Schools prove soft targets for hackers

I believe it was about the 12th of September when this whole thing started. Steve Bradshaw is superintendent of schools in Columbia Falls. That's a small town in Montana. About 30 miles away from Lacer National Park sits in the middle of the flathead valley. So like he said, it's back in September and he gets a text. I have a message that frightened me. It was basically stating that something would happen to me. He called the local police to report what he'd received. It turns out it wasn't just the superintendent. Threatening messages were rolling into students and teachers' phones and inboxes, too. And not just those in Columbia Falls, but in school districts throughout the flathead valley. And so I call the credit leaders of police chief back and said, I think I'm going to close school down tomorrow with these threats. I think we need to consider shutting the school down. He said, yeah, I think you're right. And I think it's about 4 a.m. before we finally realized, we're going to shut the whole valley down. They closed every school in the flathead valley until they could figure out what was going on. They discovered that a computer server in the Columbia Falls school district had been broken into by a faceless group of internet hackers from abroad. Once the hackers got into one server, they were able to access all of the district servers. - Well, we discovered it was a dark overlord. - All right, thanks, Jeremy. And another developing story. We now know more about the suspected cyber terrorist cell threatening the flathead valley today. - They will be your best friend if you cooperate and they will cause you a lot of financial and reputational damage if you don't. And the punishment will escalate. - We could tell we've been hacked because they got every school board members email address in that case. So it was frightening and they were, at that time, saying that they wanted $150,000 or the bitcoins. - U.S. Department of Education is warning schools nationwide about cyber terrorists. It comes after several schools, including more than two dozen schools in the flathead valley were targeted with threats to release private information of students and parents. - Not long after the dark overlords launched their cyber attack on Columbia Falls schools, they did the same thing to several other schools. - Just a month ago, dark overlord solutions attacked Columbia Falls servers. And now the group has hacked schools in Texas, Iowa, and Alabama. - Schools gather a lot of data on staff and students, things like names, birth dates, social security numbers, discipline records, and health records. With this data, thieves can create fake online identities or sell the students' information and identities. And schools' defenses against data thieves tend to be rickety. In this episode of the podcast, we're gonna look at the threats schools face from data thieves who hack into their systems. And we'll talk about another way schools may be losing control of student data without realizing it by using educational software in class. (upbeat music) For MAPM Reports, this is Educate, a podcast in collaboration with the Hekinger Report. I'm Steven Smith. - Schools face a lot of cyber threat, actually. - This is Tara Garcia-Mathuson. She covers innovation and technology and education for the Hekinger Report. - And this is something that the education kind of industry, I guess, has been late to the table too, because we think about all the threats that retail companies and corporations face, and that has been something that companies have been tackling for a long time. And schools just in the last few years are really getting on board with the idea that they need to spend time and energy and money really protecting data. And part of that is because schools are collecting more data now than they used to, and because hackers are turning to schools as sources of data that's worth stealing. - Because presumably they see schools as soft targets. - Exactly. - Well, why are schools so vulnerable to cyber threats? - Part of it is definitely budgets. So major corporations and retail companies have a lot more money to put into cybersecurity. Part of it is skill and capacity in the organization. So partly because schools have low budgets, they don't have as much money to spend on IT people who would be able to keep schools safe from this. - Let's say I have a child in sixth grade and I have a child who's a junior in high school. What kind of information might the schools have on them that someone would want to steal? - Well, there are a few different things. So one, just basic information. So name and birth date and one of the reasons why this kind of information, name, address, demographic information, part of why that is, that's something that hackers want to get, especially for kids and in both ages, fit under this umbrella that kids generally don't have accounts in lots of places. And so this is an information that's already out there and it's not information that's necessarily monitored as much. So adults may be monitoring to make sure that their identity is not stolen and getting annual credit reports and things like that. But there's not as much monitoring for kids. And so this is called, you know, it's kind of pristine data for hackers to steal and then use and maybe use without being noticed for a long time. So there's that and then schools are also using lots of educational apps these days. And so they're collecting tons of data about students that could fit into a profile that could be lucrative for companies trying to market things to families. With all of these education apps that teachers are using in the classroom, so many things are free. And so you don't have to pay to sign up or you don't have to pay to access the app. But everyone who accesses a free tool should know that there is some way that the company who created that tool is making a profit off of it. And so if they're not making a profit off of the user, they have to be making a profit off of something else. And so it's very