3 ms·

Presumably the school district doesn't really care about its students' PII being released. I mean, they might feel a bit bad, and all else being equal they'd pr

Presumably the school district doesn't really care about its students' PII being released. I mean, they might feel a bit bad, and all else being equal they'd prefer not to have it released, but no one's going to lose their jobs or their funding just for that. So the enforcement mechanism here has to be through the courts: some student or students will sue the district for negligence. Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job, so it's a good stick for the hackers to use if the district would lose such a lawsuit. What's the case law like here? Are they likely to lose?

nerdponx 6y ago
...millions of dollars of taxpayer money.
nickff 6y ago
>"Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job" I'd bet this is something the voters will care about, but it's likely to be attributed to some 'innocent mistake', 'communication error', or 'server misconfiguration'. The school district won't lose any revenue, and I doubt anyone will get fired. Maybe a contractor will get scapegoated. People on HN complain about how reckless private companies are with their data, but bureaucracies are even less accountable.
edtechstrats 6y ago
Parents/students do not have a private right of action under applicable federal law (FERPA). The US Dept of Education could theoretically hold the school district to account, but that would be extraordinary (speaking of the current context, but also historically).
kiba 6y ago
It's against the law to pay the ransom. So damned if they do, and damned if they don't. I supposed it may light the districts' ass to get good security, but if you don't know what good security looks like, how are you supposed to know?
- HenryBemis 6y ago
  USA has a good number of security frameworks. Collaborating with a more advanced education institute (for guidance) and setting a programme/project would be possible if they wanted (or now to prevent the shitshow from happening again). Any uni that has undergone similar project will have the project charter, resources, skills, timelines, lessons learned (the whole project folder). Where there is a will there is a way. And I believe thay many organisations DO know that they operate on low/bad security, they just prefer to roll the dice and use the budget for something else..

nerdponx 6y ago

...millions of dollars of taxpayer money.

nickff 6y ago

>"Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job" I'd bet this is something the voters will care about, but it's likely to be attributed to some 'innocent mistake', 'communication error', or 'server misconfiguration'. The school district won't lose any revenue, and I doubt anyone will get fired. Maybe a contractor will get scapegoated. People on HN complain about how reckless private companies are with their data, but bureaucracies are even less accountable.

edtechstrats 6y ago

Parents/students do not have a private right of action under applicable federal law (FERPA). The US Dept of Education could theoretically hold the school district to account, but that would be extraordinary (speaking of the current context, but also historically).

kiba 6y ago

It's against the law to pay the ransom. So damned if they do, and damned if they don't. I supposed it may light the districts' ass to get good security, but if you don't know what good security looks like, how are you supposed to know?

HenryBemis 6y ago
USA has a good number of security frameworks. Collaborating with a more advanced education institute (for guidance) and setting a programme/project would be possible if they wanted (or now to prevent the shitshow from happening again). Any uni that has undergone similar project will have the project charter, resources, skills, timelines, lessons learned (the whole project folder). Where there is a will there is a way. And I believe thay many organisations DO know that they operate on low/bad security, they just prefer to roll the dice and use the budget for something else..