SECTION 8: INFORMATION SECURITY AND IDENTITY

Target State (Future State)

Two primary drivers, common both to the NYCDOE and to the K-12 education industry at large, motivate the NYCDOE’s information security strategy. These are the desire to enable data-driven instruction and accountability at the school level and the increasing need for both students and staff to access data and applications regardless of whether they are in a classroom, in a central office, or at home.

One of the largest trends in K-12 education today is the increasing use of data by staff at all levels to make a wide range of instructional decisions and to hold schools accountable for results. The NYCDOE has embraced this strategy whole-heartedly with the Children First Accountability initiative and the first data-driven decision-making tool, ARIS, which made unprecedented amounts of student data available to school staff. ARIS, however, is only the beginning. Many features planned for the future include driving data access even further into the schools, whether by deploying school-based student systems (e.g., ARIS Local), by the expansion of periodic student assessment programs, or with the ever-increasing number of commercial third-party student data systems available to schools. Given the NYCDOE’s commitment to data-driven decision making at all levels, it is clear that data can no longer be “locked up” for use by the privileged few; it must be made available when and where it’s needed, without compromising security.

One of the NYCDOE’s most successful recent applications is the much lauded and award-winning FitnessGram, which allows physical education teachers to track fitness information for the students they teach. FitnessGram is so successful in part because it places relevant information about students in the hands of teachers when and where they can best use it – in the teaching environment. This is possible in the current security environment because the data presented by FitnessGram is not considered sensitive or confidential. It doesn’t take a major leap to realize the value that real-time access to student academic data could provide to a classroom teacher. However, because academic data is highly confidential and legally protected, it requires a greater level of protection. At the other end of the data access spectrum are students themselves, who frequently use school-based systems to do anything from taking a test to saving a homework document. Again, it is not hard to see the value of allowing students to access these systems from home – presumably where are located when they do their homework and thus where such access would be most valuable.

As the uses of technology in schools have evolved, so too have the associated risks. The value of making data available to the right people is unquestionable, but the value of such data to the “wrong” people has increased considerably as well. Where the primary concern was once the productivity disruption caused by an otherwise-harmless virus outbreak, today’s malicious software is capable of finding and stealing sensitive data. The situation gets even grimmer when an active attacker such as a computer hacker attempts to gain access to steal – and sell – this data. Is this really such a big problem? Of what commercial value is student data anyway? A child’s stolen identity may not be useful for opening credit card accounts, but it can be quite valuable for defrauding entitlement programs such as Medicaid and public assistance. Not serious enough? There is also the internet trade in personal information about children used by pedophiles to locate victims. Finally, there are numerous federal, state, and local laws and regulations governing the use, transportation, and storage of sensitive data with which the NYCDOE must comply.