Pearson AIMSweb 1.0 Data Breach – What You Should Know

All,

As you may have heard recently through your Principal or in the media, the Boulder Valley School District found out that it is one of more than 13,000 school districts and universities that have been impacted by a data breach at one of our key vendors – Pearson.

First, it is important to know that this breach impacted current and former Boulder Valley School District students. The breach, although significant, was contained in BVSD to name and date of birth.  No other personal information was breached through this event at Pearson.

This information is being shared so that you are aware of the situation and can better answer any parent or community member questions that may come up.

The Pearson AimsWeb 1.0 Data Breach
BVSD learned in August 2019 that an unauthorized third party gained access to Pearson’s AIMSweb 1.0 system in November 2018.  Pearson was made aware by the FBI in March 2019 but was restricted in communicating to BVSD sooner due to the ongoing investigation.

We have notified individuals directly impacted by the breach by mail. Families would have received a letter by August 30 if they were affected. Pearson is paying for the expense of notifying families and for identity or credit monitoring service through Experian.

It is important to note that at this time, Pearson has no evidence to suggest that the breached information has been misused.

Why was BVSD Using AimsWeb 1.0?
Pearson is best known as the publisher of print and digital textbooks but also develops education-related software. BVSD used AIMSweb 1.0 to track progress, inform instruction, and provide updates to parents. AIMSweb 1.0 was permanently taken out of service in July.

Our own internal investigation found no other Pearson products to be impacted by this breach.

Next Steps
I take the safety and security of our students, staff, and their data extremely seriously – as does our entire leadership team.  BVSD already has many proactive processes in place to help prevent student data breaches, and we continue to reevaluate our processes for improvements.

Additionally, BVSD continues to be in compliance with the Colorado Student Data and Transparency Act and remains vigilant in protecting student data. We will continue to work with Pearson and other vendors to ensure everything possible is done to protect the privacy of student data.

Working together, we can minimize threats, including phishing attacks, viruses, malware, and ransomware.   As always, please chime in below with your thoughts, comment, and ideas on this topic.

Andrew 

Back to School Updates from IT for 2018-2019

Today marks the first day of the 2018-2019 school year! I hope that you have all had an enjoyable and refreshing summer.  For our team, we've spent much of the summer working to continue to improve our technology integration in BVSD. Here are a few of the projects we have been focusing on:


Student Data Privacy Course 
In addition to updating our Student Data Privacy website, all staff members who work with student information are now required to take a Data Privacy course. For more information, please see the BVSD Ed Tech blog post about this topic.


Digital Citizenship 
To prepare our students for the world they live in, we focus on teaching digital citizenship from kindergarten to 12th grade. This summer, we have reorganized and enhanced our digital citizenship resources. Among the new resources is a scope & sequence, which allows teachers at any grade level to quickly identify concepts and lessons to ensure each student is supported in an age-appropriate manner. The inclusion of digital citizenship lessons in our curriculum is also in the superintendent's 100-day plan.

Parent Engagement

My team is continually working on developing resources and avenues for parents to have conversations about technology. We opened up the District Technology Advisory Committee for another round of applications, and had nearly 200 people apply! In order to receive more input from the community, we are developing a comprehensive survey about technology to send to parents, which will be reviewed by the Board of Education and sent out this fall. Additionally, we are putting together “bundles” for schools to host P.E.P. (Parent Engagement Program) Talks - timely conversations about relevant technology topics. We look forward to continuing an open dialogue about the successes and challenges of using technology, both in the classroom and at home.

Updated Technology Policies
In December of 2017, the Board of Education approved the Student Data Privacy Policy, paving the way to update our student & staff technology policies as well. The staff policy revisions, passed on August 14th, reflect the rapidly changing nature of technology and ensure the responsible use of technology throughout the district. Work will continue on an updated student policy once information from the parent survey is available later this year.

Phones

We have now deployed a new phone system in every school & building! These phones have enhanced, modernized features, such as sending voicemails to email, to help streamline communication. Employees, be on the lookout for ideas about how to use these new features in the weekly IT Tips & Tricks emails.

