Privacy Primer for Educators

1. Privacy Primer for Educators Melissa Dark Center for Education and Research in Information Assurance and Security (CERIAS) Purdue University http://www.cerias.purdue.edu/education/K-12 dark@cerias.purdue.edu

2. What is Privacy? • The ability to control the degree to which people and institutions impinge upon one’s life. • Hildreth & Hoyt, 1981 • The right claimed by an individual to control the disclosure of personal information about themselves. • Adams, 2000

3. Describe your privacy expectations of your: • Bank • Doctor • Government Officials • Clergy • Do we expect this same level of professionalism from our schools?

4. Junk Mail • Phone Calls From Telemarketers • Online Surveys • E-Mail SPAM • Grocery Savings Cards • Security Cameras • Cell Phone Tampering • Phone Logs • Workplace Surveillance What is the common factor that unites these items? Personal privacy in jeopardy.

5. Is privacy really that important? • In 1993, MacWorld launched an investigation surrounding the ability of unauthorized users to obtain information from celebrities. • This information was all obtained in a legal and ethical manner.

6. For $112 per celebrity....they found: Through online solicitation and searches, the editors were able to obtain the following information on individuals: (CQ Researcher, 1993).

7. Collection of Children’s Information • 1999 Survey: 16 million children ---14% of US citizens under the age of 18 regularly use the Internet. (1999) • Study conducted by Cai and Gantz (2000) indicated that the majority of Web sites targeted at children collect personal information from their under-age users. • Children also readily provide personal data in return for a “great prize” (Carlson, 2000)

8. Why is Privacy Important for Teachers? • Federal law mandates that teachers protect the information they gather and record regarding their students (National Center for Education Statistics, 1998). • FERPA • COPPA • Supreme Court Decisions • Failure to do so could result in personal and professional liability.

9. Privacy Practices—Common Law • Information should not be conveyed to other teachers/administrators unless the motive is to enhance performance. • Pupil information should be transmitted only upon request. • Records should be released only if there is a statutory requirement or the pupil/parents request the release.

10. Privacy Legislation for Educators • Family Educational Rights and Privacy Act , 1974 (FERPA): • Requires that educators demonstrate “due diligence” in protecting student data, information, records, and other sensitive information. • Teachers can be personally held liable for failing to maintain the integrity of such data.

11. FERPA... • Parents/guardians have a right to inspect all records. • Record of access maintained regarding individuals examining the files. • Appeals to contents are permitted. • Records must be kept confidential—no release unless there is permission. • Birth date, address, ss#, grades, test results, discipline records, attendance, health records, pictures, etc.

12. Unique Challenge of E-Mail and Electronic Documents • Teachers must demonstrate “due diligence” in protecting ALL records. • Vulnerabilities: • Open Network Connections • Poor Password Selection/Protocol • Lack of Encryption • “naked” e-Mail

13. Encryption(Enciphering sensitive information) • Encoding information • Secret Code Ring • Cryptoquip • Pig Latin • *Most* common applications offer password protection. • Confidential (not critical)---USE ENCRYPTION!!!! • NEVER send HIGHLY SENSITIVE information through email. (email should *never* be considered secure!)

14. PGP: Pretty Good Privacy (approx. $20 per unit) Requires use of Public Keys Sample PGP encrypted email:

15. Without the proper keys... the message is unreadable.

16. Sample Encrypted Document:

17. Password Protecting Windows Documents • File / Save As • Click on TOOLS • Select GENERAL OPTIONS • Enter passwords

18. Practical Privacy Techniques for Teachers: • Practice Proper Information Security Techniques • E-Mail Awareness • Use of Encryption • Download Precautions • Close the Cookie Jar • Read Privacy Statements • Set up a Second Online Account

19. Dissemination of Privacy Practices to Students: • Fundamentals of protecting privacy is a “new” skill that schools should address • (Willard, 2000) • Privacy issues need to be embedded within the curriculum as readily as technical skills • (FTC, 2001) • Short lessons and natural teaching moments work well for identifying the topic. • Teachers must serve as a role model for privacy protection practices.

20. Conclusion: • As technology is introduced into schools, it is critical to combine the technical skills with the soft (ethical) skills surrounding the media. • Attention needs to given to both teachers and students upon this topic. • Teachers must practice privacy techniques daily---to protect the information and serve as a positive role model.

21. Excellent Resources: • Stealth Surfing by Matt Lake: http://www.pcworld.com/resource/printable/article/0,aid,16350,00.asp • Follett Software Company: Privacy Sites: http://www.pathwaysmodel.com/resources/articles/adams/weblinks.cfm • Make Your PC Hacker Proof by Jeff Sengstack: http://www.pcworld.com/resource/printable/article/0,aid,17759,00.asp