56° CLEAR, Students' records wind up on Web
Last Modified: Wednesday, August 20, 2008 at 12:14 a.m.
SARASOTA COUNTY - The personal information of nearly every student in Sarasota County was made public on the Internet for nearly two months because a company that the district contracts with accidentally posted it.
The Princeton Review posted information from the district's Sarasota County Planning Tool, a clearinghouse of all kinds of student records that teachers use to develop tests and track their progress.
The information posted included the the names of about 34,000 students and their school identification numbers -- in some cases the same as their Social Security numbers. The data also included their birthday, gender, ethnicity, whether or not they have a disability and their level on the Florida Comprehensive Assessment Test. There are about 38,500 students in the Sarasota school district.
The Princeton Review said that it learned of the error Monday and immediately removed the information from the Internet. The error occurred when the Princeton Review switched Internet providers, and the company is trying to determine how many people may have viewed the files, which could be located through search engines.
"The Princeton Review takes Internet privacy seriously, and we are currently conducting a review of all of our procedures," said Stephen C. Richards, the company's chief operating officer.
Sarasota School Superintendent Lori White said she was not aware of the problem until contacted by a reporter Tuesday. Following a conference call with representatives from the company, she said the district would be reviewing the contract and deciding whether they want to keep it.
"All of that data is transmitted to a presumably secure site; that's part of the expectation," White said. "We conveyed to them our disappointment."
The Princeton Review also inadvertently made public the names and birth dates of 74,000 students in Fairfax County, Va. School officials there had hired the company to measure student performance.
The disclosure underscores the potential problems associated with compiling large student databases at a time when data drives nearly everything that happens in the school system.
The pressure to do well on standardized tests like the FCAT is prompting schools and teachers to compile massive amounts of data on students. They use the information to pinpoint skills or groups of students that need improvement.
School districts across the country have developed these kinds of databases, and Florida state law requires districts to have one.
But most districts do not have the know-how or resources to develop and maintain them on their own. So they have to contract with private companies, which then have access to student data.
Manatee County also has a contract with a private company to maintain its student test records. The state Department of Education also uses a private company to maintain its Parent Network, which parents can use to access student FCAT data.
Typically, only teachers and administrators can access information from the databases, which they use to develop tests tailored to their students' individual needs and to track their progress.
Sarasota paid about $1.7 million three years ago for the Princeton Review to develop its system. It recently renewed the contract at $350,000 for the current school year.
The company is investigating the episode, and White said she expected them to provide her information about how many people may have seen the information.
"They said it was not easily accessible, although obviously it was accessible to the public," she said.
The assessment and planning tool is just one of the services provided by the multimillion-dollar education service. A spokesman for the company could not say how many school districts the company contracts with for the database management.
In Florida, school districts are legally prohibited from releasing student information. But Sarasota School Board attorney Art Hardy said he does not think the district would be liable because the Princeton Review released it, not the school system.
The district can provide student information to individuals and companies for legitimate educational purposes. It typically includes a clause in its contracts banning companies from releasing the data.
"Obviously, they're all aware of the confidentiality requirements," Hardy said.
Some parents were also concerned about their students' information being posted to the public, especially the students whose identification numbers are the same as their Social Security numbers.
"That's definitely really shocking that they could be so caviler with their security," said Dawn Bushman, whose three children attend Toledo Blade Elementary.
"If that got out there now, what else could get out in the future?"
This story appeared in print on page A1
Next Article in Section Venice
-
Sailboat burns in Sarasota Bay
Couple's home and all their belongings are destroyed but they and their dogs survive...
Events Calendar More Events Submit Event
- Fire destroys boat in Sarasota
- Man arrested after daughter tells about marijuana
- Mother tells judge to imprison son
- Gas up, FPL new name
- Rays sell out two spring training games in Charlotte
- Expert offers hope for homes
- Sailboat burns in Sarasota Bay
- North Port city manager applies for Coral Gables job
- TAKE A TEE-BOW
- The third title was Gators' best one yet
- Mother tells judge to imprison son 9 min ago
- World briefs 9 min ago
- Sailboat burns in Sarasota Bay 17 min ago
- Playing to win Venice's top job 24 min ago
- Grim speech is ritual for a new president 30 min ago
- Gator glory 33 min ago
- The third title was Gators' best one yet 34 min ago
- Escapee captured 38 min ago
- TAKE A TEE-BOW 40 min ago
- Bradenton man held in stabbing case 41 min ago
Comments
Post a comment | View all comments on this topic.
