How the nation’s largest school system keeps students safe

Keeping schools safe in the digital age is no small feat. Just ask Demond Waters, chief information security officer for the New York City Department of Education.

It was not that long ago that New York City Public Schools was the victim of a cyberattack. In April, the personal data of the system’s more than 1.1 million students was compromised. Ensuring that doesn’t happen again is one of the many things Waters worries about.

Waters oversees the security of the largest public school system in the U.S., with a student population that exceeds many cities. The system has 185,000 employees across 1,800-plus schools and dozens of other buildings. It manages 800,000 district-issued Chromebooks and 600,000 iPads. 

Given the system’s size, schools have a lot of autonomy in their technology policies and what they can buy and use. Waters balances those myriad policies and purchases in an ever-evolving technology landscape that currently means wrestling with the rise of artificial intelligence. Through all of this, Waters keeps people safe, he says, by thinking of digital safety as the same as students’ physical safety.

The spate of so-called Zoom bombings of students’ virtual classrooms during the pandemic helps illustrate how tech issues are safety issues.

“It's not just outside in,” he recently told Route Fifty. “It's insider threats, which impacts student safety.”

Through that lens, Waters has made a number of technology updates. He’s moved the department to a zero-trust security framework in partnership with cloud security company Zscaler, as well as Google and Microsoft, which grants users and devices access only to parts of the network that are essential to their task. He’s shifted device and identity management to the cloud, where his office can garner insight into web traffic and update security for the networks and apps students and staff use.

The pandemic accelerated the centralization of identity and device management, Waters said, whereas before it had been up to individual schools to procure devices for students and manage them. Device and identity management isn’t just about checking to see how much time students spend on YouTube or TikTok during instructional hours, either. Waters said it is part of the interconnected nature of digital safety and student safety.

“Kids might be using DOE devices … and they're visiting the suicide helpline,” he said. “We're getting calls from the [New York City Police Department], and we know that student because they logged on with a student ID, we know what iPad they’re on. We can say, ‘Hey, this is a student that's in danger now.’ Now we know why you need to manage these devices, because now you're protecting something that we didn't think was a real scenario until it became a scenario.”

Some tech issues remain out of the department’s control. Amid the global CrowdStrike outage that affected many city services, a number of products and services the public schools use were impacted. And New York could soon debate a statewide ban on cellphone use in schools.

Meanwhile, there is always the worry about students or staff clicking on phishing emails, which remain a popular way for hackers to exploit vulnerabilities. Raising awareness is the biggest challenge given the size of the school system and the communications challenges that go with that. Getting principals to understand cyber risks is a good way to overcome some of those obstacles, Waters said, as they then are more inclined to turn to the Department of Education if something goes wrong.

“It's difficult with a school district this size, so we just try to do a little bit at a time,” Waters said. “With technology, if people feel like they're part of the solutions, they're more easily adopted.”

And then there are new technologies to manage. The public release of ChatGPT roiled the system last year, as reports filtered out of students using the chatbot to help with essays and other assignments. The Department of Education initially banned the use of the generative AI chatbot in January 2023, only to rescind the ban several months later. The flip created negative headlines for the school district, but it has forced the department to run its AI policy through various working groups.

“We're building AI-enabled apps, so now we're looking at the issue holistically, as an agency, not individually, as just a school who wants to use this,” Waters said. “That spearheaded more collaboration amongst the educators, the IT folks, the students, as well as the administrators.”

As part of its efforts to stay on top of the changing tech landscape, Waters said the department is trying to educate students about the technology field amid an ongoing shortage of cybersecurity and technology workers. “They don't have the opportunity, or they don't know what the jobs are,” he said.

In a bid to build that pipeline of future employees, Waters said the department looks to create opportunities for students to learn through internships, alternative high school programs and fellowships with curricula that reflect how the technology has advanced. “To me, that is a skill you can learn; that's a trade,” he said. “You can learn that programming is a trade, just like being an electrician is a trade.”