Innovate@BVSD 2018
On July 30-31st, educators, administrators, and students from BVSD and other Colorado school districts joined together at Innovate@BVSD 2018. They spent time learning about and experiencing creativity, critical thinking, communication, and collaboration in action throughout the conference. Hear what teachers and students had to say about the conference in this short video:

My team and I look forward to welcoming you back for another great school year and seeing some of these new resources in action! If you have any thoughts or input that you feel can be helpful, please chime in below.

Andrew Moore

CIO, Boulder Valley School District

Student Data Privacy v2.0

On December 12, 2017, the BVSD Board of Education adopted a Student Data Privacy Policy, as mandated by the state. In response to the rapid advance of technology, this is the first time our district has had a robust policy around data privacy. The wording was adapted from the Colorado Association of School Boards (CASB) model policy that was developed by district leaders from all around the state last year.

There were three placeholders put into the BVSD policy for us to continue to research: Chrome sync, data sharing for research purposes, & centralized vetting of apps. My team is currently working with the District Technology Advisory Committee (DTAC) and Tech Contacts to determine pros & cons for each item, which will be brought back to the board for further review. For more information on each topic, please see below:

1. Chrome Sync

When a user signs in using their Google account, Chrome will sync bookmarks, history, passwords, extensions, and other settings across devices. This allows the user to continue working in a consistent, personalized environment no matter what device they are using. This would affect all users, but specifically, BVSD students who use shared devices such as carts, computer labs, and library computers. For additional information, please see this video.

2. Data Sharing

BVSD has worked in collaboration with the Colorado Department of Education (CDE) and research organizations to participate in Data Sharing Agreements to gather anonymous student data for analysis for research purposes. For example, BVSD has shared anonymized student data with an organization studying the correlation between air quality and absences due to respiratory issues in our schools. Parties wishing to partner with BVSD for research must engage in the district’s Research Review Process. This process includes procedures that align with BVSD Board Policies regarding data privacy, requiring student anonymity, to ensure that research will benefit the district and/or education.

3. Centralized Vetting of Apps

Vetting applications means evaluating them for both their instructional use and student safety and data privacy. Vetting can be done by:

• IT personnel
• Curriculum specialists in Instructional Services & Equity
• Teachers & Teacher Librarians
• Students

Currently, we require a Data Privacy Addendum (DPA) from every vendor that we contract with to purchase software. Additionally, we soon will be asking teachers to watch this video, vet, and list free click-through applications that they are using in their classrooms. Centralized vetting would mean that this responsibility would shift to district personnel.

What's Next?
Teachers will soon get their biannual survey, required by law, to add any apps and/or websites, they use to this list. If you are a teacher, please be on the lookout for this required action early in 2018.

It is essential that we all stay compliant with the law and engage in transparent communication with our community around this important issue of keeping student data private!

Please chime in below with your comments.

Andrew

Welcome back to the 16-17 school year!

After a much needed break our teachers and staff will be coming back to systems that have been updated for security and ease of use. New student usernames and passwords will help us educate our younger students on keeping private information confidential, and older students on strong passwords and why they are important.

Teachers and staff can now turn on dual factor authentication within their Google accounts making their account inaccessible by an intruder if their password is ever compromised. This feature is currently mandatory for all IT and Ed Tech employees.

Another change implemented over the summer is the way in which schools will order new technology. This new way of ordering technology tools is just like how schools currently order paper and pencils. No more special process for ordering technology! And most of what you can order is in stock to ensure timely deliveries.

This year I personally plan to spend more time finding ways to eliminate the digital divide in our schools. From continuing our 1:Web programs at Centaurus and Broomfield high schools to providing direct internet to those in need, my focus on this civil rights issue is sure to grow.

Finally, watch for information on new networks, phones, technology funding, and expanding partnerships as the year plays out and IT continues to support the Success Effect in BVSD. I continue to believe IT must innovate and adapt to support our teachers and students with new teaching practices. I will continue help to ensure that the best future-ready learning environments are available for all of our students.

Please log in to chime in below. I appreciate your input - innovative and critical alike. Both make us better at what we do.

Happy 16-17 School Year!

Andrew