Recognizing schools’ growing vulnerability to cyberthreats, the Cybersecurity and Infrastructure Security Agency released anticipated guidance Tuesday outlining recommendations on how districts can strengthen their cyberdefenses. The CISA report was mandated by Congress’ passage of the K-12 Cybersecurity Act of 2021, which requires the agency to report risks the K-12 sector faces in the cybersphere.

Among CISA’s key recommendations for school systems is taking meaningful steps in security investments, such as implementing multi-factor authentication and running a strong cybersecurity training program. District leaders should also work with peers and partners in the education space to raise awareness around the issue, the agency said.

K-12 leaders need to ensure cybersecurity is a bigger priority and use available grant programs to improve a district’s networks, CISA said. The agency’s report began with a message that these recommendations “must come from the top down” with leaders emphasizing a “cybersecure culture.” The burden to take on these changes cannot fall squarely on IT and cybersecurity staff alone, the guidance said.

Citing the nonprofit K12 Security Information Exchanges’ 2022 annual report, CISA noted that reported cyberattacks against school districts have increased from 400 in 2018 to an accumulated total of more than 1,300 incidents by 2021. 

On top of that, K-12 leaders typically have small budgets to commit to taking on these security threats.

A November report by the Multi-State Information Sharing and Analysis Center found the average school spends about 8% of its IT budget on cybersecurity measures. As CISA collected feedback through listening sessions with K-12 leaders, many stakeholders told the agency they were struggling with cybersecurity and IT staffing shortages. 

On Monday, the Maryland Office of the Inspector General for Education released more details about a 2020 ransomware attack that cost Maryland’s Baltimore County Public Schools over $9.6 million. The accumulated costs are tied to recovery efforts from the cyberattack, upgrades to the district’s system, and a switch to a new platform. 

The inspector general’s investigation said the incident originated from a phishing attack addressed to a school staff member. The email attachment could not be initially opened, and a district tech liaison found the email to be suspicious. However, when the tech liaison forwarded the message to a district IT contractor for help, the contractor accidentally opened the attachment with an unsecured Baltimore County schools email account. That action became the entry point for undetected malware into the district’s IT system, the investigation said.

Meanwhile, the Los Angeles Unified School District indicated to the California Department of Justice that last year’s major ransomware attack occurred earlier than initially reported — meaning the incident went undetected for a month. 

In an October report, the U.S. Government Accountability Office highlighted the lack of coordination on school cybersecurity between the U.S. Department of Education and CISA with other agencies and the K-12 community. 

According to CISA’s report, the new guidance is just one step the agency is taking toward improving school cybersecurity.

“Going forward, CISA will continue to partner with the K-12 education community, and work with technology providers to encourage provision of free or low-cost security tools and products that are secure by default and design,” the CISA report said.

Given the consistent amount of ransomware attacks impacting school districts nationwide, Doug Levin, national director of K12 Security Information Exchange, said in a statement that the CISA report was released “not a moment too soon.”

“This landmark federal report clearly and concisely communicates the cybersecurity challenge the U.S. K-12 education sector is facing and recommends common sense steps that stakeholders — including superintendents, school administrators, school board members, and state policymakers—can take to bring about needed change,” Levin said.

The recent development of ChatGPT — a sophisticated artificial intelligence chatbot that can search databases and create essays, poetry, computer code, lyrics and other works — has school leaders concerned that students now have an easy way to plagiarize their schoolwork.

These fears emerged as New York City Public Schools, the nation’s largest school system, blocked access to ChatGPT on its network and devices in December, following requests from schools to do so. 

Meanwhile, a Princeton University student last week announced he had developed an app called GPTZero that can detect if an essay was written by a human or an AI chatbot.

Quickly developing AI technology is already beginning to pose major questions about where it fits into education — and whether it has a place in the classroom. 

In New York City, the AI chatbot program was blocked “due to concerns about negative impacts on student learning, and concerns regarding the safety and accuracy of content,” said Jenna Lyle, the district’s spokesperson, in an emailed statement to K-12 Dive. While the tool may be able to provide quick and easy answers to questions, she said "it does not build critical-thinking and problem-solving skills, which are essential for academic and lifelong success." 

Despite these restrictions, Lyle said, individual schools may request access to ChatGPT when students are learning about AI-related technology.

Educators' concerns swirl around the limited ability to detect an AI-generated essay or assignment. But the newly developed free GPTZero app offers a glimpse of hope for ferreting out whether homework was created by AI. 

To Robin Lake, director of the Center on Reinventing Public Education, students should still have access to AI chatbots in school. Students are excited to use this technology, and they will find ways to use AI even if schools block access, she said. This technology is also rapidly shaping the demands of the future workforce.

