Cybertraps for Educators Digest

By Frederick Lane ~ 8 June 2023

"Smoke Gets In Your Eyes" 🎶 It's been quite a week here in the northeast United States and in New York City in particular. Thanks to a large number of fires in Canada (particularly in Quebec Province) and a massive low pressure system spinning slowly counterclockwise of the coast of Maine, a veritable river of smoke has flowed down the Hudson Valley to the Big Apple and much of the rest of the East Coast.

Normally, in the scene pictured above, you can see the skyscrapers of Manhattan. But thanks to an air quality index that peaked over 400 (and is still north of 200), NYC currently has some of the worst air quality in the world. Check out the photos online; it's definitely not a great start to the summer here.

Pandemic Vacation. Last week's issue fell victim to my first up-close encounter with COVID-19. Thanks to multiple vaccinations and the wonder drug Paxlovid (crossing 60 is not all bad), the symptoms were relatively short-lived and fairly mild. Big fan of science here. 🧪🧪

Episode One of the Cybertraps Summer Webinar Series, "Summer Cybertraps: Social Media and Vacation Photos," was well-received. You can view the recording here: https://www.nasdtec.net/page/Social_Media_Vacation_Photos. Episode 2, "The Cybertraps of Second Jobs and Side Hustles," will take place at 11:30EST on Tuesday, June 20, 2023.

🎼 Above the Fold: School District Strips "Sound of Music" of Nazi Imagery

Cybertraps Themes: Smartphones / Social Media / Cyberharassment / Misappropriation of Imagery

The spirit of Thomas Bowdler perseveres. In the early 19th century, Thomas Bowdler and his sister Henrietta co-edited The Family Shakespeare, a volume

in which nothing is added to the original text : but those words and expressions are omitted which cannot with propriety be read aloud in a Family.

Like Hamlet's father, the ghosts of the Bowdlers reappeared last week at the Rolling Hills Elementary School in Fullerton, CA. When some parents learned that the school's 6th-graders were putting on a performance of "The Sound of Music," replete with Nazi paraphernalia and gestures, parental protests were swift and vehement.

To edit or not to edit? That was the question and it was not one over which the district officials deliberated very long. Fullerton School District Superintendent Bob Pletka quickly announced that all swastikas would be removed from the set and that students would be instructed not to perform the Nazi salute.

A reflection of our times. Pletka cited two reasons for the changes, both of which underscore challenges facing school districts these days. First, he worried that if children were photographed wearing swastikas or in front of a Nazi flag, those images could wind up on social media, which could expose the children to ridicule or harassment. Pletka also noted the recent surge in neo-Nazism and anti-Semitism and expressed concern that use of the swastika on set "might draw a group of people we do not want."

Not all parents agreed with the decision to edit the play. One parent told the district school board that the play offered the opportunity for "teachable moments" and that she trusted teachers to have "necessary conversations with students."

The broader picture. It is an unfortunate truth, however, that educators and administrators do need to consider how school productions might be viewed if photos or videos are seen out of context on the internet. This is another example of how social media has made contemporary education so much more challenging: At a time when the lessons of "The Sound of Music" are painfully relevant, the digital risks to children may make schools reluctant to stage performances. And even if they do, the show loses some of its impact if Captain Von Trapp doesn't tear up the Nazi flag that his butler hoisted above the front door.

💽 2. The Shifting Stories of A School Data Theft

Cybertraps Themes: Cybersecurity / Phishing / Data Extraction / Transparency / Identity Theft

A Common Scenario. In the fall of 2022, administrators in the San Diego Unified School District alerted parents that the district had suffered a "cybersecurity incident." District Superintendent Lamont Jackson advised parents that the district was assessing the situation and rolling out new passwords for staff and students.

Six months later, the district alerted parents to the fact that the hackers had gained access to "the names and medical information of students." However, "[t]he district did not respond to questions about how many students had been affected, whether staff data also may have been compromised and how the security measures have been enhanced."

Just two weeks later, the district's assessment shifted again:

In addition to students’ medical information, the breach in October affected current and former employees’ sensitive personal data, including Social Security numbers, direct-deposit account information, medical information and more, Dennis Monahan, the district’s executive director of risk services, said the evening of June 2.

Inherently challenging. Parents, students, and staff are understandably frustrated by the drip-drip of new revelations. But assessing the scope a cybersecurity breach can be profoundly challenging; after all, hackers are highly motivated to cover their tracks.

And every hacked organization faces sharply competing interests with respect to the amount of information it should disclose. Some relevant parties–like law enforcement, insurance companies, or the breached organization itself–would prefer to release as little information as possible. But those affected, of course, want as much information as possible, particularly given that the risks of identity theft and financial fraud rise with every day of delay.

While every case is different, I believe that school districts should try to practice zealous transparency. Given the vast quantities of information that school districts collect and store, delays in disclosure can significantly increase the risk of harm to members of the school community. And there's another risk: a series of announcements with increasingly bad news can undermine public trust, which is all too often in short supply.