often the data that's collected by the app that they can then turn around and sell, perhaps to a data broker directly to other companies that are interested in that data. - Let's talk about these data brokers. Who are they and what's their ambition? - Yeah, data brokers. So there are companies that basically create profiles using data that they collect on the internet based on people's purchasing habits and browsing habits. And so they are creating profiles about individuals to sell to other companies. And so often companies want to be able to target sales and marketing information. And so the more they know about someone's user habits, the more they can target the people who would be most likely to act on an app that they see, for example. And so data brokers are the ones that are connecting those companies with the data. - Can you put a scale on this in terms of all of the problems that a school might need to deal with? Where does cyber threat fit in that constellation? Is it a tiny thing? Is it a big thing? - I think it depends on who you talk to in a school. So an IT director would certainly say this is a top issue and a top kind of risk for schools because so much more data is being collected by schools now. The reality is, I mean, some school districts, K-12 districts are reporting probes from hackers and attempted attacks every few seconds every single day. There have been hundreds of cyber incidents, I guess, in the last couple of years. So Doug Levin, he's a consultant with ed tech strategies as his company and he has the cyber incident map. And so he's tracked 316 incidents since January 2016. - The reason that I began to track is that there was not good statistics on the nature of these incidents, the prevalence of these incidents, whether the threat was growing and what, you know, what it looked like. - This is Doug Levin. He started a company called ed tech strategies that helps schools and businesses beef up their cybersecurity. He helped develop education technology policies under President Clinton, George W. Bush, and Obama. - And I've been quite surprised at what I have found over the couple of years that I've assembled data. It does appear that the rate of attacks is increasing and certainly the severity is also increasing. One thing to note though is that I'm only able to track incidents that are reported publicly. Based on data that I have seen, primarily from States Attorney General, I have reason to believe that the number of incidents may be 10 to 20 times more than what I'm seeing. It's just the case that reporting requirements vary by state and locality. And many of those are not made public in any kind of a prompt way. - Are schools more vulnerable than other kinds of institutions and if so, why? - So the answer is sort of yes and no. Schools have begun to rely on technology and access to the internet like never before. And really since maybe 2008 or so, there has been renewed investment in school technology, particularly in broadband access to schools. It is increasingly common for students and teachers to have their own school-issued devices that are connected to the internet. So with that sort of exposure to the internet, we shouldn't be surprised that schools are now falling prey to these hacks and attacks. I think what makes schools a little bit different from other sorts of organizations or institutions is that schools are always struggling to manage their dollars. in their funding. And when they have enough money to purchase technology, they often are sort of just getting by. And so they may under-invest in cybersecurity training, they may under-invest in cybersecurity products. They may not be as sophisticated in terms of evaluating products for their sort of threat profile. And so the degree that schools have dedicated technology staff, they're more likely to have staff that are assisting teachers in using that technology and teaching and learning than in securing school networks from bad actors. And so, you know, what we see in the private sector is you may see one tech support specialist for every, you know, 50 to 200 or 300 users in extreme cases. In education, it wouldn't be surprising to see one tech support, a staff person for every 1,000 or 1200 devices. Like most school districts in this country, I believe, you know, technology hits school districts and we knew it was going to be a good tool, but we really didn't have anybody that was trained in technology. Which Columbia Falls Superintendent Steve Bradshaw again? We didn't know at the time how much it was going to grow and what the security risks were and those type of things. In Columbia Falls, the Sheriff's Department, a cybersecurity company and the FBI got involved in the case. They discovered the hackers got access to loads of data schools had been collecting on staff. They also got a lot of information on students. By law, we have to keep main pieces of the transcript of the student, of course. And then we have to keep other information. I think it's seven years in the state of Montana. We have to keep the health records and different things that we have on students and then we're supposed to destroy that information other than the transcripts. But because it's now all on computers and servers, I think school districts sometimes don't destroy the information as quickly as they should because sometimes they're not even aware that it's there. And any student that gets Medicaid benefits that is in our special needs program, we have to have their social security number along with their Medicaid number to be able to build and Medicaid for the services that we provide. So we send out notices to all the students, all the employees. Security consultant Doug Levin says there are some easy first step schools can take to protect their technology and the information they store. So I think there are three ways that I would start. These are not necessarily very expensive and these are things that people can do pretty quickly. So I think the first thing is important for people in schools to get a handle on their sort of