While AI could lead students to not do original work, it also creates an opportunity for teachers to get more creative with assignments and assessments, Lake said. 

“Now is the time to have the conversation with kids — it’s their future, it’s their jobs. Let’s talk to them about how they want to use these tools to get the most out of their learning,” Lake said.

There are simple ways teachers can integrate instruction on AI into lessons, such as discussing how the technology is used every day without students even noticing it. Common uses of AI can look like asking Siri a question on an iPhone or tracking online purchases, said Michael Martucci, a Florida school administrator who helped develop a statewide AI curriculum, in an October interview with K-12 Dive.

This can help students also understand how to use AI themselves to create their own apps or solve problems. When digging deeper into the subject, students can understand how machine learning runs AI and apply those skills to their own learning processes, Michael Daley, an associate professor and director of the Center for Professional Development & Education Reform at the Warner School of Education at the University of Rochester, previously told K-12 Dive. 

“Maybe assigning essays was not the right thing a long time ago and didn’t really measure the things we value in students,” Lake said. “Could we use this as an opportunity to really get to a deeper level with kids about how to write strong essays and have them critique essays that the AI bots are producing?”

But like all technological tools, AI can be used well or poorly, Lake said. 

“It can detract from equity, it can promote equity,” she said. “The job at hand is to think about how can we use this tool well on behalf of kids to prepare them for the future?”

UPDATE: Jan. 11, 2023: In a joint online interview Wednesday morning, NWEA CEO Chris Minnich and HMH CEO Jack Lynch said HMH's acquisition of NWEA will give schools a fuller offering of assessment and curriculum tools.

"It's not enough just to give kids the best data," said Minnich, who is expected to transition to a leadership role in HMH’s assessment division. "We also need to answer the question about what's next for students."

The acquisition's 90-day customary regulatory review, which begins this month, will be conducted by the Oregon attorney general's office due to NWEA's nonprofit status there, as well as the U.S. Department of Justice.

All proceeds from the acquisition, which has not been disclosed, will be used to create a separate foundation, Minnich said. The name of the foundation and specific areas of giving have not been finalized, but the charity will have a national reach, he said.

_________________________

The education research and assessment nonprofit NWEA is being acquired by learning technology company Houghton Mifflin Harcourt, known as HMH, the organizations announced Tuesday.

NWEA, which administers the MAP Growth assessments, is expected to operate as a division of HMH once a customary regulatory review has taken place and the agreement is formalized. The MAP Growth assessment cycles are not expected to be impacted, and educators can continue generating and reading reports and using other NWEA tools, according to a statement from the nonprofit.

HMH will integrate NWEA assessment and tools with its curriculum on the company's platform. In the near term, proceeds from the acquisition will fund NWEA's continued focus on student learning and outcomes, with plans to eventually convert to a separate private foundation — unnamed as of now. The groups did not disclose the acquisition price.

NWEA worked with 10,000 school systems in 2022, said CEO Chris Minnich in a statement. 

"When considering the right path forward, we kept our school district and state education partners at the center, with a focus on how we can deliver for them, especially in the areas they value," Minnich said. "As part of HMH, we will be able to address their needs faster while staying focused on the deep, trusting relationships we have built with them.” 

NWEA also said the agreement will give educators "even more valuable information that helps identify learning needs, inform instruction, and personalize learning plans."

The organizations expect no interruptions to NWEA services, including professional learning workshops and school improvement services, and any events scheduled or planned are to continue as normal. 

“We are thrilled at the potential this acquisition brings for K-12 educators, at a time when the connection between instruction and assessment is increasingly critical for student success,” said Jack Lynch, CEO of HMH. 

HMH serves more than 50 million students and 4 million educators in 150 countries, according to the announcement. HMH is a portfolio company of Veritas Capital, a private investment firm that focuses on businesses providing technology and technology-enabled solutions.

A new report points to "disturbing" evidence of safety risks from exposure of students' online data through ed tech, with 96% of apps used or recommended by K-12 schools sharing students' personal information with third parties.  

In a study conducted by Internet Safety Labs, a nonprofit that conducts product safety testing and research, researchers also found custom apps for school districts — or apps from large ed tech platform developers that can be personalized for districts — are among the least safe compared to more generic apps. 

Meanwhile, efforts by lawmakers to update the Children's Online Privacy Protection Act stalled during December's negotiations for the FY 2023 omnibus spending bill. Because a new congressional session began last week, lawmakers will need to reintroduce that legislation.

About three-fourths of the time, students' personal data is shared with advertisers or other entities that may profit from the information collected. Additionally, 79% of the apps reviewed could access student location information, and 52% could access calendar and contact information, the report said.

