Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article

This Is Going on Your Permanent Record: A Legal Analysis of Educational Data in the Cloud

Published: 09 August 2024 Publication History

Abstract

Timeline of FERPA legislation, case law related to it, and computing technologies
Moving operations to the cloud has become a way of life for many educational institutions. Much of the information these institutions store in the cloud is protected by the Family Educational Rights and Privacy Act (FERPA), which was last amended in 2002, well before cloud computing became ubiquitous. The application of a 1974 law to 21st-century technology presents a plethora of legal and technical questions. In this article, we present an interdisciplinary analysis of these issues. We examine both existing statutes and case law and contemporary research into cloud security, focusing on the impact of the latter on the former. We find that FERPA excludes information that students and faculty often believe is protected and that lower-court decisions have created further ambiguity. We additionally find that given current technology, the statute is no longer sufficient to protect student data, and we present recommendations for revisions.

References

[1]
[n. d.]. Privacy act of 1974, public law no. 93-579. U.S. Statutes at Large 88 ([n. d.]). pp. 1896-1910 (codified as amended in U.S. Code, Title 5, Section 552a).
[2]
1974. Family Educational Rights and Privacy Act of 1974. U.S. Statutes at Large 88 (1974). pp. 828–834 (codified as amended in U.S. Code, Title 20, Section 1232g).
[4]
Ohio Revised Code §149.43(A)(1)(v). [n. d.]. ([n. d.]).
[5]
Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, and Mauro Conti. 2018. A survey on homomorphic encryption schemes: Theory and implementation. Comput. Surveys 51, 4, Article 79 (July2018), 35 pages.
[6]
Giuseppe Ateniese, Randal Burns, Reza Curtmola, Joseph Herring, Lea Kissner, Zachary Peterson, and Dawn Song. 2007. Provable data possession at untrusted stores. In Proceedings of the 14th ACM Conference on Computer and Communications Security (Alexandria, Virginia, USA) (CCS ’07). Association for Computing Machinery, New York, NY, USA, 598–609.
[7]
Baltimore County Public Schools. 2021. Rule 4104: Acceptable Use Policy for Technology and Social Media (TAUP) for Authorized Users. Retrieved July 20, 2022 from https://go.boarddocs.com/mabe/bcps/Board.nsf/files/C7P2QC034476/$file/RULE4104_092821_Finalized.pdf
[8]
Bauer v. Kincaid. 1991. Federal Supplement 759 (1991), 575. U.S. District Court for the Western District of Missouri.
[9]
Erik Carl Bennett. 2020. Jumping into the Cloud: Privacy, Security and Trust of Cloud-Based Computing within K-12 American Public Education. Ph. D. Dissertation. City University of New York.
[10]
Johann Betz, Dirk Westhoff, and Günter Müller. 2017. Survey on covert channels in virtual machines and cloud computing. Transactions on Emerging Telecommunications Technologies 28, 6 (2017), 16 pages.
[11]
Arnab Kumar Biswas, Dipak Ghosal, and Shishir Nagaraja. 2017. A survey of timing channels and countermeasures. Comput. Surveys 50, 1, Article 6 (March2017), 39 pages.
[12]
Ivano Bongiovanni. 2019. The least secure places in the universe? A systematic literature review on information security management in higher education. Computers & Security 86 (2019), 350–357.
[13]
John M. Borky and Thomas H. Bradley. 2018. Protecting information with cybersecurity. Effective Model-Based Systems Engineering (2018), 345—-404.
[14]
Kevin D. Bowers, Ari Juels, and Alina Oprea. 2009. Proofs of retrievability: Theory and implementation. In Proceedings of the 2009 ACM Workshop on Cloud Computing Security (Chicago, Illinois, USA) (CCSW ’09). Association for Computing Machinery, New York, NY, USA, 43–54.