password and account policies. So each user should have their own account, should not be sharing accounts, they should have strong passwords and use password managers. And that would, and to the extent that they can use two factor or multifactor authentication, essentially just sort of good password policies, that would go a long way. Secondly, I think schools could offer training and how to assess threats. So phishing attacks, malware, helping to educate users so that they're a little bit more skeptical about what they're seeing online, what they're downloading and what they're clicking. And then the third thing I would say is that it's really important for schools to keep their software and their technology up to date as they can. And so schools are often running older technology, but to the extent that they can, it's really important that they're running the most current versions of software, the most current drivers on their hardware. And those three things alone would go a long way to helping sort of reducing schools threat profile, if you will. It's what many people would call just good cyber hygiene. I think that the challenge for many people in the space is trying to balance the potential of these technologies to do good with the potential for them to do harm, primarily because of breaches of privacy. And we're looking at it's school cybersecurity issues. These are not hypothetical issues about what might happen with data that's collected about students. These are incidents that are already happening, and are already leaking data about students about educators, they're redirecting school resources away from school's hands and into criminals' pockets. And I've learned nothing else over this ordeal. It's how much work school districts have to do on their security with the information, the confidence or information that we have. Here's Superintendent Steve Bradshaw. What seems like, at least to my career, something that came along fairly fast, technology were crippled without the technology today. I mean, the good portion of what I do is the superintendent is handled by emails. The whole ordeal in Columbia Falls was taxing on the community and on the school's budget. Luckily, they had insurance that specifically covered cyber security. I can remember sitting with the person representing the school board's association and saying, "Hey, well, this is something good that you should be aware of," and I thought, "Well, who in the world do need that?" And remember that I know that following fall, I would need it. So, it was written into the plan, somebody had the foresight to write it into the plan, which is really fortunate, because I'm not sure this school district with our limited budget would have been able to financially handle what it cost to get through the situation, because by the time we got through, it was well over, not counting our personnel time and over time and that type of thing, but just the bill from the security company itself was over $200,000. When the dark overlords received a small payment from someone related to the case, they agreed to leave the district alone and to not release the data they had collected. The district did not pay any ransom whatsoever, and that definitely there was a ransom paid. It wasn't, it was about $5,000 from what I understand. I don't know who paid that, but the school district didn't pay it. But in their final email, to me, they said, well played, Mr. Bradshaw, because you paid us a partial payment, we won't throw all your information out there on the dark web. But you know, honestly, I can't tell you who paid the $5,000, but I know it wasn't the county, the sheriff's department. It wasn't our local police department, and it wasn't the district. So I have to assume that it was most likely a federal agency. The FBI declined to comment on whether they paid the $5,000. The Columbia Falls school district has put more protective measures into place in order to keep future data from getting into the wrong hands. They have reduced the number of servers used in the district, blocked access to websites outside of the United States, and implemented stricter password policies. New technology and software that teachers want to use in the classroom has to be approved by the district. They've also taken stock of the information they have archived digitally, and have moved some records to servers that aren't connected to the internet. We have created what we think is about as safe as we can afford to do. At the same time, I'm really concerned that we could get hacked again. And I think it's getting different in the country and all honesty could get hacked. Just the fact that these guys are so good at what they do, and we think we're one step of the head of them, but I don't think we are. That's it for this episode. We'd love to hear your thoughts and feedback. This podcast make you think twice about how schools protect personal information or how safe your own online data might be. Let us know we're on Twitter and Facebook at Educate Podcast, where you can send us a note to [email protected]. We'd also like to know if going to college changed your social class, APM reports is producing a documentary about colleges and economic mobility, we want to know what people gain and what they lose when they change social classes, and what higher education has to do with it. You can tell us your story by filling out a brief questionnaire at apmreports.org/documentaries so we can get in touch with you. We'll be back in two weeks to talk about why social mobility has stalled in the United States and the role that higher education plays. Alex Bomber. Tom Hart and Chris Juleen produced the podcast, "Gathering Winter Is Our Editor" and Emily Hanford is our senior producer. Our sound engineer for this episode was Corey Shrupple. We partner with the Heckinger Report, a non-profit independent news organization focused on inequality and innovation in education. Support for APM Reports comes from Lumenna Foundation and the Spencer Foundation. I'm Stephen Smith. Thanks for listening. This is APM.