“We all know how much personal data is already flowing to companies that excel in monetizing it, but this research provides an accurate look at the reality of where student data is going," said Lisa LeVasseur, executive director of ISL, in a statement. LeVasseur added the research could lead to the creation of software product safety standards. 

The ISL research examined a random sampling of ed tech use in 13 schools in each state and the District of Columbia for a total review of 663 schools with 455,882 students. Researchers also reviewed ed tech behaviors at one private school in each state. In total, they analyzed 1,722 apps.

The COVID-19 pandemic greatly increased school districts' use of ed tech. At the same time, momentum has grown at local, state and federal levels to protect students' online personal data.

At the local level, school administrators are verifying they are adhering to state and federal student privacy laws during the procurement stage. They are also vetting proposed apps to make sure they're really needed for learning and don't duplicate existing resources.

State education systems are helping districts comply with privacy requirements and safeguard their own data systems to protect students' private information.

In California, the recent passage of the California Age-Appropriate Design Code Act prohibits companies that provide online services, products or features likely to be accessed by children from using a child’s personal information or collecting, selling or retaining a child’s geolocation, among other protections.

However, in December, NetChoice, an organization that advocates for free enterprise and expression on the internet, sued the state, saying the law "expands government power over online speech under the guise of protecting children," according to a statement from NetChoice.

At the federal level, student data privacy advocates and some lawmakers have said they are hopeful the 118th Congress will make progress in updating the Children’s Online Privacy Protection Act. The law was enacted in 2000 and last updated in 2013. 

Sen. Edward Markey, D-Massachusetts, an author of the original COPPA, said in a Dec. 20 statement, "The toxicity, tracking, and targeting that young people face on the internet has reached a crisis point" 

Additionally, the Federal Trade Commission announced in May that it "intends to scrutinize compliance with the full breadth of the substantive prohibitions and requirements of the COPPA Rule and statutory language."

This monitoring includes a focus on ensuring ed tech companies do not disclose more student information than is necessary for a child to participate in that digital activity, according to the announcement.

The Federal Communications Commission announced Wednesday it is seeking public comment on using its E-rate program to pay for school and library cybersecurity improvements, such as advanced or next-generation firewalls. Feedback must be shared by Feb. 13, and reply comments must be filed by March 30.

FCC advises the public specifically share their take on these five areas: The definition of next-generation firewalls and services; the specific equipment, services to be used and costs affiliated with next-generation firewalls; how these firewall services should be categorized under the E-rate program; any measures to ensure cost-effective choices when applicants purchase advanced firewalls; and the FCC’s legal authority to extend coverage of these services in the E-rate program.

The agency’s announcement follows requests and issues raised in recent months from various E-rate stakeholders, including The School Superintendents Association (AASA), the Consortium for School Networking, communications technology provider Cisco, and E-rate consulting firm Funds For Learning.

Recent calls to the FCC to include upgraded firewalls in its E-rate program come as schools continue to grapple with growing cybersecurity threats and struggle to find resources to combat these concerns. 

The E-rate program is administered by the FCC and provides significant discounts for school internet connections and telecommunications infrastructure. It currently covers basic firewall services.

A Dec. 8 letter to the agency from U.S. Rep. Doris Matsui, D-California, said basic firewalls “fall far short of adequately addressing the threat landscape schools face today.”

Matsui urged the FCC to collaborate with other federal agencies to help protect schools against cyberattacks. In an October report, the U.S. Government Accountability Office found the Department of Education and Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency “have little to no interaction with other agencies and the K-12 community” over cybersecurity in schools.

Over a year has passed since the K-12 Cybersecurity Act of 2021 directed the Department of Homeland Security to conduct a study examining K-12 cybersecurity challenges. Because of this legislation, the FCC said it did not move forward to include advanced firewalls and additional network security services in the E-rate program for fiscal 2022. Specifically, the agency said the results of that study will “provide invaluable insights into what cybersecurity services will be most impactful for K-12 educational institutions.”

To submit a public comment to the FCC on the matter, visit http://www.fcc.gov/ecfs.

The small microphone pinned to the teacher each day was barely noticeable. But for the student with a hearing impairment who now heard her instructor’s voice with clarity through headphones, the effect was clear, recalls Fabienne Doucet.

Doucet, the executive director for New York University’s Metropolitan Center for Research on Equity and the Transformation of Schools and an associate professor of early childhood and urban education, had been supervising a student teacher as part of the educator’s training, and while the microphone didn’t change the way the teacher worked with her class, the small addition elevated the learning experience for their pupil significantly.

