How the nation’s largest school system keeps students safe

naphtalina via Getty Images

 

Connecting state and local government leaders

By thinking of physical and digital safety as the same, the New York City schools are preparing their systems for ever-evolving technologies.

Keeping schools safe in the digital age is no small feat. Just ask Demond Waters, chief information security officer for the New York City Department of Education.

It was not that long ago that New York City Public Schools was the victim of a cyberattack. In April, the personal data of the system’s more than 1.1 million students was compromised. Ensuring that doesn’t happen again is one of the many things Waters worries about.

Waters oversees the security of the largest public school system in the U.S., with a student population that exceeds many cities. The system has 185,000 employees across 1,800-plus schools and dozens of other buildings. It manages 800,000 district-issued Chromebooks and 600,000 iPads. 

Given the system’s size, schools have a lot of autonomy in their technology policies and what they can buy and use. Waters balances those myriad policies and purchases in an ever-evolving technology landscape that currently means wrestling with the rise of artificial intelligence. Through all of this, Waters keeps people safe, he says, by thinking of digital safety as the same as students’ physical safety.

The spate of so-called Zoom bombings of students’ virtual classrooms during the pandemic helps illustrate how tech issues are safety issues.

“It's not just outside in,” he recently told Route Fifty. “It's insider threats, which impacts student safety.”

Through that lens, Waters has made a number of technology updates. He’s moved the department to a zero-trust security framework in partnership with cloud security company Zscaler, as well as Google and Microsoft, which grants users and devices access only to parts of the network that are essential to their task. He’s shifted device and identity management to the cloud, where his office can garner insight into web traffic and update security for the networks and apps students and staff use.

The pandemic accelerated the centralization of identity and device management, Waters said, whereas before it had been up to individual schools to procure devices for students and manage them. Device and identity management isn’t just about checking to see how much time students spend on YouTube or TikTok during instructional hours, either. Waters said it is part of the interconnected nature of digital safety and student safety.

“Kids might be using DOE devices … and they're visiting the suicide helpline,” he said. “We're getting calls from the [New York City Police Department], and we know that student because they logged on with a student ID, we know what iPad they’re on. We can say, ‘Hey, this is a student that's in danger now.’ Now we know why you need to manage these devices, because now you're protecting something that we didn't think was a real scenario until it became a scenario.”

Some tech issues remain out of the department’s control. Amid the global CrowdStrike outage that affected many city services, a number of products and services the public schools use were impacted. And New York could soon debate a statewide ban on cellphone use in schools.

Meanwhile, there is always the worry about students or staff clicking on phishing emails, which remain a popular way for hackers to exploit vulnerabilities. Raising awareness is the biggest challenge given the size of the school system and the communications challenges that go with that. Getting principals to understand cyber risks is a good way to overcome some of those obstacles, Waters said, as they then are more inclined to turn to the Department of Education if something goes wrong.

“It's difficult with a school district this size, so we just try to do a little bit at a time,” Waters said. “With technology, if people feel like they're part of the solutions, they're more easily adopted.”

And then there are new technologies to manage. The public release of ChatGPT roiled the system last year, as reports filtered out of students using the chatbot to help with essays and other assignments. The Department of Education initially banned the use of the generative AI chatbot in January 2023, only to rescind the ban several months later. The flip created negative headlines for the school district, but it has forced the department to run its AI policy through various working groups.

“We're building AI-enabled apps, so now we're looking at the issue holistically, as an agency, not individually, as just a school who wants to use this,” Waters said. “That spearheaded more collaboration amongst the educators, the IT folks, the students, as well as the administrators.”

As part of its efforts to stay on top of the changing tech landscape, Waters said the department is trying to educate students about the technology field amid an ongoing shortage of cybersecurity and technology workers. “They don't have the opportunity, or they don't know what the jobs are,” he said.

In a bid to build that pipeline of future employees, Waters said the department looks to create opportunities for students to learn through internships, alternative high school programs and fellowships with curricula that reflect how the technology has advanced. “To me, that is a skill you can learn; that's a trade,” he said. “You can learn that programming is a trade, just like being an electrician is a trade.”

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.