# data[].attributes.body
This padlet is concentrating on technology in schools, specifically privacy issues and protection of user data. The author is employed as a network administrator for a rural school district west of Fort Worth, Texas. The district is comprised of five educational campuses along with an administration building, bus barn, and maintenance building. The author is working on a Master of Arts in Administrative Leadership at Angelo State University.

This presentation is geared towards administrators and technicians in school technology departments, particularly those who are involved with securing access to student and staff personal data.  The Family Educational Rights and Privacy Act (FERPA) allows parents and students who are 18-years-old or older to have some control over any disclosure of student records or personally identifiable information (PII) from school records (20 U.S.C. § 1232g). I chose this topic because student information needs to be kept private. Information contained in this padlet should assist information technology workers in protecting students’ PII from access by outside forces.

References

The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g (1974).

# data[].attributes.attachment_link.readable_text
The purpose of this part is to set out requirements for the protection of privacy of parents and students under section 444 of the General Education Provisions Act, as amended.

34 CFR 300.610 through 300.626 contain requirements regarding the confidentiality of information relating to children with disabilities who receive evaluations, services or other benefits under Part B of the Individuals with Disabilities Education Act (IDEA). 34 CFR 303.402 and 303.460 identify the confidentiality of information requirements regarding children and infants and toddlers with disabilities and their families who receive evaluations, services, or other benefits under Part C of IDEA. 34 CFR 300.610 through 300.627 contain the confidentiality of information requirements that apply to personally identifiable data, information, and records collected or maintained pursuant to Part B of the IDEA.

The following definitions apply to this part:

Attendance includes, but is not limited to -

Authorized representative means any entity or individual designated by a State or local educational authority or an agency headed by an official listed in § 99.31(a)(3) to conduct - with respect to Federal- or State-supported education programs - any audit or evaluation, or any compliance or enforcement activity in connection with Federal legal requirements that relate to these programs.

Biometric record, as used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.

Directory information means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.

Directory information includes, but is not limited to, the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status ( e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors, and awards received; and the most recent educational agency or institution attended.

Disciplinary action or proceeding means the investigation, adjudication, or imposition of sanctions by an educational agency or institution with respect to an infraction or violation of the internal rules of conduct applicable to students of the agency or institution.

Disclosure means to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record.

Early childhood education program means -

A Head Start program or an Early Head Start program carried out under the Head Start Act ( 42 U.S.C. 9831 et seq.), including a migrant or seasonal Head Start program, an Indian Head Start program, or a Head Start program or an Early Head Start program that also receives State funding;

Educational agency or institution means any public or private agency or institution to which this part applies under § 99.1(a).

Party means an individual, agency, institution, or organization.

Personally Identifiable Information

The term includes, but is not limited to -

Student, except as otherwise specifically provided in this part, means any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records.

[ 53 FR 11943, Apr. 11, 1988, as amended at 60 FR 3468, Jan. 17, 1995; 61 FR 59295, Nov. 21, 1996; 65 FR 41852, July 6, 2000; 73 FR 74851, Dec. 9, 2008; 76 FR 75641, Dec. 2, 2011]

An educational agency or institution shall give full rights under the Act to either parent, unless the agency or institution has been provided with evidence that there is a court order, State statute, or legally binding document relating to such matters as divorce, separation, or custody that specifically revokes these rights.

Nothing in this section prevents an educational agency or institution from disclosing education records, or personally identifiable information from education records, to a parent without the prior written consent of an eligible student if the disclosure meets the conditions in § 99.31(a)(8), § 99.31(a)(10), § 99.31(a)(15), or any other provision in § 99.31(a).

[ 53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3188, Jan. 7, 1993; 65 FR 41853, July 6, 2000; 73 FR 74852, Dec. 9, 2008]

§ 99.6 [Reserved]

# data[].attributes.attachment_link.description
The purpose of this part is to set out requirements for the protection of privacy of parents and students under section 444 of the General Education Provisions Act, as amended. 34 CFR 300.610 through 300.626 contain requirements regarding the confidentiality of information relating to children with disabilities who receive evaluations, services or other benefits under Part B of the Individuals with Disabilities Education Act (IDEA).

# data[].attributes.headline
The Family Educational Rights and Privacy Act (FERPA) 

# data[].attributes.subject
The Family Educational Rights and Privacy Act (FERPA) 

# data[].attributes.body
The Family Educational Rights and Privacy act is located in Title 20, Section 1232g (20 U.S.C. § 1232g). The law requires schools that receive federal funds to comply with procedures regarding the privacy of student educational records.

Those procedures include non-disclosure of a student's protected information to a third party or any party that is not the student or the student’s parent(s). For instance, a school could not provide student educational information on a resume or recommendation letter without the expressed consent of the student.

Students also have the right to inspect their school records and any request must be granted within 45 days of receipt. If there have been changes to the student’s file, the student must be notified before those files can be disclosed to future employers or other educational institutes.

Institutions that do not comply with FERPA guidelines risk losing federal funding (Hlavak & Easterly, 2015).

# data[].attributes.attachment_link.readable_text
The purpose of this part is to set out requirements for the protection of privacy of parents and students under section 444 of the General Education Provisions Act, as amended.

34 CFR 300.610 through 300.626 contain requirements regarding the confidentiality of information relating to children with disabilities who receive evaluations, services or other benefits under Part B of the Individuals with Disabilities Education Act (IDEA). 34 CFR 303.402 and 303.460 identify the confidentiality of information requirements regarding children and infants and toddlers with disabilities and their families who receive evaluations, services, or other benefits under Part C of IDEA. 34 CFR 300.610 through 300.627 contain the confidentiality of information requirements that apply to personally identifiable data, information, and records collected or maintained pursuant to Part B of the IDEA.

The following definitions apply to this part:

Attendance includes, but is not limited to -

Authorized representative means any entity or individual designated by a State or local educational authority or an agency headed by an official listed in § 99.31(a)(3) to conduct - with respect to Federal- or State-supported education programs - any audit or evaluation, or any compliance or enforcement activity in connection with Federal legal requirements that relate to these programs.

Biometric record, as used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.

Directory information means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.

Directory information includes, but is not limited to, the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status ( e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors, and awards received; and the most recent educational agency or institution attended.

Disciplinary action or proceeding means the investigation, adjudication, or imposition of sanctions by an educational agency or institution with respect to an infraction or violation of the internal rules of conduct applicable to students of the agency or institution.

Disclosure means to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record.

Early childhood education program means -

A Head Start program or an Early Head Start program carried out under the Head Start Act ( 42 U.S.C. 9831 et seq.), including a migrant or seasonal Head Start program, an Indian Head Start program, or a Head Start program or an Early Head Start program that also receives State funding;

Educational agency or institution means any public or private agency or institution to which this part applies under § 99.1(a).

Party means an individual, agency, institution, or organization.

Personally Identifiable Information

The term includes, but is not limited to -

Student, except as otherwise specifically provided in this part, means any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records.

[ 53 FR 11943, Apr. 11, 1988, as amended at 60 FR 3468, Jan. 17, 1995; 61 FR 59295, Nov. 21, 1996; 65 FR 41852, July 6, 2000; 73 FR 74851, Dec. 9, 2008; 76 FR 75641, Dec. 2, 2011]

An educational agency or institution shall give full rights under the Act to either parent, unless the agency or institution has been provided with evidence that there is a court order, State statute, or legally binding document relating to such matters as divorce, separation, or custody that specifically revokes these rights.

