particularly video conferencing technologies, really opened up a lot of questions about the ethics and the legal concerns about should students have their cameras on? Is it appropriate to record the meetings? Is it actually necessary to record the meetings? Does it depend on whether parents consent? I don’t know if there’s necessarily been consensus on any one of those issues, but I think it just highlights how many more  ethical and privacy-related questions came up as a result of kind of this new paradigm for how education is being delivered.

And I think it also kind of highlights this familiar dynamic that does take place in schools, and probably other industries as well, fairly often, which is there’s some sort of problem or issue, and again, partially because of a lack of resources or a lack of support from institutions that could provide assistance, there may be a tendency sometimes to kind of over-invest in technology solutions, maybe at the expense, in some cases of vetting those programs, of minimizing the number of programs that are being invested in. I spoke to numerous experts who were saying people are very concerned about privacy, saying it’s always better for a school district to kind of focus on a small number of technology platforms that it’s using, both for the ease and convenience of use for the students and their families, but also because kind of the fewer different platforms you have flying around and the fewer different accounts students are making and teachers are making, and the less information that’s kind of flying around, the less you have to worry about sort of that information ending up in the wrong hands or being used for the wrong purpose.

Jon M: [00:30:23] So following up on that, is cybersecurity an issue for schools?

Mark L: [00:30:28] It’s actually a huge issue. It has been for, for many years, but has been particularly of concern during a pandemic, cybersecurity hackers, ransomware attackers, these entities that essentially kind of target institutions or organizations that they deem likely to pay a high premium for getting the data back that’s stolen or taken from them. And so we often see this directed at schools, hospitals, other organizations where the data that they’re collecting is very important, very sensitive and critical to the operation of that institution. And so there are cybersecurity leaders among chief technology officers who work in K-12 schools who have been talking about these issues for several years.

I think there’s probably a wider awareness of the issue now, because you know, we’ve seen even this past fall, we saw a couple of big instances of large districts that were shut down for several days after ransomware attackers breached the network. i’m thinking of one case, actually fairly close to where I live, Baltimore County, Maryland, just, about an hour away from me, where the district shut down instruction for several days. And then many students and staff members had to exchange their devices, or at least return the devices that they were using remotely to the school so they could be wiped and embedded properly for any traces of whatever happened. In fact, the system, there was a Senate hearing, a US Senate hearing last  fall on the topic of cybersecurity more generally. And among the speakers at that hearing was the superintendent of the school district in Hartford, Connecticut. She shared a very similar story about, I believe, the first week of school or early in the school year, their system was hacked, and not only did it disrupt the start of the school year and kind of create chaos and confusion, but the technology team at the district has been working since then and it’s taken several months to assess the damage and try to repair it. It’s also been very costly. And I think this is one of many issues that highlight the need for more resources and more thought to be invested in this. The Consortium for School Networking, which is a membership organization of chief technology officers in K-12 schools,  has done survey work for years that shows that  many schools underestimate the risk of a cybersecurity attack relative to the actual risk, but also that many of them lack the either the tools, the expertise, or the staffing to adequately prepare for or deal with the event of an attack. And these can be very disruptive to the immediate operation of the school, but just also we don’t know, when an attack like this does come up, which data is getting taken, what can be done to repair, that oftentimes the specifics of the effects of an attack like that don’t emerge for quite a while.

And so I’ll just wrap up by saying the reason this is of particular concern during the pandemic, because of course, because while we have seen many schools reopened their doors, the school buildings for at least partial instruction, you know, hybrid instruction for some of the students, we know that in the aggregate far more of the American K-12 education landscape is being conducted online, which means that the threat and according to the FBI and other cyber security experts, is higher than normal. Um, and the last point I’ll make is there was, as part of that cybersecurity hearing in the Senate or maybe it was a different hearing, I’m not remembering exactly, but the director of the federal cybersecurity agency said that there are federal resources for cybersecurity tools that schools can take advantage of, but then only a very small fraction of the school districts in the country have actually downloaded or applied for membership in those. And I think that that was really striking to me and really underscored just, I mean, this is a very complex issue. It can be a very abstract threat to kind of conceptualize, I think, for people who are dealing with more immediate or more pressing short-term concerns. And I think coupled with, you know, an absence of robust funding and support for prevention and education and training for both school technology officers and everyone that works in a school, I think cybersecurity remains a very significant and very tangible threat that should be taken very seriously.