[15]
Kevin D. Bowers, Marten van Dijk, Ari Juels, Alina Oprea, and Ronald L. Rivest. 2011. How to tell if your cloud files are vulnerable to drive crashes. In Proceedings of the 18th ACM Conference on Computer and Communications Security (Chicago, Illinois, USA) (CCS ’11). Association for Computing Machinery, New York, NY, USA, 501–514.
[16]
Burnett v. San Mateo–Foster City School District, No. 17-15841. 2018. (2018). (U.S. Court of Appeals for the Ninth Circuit).
[17]
Tom Burt. 2019. Recent Cyberattacks Require us all to be Vigilant. Retrieved August 15, 2022 from https://blogs.microsoft.com/on-the-issues/2019/10/04/recent-cyberattacks-require-us-all-to-be-vigilant/
[18]
Jack Cable, Drew Gregory, Liz Izhikevich, and Zakir Durumeric. 2021. Stratosphere: Finding vulnerable cloud storage buckets. In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses (San Sebastian, Spain) (RAID ’21). Association for Computing Machinery, New York, NY, USA, 399–411.
[19]
Central Dauphin School District v. Hawkins. 2018. Atlantic Reporter, 3rd Series 199 (2018), 1005. Commonwealth Court of Pennsylvania.
[20]
Children’s Online Privacy Protection Act of 1998, Public Law No. 105-277, Title XIII. [n. d.]. U.S. Statutes at Large 112 ([n. d.]). pp. 728–735 (codified as amended in U.S. Code, Title 15, Sections 6501–6506).
[21]
Code of Federal Regulations, Title 34, Part 99, Section 31. [n. d.]. ([n. d.]).
[22]
Ben Cohen, Ashley Hu, Deisy Patino, and Joel Coffman. 2022. Educational data in the cloud: Legal implications and technical recommendations. In 2022 IEEE/ACM 15th International Conference on Utility and Cloud Computing (UCC) (Vancouver, WA). IEEE, 181–182.
[23]
Andrea Continella, Mario Polino, Marcello Pogliani, and Stefano Zanero. 2018. There’s a hole in that bucket! A large-scale analysis of misconfigured S3 buckets. In Proceedings of the 34th Annual Computer Security Applications Conference (San Juan, PR, USA) (ACSAC ’18). Association for Computing Machinery, New York, NY, USA, 702–711.
[24]
Curto v. Smith. 2003. Federal Supplement, 2nd Series 248 (2003), 132. (U.S. District Court for the Northern District of N.Y.).
[25]
Lynn M. Daggett. 2008. FERPA in the twenty-first century: Failure to effectively regulate privacy for all students. Catholic University Law Review 58, 1 (2008), 60–114.
[26]
Daniel S. v. Board of Education of York Community High School. 2001. Federal Supplement, 2nd Series 152 (2001), 949. (U.S. District Court for the Northern District of Illinois).
[27]
Carlo Di Giulio, Read Sprabery, Charles Kamhoua, Kevin Kwiat, Roy H. Campbell, and Masooda N. Bashir. 2017. Cloud security certifications: A comparison to improve cloud service provider security. In Proceedings of the Second International Conference on Internet of Things, Data and Cloud Computing (Cambridge, United Kingdom) (ICC ’17). Association for Computing Machinery, New York, NY, USA, Article 120, 12 pages.
[28]
Carlo Di Giulio, Read Sprabery, Charles Kamhoua, Kevin Kwiat, Roy H. Campbell, and Masooda N. Bashir. 2017. Cloud standards in comparison: Are new security frameworks improving cloud security?. In 2017 IEEE 10th International Conference on Cloud Computing (CLOUD 2017). IEEE, 50–57.
[29]
Easton Area School District v. Miller. 2018. Atlantic Reporter, 3rd Series 191 (2018), 75. Commonwealth Court of Pennsylvania.
[30]
Lesley Fair. 2022. FTC to Ed Tech: Protecting Kids’ Privacy is Your Responsibility. Retrieved August 15, 2022 from https://www.ftc.gov/business-guidance/blog/2022/05/ftc-ed-tech-protecting-kids-privacy-your-responsibility