August 20, 2008 5:18:00 am
RE: http://www.heraldtribune.com/a...20/ARTICLE/808200369
All it would take is one 'wrong' person to access this identification information and 34,000 students have now had their identities compromized. That information was posted for about two months and is now accessible throughout the world. Smart move, The Princeton Review. Can you say, "I smell a lawsuit"?
August 20, 2008 5:43:26 am
This is a ridiculous,stupid event. The Princeton Review should refund all of our $350,000 for this year and some of the 1.7 mil. that was originally paid to them for their shoddy performance!
In today's society when identity theft is so rampant, they should be punished for the careless fashion in which they operated. Our children have enough problems without having their i.d.'s compromised on the internet before they are even adults!
Mad Max
August 20, 2008 5:52:32 am
My kids go to SRQ county schools. What assurances (b.s. is more accurate) are "they" going to give us that our childrens identity wasn't stolen/compromised? I send my kids to school to learn - not to have problems later in life trying to get credit, a job or even a bank account. Secure site - ha - someone had to put the info on the site so that means that it can accessed! Yes the school board should get their money back - but what about the students?
August 20, 2008 8:07:35 am
Why is there always a delay from those in positions of authority from taking action at once?
This Contract should be null and void now, effective today.
This company should be sued for payments already made to it and for damages.
What is the problem?
Look at the exposure of all these students on the net?
Where is the outrage?
Where is the action?
Where is the demanding of public accountability RIGHT NOW?
August 20, 2008 8:29:56 am
My daughter graduated from a local high school this past spring.
This summer she received in the mail catalogues from Wal-Mart, Target Pottery-Barn teen and several other merchants. These catalogues were specifically geared towards outfitting dorm rooms. Either our beloved school system or Princeton Review (who administers the SAT and ACT) sold our childrens data to marketers.
August 20, 2008 10:01:06 am
The whole question of what does and does not constitute a security "breach" is open to legal debate. (The reason for the debate is that virtually all data are exposed to one degree or another at all times.) One might argue that there was no meaningful breach at Princeton Review until the NY Times was informed. Hence, one might argue, the competitor caused (or contributed to) the breach! Liability? --Ben http://hack-igations.blogspot....te-to-lost-data.html
August 20, 2008 10:29:08 am
Can anyone say "refund"?
August 20, 2008 10:30:00 am
The finger pointing has to stop. I don't care who did or didn't do whatever. I'd like to know why this keeps happening? Identity theft is rampant and it seems very little is being done to deter these theiving scumbags. Financial instutions want us to think on-line banking is secure. Retails & credit card companies want us to think a swipe of a debit/credit card is the safest. Too many instances of security breaches. Who's in charge --- Kinda like the fox guarding the hen house IMO. Finger pointing. Now we have the schools & our childrens personal info exposed. Don't have to worry about Myspace anymore - we gotta worry about the school board and their incompent business practices!
August 20, 2008 10:40:23 am
I don't have kids in the school system yet but I would hope that this all is addressed before I do since this is not a matter to take litely. The School Board has every right to a refund and deserves it. I strongly suggest taking it a step further though and that safety measures are taken to protect the students who were exposed to predators of all types, not just identity thefts. Every last one of these kids should have an identity theft policy opened up for them with their parents as the contact to be notified of fraudulent activity with their identity. There are numerous companies out there to protect them so tell Princeton Review to start shopping and signing up every student they have on that list.
August 20, 2008 12:04:12 pm
If the past serves as any example, nobody in the School System will be held responsible for this and nobody will be fired. The explanation will always be that somebody else was at fault and our multi-billion dollar school administration is not responsible in any way. That's why our school system is a constant embarrassment.
Post a comment | View all comments