Nothing in this section prevents an educational agency or institution from disclosing education records, or personally identifiable information from education records, to a parent without the prior written consent of an eligible student if the disclosure meets the conditions in § 99.31(a)(8), § 99.31(a)(10), § 99.31(a)(15), or any other provision in § 99.31(a).

[ 53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3188, Jan. 7, 1993; 65 FR 41853, July 6, 2000; 73 FR 74852, Dec. 9, 2008]

§ 99.6 [Reserved]

# data[].attributes.attachment_link.description
The purpose of this part is to set out requirements for the protection of privacy of parents and students under section 444 of the General Education Provisions Act, as amended. 34 CFR 300.610 through 300.626 contain requirements regarding the confidentiality of information relating to children with disabilities who receive evaluations, services or other benefits under Part B of the Individuals with Disabilities Education Act (IDEA).

# data[].attributes.headline
5 Tips for Protecting Student Data and Living Up to FERPA

# data[].attributes.subject
5 Tips for Protecting Student Data and Living Up to FERPA

# data[].attributes.body
The article contains valuable advice for information technology departments when dealing with outside vendors regarding student data. Third-party companies are not allowed to receive student information, except under certain circumstances that are legitimate educational uses and the data remains under direct control by the school (Schwartz, 2018).

# data[].attributes.attachment_link.readable_text
How can ed-tech companies and K-12 school district technology leaders make sure they are compliant with federal data privacy laws? And just as importantly, what protections should schools and vendors be aware of that aren't required by federal law?

Student privacy experts addressed these questions at a panel Monday at the International Society for Technology in Education's annual conference in Chicago.

Businesses and other organizations looking for intel on the school marketplace should check out EdWeek Market Brief, a service that provides news, analysis, and original data on the ever-changing needs and priorities of schools.

The panelists discussed the Family Educational Rights and Privacy Act (FERPA), which prohibits the disclosure of students' protected information to a third party under most circumstances. The law includes an exception for those designated as "school officials." In those instances, schools can share students' data with third parties, including ed-tech companies, as long as the school retains "direct control" over the information and the vendor is using the data for a legitimate educational interest, as defined by the school.

Because the law mandates that companies follow school systems' policies when it comes to approved uses of student data, requirements for FERPA compliance can vary from district to district, said Michael Hawes, the director of the Student Privacy Policy and Assistance Division at the U.S. Department of Education.a.

That means a vendor proclaiming that they're "FERPA-compliant" on their website or promotional materials is essentially meaningless, he said.

"There is no such thing as a 'FERPA seal of approval,'" Hawes said.

Student Privacy Pledge a 'Good Start'

Then there's the Student Privacy Pledge, a voluntary set of restrictions around student data that has been signed by more than 300 ed-tech companies.

Even if a vendor signs on to the pledge, districts still need to ensure that they're FERPA-compliant, said Sara Kloek, the director of education policy at the Software and Information Industry Association.

Signing the pledge is "a good start," she said, "but it doesn't get into the specific state privacy laws, or even the individual practices of your particular district or school."

When vendors make blanket statements of FERPA compliance, it's an indication that they don't understand what the law requires, said Bill Fitzgerald, a student privacy expert and a project director at InnovateEDU, a Brooklyn-based education equity nonprofit.

District should "hammer them on that, because that's bad practice," he said.

And even if they actually do comply with FERPA, the ed-tech apps that students are using could still put their privacy at risk, said Fitzgerald.

Conversations about student privacy tend to focus on personally identifiable information, which is "a pretty narrow spectrum of information," Fitzgerald said. And while most of the privacy issues that surface aren't the result of bad intent, they can still have consequences for kids, he said.

Kloek recommends that districts have detailed conversations with the vendors they're hoping to work with, focusing on district-specific policies and the laws of their particular state.

Data-privacy Tips and Suggestions

The panel offered some suggestions for issues that should be raised in conversations between vendors and districts, as well as tips for districts developing their own privacy policies:

1. Be prepared to be held to high data-privacy standards. The Student Data Privacy Consortium, an alliance of districts across several states, has created a model contract that districts can use when evaluating products. They list the vendors that are members of the consortium on their website.

"If you want to work with a vendor that's on that list, make the same demands," Fitzgerald told educators.

Similarly, districts looking to partner with companies that also work in the European Union can ask that the vendors follow GDPR, recently-passed European legislation that gives individuals more control over and access to their data.

Ed-tech companies aren't required to agree to these requests, but "it's a good conversation to have," said Fitzgerald, "because you'll get a sense of how customer-centric their posture is and how privacy-centric their posture is."

2. Understand 'data sunsets' and explain them. Companies will sometimes include their privacy policies information about when (or if) they will delete the data that they collect, Fitzgerald said.

Districts should check to make sure that the timeline is reasonable, taking into account the sensitivity of the data in question and how critical it is to the work of the vendor.

3. Be aware of district policies outlining who reviews products, and what they're looking for. The district central office doesn't have to be responsible for reviewing all products, said Hawes, but there should be a district-wide protocol for how to evaluate potential ed-tech tools. Hawes recommends that the staff who will be going through this process-a group that can include teachers-are using uniform criteria, he said.

4. Don't attempt to side-step FERPA, and know the law. Many districts have tried to avoid addressing FERPA compliance by asking parents to give consent for apps and other services, said Hawes. Districts can do this for products that are optional, but for products that are required to participate in daily instruction, this isn't a viable option, he said.

"Parents cannot be forced to waive their FERPA rights as a condition of receiving educational services for their children."

5. Be transparent. When vendors and districts face pushback from parents about data collection, it's often because they are secretive about their practices, said Hawes.

"In the absence of full information, people tend to assume the worst," he said. If district leadership or an ed-tech vendor feels like they can't justify their data collection practices, that's a problem, said Hawes. "If parents would freak out about the list of data elements you're collecting, then you need to think about why you're collecting them."

Coverage of how parents work with educators, community leaders and policymakers to make informed decisions about their children's education is supported by a grant from the Walton Family Foundation, at waltonk12.org. Education Week retains sole editorial control over the content of this coverage.

# data[].attributes.attachment_link.title
5 Tips for Protecting Student Data and Living Up to FERPA - Market Brief

# data[].attributes.attachment_link.description
How can ed-tech companies and K-12 school district technology leaders make sure they are compliant with federal data privacy laws? And just as importantly, what protections should schools and vendors be aware of that aren't required by federal law? Student privacy experts addressed these questions at a panel Monday at the International Society for Technology in Education's annual conference in Chicago.

# data[].attributes.body
In 2002 the Supreme Court ruled that there were no personal rights to enforce HIPPA. The ruling stemmed from a Washington case where Gonzaga University was sued over the withholding of a certification affidavit. The petitioner was awarded damages on the FERPA claim in the lower court, but it was appealed and ultimately the Supreme Court found in favor of the school (Gonzaga University v. Doe, 2002).

Although the school could lose federal funds for a FERPA violation, the court ruled that FERPA “does not give rise to a private cause of action” (Gonzaga University v. Doe, 2002, para. 1).

The FERPA statute only addresses federal funding and does not offer personal rights under civil rights provisions of FERPA (Gonzaga University v. Doe, 2002).

# data[].attributes.body
“In order to promote student safety, on written request by a parent, school district board of trustees, governing body of an open-enrollment charter school, principal, assistant principal, or staff member, as authorized by Texas Education Code (TEC) §29.022(a-1), a school district or an open-enrollment charter school must provide video equipment to campuses in accordance with TEC, §29.022, and this section. Campuses that receive video equipment must place, operate, and maintain video cameras in self-contained classrooms or other special education settings in accordance with TEC, §29.022, and this section. (19 TAC § 103.1301)”

Cameras may be requested by any party related to the school.