[31]
Family Educational Rights and Privacy. 2008. Federal Register 73 (2008), 74816. (amending Code of Federal Regulations, Title 34, Section 99).
[32]
Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, and Multi-State Information Sharing and Analysis Center. 2020. Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data. Retrieved August 15, 2022 from https://www.cisa.gov/uscert/ncas/alerts/aa20-345a
[33]
Federal Rules of Civil Procedure, Section 12(b)(6). [n. d.]. ([n. d.]).
[34]
Frasca v. Andrews. 1979. Federal Supplement 463 (1979), 1043. (U.S. District Court for the Eastern District of New York).
[35]
Katie Fritchen. 2020. How to apply the NIST cybersecurity framework in K-12 school districts. Managed Methods (2020).
[36]
Paul A. Gasparotti. 2022. Proceedings of the Public Meeting of the Board of Education of Baltimore County, February 8, 2022. Retrieved August 7, 2022 from https://cdn5-ss3.sharpschool.com/UserFiles/Servers/Server_2744/File/BOE/info-summaries/21-22/Baltimore%20County%20Board%20of%20Education%20Meeting%20-%20020822%20(Condensed).pdf
[37]
Gonzaga University v. John Doe. 2002. U.S. Reports 536 (2002), 273.
[38]
Google. 2021. Google Workspace for Education terms of service. Retrieved August 10, 2022 from https://workspace.google.com/terms/education_terms.html
[39]
Vipul Goyal, Omkant Pandey, Amit Sahai, and Brent Waters. 2006. Attribute-based encryption for fine-grained access control of encrypted data. In Proceedings of the 13th ACM Conference on Computer and Communications Security (Alexandria, Virginia, USA) (CCS ’06). Association for Computing Machinery, New York, NY, USA, 89–98.
[40]
J. N. Gray and M. Anderton. 1987. Distributed computer systems: Four case studies. Proc. IEEE 75, 5 (1987), 719–726.
[41]
D. R. Harward. 2018. Cyber Attackers Hold Valley College Hostage. Retrieved August 16, 2022 from https://web.archive.org/web/20170223200024http://thevalleystar.com/cyber-attackers-hold-valley-college-hostage/
[42]
Taarika Hegde, Josh Gangl, Stanislav Babenko, and Joel Coffman. 2023. Cloud security frameworks: A comparison to evaluate cloud control standards. In Proceedings of the IEEE/ACM 16th International Conference on Utility and Cloud Computing (Taormina (Messina), Italy) (UCC 2023). Association for Computing Machinery, New York, NY, USA, 6.
[43]
Hudl. 2022. Privacy Policy. Retrieved August 10, 2022 from https://www.hudl.com/privacy
[44]
Nader Issa and Lauren FitzPatrick. 2022. Massive CPS Data Breach Exposes Records of 560,000 Students, Employees. Retrieved August 16, 2022 from https://chicago.suntimes.com/education/2022/5/20/23132983/cps-public-schools-data-breach-students-employees-records-battelle-kids
[45]
Scott Jaschik. 2022. Lincoln College in Illinois to close. Retrieved July 26, 2022 from https://www.insidehighered.com/news/2022/04/01/lincoln-college-illinois-close
[46]
Jensen Ex Rel. CJ v. Reeves. 1999. Federal Supplement, 2nd Series 45 (1999), 1265. (U.S. District Court for the District of Utah).
[47]
Jensen Ex Rel. CJ v. Reeves. 2000. Federal Reporter, 3rd Series 233 (2000), 1203. (U.S. Court of Appeals for the Tenth Circuit).
[48]
Shaharyar Khan, Ilya Kabanov, Yunke Hua, and Stuart Madnick. 2022. A systematic analysis of the capital one data breach: Critical lessons learned. ACM Transactions on Privacy and Securiry 26, 1, Article 3 (Nov.2022), 29 pages.
[49]
Kristal Kuykendall. 2022. Battelle for Kids Data Breach Impact Spreads from Ohio to Illinois, Now Includes 600K+ Students. https://thejournal.com/articles/2022/05/24/battelle-for-kids-data-breach-impact-spreads-from-ohio-to-illinois.aspx
[50]
