Is CPS keeping student data safe? Chaos and confusion as district scrambles to comply with privacy law after recent breach.

Around this time last year, computer science teacher Maggie Valcik received some startling news. She had been looking forward to teaching a class using curriculum from Code.org as part of a Chicago Public Schools pilot program allowing middle school students to earn high school credit.

Shortly before school started, Valcik learned that Code.org was not approved for use by CPS. Never mind that the district’s teachers had been using the learn-to-code platform for years.

“CPS instead offered a curriculum that was hastily put together by an outside consultant in one weekend. There were gaps in the new curriculum that were frustrating for me and my students,” said Valcik, who also teaches special education at Ashburn Community Elementary School on the Southwest Side.

A year later, as of press time, Code.org was still “in process” of being approved, as CPS continues to struggle to comply with the terms of the latest version of the Student Online Personal Protection Act, or SOPPA. School starts Monday for CPS students.

Illinois school districts had nearly two years — until July 2021 — to meet the new requirements of the law, which regulates student data collection and use by schools, the State Board of Education and educational technology companies. Most districts banded together on a free, one-stop shop for vetting vendors’ student privacy safeguards. CPS didn’t join this group, and chaos ensued.

The district suffered a major student data breach during the last school year. And CPS is still in the process of evaluating the use of many programs, including a post-high school planning tool heavily touted on its own website. CPS teachers say that when they can’t use their desired curriculum, their students are at a disadvantage compared with peers in suburban districts that have already ironed out SOPPA-related issues.

“Our district is taking a completely asinine approach to SOPPA compliance, and it’s hurting kids, literally hurting children,” Lane Tech College Prep computer science teacher Jeff Solin said. “We’re dealing with enough, with learning loss from the pandemic as is, and now we have this layer on top of it.”

In a statement, CPS said it “has been working with vendors daily since early 2021 in an effort to ensure that students continue to have access to high-quality educational resources that meet SOPPA. The district works continuously to procure vendors who specialize in educational technology and will follow all of the necessary procedures to become fully compliant.”

Cassie Creswell, director of Illinois Families for Public Schools, was one of the architects of the SOPPA amendments. She said an earlier version of the act was weak in transparency and security.

In August 2019, Gov. J.B. Pritzker signed changes into the law designed to give parents greater control over their children’s data — which are only supposed to be used for instructional or administrative purposes.

Districts are required to post agreements with educational software companies, list the information being collected and provide a clear explanation of how a parent can inspect, correct or delete their child’s data. If there is a data breach, schools have 30 days to notify parents of affected students.

A CPS parent herself, Creswell said the district is not sharing all the essential information. CPS maintains a public, searchable website that lists operators, their approval status and related resources. But elements, including contracts and data being shared, appear to be missing for some of the approved companies.

“Transparency is a key part of the law, and CPS is not compliant with it,” Creswell said. “It’s upsetting to me, as a parent and as a privacy advocate, given the effort we put in to getting that law passed and how hard we had to fight against the tech industry to get those provisions in, and then to have the school district not fulfilling its end of the deal is really horrifying.”

Another example of CPS’ struggle with the new rules is a program called Naviance.

CPS has a page on its website devoted to Naviance, a tool that students begin using in sixth grade to explore college or career goals and is part of a graduation requirement. Yet as of press time, Naviance was still “in process” of being approved.

CPS said it is still negotiating the Naviance contract. The district blamed the delay in part on Naviance being acquired by PowerSchool, a CPS-approved vendor.

Meanwhile, a search on CPS’ SOPPA vendor site for Aspen — the platform where the district stores student grades and attendance information — yields no results. CPS said Aspen is not an instructional resource so it’s not required to be on the SOPPA vendor list, something Creswell disputes. SOPPA does not make this distinction, Creswell said.

Creswell said CPS has overreached in its interpretation of SOPPA in other ways. Consider Adobe, which is not an educational software company.

For a long time, Lane Tech students used Adobe InDesign to lay out their newspaper. But Adobe products were not approved for use at the start of the last school year, so the staff of the Lane Tech Champion had to scramble to learn a new system.

CPS ended up executing a contract with Adobe in December, following outcry from students and teachers.

In its statement, CPS admitted there was “some initial confusion if Adobe products were required to be SOPPA-compliant. Upon further review, CPS determined that Adobe products did not have to comply with SOPPA since the products were developed and marketed for multiple industries.”

Mara Mellits, Champion co-editor-in-chief before graduating in June, said it was difficult having to learn a substitute for InDesign, and the newspaper suffered because of it.

“It felt so unnecessary, just especially because suburban school districts were able to work around this,” Mellits said. “They could still use the resources that we couldn’t. It just felt so unfair.”