FERPA regulations still apply to the release of any video clip.

Recordings must be retained for three months.

# data[].attributes.attachment_link.readable_text
(a) Requirement to implement. In order to promote student safety, on written request by a parent, school district board of trustees, governing body of an open-enrollment charter school, principal, assistant principal, or staff member, as authorized by Texas Education Code (TEC) §29.022(a-1), a school district or an open-enrollment charter school must provide video equipment to campuses in accordance with TEC, §29.022, and this section. Campuses that receive video equipment must place, operate, and maintain video cameras in self-contained classrooms or other special education settings in accordance with TEC, §29.022, and this section. (b) Definitions. For purposes of TEC, §29.022, and this subchapter, the following terms have the following meanings. (1) Parent means a person described in TEC, §26.002, whose child receives special education and related services in one or more self-contained classrooms or other special education settings. Parent also means a student who receives special education and related services in one or more self-contained classrooms or other special education settings and who is 18 years of age or older or whose disabilities of minority have been removed for general purposes under Texas Family Code, Chapter 31, unless the student has been determined to be incompetent or the student's rights have been otherwise restricted by a court order. (2) Staff member means a teacher, a related service provider, a paraprofessional, a counselor, or an educational aide assigned to work in a self-contained classroom or other special education setting. (3) Open-enrollment charter school means a charter granted to a charter holder under TEC, §12.101 or §12.152, identified with its own county district number. (4) Self-contained classroom means a classroom on a regular school campus (i.e., a campus that serves students in general education and students in special education) of a school district or an open-enrollment charter school, including a room attached to the classroom used for time-out, but not including a classroom that is a resource room instructional arrangement under TEC, §42.151, in which a majority of the students in regular attendance are provided special education and related services for at least 50 percent of the instructional day and have one of the following instructional arrangements/settings described in the student attendance accounting handbook adopted under §129.1025 of this title (relating to Adoption by Reference: Student Attendance Accounting Handbook): (A) self-contained (mild/moderate/severe) regular campus; (B) full-time early childhood (preschool program for children with disabilities) special education setting; (C) residential care and treatment facility--self-contained (mild/moderate/severe) regular campus; (D) residential care and treatment facility--full-time early childhood special education setting; (E) off home campus--self-contained (mild/moderate/severe) regular campus; or (F) off home campus--full-time early childhood special education setting. (6) Video camera means a video surveillance camera with audio recording capabilities. (7) Video equipment means one or more video cameras and any technology and equipment needed to place, operate, and maintain video cameras as required by TEC, §29.022, and this section. Video equipment also means any technology and equipment needed to store and access video recordings as required by TEC, §29.022, and this section. (9) School business day means a day that campus, school district, or open-enrollment charter school administrative offices are open. (10) Time-out has the meaning assigned by TEC, §37.0021. (c) Exclusions. A school district or open-enrollment charter school is not required to provide video equipment to a campus of another district or charter school or to a nonpublic school. In addition, the Texas School for the Deaf, the Texas School for the Blind and Visually Impaired, the Texas Juvenile Justice Department, and any other state agency that provides special education and related services to students are not subject to the requirements in TEC, §29.022, and this section. (d) Use of funds. A school district or open-enrollment charter school may solicit and accept gifts, grants, and donations from any person to implement the requirements in TEC, §29.022, and this section. A district or charter school is not permitted to use Individuals with Disabilities Education Act, Part B, funds or state special education funds to implement the requirements of TEC, §29.022, and this section. (e) Dispute resolution. The special education dispute resolution procedures in 34 Code of Federal Regulations, §§300.151-300.153 and 300.504-300.515, do not apply to complaints alleging that a school district or open-enrollment charter school has failed to comply with TEC, §29.022, and/or this section. Complaints alleging violations of TEC, §29.022, and/or this section must be addressed through the district's or charter school's local grievance procedures or other dispute resolution channels. (f) Regular school year and extended school year services. TEC, §29.022, and this section apply to video surveillance during the regular school year and during extended school year services. (g) Policies and procedures. Each school district board of trustees and open-enrollment charter school governing body must adopt written policies relating to the placement, operation, and maintenance of video cameras under TEC, §29.022, and this section. At a minimum, the policies must include: (1) a statement that video surveillance is for the purpose of promoting student safety in certain self-contained classrooms and other special education settings; (2) information on how a person may appeal an action by the school district or open-enrollment charter school that the person believes to be in violation of this section or a policy adopted in accordance with this section, including the appeal and expedited review processes under §103.1303 of this title (relating to Commissioner's Review of Actions Concerning Video Cameras in Special Education Settings) and the appeals process under TEC, §7.057; (3) a requirement that the school district or open-enrollment charter school provide a response to a request made under this section not later than the seventh school business day after receipt of the request by the person to whom it must be submitted under TEC, §29.022(a-3), that authorizes the request or states the reason for denying the request; (4) except as provided by paragraph (6) of this subsection, a requirement that a school or campus begin operation of a video camera in compliance with this section not later than the 45th school business day, or the first school day after the 45th school business day if that day is not a school day, after the request is authorized unless the Texas Education Agency (TEA) grants an extension of time; (7) the procedures for requesting video surveillance and the procedures for responding to a request for video surveillance; (8) the procedures for providing advanced written notice to the campus staff and the parents of the students assigned to a self-contained classroom or other special education setting that video and audio surveillance will be conducted or cease in the classroom or setting, including procedures for notice, in compliance with TEC, §29.022(b), of the opportunity to request continued video and audio surveillance if video and audio surveillance will otherwise cease; (9) a requirement that video cameras be operated at all times during the instructional day when one or more students are present in a self-contained classroom or other special education setting in which video cameras are placed; (10) a statement regarding the personnel who will have access to video equipment or video recordings for purposes of operating and maintaining the equipment or recordings; (11) a requirement that a campus continue to operate and maintain any video camera placed in a self-contained classroom or other special education setting for as long as the classroom or setting continues to satisfy the requirements in TEC, §29.022(a), for the remainder of the school year in which the school or campus received the request, unless the requestor withdraws the request in writing; (12) a requirement that video cameras placed in a self-contained classroom or other special education setting be capable of recording video and audio of all areas of the classroom or setting, except that no visual monitoring of bathrooms and areas in which a student's clothes are changed may occur. Incidental visual coverage of the inside of a bathroom or any area of the classroom or other special education setting in which a student's clothes are changed is permitted only to the extent that such coverage is the result of the layout of the classroom or setting. Audio recording of the inside of a bathroom or any area of the classroom or other special education setting in which a student's clothes are changed is required; (13) a statement that video recordings must be retained for at least three months after the date the video was recorded and that video recordings will be maintained in accordance with the requirements of TEC, §29.022(e-1), when applicable; (14) a statement that the regular or continual monitoring of video is prohibited and that video recordings must not be used for teacher evaluation or monitoring or for any purpose other than the promotion of student safety; (15) at the school district's or open-enrollment charter school's discretion, a requirement that campuses post a notice at the entrance of any self-contained classroom or other special education setting in which video cameras are placed stating that video and audio surveillance are conducted in the classroom or setting; (16) the procedures for reporting an allegation to the school district, charter school, or school that an incident occurred in a self-contained classroom or other special education setting in which video surveillance under TEC, §29.022, and this section is conducted; (17) the local grievance procedures for filing a complaint alleging violations of TEC, §29.022, and/or this section; and (18) a statement that video recordings made under TEC, §29.022, and this section are confidential and a description of the limited circumstances under which the recordings may be viewed. (h) Confidentiality of video recordings. A video recording made under TEC, §29.022, and this section is confidential and may only be released and/or viewed by the following individuals, to the extent permitted or required by TEC, §29.022(i), and to the extent not limited by the Family Educational Rights and Privacy Act of 1974 (FERPA) or other law: (1) a staff member or a parent of a student involved in an incident described in subsection (b)(8) of this section that is documented by a video recording for which an incident has been reported to the district, charter school, or school; Cont'd...