Carl E. Landwehr. 1981. Formal models for computer security. Comput. Surveys 13, 3 (Sept.1981), 247–278.
[51]
Jin Li, Wei Xiao, and Chong Zhang. 2023. Data security crisis in universities: Identification of key factors affecting data breach incidents. Humanities and Social Sciences Communications 10, 1 (30 May2023), 270.
[52]
Xiaoxuan Lou, Tianwei Zhang, Jun Jiang, and Yinqian Zhang. 2021. A survey of microarchitectural side-channel vulnerabilities, attacks, and defenses in cryptography. Comput. Surveys 54, 6, Article 122 (July2021), 37 pages.
[53]
Paulo Martins, Leonel Sousa, and Artur Mariano. 2017. A survey on fully homomorphic encryption: An engineering perspective. Comput. Surveys 50, 6, Article 83 (Dec.2017), 33 pages.
[54]
Maryland State Education Association. 2020. Distance learning, data privacy, and contractual issues for educators. Retrieved August 10, 2022 from https://marylandeducators.org/faq/distance-learning-data-privacy-and-contractual-issues-for-educators/
[56]
Steve Mutkoski. 2014. Cloud computing, regulatory compliance, and student privacy: A guide for school administrators and legal counsel. UIC John Marshall Journal of Information Technology & Privacy Law 30, 3 (2014), 511–534.
[57]
National Institute of Standards and Technology. 2018. Framework for Improving Critical Infrastructure Cybersecurity. Retrieved August 8, 2022 from https://nvlpubs.nist.gov/nistpubs/cswp/nist.cswp.04162018.pdf
[58]
National Security Agency. 2020. Mitigating Cloud Vulnerabilities - U.S. Department of Defense. https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF
[59]
University of Colorado University Information Services Communications. 2022. Multipronged Approach Prevents Data Breach. Retrieved December 3, 2022 from https://www.cu.edu/blog/uis-news/multipronged-approach-prevents-data-breach
[60]
Megan O’Neil. 2014. Data Breaches Put a Dent in Colleges’ Finances as Well as Reputations. Retrieved July 26, 2022 from https://www.chronicle.com/article/data-breaches-put-a-dent-in-colleges-finances-as-well-as-reputations/
[61]
OWASP. 2021. A01:2021 – Broken Access Control. https://owasp.org/Top10/A01_2021-Broken_Access_Control/
[62]
Owasso Independent School District v. Falvo. 2002. U.S. Reports 534 (2002), 426.
[63]
Owasso Independent School District v. Falvo. 2002. U.S. Reports 534 (2002), 426. (Justice Scalia, concurring).
[64]
Praveen Kumar P, Syam Kumar P, and Alphonse P. J. A.2018. Attribute based encryption in cloud computing: A survey, gap analysis, and future directions. Journal of Network and Computer Applications 108 (2018), 37–52.
[65]
PowerSchool. 2022. Schoology Learning. Retrieved August 10, 2022 from https://www.powerschool.com/solutions/unified-classroom/schoology-learning/
[66]
Prospect Reels. 2018. Terms of Use. Retrieved August 10, 2022 from https://prospectreels.com/terms-of-use/
[67]
Joel Reardon, David Basin, and Srdjan Capkun. 2013. SoK: Secure Data Deletion. In 2013 IEEE Symposium on Security and Privacy. 301–315.
[68]
Joel Reidenberg, N. Cameron Russell, Jordan Kovnot, Thomas B. Norton, Ryan Cloutier, and Daniela Alvarado. 2013. Privacy and Cloud Computing in Public Schools. Center on Law and Information Policy 2. Fordham University.
[69]
Rios v. Read. 1977. Federal Rules Decisions 73 (1977), 589. U.S. District Court for the Eastern District of New York.
[70]
Veronica Rocha. 2017. Los Angeles Valley College pays 28,000 in Bitcoin ransom to hackers. Retrieved August 10, 2022 from https://www.latimes.com/local/lanow/la-me-ln-los-angeles-valley-college-hacking-bitcoin-ransom-20170111-story.html
[71]
Rome School District v. Grifasi. 2005. New York Official Reports, 2nd Series 806 (2005), 381. (Supreme Court of the State of N.Y., Oneida County).
