"We take your child's privacy and the security of your child's data seriously, and deeply regret that this incident occurred."
- LAUSD
As LAUSD parents attempt to recover from three days of disruptions due to Superintendent Carvalho's botched handling of labor negotiations, a new surprise showed up in some mailboxes. Despite past assurances that the District had intercepted a "one-time" attack on its computer systems during the 2022 Labor Day weekend and prevented any access to sensitive information, parents and teachers are reporting that they are now receiving "Notice of Data Breach" letters. It is not clear if the recipients are among the "approximately 2,000" current and former students the District was forced to acknowledge after an investigation by "The 74" or if this is an entirely new group of victims.
The letter that I reviewed was dated March 22, 2023, which is 200 days after the District shut down its system in an attempt to secure the data that it contained and 234 days after Russian hackers first compromised the system. The parent who received the letter was warned that "one or more files that included your child's name and medical information" was identified in a "review of the files involved". It did not say if the child's information was actually found on the Dark Web or if it was simply in a file that was known to be compromised.
While the letter included information about steps the parent could take to protect their child's credit, including requesting copies of their credit reports and placing Fraud Alerts and Credit Freezes on their accounts, it did not specify any actions that the LAUSD was taking to protect the student. Most notably, there were no offers of free credit monitoring as is usually standard practice when there is a breach of computer systems.
The letter also ignored the fact that it was the child's medical information that was exposed. This violation of privacy has the potential of being traumatic to not only the student but to their parents. While this genie cannot be placed back in the bottle, an offer of counseling seems like it would have been appropriate.
Also worth noting is that the letter was "signed" with a generic "Los Angeles Unified School District," not by Superintendent Carvalho or any person that he has placed in charge. Noticeably, instead of the Superintendent's flashy new logo, it is marked with the old one. Apparently, the bad news is not conducive to Carvalho's attempts at rebranding the district in his image.
This latest round of notices only exacerbates the feeling of mistrust by the public in the management of the LAUSD. At this point, there have been enough shoe drops to supply a consortium of octopuses. With the Superintendent unwilling to provide truthful information to the victims of this computer hack, the School Board needs to take control with the following actions:
- Begin an independent investigation that looks into how the District's computer systems were compromised. There was a time when the LAUSD Inspector General's office could have been delegated this task, but the previous board majority decimated this office in an attempt to prevent the investigation of charter schools that were breaking the rules.
- Appoint an independent body to determine exactly what data was compromised, how much of it is unaccounted for, and ensure that all potential victims have been properly notified.
- Conduct an independent audit of the funds that have been spent in the aftermath of the hack. While the Superintendent's office may have convinced the Board that he needed to be able to spend money without approval to deal with the consequences of the hack, this should not mean that he is not held accountable for ensuring that it was spent wisely.
- Make credit monitoring and trauma counseling available to anyone victimized by the illegal release of information.
Carl Petersen is a parent advocate for public education, particularly for students with special education needs. He was elected to the Northridge East Neighborhood Council and is the Education Chair. As a Green Party candidate in LAUSD's District 2 School Board race, he was endorsed by Network for Public Education (NPE) Action. Dr. Diane Ravitch has called him "a valiant fighter for public schools in Los Angeles." For links to his blogs, please visit www.ChangeTheLAUSD.com. Opinions are his own.