# data[].attributes.attachment_link.description
(a) Requirement to implement. In order to promote student safety, on written request by a parent, school district board of trustees, governing body of an open-enrollment charter school, principal, assistant principal, or staff member, as authorized by Texas Education Code (TEC) §29.022(a-1), a school district or an open-enrollment charter school must provide video equipment to campuses in accordance with TEC, §29.022, and this section.

# data[].attributes.headline
Student privacy and the Fourteenth Amendment

# data[].attributes.subject
Student privacy and the Fourteenth Amendment

# data[].attributes.body
Schools could be opening themselves up to lawsuits based on zero-tolerance policies concerning legally prescribed or over-the-counter medications. Elisabeth Frost cites an example of a student in possession of prescribed birth control pills, which is protected under the Fourteenth Amendment. She argues that schools that use zero tolerance in such cases are in violation of constitutional law(Frost, 2006).

Schools with zero-tolerance policies should review criteria to ensure that students are treated fairly.

Policies that could be in violation of state or federal laws also should be reviewed.

Parental consent rules may also be in violation of federal or state laws.

# data[].attributes.body
The school I am employed at publishes a Student Code of Conduct based on recommendations from the Texas Association of School Boards (TASB). However, the code is relatively lax when it comes to privacy issues. The only rules that come close are in regards to technology: “Attempt to access or circumvent passwords or other security-related information of the district, students, or employees or upload or create computer viruses, including off school
property if the conduct causes a substantial disruption to the educational environment. Attempt to alter, destroy, or disable district technology resources including but not limited to computers and related equipment, district data, the data of others, or other networks connected to the district’s system, including off school property if the conduct causes a substantial disruption to the educational environment” (Bridgeport Independent School District, 2021, p. 14)

# data[].attributes.body
IEEE Computer Society (also known as “I-triple-E”) is one of the oldest associations for computer professionals.  The group was founded in 1946 and boasts a worldwide membership of over 373,000 professionals (IEEE Computer Society, n.d.).

A blog posting on cybersecurity strategies is relevant due to the risks involved should rogue individuals gain access to computer systems. Organizations have a feeling that they are not at risk of a cyber-attack and can be ill-prepared when that attack eventually occurs. Security starts with realigning attitudes that cybersecurity is everyone’s responsibility and begin to institute policies and procedures to prevent attacks (Waqas, 2021).

# data[].attributes.attachment_link.readable_text
As the security landscape continues to grow increasingly complex, harboring an arsenal of threats and vulnerabilities, it is high time for organizations to formulate a robust cybersecurity strategy. One needs to consider that enterprises experience a loss of $3.92 on average due to data breaches.

One reason for increasing data breaches is that every organization thinks they are not at risk of cyber-attacks. The issue should be addressed by hiring a CISO (Chief Information Security Officer) who serves as the cybersecurity leader. The CISO's role is to manage the cyber risks that the organization is facing. They prioritize what is crucial to risk management, define and explore it, and develop ways to control the situation. If you've hired an ineffective CISO, the chances of your security strategy succeeding are meager. To propagate security within enterprises and organizations, we've compiled an excellent article that delves into some of the most commonly encountered challenges CISOs face, along with the steps they can take to combat those threats.
Want more tech news? Subscribe to ComputingEdge Newsletter Today!
Role of CISO in Maintaining Security

When it comes to combating threats, the most significant step that CISOs (Chief Information Security Officer) can take is to alter their attitudes. Instead of limiting pressing security matters to the relevant teams, enterprises need to believe that cybersecurity is the entire organization's responsibility. The slightest mistake of even one employee could have devastating consequences for the company as a whole.

Organizations must formulate well-defined security plans with effective yet attainable security goals. For this to work out, companies must employ the "right" cybersecurity leader to guide employees through the security measures that have been used and overlook the entire cybersecurity strategy. Unfortunately, many modern organizations are in denial of the urgency with which security matters need to be resolved and continue to harbor the misheard belief that they face no severe risk, which could not be further away from the reality of the situation.

As the threat landscape continues to evolve at a mind-boggling speed, many companies would rather accept the possibility of a cyberattack as an 'unavoidable security event' instead of employing innovative security measures that prevent these assaults from occurring in the first place. The only way that companies stand a chance against cybercriminals is to accept their reality. Moreover, employ robust cybersecurity leadership and values, fostering a strong security culture within the enterprise.

Companies tend to forego the significance of appointing a trustworthy cybersecurity leader, which almost always ends in disaster. Succeeding in cybersecurity isn't just a matter of dumb luck; instead, companies need to utilize an arsenal of proficiencies, including special skills, contextual knowledge, along with a thorough understanding of risks and how to mitigate them. At the center of the security strategy, the cybersecurity leader bears responsibility for cohesion within the security team, effective communication between the entire organization, devising cybersecurity plans, prioritizing threats, and articulating value.

What Challenges Do CISOs Face?

CISOs carry a massive responsibility on their shoulders. Not only are they tasked with propagating security values within the workforce, but they also have to maintain a robust cybersecurity infrastructure- one which leaves no room for cybercriminals to exploit. Unlike the challenges encountered in IT, the threats faced by CISOs are frequently changing, which makes prevention against them an extremely arduous task. As malicious agents grow increasingly sophisticated in their attacking techniques, it is up for CISOs and organizations to undergo a similar evolution in their security measures if they wish to succeed in the fight against cybercriminals.

The CISO's job is to develop strategies that enable prevention against the threats occupying the digital landscape today and the vulnerabilities that may arise in the future. To ensure the longevity of the cybersecurity infrastructure, the CISO must find the optimal balance between the risks, costs, and effective usability factors. Some other responsibilities that the CISO needs to carry out include:

Articulating-managing and conveying the complex set of evolving cyber risks to the organization.

Addressing the slightest change within the developed security strategy and staying in lockstep with the process shifts implemented across the company.

Bringing higher-level executives on board with the developed security plan and garnering the support of every vendor and employee.

Monitor the integration of appropriate cybersecurity endpoint tools.

Managing Cyber Risk Within the Organization

The most difficult challenge that a CISO can encounter is effectively prioritizing, managing, and eliminating the cyber risks facing their organization. If an enterprise were to drop the 'management' part out of their security strategy, it would prove too expensive and burdensome to eliminate all threats- which is why prioritizing and managing threats is vital for the company's cybersecurity infrastructure success. The goals must be defined, and possible avenues for control explored to decide what is most important to a risk management initiative.

The organization's risk desire is defined through an executives-and-board discussion. It should be expressed in both qualitative and quantitative terms for clarity and metrics tracking. For any security strategy to succeed in its implementation for the long run, setting up achievable goals is highly essential. However, CISOs must do their due diligence and devise plans that foster security values instead of diminishing them.

The Bottom Line

The current state of the present-day threat landscape might make it difficult for employees and CISOs alike to maintain a positive attitude. But a silver lining to look forward to is that most large-scale companies have started to understand the significance of security and now include cybersecurity skills into the C-suite, and in some cases, even the board of directors. However, it is still the responsibility of every single employee to remain vigilant and exercise cybersecurity practices!