[72]
S. A. v. Tulare County Office of Education (No. CV F 08-1215 LJO GSA). 2009. (2009). (U.S. District Court for the Eastern District of California).
[73]
Amit Sahai and Brent Waters. 2005. Fuzzy identity-based encryption. In Advances in Cryptology – EUROCRYPT 2005, Ronald Cramer (Ed.). Springer Berlin, Berlin, 457–473.
[74]
Santamaria v. Dallas Independent School District (Civil Action No. 3:06-CV-692-L). 2006. (U.S. District Court for the Northern District of Texas).
[75]
Walter W. Schilling. 2011. Faculty usage of cloud computing: The capabilities and risks. The ASEE Computers in Education Journal 2, 4 (2011), 87–97.
[76]
Shweta Sharma. 2022. Education Sector Hounded by Cyberattacks in 2021. Retrieved August 10, 2022 from https://www.csoonline.com/article/3647760/education-sector-hounded-by-cyberattacks-in-2021.html
[77]
Natasha Singer. 2022. A Cyberattack Illuminates the Shaky State of Student Privacy. https://www.nytimes.com/2022/07/31/business/student-privacy-illuminate-hack.html
[78]
Daniel Solove. 2013. Interview with Kathleen Styles, Chief Privacy Officer, U.S. Department of Education. Retrieved August 7, 2022 from https://web.archive.org/web/20140718050829http://www.safegov.org/2013/4/18/interview-with-kathleen-styles,-chief-privacy-officer,-us-department-of-education
[79]
Alicia Solow-Niederman, Leah Plunkett, and Urs Gasser. 2014. Student Privacy and Cloud Computing at the District Level: Next Steps and Key Issues. Technical Report 2014-1. Berkman Center for Internet & Society.
[80]
State ex rel. ESPN, Inc. v. Ohio State University. 2012. North Eastern Reporter, 2nd Series 970 (2012), 939. (Supreme Court of the State of Ohio).
[81]
State ex rel. Miami Student v. Miami University. 1997. North Eastern Reporter, 2nd Series 680 (1997), 956. (Supreme Court of the State of Ohio).
[82]
Student Bar Association Board of Governors, of School of Law, University of North Carolina at Chapel Hill v. Byrd. 1977. South Eastern Reporter 239 (1977), 415. (Supreme Court of the State of N.C.).
[83]
Student Privacy Policy Office. 2021. A Parent Guide to the Family Educational Rights and Privacy Act (FERPA). Technical Report SPPO-21-04. United States Department of Education, Washington, DC.
[84]
Student Privacy Policy Office. 2023. An Eligible Student Guide to the Family Educational Rights and Privacy Act (FERPA). Technical Report SPPO-23-01. United States Department of Education, Washington, DC.
[85]
Emily Sullivan. 2020. Baltimore County Public Schools Hit by Ransomware Attack. Retrieved July 20, 2022 from https://www.wypr.org/news/2020-11-25/baltimore-county-public-schools-hit-by-ransomware-attack
[86]
Faiza Tazi, Josiah Dykstra, Prashanth Rajivan, and Sanchari Das. 2022. SOK: Evaluating privacy and security vulnerabilities of patients’ data in healthcare. In Proceedings of the 11th International Workshop on Socio-Technical Aspects in Security and Trust (STAST 2021), Simon Parkin and Luca Viganò (Eds.). Springer International Publishing, Cham, 153–181.
[87]
Jill Lynn Tyler. 2001. The healthcare information technology context: A framework for viewing legal aspects of telemedicine and teleradiology. In Proceedings of the 34th Hawaii International Conference on System Sciences.
[88]
Johanna Ullrich, Tanja Zseby, Joachim Fabini, and Edgar Weippl. 2017. Network-based secret communication in clouds: A survey. IEEE Communications Surveys & Tutorials 19, 2 (2017), 1112–1144.
[89]
United States Department of Education. [n. d.]. Protecting student privacy. Retrieved August 10, 2022 from https://studentprivacy.ed.gov
[90]
