School district apps: Concerns about privacy, transparency

Data about students, parents and education is a hot commodity, raising privacy questions about how much information is too much.

Tens of thousands of Tarrant County parents, students, teachers, and community members use school district mobile phone apps to find out what is happening in their districts and on their campuses.

In the Fort Worth school district, 51,000 people use the district’s mobile app. Arlington’s app has 32,000 users. About 10,000 people are using the app for the Northwest district.

How much data is gleaned from people using the mobile apps? Experts say the information can fall into the hands of data brokers, marketers and others, despite efforts to keep it private. They also say there is a lack of transparency surrounding how the technology works.

“The average consumer would want to understand exactly what a particular company is doing,” said Sophia Cope, a staff attorney with the Electronic Frontier Foundation (EFF), a national nonprofit organization for digital civil liberties. “The expectations are even greater for parents with children in school.”

“It’s a transparency problem,” Cope said. “The companies are not, we believe, being totally upfront in explaining the technology. Districts don’t know what questions to ask before they sign these contracts, and they’re not informing the parents of what they’re doing.”

But school officials said they are confident the app developers they hired are neither gathering nor sharing information from users.

“They don’t have access to the data …,” said Clint Bond, a spokesman for the Fort Worth school district. “Basically, we can push information out, but there’s not a two-way exchange of information.”

School administrators said app developers they contracted with do not have permission to sell any data gleaned from the apps.

Randy Sumrall, executive director of technology for the Birdville district, said the district’s app contractor, Schoolwires, does not have permission to distribute or sell student information.

“If we found out they were doing it, we would stop using them,” Sumrall said.

Permission granted

Phone apps for the Arlington, Fort Worth, Birdville, Northwest and Mansfield school districts — like most apps — require users to submit to a variety of “permissions,” though just exactly what you’re permitting the app to do is unclear.

The permissions vary by district.

Upon downloading Birdville’s app, for example, permissions are requested for the device identity, the calendar, location, photos, media, files and the camera. Fort Worth’s app requests permissions for modifying or reading the contents of the SD (memory) card. Permissions for the Northwest district app include accessing identity, the calendar, phone call logs, and photos, media and files.

Some of the permissions are required for users to access all features of an app. But it’s not clear what else could be done with the permissions.

“Outside of these generic permissions, it’s hard to tell,” said Grayson Milbourne, director of security intelligence at the Colorado headquarters for Webroot, an international Internet security firm. “You’d have to do an analysis of an app at a code level.”

That requires an advanced knowledge of programming language that most people simply do not have, Milbourne said.

Apps that ask for access to areas such as phone storage or photos are concerning, especially if those permissions have nothing to do with the app’s stated purpose, he added.

“If you don’t need it, don’t put it in there,” Milbourne said.

How private are policies?

But even if information is not being accessed and shared now, wording in a privacy policy within Birdville’s app leaves the possibility open.

A Schoolwires privacy policy on the app states: “One instance in which personal information in educational records may be disclosed to third parties under FERPA is if the information is classified as ‘directory’ information by your educational institution.”

A privacy policy within Northwest’s app states: “By entering your username and password to access HAC (Home Access Center) or MSB (MySchoolBucks) you consent to the sharing of information with those third party providers who may utilize your personal information in compliance with their respective privacy policies. … Children under the age of 13 are not permitted to access HAC or MSB accounts.”

App development contracts for the Arlington, Fort Worth, Birdville, Northwest and Mansfield districts, obtained through public information requests, show a lack of stringent privacy policies between developers and the school districts. Often, when privacy is mentioned, the full responsibility for compliance is on the districts.

For example, the contract between the Arlington district and app developer AVAI states that the client (the district) is solely responsible for complying with all laws, including privacy laws.

The Carroll school district requested an opinion from the state attorney general’s office regarding the release of the contract information.

Phone apps are a part of everyday life, and many people willingly give up their privacy in exchange for the convenience and information apps provide.

But when students and school districts are involved, privacy rights are more complicated.

Certain privacy laws apply to electronic student data. For example, the Children’s Online Privacy Protection Act (COPPA) prevents the release of electronic data from students under age 13, unless they have parental permission.

FERPA (the Family Educational Rights and Privacy Act) is a federal law that prohibits schools and their contractors from releasing information about sensitive student education records such as grades.

Certain information about students is fair game for data brokers.

Parents must formally opt out to prevent the release of their child’s “directory” information.

If a parent does not opt out, it is legal for schools to disclose directory information such as a student’s name, address, phone number, date of birth and dates of attendance at school, according to the U.S. Department of Education website.

“Data brokers are very interested in FERPA [Family Educational Rights and Privacy Act] data, and if an app developer has FERPA data all neatly organized, it’s really simple to just pick it up and purchase it,” said Pam Dixon, executive director of World Privacy Forum based in San Diego. Dixon serves on the editorial board of the Technology Science journal at Harvard University and has testified before Congress and government agencies on privacy issues.

Basic directory information is enough to start a detailed, lifelong profile that can be kept on file indefinitely, Dixon said.

Schools often lack the resources to deal with the complexity of all of the privacy laws and technology related to digital data.

“The educational sector just isn’t there yet,” Dixon said. “They’re just not. They’d need a team of security researchers and a privacy attorney, and that kind of information just hasn’t made it into the school districts.”

‘The app has many benefits’

School district officials said they offer apps to give parents, students and community members mobile access to school information. Data on sports, school lunch menus, closings, bad weather and district social media accounts is accessible through the apps. All are intended as a way to engage parents and the community.

“The app has many benefits for our users and provides our parents and students important information on the go,” said Rick Herron of Carroll’s communications office. “News and alerts are immediate and become a valuable way to receive district notifications immediately. With so many parents and students using phones, this vehicle of communication is the trend, and we are seeing great results.”

Today’s mobile lifestyle led local districts to develop apps to offer up-to-the minute information to parents, students, teachers and community members.

“Our community, our parents are mobile,” said Bond, the Fort Worth district spokesman. “They want and need information conveniently in the palm of their hand and at the tap of a button.”

App users can choose what schools to follow, allowing them to receive customized updates and news. A general news feed from the districts is often included as well. Information about sports, lunch menus and bus routes is also popular, officials said.

“Our app can be completely customized,” said Emily Conklin, communications director for the Northwest district. “That’s something we really wanted. We also surveyed the staff and community members during the development process, so we had a lot of feedback.”

Even though the apps are popular and beneficial to students and parents, Dixon said districts must remain vigilant about information mining.

Dixon said she was met with a lot of resistance in the fall when she released a video about FERPA and how data brokers use the information.

“Teachers and school administrators wrote to me saying how schools never release the information and data brokers never get the information,” she said.

But data brokers are ruthless when it comes to getting information they want, Dixon said.

“We’ve seen over and over again how nasty they can be,” she said. “We have to be very passionate about protecting kids.”

This story was originally published January 2, 2016 at 1:50 PM with the headline "School district apps: Concerns about privacy, transparency."