“It didn’t take away from anyone — and in fact, it added to the student and their learning,” said Doucet. “It’s not doing something special. It’s thinking about everyone."

While all students come into classrooms with an expectation to learn, learning needs can be varied and distinct, including vision and hearing impairments, attention-deficit hyperactivity disorder or dyslexia. When it comes to learning styles, diversity abounds.

Designing a curriculum to address all these distinctions can be a challenge. Luckily, there are tools, resources and approaches that can help educators create successful opportunities for all learners. The first step is to address existing student needs and then look for solutions that can support all students and their unique needs.

“Equity is providing folks with what they need to meet those outcomes,” said Doucet.

Equitable solutions expand learning for all

Screen readers and contrast tools, which can make text pop more clearly on a digital page, are learning tools that support students who have vision and hearing needs. But these tools can also support pupils who may be learning English as a second language, providing another layer of support to help them translate as they read. These supports also serve learners — and educators — who prefer to multi-task, allowing them to listen to an online lesson while working through a problem set at the same time.

“These tools are not designed for one student, but provide flexibility for all,” said Luis Pérez, a technical assistance specialist at CAST, which promotes a universal design for learning approach for classrooms.

Pérez, who has been with CAST for almost five years, advocates for technology that can expand the way students engage with curriculum. A print article is a fixed learning tool — students can’t zoom into a page or even brighten the page for more clarity. Digitize that material with accessibility in mind, however, and suddenly a lesson can be made more equitable to a variety of learners. Text size can be increased for those with low vision, or fonts changed for those with dyslexia — or just those who find serif fonts like Times New Roman harder to read.

“The benefit of technology is that it gives you the flexibility to not just deliver information to learners, but help them navigate it in different ways and remove barriers,” said Pérez.

The point that more options benefit all learners rather than favoring a few is one Doucet stands behind, as well. She said educators and curriculum designers can use this argument when presented with pushback about added tools and programs, calling them “special” or “add-ons” for some and not for others.

“We are already doing some for some, and not for others,” Doucet said. "Some people get all the things, and others have to deal. What we're helping people do is flip the script so that the most widely available and most openly accessible is beneficial to everyone as opposed to being restrictive, and doing something special.”

Including IT in your toolbox

One resource that may already be in-house is IT staff who work on a school’s site or within a district and may be fluent in many accessibility tools educators can adopt quickly — and without any added expense. 

Sheryl Burgstahler, founder of the Disabilities, Opportunities, Internetworking, and Technology Center and director of accessible technology services at the University of Washington, recommends reaching out to these experts before signing up for or moving forward with any technology add-ons. Running ideas or apps by them first may help teachers and curriculum designers hone how to apply more UDL plans to their lessons.

“I would invite IT people to be part of your planning when thinking about who may or may not have full access to materials,” said Burgstahler, also a former middle school teacher.

Burgstahler suggests these conversations should happen before lesson plans and materials are constructed and not after. For example, she said, YouTube can generate captions for videos that educators may upload as part of their curriculum. But captions often need to be edited no matter how good the AI is. That step can only be taken by the person — in this case, the teacher — who uploads the material.

IT experts can also help teachers learn about different UDL features, which may not be immediately apparent. For example, educators may be able to download ad blockers to help students who have ADHD focus. The site NoMouse.org is another resource that lets educators test whether a web page can be navigated without a mouse — a device that may be difficult to use for students with physical challenges.

Another option is to go to the University of Washington's IT accessibility checklist, which can help educators examine whether the lessons and materials they’re hoping to bring into the classroom are as equitable to all learners as possible.

Don’t ignore physical spaces and devices

Educators should also consider how their classrooms are set up, especially for those teaching science, technology and engineering classes that may lean heavily on hands-on learning. Experts suggest examining whether assistive technology is available so a student with low-vision or mobility challenges can still participate in a chemistry experiment or a robot design assignment.

Lowering work benches or widening aisles can ensure students in wheelchairs, for example, can still help a lab partner dissect a frog or work on the same computer during a group project.

Even technology pointedly designed to increase accessibility should be reassessed to ensure it meets the needs of students, said Pérez. He points specifically to augmented and virtual reality devices, which expand a user’s experience through virtual environments and often haptic and vibrational feedback but may not be optimum for all pupils.

“People with balance issues can’t put on the headsets and use the technology,” Pérez said.

For those educators who end up feeling overwhelmed and worried about making a mistake, the best decision any teacher can take to expand inclusive options for students is to take the first step, Pérez added. Going in with the mindset that everything has to work for everyone at the outset can stop educators from even trying, which ultimately helps no one.

“What I feel holds back educators is they let perfect get in the way,” Pérez said. “They should remember this is a journey."