United States Department of Education. 2015. Frequently Asked Questions - Cloud Computing. Retrieved July 20, 2022 from https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FAQ_Cloud_Computing_0.pdf
[91]
United States v. Miami University. 1998. Federal Supplement, 2nd Series 91 (1998), 1132. (U.S. District Court for the Southern District of Ohio).
[92]
United States v. Miami University. 2002. Federal Reporter, 3rd Series 294 (2002), 797. (U.S. Court of Appeals for the Sixth Circuit).
[93]
Thijs van Ede, Niek Khasuntsev, Bas Steen, and Andrea Continella. 2022. Detecting anomalous misconfigurations in AWS identity and access management policies. In Proceedings of the 2022 on Cloud Computing Security Workshop (Los Angeles, CA, USA) (CCSW’22). Association for Computing Machinery, New York, NY, USA, 63–74.
[94]
Loree Varella. 2016. When it rains, it pours: Protecting stude nt data stored in the cloud. Rutgers Computer & Technology Law Journal 42, 1 (2016), 94–119.
[95]
Verizon Communications Inc.2019. Verizon 2019 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/2019/
[96]
Verizon Communications Inc.2020. Verizon 2020 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/2020/
[97]
Verizon Communications Inc.2021. Verizon 2021 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/2021/
[98]
Verizon Communications Inc.2022. Verizon 2023 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/2022/
[99]
Verizon Communications Inc.2023. Verizon 2023 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/2023/
[100]
Frank Wang, James Mickens, Nickolai Zeldovich, and Vinod Vaikuntanathan. 2016. Sieve: Cryptographically enforced access control for user data in untrusted clouds. In 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16). USENIX Association, Santa Clara, CA, 611–626. https://www.usenix.org/conference/nsdi16/technical-sessions/presentation/wang-frank
[101]
Elise Young. 2015. Educational privacy in the online classroom: FERPA, MOOCs, and the big data conundrum. Harvard Journal of Law & Technology 28, 2 (2015), 549–592.
[102]
Elana Zeide. 2016. Student privacy principles for the age of big data: Moving beyond FERPA and FIPPS. Drexel Law Review 8, 2 (2016), 339–394.
[103]
Yinghui Zhang, Robert H. Deng, Shengmin Xu, Jianfei Sun, Qi Li, and Dong Zheng. 2020. Attribute-based encryption for cloud computing access control: A survey. Comput. Surveys 53, 4, Article 83 (Aug.2020), 41 pages.
[104]
Zoom Video Communications. 2020. FERPA Guide. Retrieved August 10, 2022 from https://explore.zoom.us/docs/doc/FERPAGuide.pdf

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Journal on Responsible Computing
ACM Journal on Responsible Computing  Volume 1, Issue 3
September 2024
158 pages
EISSN:2832-0565
DOI:10.1145/3613742
  • Editor:
  • Kenneth R. Fleischmann
Issue’s Table of Contents

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 09 August 2024
Online AM: 04 July 2024
Accepted: 24 May 2024
Revised: 02 April 2024
Received: 07 December 2022
Published in JRC Volume 1, Issue 3

Check for updates

Author Tags

  1. The Family Educational Rights and Privacy Act (FERPA)
  2. student records
  3. privacy
  4. law
  5. cloud computing
  6. computer security
  7. NIST Cybersecurity Framework
  8. standards

Qualifiers

  • Research-article

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • 0
    Total Citations
  • 130
    Total Downloads
  • Downloads (Last 12 months)130
  • Downloads (Last 6 weeks)46
Reflects downloads up to 01 Oct 2024

Other Metrics

Citations

View Options

Get Access

Login options

Full Access

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Full Text

View this article in Full Text.

Full Text

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media