# data[].attributes.attachment_link.title
Cybersecurity for Organizations | IEEE Computer Society

# data[].attributes.attachment_link.description
As the security landscape continues to grow increasingly complex, harboring an arsenal of threats and vulnerabilities, it is high time for organizations to formulate a robust cybersecurity strategy. One needs to consider that enterprises experience a loss of $3.92 on average due to data breaches.

# data[].attributes.body
With the advent of technology for teaching, grading, attendance, and other school-related activities, third-party companies are entrusted with students private personal information. This article talked about the California-based company Illuminate Education, which suffered a breach and allowed up to 820,000 current and former NYC students' information to be stolen.

What is most disheartening about this story is that the company misrepresented its cybersecurity protocols to the school district, leading the district to believe that data was encrypted. According to the news story, New York state law requires encryption for personally identifiable student information (Elsen-Rooney, 2022).

The main issue with this story is that schools are trusting third-party vendors to maintain security within the law, but there are bad actors who are not living up to their end of the bargain, and it is virtually impossible for a school district to personally vet each and every vendor they deal with for cybersecurity issues.

# data[].attributes.attachment_link.readable_text
Personal data for roughly 820,000 current and former New York City public school students was compromised in the hack of a widely-used online grading and attendance system earlier this year, city Education Department officials said Friday, revealing what could be the largest-ever breach of K-12 student data in the U.S.

Furious city Education Department officials are accusing Illuminate Education, the California-based company behind the popular Skedula and PupilPath platforms, of misrepresenting its cybersecurity measures by certifying that it encrypts all student data when in fact the company left some of it unencrypted.

The breach prompted a weekslong shutdown of grading and attendance systems in January, causing chaos at city schools. The hackers gained access to a database with the names, birthdays, ethnicities, home languages and student ID numbers of current and former public school students going back to the 2016-17 school year, Illuminate told the Education Department. Illuminate did not specify what categories of information were compromised for each of the 820,000 affected students.

The hackers also extracted information about whether students get special education services, class and teacher schedules, and whether kids receive free lunch, according to the Education Department.

The hack amounts to what is likely the largest-ever single breach of personal student data in the U.S., according to an expert who has tracked school cybersecurity incidents, and raises a host of new privacy questions for families and city schools.

"I can't think of another school district that has had a student data breach of that magnitude stemming from one incident," said Doug Levin, the national director of K12 Security Information Exchange, a group that has tracked cyberattacks targeting schools and education platforms since 2016.

There are roughly 930,000 students in the city public school system.

The compromised data falls into four categories: "biographic information," which includes full names, birthdays, student ID numbers, ethnicity and language information; "special education information," which discloses whether a student receives services for a disability; "sensitive information," which relates to a student's economic status; and "academic information," which includes students' assessment grades and the names of their teachers.

Illuminate didn't break down how many students were affected by each category of data breach, other than disclosing that the hackers accessed economic status information for 15,000 students.

DOE spokesman Nathaniel Styer blasted Illuminate for allegedly fudging its cybersecurity protocols - and promised follow-up for families and schools.

"We are outraged that Illuminate represented to us and schools that legally required industry-standard critical safeguards were in place when they were not," he said.

Styer said the DOE asked the NYPD, FBI and New York Attorney General to investigate the initial hack, and requested that the state Education Department look into Illuminate's compliance with student data privacy laws.

"We understand how important it is that families can trust that their child's data is protected, and we are exploring options to hold Illuminate accountable for violating that trust," Styer added.

That Illuminate waited two months to formally notify the city of the breach "shows the company has been more concerned with protecting itself than protecting our students," Adams said in a statement.

"This is completely unacceptable, and why we've asked the NYSED [state Education Department] to investigate Illuminate's compliance with state law," Adams said. "We will not tolerate bad actors in this city and plan to hold Illuminate fully accountable for not providing our students with the security and timely notification the company promised."

In the coming weeks, the DOE said it will work with Illuminate to send the families of each of the roughly 820,000 students affected by the breach an individualized letter explaining what specific data was compromised. Illuminate will likely sponsor a credit-monitoring service for affected students, who may now be vulnerable to identity theft, education officials said.

"Certainly date of birth, names, that is sufficient to worry about that being obtained by criminal actors. I certainly think it would be appropriate credit monitoring would be offered to victims," said Levin.

DOE officials said Illuminate has not disclosed any information about what, if anything, the hackers had done with the personal data, or whether the company paid a ransom.

Illuminate said in a statement that its investigation into "unauthorized access of our systems" found that "some personal information was involved. We are in the process of notifying customers that may have been affected. There is no evidence of any fraudulent or illegal activity related to this incident."

A DOE spokesman said Illuminate previously certified as part of a data privacy and security agreement that it was encrypting all of its personal student data, but admitted in conversations with the DOE following the hack that the compromised data was not encrypted, education officials said.

State law requires that "encryption ... must be in place when [personally identifiable student] data is stored or transferred."

Levin said outside vendors like Illuminate that contract with schools have been the targets of an increasing number of cyberattacks - and don't always have adequate security measures in place.

Personal data belonging to kids is especially valuable on the dark web because kids are less likely than adults to be monitoring for identity theft or credit fraud, Levin added.

"It is absolutely the case that criminals can open accounts for minors, and damage their creditworthiness even before they get out of elementary school," he said.

That's a big concern for Cynthia McKnight, the parent of a teenager at the Brooklyn Latin School who uses PupilPath for his grades.

"It's shocking," she said. "I have a family member who went through identity theft and it was horrible trying to correct ... we're going to have to monitor his [my son's] credit. I wasn't expecting it so young."

Illuminate said not all information stored in PupilPath and Skedula was compromised, according to the Education Department.

No specific data from students' individual education plans, financial information or social security numbers were accessed, according to the DOE.

Levin said it's difficult to determine without a detailed report "whether the company was negligent, or whether the DOE was negligent, or whether they had reasonable practices" and were unlucky victims.

Illuminate does not have any districtwide contracts with the city Education Department, but hundreds of individual public schools have their own deals with Illuminate and have paid the company more than $16 million since 2019.

Schools that use Skedula and PupilPath rely heavily on the systems to track grades and attendance, keep in touch with parents and even contact trace positive COVID-19 cases - which is why the weekslong outage caused such disruption for educators and families.

DOE officials said Illuminate has agreed to a review by the DOE and an independent monitor to verify its cybersecurity safeguards, and a spokesman said "we do not believe that it is in the best interest of school communities to remove this service and disrupt school operations during this school year."

"For next school year, we are reviewing whether to allow the use of Illuminate products in our schools," the spokesman added.

# data[].attributes.attachment_link.title
Data of 820,000 NYC students compromised in hack of online grading system: Education Dept.

# data[].attributes.attachment_link.description
Furious city Education Department officials are accusing Illuminate Education, the California-based company behind the popular Skedula and PupilPath platforms, of misrepresenting its cybersecurity measures by certifying that it encrypts all student data when in fact the company left some of it unencrypted.

# data[].attributes.body
Principle 2 of the IEEE Computer Society (IEEE) Code of Ethics states: “Software engineers shall act in a manner that is in the best interests of their client and employer, consistent with the public interest. In particular, software engineers shall, as appropriate:
2.05. Keep private any confidential information gained in their professional work, where such confidentiality is consistent with the public interest and consistent with the law” (IEEE Computer Society, 1999, 2 section).

In my career as a computer programmer and now as a network engineer and information technology professional, I have access to a large amount of data. I consider it paramount that I protect that data to the best of my ability and take any safeguards necessary to prevent its unauthorized use. Although I am not a member of IEEE, I take their code of ethics very seriously.