Jon M: [00:34:51] Following up on the question of access to students’ data, you’ve written about the concerns with school student directories and parents’ ability to opt out. What are directories and what are the key ethical issues?

Mark L: [00:35:06] So basically the federal privacy law gives students a right to access and amend their educational records as well as to restrict the disclosure of certain “directory information.” So there are quite a few pieces of information that fall into that category, including everything from full names, height and weight, date and place of birth, you know, basic biographical details, contact information, social media handles, home address. It could potentially even include photographs of students. You can sort of think of it as identifying information for a particular student. Now, one of the criticisms among privacy advocates of FERPA, the federal privacy law, is that it does not take into account the widespread availability of information on the internet and the ability for all of that information I’ve just described to be quickly scraped into a database and sold to companies without the students’ or parents’ knowledge. This law was originally written in 1974, and I think there’s a robust argument to be made that a lot of the modern concerns about how data can be shared and misused are not reflected in the law, but regardless, you know, FERPA does permit students and parents to request that schools refrain from publicly disclosing any of that directory information. And it requires schools to offer families that opportunity proactively, uh, at the beginning of the school year. However, for some of the same reasons I talked about with why cybersecurity might be marginalized in terms of how many resources are devoted to it, this report from the World Privacy Forum earlier this year found that more than 60% of the schools surveyed don’t publish an opt-out form for that directory information in a way that’s online and easily accessible to the public. Only slightly more than half of schools posted that notice online at all.

A lot of parents are given only one to two months per year on average to decide whether to opt out of that data being shared or used, which is far less time than post-secondary colleges tend to give. They tend to give the opportunity to opt out last all year round. The report even shared that some of the opt-out forms that schools are using, providing to parents to give them the option, are written in such a way that it sort of hints that parents should not take the privacy steps that they’re being offered to take. It’s impossible to know whether that’s intentional or just something that in the crafting of the language, that’s not precise, but I mean, all of this sort of reflects, I think, kind of, I keep coming back to it. All of what I just described really does highlight the issue I just talked about, which is privacy laws in particular are quite complex and require a lot of intentional planning and infrastructure to execute and abide by thoroughly and successfully. And this report found in particular, rural schools are more likely to be among the schools that are not offering these opt-out possibilities to the extent they should be. And I think a lot of what that reflects is once again, that privacy is often not deemed among the obligations of a school district that warrant robust funding and resources. And I think we see that playing out in this situation in terms of the disparities and transparency to families about their options. You know, I mean, you can imagine, especially during the pandemic, but just in general, the complexities of this privacy law that I’m laying out here are not what so many families are going to be proactively expecting. And I think schools really do have an obligation to be providing this to families in as clear and accessible language as possible. And as well  in multiple languages, you know, in all of the languages that are spoken by students and families in their respective districts. And so once again, I think it really highlights the importance of a bigger focus on these issues because they do have very tangible impact. 

Jon M: [00:39:06] Thank you, Mark Lieberman of Education Week.

Mark L: [00:39:12] Thank you for having me.

Amy H-L: [00:39:14] And thank you listeners. If you enjoyed this podcast, please share it with a friend or colleague. Subscribe wherever you get your podcasts and give us a rating or review. This helps others to find the show. Check out our website,,  for more episodes and articles. Subscribe to our monthly emails. We post annotated transcripts of our interviews to make them easy to use in workshops or classes. We work with consultants to offer customized SEL programs, with a focus on ethics, for schools and youth programs in the New York City area. Contact us at  We’re on Facebook, Instagram, and Twitter @ethicalschools. Our editor and social media manager is Amanda Denti. Until next week.

Click here to listen to this episode.