I am skeptical about the first part (the second part, about facial recognition, seems good, and at this point might just be a budget issue -- that to comb throu

I am skeptical about the first part (the second part, about facial recognition, seems good, and at this point might just be a budget issue -- that to comb through the low quality results manually given current software would take too many man-hours). I have seen IT for school districts. It's often one person, who has an insane number of demands on their time, no resources, and no specialized knowledge in security, building a number of systems that handle sensitive and non-sensitive data the district cares about. Given how homogeneous that situation is, evading detection consistently seems... extremely doable. And being caught 1% of the time means they have access to 99% of the networks -- they aren't magicians, there wouldn't be a clear way to intuit the larger context. If they all use e.g. web based grading software, and that gets 0-day'd, your 'almost certain' estimate gets readjusted by quite a lot too, and that's not a crazy thing to have happen either.