# data[].attributes.attachment_link.readable_text
Short Version

PREAMBLE

The short version of the code summarizes aspirations at a high level of the abstraction; the clauses that are included in the full version give examples and details of how these aspirations change the way we act as software engineering professionals. Without the aspirations, the details can become legalistic and tedious; without the details, the aspirations can become high-sounding but empty; together, the aspirations and the details form a cohesive code.

Software engineers shall commit themselves to making the analysis, specification, design, development, testing and maintenance of software a beneficial and respected profession. In accordance with their commitment to the health, safety and welfare of the public, software engineers shall adhere to the following Eight Principles:

1. PUBLIC - Software engineers shall act consistently with the public interest.

2. CLIENT AND EMPLOYER - Software engineers shall act in a manner that is in the best interests of their client and employer consistent with the public interest.

3. PRODUCT - Software engineers shall ensure that their products and related modifications meet the highest professional standards possible.

4. JUDGMENT - Software engineers shall maintain integrity and independence in their professional judgment.

5. MANAGEMENT - Software engineering managers and leaders shall subscribe to and promote an ethical approach to the management of software development and maintenance.

6. PROFESSION - Software engineers shall advance the integrity and reputation of the profession consistent with the public interest.

7. COLLEAGUES - Software engineers shall be fair to and supportive of their colleagues.

8. SELF - Software engineers shall participate in lifelong learning regarding the practice of their profession and shall promote an ethical approach to the practice of the profession.

Full Version

PREAMBLE

Computers have a central and growing role in commerce, industry, government, medicine, education, entertainment and society at large. Software engineers are those who contribute by direct participation or by teaching, to the analysis, specification, design, development, certification, maintenance and testing of software systems. Because of their roles in developing software systems, software engineers have significant opportunities to do good or cause harm, to enable others to do good or cause harm, or to influence others to do good or cause harm. To ensure, as much as possible, that their efforts will be used for good, software engineers must commit themselves to making software engineering a beneficial and respected profession. In accordance with that commitment, software engineers shall adhere to the following Code of Ethics and Professional Practice.

The Code contains eight Principles related to the behavior of and decisions made by professional software engineers, including practitioners, educators, managers, supervisors and policy makers, as well as trainees and students of the profession. The Principles identify the ethically responsible relationships in which individuals, groups, and organizations participate and the primary obligations within these relationships. The Clauses of each Principle are illustrations of some of the obligations included in these relationships. These obligations are founded in the software engineer's humanity, in special care owed to people affected by the work of software engineers, and the unique elements of the practice of software engineering. The Code prescribes these as obligations of anyone claiming to be or aspiring to be a software engineer.

It is not intended that the individual parts of the Code be used in isolation to justify errors of omission or commission. The list of Principles and Clauses is not exhaustive. The Clauses should not be read as separating the acceptable from the unacceptable in professional conduct in all practical situations. The Code is not a simple ethical algorithm that generates ethical decisions. In some situations standards may be in tension with each other or with standards from other sources. These situations require the software engineer to use ethical judgment to act in a manner which is most consistent with the spirit of the Code of Ethics and Professional Practice, given the circumstances.

Ethical tensions can best be addressed by thoughtful consideration of fundamental principles, rather than blind reliance on detailed regulations. These Principles should influence software engineers to consider broadly who is affected by their work; to examine if they and their colleagues are treating other human beings with due respect; to consider how the public, if reasonably well informed, would view their decisions; to analyze how the least empowered will be affected by their decisions; and to consider whether their acts would be judged worthy of the ideal professional working as a software engineer. In all these judgments concern for the health, safety and welfare of the public is primary; that is, the "Public Interest" is central to this Code.

The dynamic and demanding context of software engineering requires a code that is adaptable and relevant to new situations as they occur. However, even in this generality, the Code provides support for software engineers and managers of software engineers who need to take positive action in a specific case by documenting the ethical stance of the profession. The Code provides an ethical foundation to which individuals within teams and the team as a whole can appeal. The Code helps to define those actions that are ethically improper to request of a software engineer or teams of software engineers.

The Code is not simply for adjudicating the nature of questionable acts; it also has an important educational function. As this Code expresses the consensus of the profession on ethical issues, it is a means to educate both the public and aspiring professionals about the ethical obligations of all software engineers.

PRINCIPLES

Principle 1 - PUBLIC

Software engineers shall act consistently with the public interest. In particular, software engineers shall, as appropriate:

1.01. Accept full responsibility for their own work.

1.02. Moderate the interests of the software engineer, the employer, the client and the users with the public good.

1.03. Approve software only if they have a well-founded belief that it is safe, meets specifications, passes appropriate tests, and does not diminish quality of life, diminish privacy or harm the environment. The ultimate effect of the work should be to the public good.

1.04. Disclose to appropriate persons or authorities any actual or potential danger to the user, the public, or the environment, that they reasonably believe to be associated with software or related documents.

1.05. Cooperate in efforts to address matters of grave public concern caused by software, its installation, maintenance, support or documentation.

1.06. Be fair and avoid deception in all statements, particularly public ones, concerning software or related documents, methods and tools.

1.07. Consider issues of physical disabilities, allocation of resources, economic disadvantage and other factors that can diminish access to the benefits of software.

1.08. Be encouraged to volunteer professional skills to good causes and contribute to public education concerning the discipline.

Principle 2 - CLIENT AND EMPLOYER

Software engineers shall act in a manner that is in the best interests of their client and employer, consistent with the public interest. In particular, software engineers shall, as appropriate:

2.01. Provide service in their areas of competence, being honest and forthright about any limitations of their experience and education.

2.02. Not knowingly use software that is obtained or retained either illegally or unethically.

2.03. Use the property of a client or employer only in ways properly authorized, and with the client's or employer's knowledge and consent.

2.04. Ensure that any document upon which they rely has been approved, when required, by someone authorized to approve it.

2.05. Keep private any confidential information gained in their professional work, where such confidentiality is consistent with the public interest and consistent with the law.

2.06. Identify, document, collect evidence and report to the client or the employer promptly if, in their opinion, a project is likely to fail, to prove too expensive, to violate intellectual property law, or otherwise to be problematic.

2.07. Identify, document, and report significant issues of social concern, of which they are aware, in software or related documents, to the employer or the client.

2.08. Accept no outside work detrimental to the work they perform for their primary employer.

2.09. Promote no interest adverse to their employer or client, unless a higher ethical concern is being compromised; in that case, inform the employer or another appropriate authority of the ethical concern.

Principle 3 - PRODUCT

Software engineers shall ensure that their products and related modifications meet the highest professional standards possible. In particular, software engineers shall, as appropriate:

3.01. Strive for high quality, acceptable cost and a reasonable schedule, ensuring significant tradeoffs are clear to and accepted by the employer and the client, and are available for consideration by the user and the public.

3.02. Ensure proper and achievable goals and objectives for any project on which they work or propose.

3.03. Identify, define and address ethical, economic, cultural, legal and environmental issues related to work projects.

3.04. Ensure that they are qualified for any project on which they work or propose to work by an appropriate combination of education and training, and experience.

3.05. Ensure an appropriate method is used for any project on which they work or propose to work.

3.06. Work to follow professional standards, when available, that are most appropriate for the task at hand, departing from these only when ethically or technically justified.

3.07. Strive to fully understand the specifications for software on which they work.

3.08. Ensure that specifications for software on which they work have been well documented, satisfy the users requirements and have the appropriate approvals.