The best approach: Prevention. There are an almost endless number of guides for enhancing school cybersecurity but two recent articles offer some useful suggestions:

"4 steps to avoid a ransomware attack," by Ahsan Siddiqui, Director of Product Management, Arcserve; and

"Safeguarding K-12 school networks with proactive cybersecurity approaches," by
Joseph Tibbetts, Senior Director for Tech Alliances and API, Mimecast.

🌈 3. Wisconsin "Pride Fest" Draws Online Attacks

Cybertraps Themes: Social Media / Culture Wars / Free Speech / Harassment of Staff / Public Relations / Preparedness

June is Pride Month and like so many school districts around the country, Eugene (OR) School District 4J decided to join the celebration by hosting a Pride Fest in the North Eugene High School football stadium on Friday, June 2.

To promote the event, District 4J posted a flyer to its social media account listing the activities that would take place and the community guests who would participate. But the prospect of "Drag performances" was apparently triggering to a small but hostile group of Oregon parents and religious activists.

The Kids for Success PAC, an Oregon-based group that pushes for greater parents' rights in schools and opposes "ideological agendas," sent out an email blast highlighting the District 4J plans and urging members to protest to the district school board:

When HIV and pregnancy groups are sponsoring an event for children, we must question the moral direction of our community. When the 4J School District adds their name to the same, we must question their moral direction as well. The next 4J School Board meeting is Wednesday, June 7 at 7 pm. Sign up to give public comment by 5 pm this Monday, June 5th ...

LibsofTikTok also apparently blasted out the flyer to its more than 2 million followers on May 30, asking "Why would a school hold drag shows for young kids?" Although the organization's tweet is still up, what was at one point the top reply–a GIF of a man loading a cartridge into the chamber of a semi-automatic rifle–has since been deleted.

In response, district officials pulled the flyer from the school's social media accounts, citing "negative and hateful comments towards themselves and the district." District Communications Director Jenna McCulley also said that students told the District that the online diatribes made them feel unsafe. Nonetheless, the district said that the Pride Fest event would go forward as planned.

The Proud Boys, long identified as one of the country's leading hate groups, has apparently decided to focus on "taking back June" (which also not-so-coincidentally happens to contain Juneteenth, the federal holiday celebrating the end of African-American enslavement). Several protesters, including a couple of members of the McKenzie River Proud Boys, reportedly stood outside the Pride Fest event and verbally harassed attendees as they walked to the event.

All politics may be local, as Speaker Tip O'Neill famously said, but public education no longer is. The twin forces of cultural polarization and social media create the potential for any school activity to become a political flashpoint.

Be Prepared. As the successful District 4J Pride Fest illustrated, school districts do not need to cave to angry voices, particularly those braying from outside the community. But it would be irresponsible not to recognize the potential dangers every school now faces and to plan accordingly.

A short checklist: Discuss security measures, liaise with local and state law enforcement, educate parents and students about free speech and its limitations, and have a crisis response plan that is updated regularly.

🚓 4. Teacher Gets 10 Year Jail Term for Solicitation

Cybertraps Themes: Solicitation / Online Trafficking / Undercover Investigation / Entrapment?

Fake Ads. The FBI and the Sioux City (IA) Police Department have been conducting an undercover investigation into sex trafficking in the area. As part of their investigation, law enforcement agents posted ads on an unnamed dating site offering sex services for money.

Stung. Andrew Heller, a 7-12 social studies teacher and high school baseball coach for the Wynot (NE) Public Schools, was one of the people who responded to the ad. Although the ad suggested that the poster was 19, the law enforcement agent who wrote back to Heller pretended to be a 14-year-old girl. After initially hesitating, Heller ultimately agreed to pay $200 and provide alcohol to the "girl" in exchange for sex. He showed up at the agreed-upon meeting place with "alcohol, condoms and cash."

Book Thrown. After pleading guilty in January 2023, Heller was sentenced in late May to 10 years in federal prison, $5100 in assessments, and 5 years of supervised release.

🏖️ 5. What, No Vacation Days Left?

Cybertraps Themes: Cameras Are Everywhere / Threat of Violence / Failure to Report

For months last winter, schools in southeast Michigan endured a series of bomb threats. On February 2, a note containing a bomb threat was discovered by a staff member in a hallway of Hazel Park Junior High School.

School surveillance cameras helped explain how the note wound up in the hallway. A teacher named Paul Jacobs was recorded putting the note on a desk near his classroom doorway. A student picked up the note, read it, and dropped it back on the desk. The note slipped off the desk and fluttered into the hallway, threat-side down. Jacobs then peered up and down the hallway and carefully flipped the note over.

"I'm So Tired." In a subsequent interview, Jacobs told the Hazel Park Police that he hoped a student would find the note and that school would be cancelled, so that he could have a day off.

Charges. Although Jacobs originally faced "a misdemeanor charge of an intentional threat to commit an act of violence at a school, the police were unable to prove that he was the author of the threat. Instead, he ultimately pleaded guilty to a misdemeanor for failure to report the note. Jacobs could have been sentenced to up to a year in jail but instead was ordered to serve two weeks, followed by two years of probation.

Other conditions. His sentence also included $2,305 in fines and costs,  a mandatory "impulse control class," and ongoing mental health treatment.

📧 Have a great week, everyone. If you have questions, story ideas, or other suggestions, please email me: FSLane3@Cybertraps.com.