3.09. Ensure realistic quantitative estimates of cost, scheduling, personnel, quality and outcomes on any project on which they work or propose to work and provide an uncertainty assessment of these estimates.

3.10. Ensure adequate testing, debugging, and review of software and related documents on which they work.

3.11. Ensure adequate documentation, including significant problems discovered and solutions adopted, for any project on which they work.

3.12. Work to develop software and related documents that respect the privacy of those who will be affected by that software.

3.13. Be careful to use only accurate data derived by ethical and lawful means, and use it only in ways properly authorized.

3.14. Maintain the integrity of data, being sensitive to outdated or flawed occurrences.

3.15 Treat all forms of software maintenance with the same professionalism as new development.

Principle 4 - JUDGMENT

Software engineers shall maintain integrity and independence in their professional judgment. In particular, software engineers shall, as appropriate:

4.01. Temper all technical judgments by the need to support and maintain human values.

4.02 Only endorse documents either prepared under their supervision or within their areas of competence and with which they are in agreement.

4.03. Maintain professional objectivity with respect to any software or related documents they are asked to evaluate.

4.04. Not engage in deceptive financial practices such as bribery, double billing, or other improper financial practices.

4.05. Disclose to all concerned parties those conflicts of interest that cannot reasonably be avoided or escaped.

4.06. Refuse to participate, as members or advisors, in a private, governmental or professional body concerned with software related issues, in which they, their employers or their clients have undisclosed potential conflicts of interest.

Principle 5 - MANAGEMENT

Software engineering managers and leaders shall subscribe to and promote an ethical approach to the management of software development and maintenance. In particular, those managing or leading software engineers shall, as appropriate:

5.01 Ensure good management for any project on which they work, including effective procedures for promotion of quality and reduction of risk.

5.02. Ensure that software engineers are informed of standards before being held to them.

5.03. Ensure that software engineers know the employer's policies and procedures for protecting passwords, files and information that is confidential to the employer or confidential to others.

5.04. Assign work only after taking into account appropriate contributions of education and experience tempered with a desire to further that education and experience.

5.05. Ensure realistic quantitative estimates of cost, scheduling, personnel, quality and outcomes on any project on which they work or propose to work, and provide an uncertainty assessment of these estimates.

5.06. Attract potential software engineers only by full and accurate description of the conditions of employment.

5.07. Offer fair and just remuneration.

5.08. Not unjustly prevent someone from taking a position for which that person is suitably qualified.

5.09. Ensure that there is a fair agreement concerning ownership of any software, processes, research, writing, or other intellectual property to which a software engineer has contributed.

5.10. Provide for due process in hearing charges of violation of an employer's policy or of this Code.

5.11. Not ask a software engineer to do anything inconsistent with this Code.

5.12. Not punish anyone for expressing ethical concerns about a project.

Principle 6 - PROFESSION

Software engineers shall advance the integrity and reputation of the profession consistent with the public interest. In particular, software engineers shall, as appropriate:

6.01. Help develop an organizational environment favorable to acting ethically.

6.02. Promote public knowledge of software engineering.

6.03. Extend software engineering knowledge by appropriate participation in professional organizations, meetings and publications.

6.04. Support, as members of a profession, other software engineers striving to follow this Code.

6.05. Not promote their own interest at the expense of the profession, client or employer.

6.06. Obey all laws governing their work, unless, in exceptional circumstances, such compliance is inconsistent with the public interest.

6.07. Be accurate in stating the characteristics of software on which they work, avoiding not only false claims but also claims that might reasonably be supposed to be speculative, vacuous, deceptive, misleading, or doubtful.

6.08. Take responsibility for detecting, correcting, and reporting errors in software and associated documents on which they work.

6.09. Ensure that clients, employers, and supervisors know of the software engineer's commitment to this Code of ethics, and the subsequent ramifications of such commitment.

6.10. Avoid associations with businesses and organizations which are in conflict with this code.

6.11. Recognize that violations of this Code are inconsistent with being a professional software engineer.

6.12. Express concerns to the people involved when significant violations of this Code are detected unless this is impossible, counter-productive, or dangerous.

6.13. Report significant violations of this Code to appropriate authorities when it is clear that consultation with people involved in these significant violations is impossible, counter-productive or dangerous.

Principle 7 - COLLEAGUES

Software engineers shall be fair to and supportive of their colleagues. In particular, software engineers shall, as appropriate:

7.01. Encourage colleagues to adhere to this Code.

7.02. Assist colleagues in professional development.

7.03. Credit fully the work of others and refrain from taking undue credit.

7.04. Review the work of others in an objective, candid, and properly- documented way.

7.05. Give a fair hearing to the opinions, concerns, or complaints of a colleague.

7.06. Assist colleagues in being fully aware of current standard work practices including policies and procedures for protecting passwords, files and other confidential information, and security measures in general.

7.07. Not unfairly intervene in the career of any colleague; however, concern for the employer, the client or public interest may compel software engineers, in good faith, to question the competence of a colleague.

7.08. In situations outside of their own areas of competence, call upon the opinions of other professionals who have competence in that area.

Principle 8 - SELF

Software engineers shall participate in lifelong learning regarding the practice of their profession and shall promote an ethical approach to the practice of the profession. In particular, software engineers shall continually endeavor to:

8.01. Further their knowledge of developments in the analysis, specification, design, development, maintenance and testing of software and related documents, together with the management of the development process.

8.02. Improve their ability to create safe, reliable, and useful quality software at reasonable cost and within a reasonable time.

8.03. Improve their ability to produce accurate, informative, and well-written documentation.

8.04. Improve their understanding of the software and related documents on which they work and of the environment in which they will be used.

8.05. Improve their knowledge of relevant standards and the law governing the software and related documents on which they work.

8.06 Improve their knowledge of this Code, its interpretation, and its application to their work.

8.07 Not give unfair treatment to anyone because of any irrelevant prejudices.

8.08. Not influence others to undertake any action that involves a breach of this Code.

8.09. Recognize that personal violations of this Code are inconsistent with being a professional software engineer.

This Code was developed by the IEEE-CS/ACM joint task force on Software Engineering Ethics and Professional Practices (SEEPP):

Executive Committee: Donald Gotterbarn (Chair),

Keith Miller and Simon Rogerson;

Members: Steve Barber, Peter Barnes, Ilene Burnstein, Michael Davis, Amr El-Kadi, N. Ben Fairweather, Milton Fulghum, N. Jayaram, Tom Jewett, Mark Kanko, Ernie Kallman, Duncan Langford, Joyce Currie Little, Ed Mechler, Manuel J. Norman, Douglas Phillips, Peter Ron Prinzivalli, Patrick Sullivan, John Weckert, Vivian Weil, S. Weisband, and Laurie Honour Werth.

This Code may be published without permission as long as it is not changed in any way and it carries the copyright notice.
Copyright © 1999 by the Institute for Electrical and Electronics Engineers, Inc. and the Association for Computing Machinery, Inc.

# data[].attributes.attachment_link.description
The short version of the code summarizes aspirations at a high level of the abstraction; the clauses that are included in the full version give examples and details of how these aspirations change the way we act as software engineering professionals.

# data[].attributes.body
​

Clay Walker is the technology director of Peaster Independent School District (Peaster ISD).   He is a former director at Bridgeport Independent School District and Little Elm Independent School District before taking the job at Peaster in 2020.

We talked about the importance of having legal and ethical guidelines to safeguard student PII (Personal identifiable information). Walker said that the law “codifies the requirements that schools must protect PII.  This can also give merit to the local director responsible that he/she is not "going crazy" trying to protect PII” (C. Walker & J. Hendry, personal communication, April 28, 2022).  Walker said that administrators must understand the balance between security and usability.  Information technology administrators lean more towards the security side. An emphasis on security can hinder usability by the customer (students). PII is an unseen commodity until there is a data breach. When that happens, it is too late to worry about what has been protected.

Walker described three best practices for safeguarding data in the school:

Limited access.  Users should not have access to data that is not necessary for their job.  For example, does a classroom teacher need to know the SSN of students in her class?  No.  So the systems that house that data should make sure the teachers do not have access to that particular element.

Mitigation. This goes along with Limited Access.  IF/When there is a network breach, only specific roles should have access to sensitive data.  For example, if a user's account is the source of a network breach, what becomes exposed is ONLY what that user has access to.  If this is a non-privileged user, they only have access to their classroom data which does not include sensitive data (such as SSN), but only Names and Local ID's.

Education.  In 2022, the end-user, without a doubt, is the most vulnerable piece of our security puzzle.  Majority (if not all) data breaches are focusing on the end-user clicking a link, opening and email, etc.  Educating the end-user to recognize illegitimate email messages and other communications is key in preventing network breaches (C. Walker & J. Hendry, personal communication, April 28, 2022).

One of the biggest issues facing school technology departments involves online testing.  The Texas Education Agency (TEA) has mandated that all assessment tests move to an online platform (Tex. Educ. Code § 39.02341) by the 2022-2023 academic year. Walker noted the new statute places technology departments in a more crucial role. “Up to this point, it has been more of a convenience that the technology department be available to fix things.  In reality, if the network or computer is broken, the teacher can still deliver instruction.  While it may not be ideal, it can still happen.  With the new online testing requirements, if the network or computer is broken, our assessments (that help determine our state accountability ratings) are not being delivered and therefore our accountability ratings are in direct jeopardy (C. Walker & J. Hendry, personal communication, April 28, 2022)”  Walker told me that technology departments can no longer be afterthoughts by school administrations.

Keeping up with all of the requirements and changes to the educational technology industry can be a full-time job. Walker is a member of the North Texas Association of Technical Directors (NTATD), an informal regional group that shares information, tips, and tools for better management of school technical departments. The group also discusses legal issues and the impacts they may have on educational institutions along with best practices for dealing with those potential issues.

​

# data[].attributes.headline
Best practices for safekeeping critical data

# data[].attributes.subject
Best practices for safekeeping critical data

# data[].attributes.body
​

I have been working in the computer industry in various jobs for the last 27 years.  The following is a list of recommendations and best practices to assist in keeping customer or user data safe and secure:

Limit data access to only those who require it for their job. Teachers do not need the social security number or home addresses of students. Do a regular inventory of who has access to critical data and limit access where necessary (C. Walker & J. Hendry, personal communication, April 28, 2022).

The safest way to protect data is to never collect the data. If specific data is not going to be used, then institutions should never ask for or collect that data (J. Clayton & J. Hendry, personal communication, May 29, 2022).

Limiting access rights to users can protect the overall network from potential bad actors. A teacher only needs access to some data regarding their classrooms. Principals only need data for their schools. Limiting access mitigates large amounts of data loss should those individuals get hacked or accidentally release data (C. Walker & J. Hendry, personal communication, April 28, 2022).

Know your vendors. Make sure that you understand their methods of securing data and that the security they implement is adequate to safeguard data and meet legal requirements for security. Understand that anytime you allow a third-party company to access data, you are putting your data at risk (Elsen-Rooney, 2022).

Educate your uses – frequently. Sometimes it’s difficult to remember that many teachers and administrators are not computer-literate. Most data breaches come from users clicking something they shouldn’t have, such as a bogus webpage, or a bad link in an email (C. Walker & J. Hendry, personal communication, April 28, 2022). Constant training, education, and online drills are necessary to help teach users the importance of online safety.

Don’t ignore your infrastructure. An IT administrator should constantly monitor and check servers, computers, and other appliances to ensure they have the latest virus and malware protection updates. It’s much easier to keep holes closed than have to restore data from backups.

Which leads to backups. Make sure that your off-site backups are stored in a secure location. I worked with a company once that stored their backups at the owner’s home. It was fine until his home was the target of a burglary and the perpetrators walked off with several backups of customer data.

​

# data[].attributes.body
Since my early days as a computer programmer, I’ve known that protecting data is paramount. Whether it is customer data or proprietary code I am judged by how I am able to safeguard the information provided to me. The fact that there are laws concerning data privacy is secondary to me. I believe that it is my moral and ethical obligation to protect information that is not mine to distribute and I don’t need a law to instruct me on what should be second nature. I have had easy access to valid credit card numbers, social security numbers, home addresses, and even medical information for customers of the companies I have completed projects for. There was never any inclination on my part to procure any of that information for personal gain.

However, as I have progressed through this class I have learned that laws are needed to prevent careless and accidental disclosure of information along with specific criteria for the release of data. It has been an interesting journey to see the different means of setting legal standards and understanding how those standards intertwine. However, I do believe that when it comes to ethical standards, one either has a sense of good ethics or they don’t. I’ve always believed that personal ethics are something internal. Ethics are not taught but instead are nurtured.

# data[].attributes.body
Bridgeport Independent School District. (2021). Bridgeport ISD student code of conduct. https://drive.google.com/file/d/1ne4nY_EBKEofvghDDLY55j1oZ1Pdc-ys/view

Clayton, J., & Hendry, J. (2022, May 29). Personal communication.

Elsen-Rooney, M. (2022, March 25). Data of 820,000 NYC students compromised in hack of online grading system: education dept.. New York Daily News. https://www.nydailynews.com/new-york/education/ny-hack-illuminate-online-gradebook-compromised-personal-data-20220325-ahy3b3b3t5cjzajau63muqcniq-story.html

Frost, E. (2006). Zero privacy: schools are violating students' Fourteenth Amendment right of privacy under the guise of enforcing zero tolerance policies. Washington Law Review, 81(2), 391–415. https://digitalcommons.law.uw.edu/wlr/vol81/iss2/6/

Gonzaga University v. Doe, 536 U.S. 273 (2002). https://www.supremecourt.gov/opinions/boundvolumes/536bv.pdf

Hlavak, G. C., Esq., & Easterly, E. J., Esq. (2015, April 1). FERPA primer: the basics and beyond. National association of colleges and employers. https://www.naceweb.org/public-policy-and-legal/legal-issues/ferpa-primer-the-basics-and-beyond/

IEEE Computer Society. (n.d.). About the IEEE computer society. IEEE computer society. Retrieved May 1, 2022, from https://www.computer.org/about

IEEE Computer Society. (1999). Code of ethics. https://www.computer.org/education/code-of-ethics

Schwartz, S. (2018, June 26). 5 tips for protecting student data and living up to FERPA. Education Week. https://marketbrief.edweek.org/marketplace-k-12/5-tips-protecting-student-data-living-ferpa/

Texas Education Code § 39.02341 (2019 & rev. 2021). https://statutes.capitol.texas.gov/Docs/ED/htm/ED.39.htm

The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g (1974 & rev. 2022). https://www.ecfr.gov/current/title-34/part-99

U.S. Const. art. XIV, § 1.

Walker, C., & Hendry, J. (2022, April 28). Personal communication.

Waqas, I. (2021, October 31). How to win the security fight: quick tips for CISOs and organizations. Trends. https://www.computer.org/publications/tech-news/trends/cybersecurity-for-organizations