Mellits said her teacher couldn’t use the Turnitin plagiarism detection service for her Advanced Placement English literature class last year. The program was “in process” of approval at press time, according to CPS’ site.

When Mellits talked with the Tribune in July, the Champion appeared to be affected by another SOPPA-related complication. Lane Tech, a selective enrollment school, apparently stopped paying its newspaper’s web-hosting provider, SNO Sites, amid confusion over whether the program is SOPPA-approved. The website was briefly taken offline, which meant Mellits couldn’t access her clips to prepare her portfolio for Boston University, where she will study journalism this fall.

Tom Hutchinson — co-founder and co-owner of SNO, a Minnesota-based company — said he underwent a “simple” process to get approved for use by the 800-plus school systems that participate in the Illinois Student Privacy Alliance. SNO provides web services to around 200 schools and universities in Illinois, including a handful in CPS.

Hutchinson said CPS’ SOPPA process was much more arduous compared with the consortium system.

Academic software companies must go through a request-for-qualifications process and establish a legal agreement with CPS to be considered approved vendors.

“It was extensive. It probably took me two weeks’ worth of work. For several of the sections I simply had to answer, ‘It does not pertain to us,’” Hutchinson said. “They were asking for things like tax records and really invasive stuff, I thought. But anyway, I went through the entire process and then waited. I think I learned about two months later that we had been denied.”

CPS said it has added resources to help process agreements, but is still managing a large volume of technology vendors, and each one must receive attention and scrutiny. CPS said it denied about 20 vendors for not meeting the district’s technical requirements and a few others for contract issues.

Hutchinson said his application was rejected in mid-2021. The approval finally arrived in February 2022, after CPS’ Phoenix Military Academy sponsored the company to help move the process along, Hutchinson said.

SNO didn’t appear on the online CPS SOPPA vendor list as of press time. Hutchinson provided documentation to the Tribune to show the company had been approved, but a CPS representative disputed the approval and said a legal agreement is still needed.

Hutchinson reactivated the Lane Tech Champion site this month after he spoke with the Tribune. He noted other CPS schools had paid in full this year.

Solin, of Lane Tech, said CPS sanctioned one of the hacks teachers devised to be able to use Adobe before its SOPPA agreement was signed. Fake email addresses allowed students to log into the software, but their personal information wasn’t attached to those accounts.

Because CPS didn’t block unapproved programs as it said it would, according to Solin, teachers were put in the “uncomfortable position” of weighing their curriculum needs against possible discipline for using such programs. Solin said he spotted a colleague last summer “crying in the hall the week before school started, when all the teachers were back, because they were finding out that their entire curriculum and everything they’ve built … they can’t use it anymore. It’s devastating.”

In its statement, CPS said if a school uses a product that does not appear within the “approved for use” or “in process” categories, the school should complete a questionnaire to ensure the district works with the vendor toward SOPPA compliance. Solin said he filled it out for each product he used, and nothing came of it.

Katie Roznai, who teaches chemistry and computer science at World Language High School in Little Village, didn’t want to be in limbo. Because Code.org has not been approved, Roznai opted to use a different curriculum for her upcoming Advanced Placement computer science principles classes, even though she heard Code.org is the best choice.

“On the College Board AP site, you have to declare your curriculum and upload a syllabus. There’s a weeklong professional development for whatever curriculum that you choose,” Roznai said. “If (Code.org) was approved midyear, I probably wouldn’t switch this year. But I might switch next year.”

Valcik, meanwhile, said she quit using the program CPS provided last year instead of Code.org because the “lessons were not up to par.” She said she also didn’t get to use Tinkercad, the free online 3D modeling program, or the communication app ClassDojo.

CPS said the Tinkercad vendor didn’t submit a proposal through the proper channels. The ClassDojo proposal was not approved for use, CPS said, because the operator would not sign the district’s master services agreement. ClassDojo doesn’t appear on the CPS SOPPA vendor list, even as a denied vendor.

Battelle for Kids, a technology organization that stores student course information and assessment data for teacher evaluations, also doesn’t appear on the list. CPS said that, like Aspen, Battelle is exempt from SOPPA because it’s not an instructional resource.

The district notified parents in May that Battelle suffered a ransomware attack in December on a server used to store CPS student and staff information from 2015-19.

The attackers accessed student names, birth dates, genders, grade levels, schools, student ID numbers, information about courses taken and scores from performance tasks, but not Social Security numbers, home addresses, financial information or health data, CPS said.

CPS said Battelle confirmed it complied with the district’s request to delete any CPS data not necessary for the delivery of contracted services. CPS said as a result of this breach, it is asking all of its vendors with data-sharing agreements to confirm the deletion of any unnecessary data and is implementing annual security assurances.

Creswell said the Battelle breach raises questions about the way CPS enforces its contracts.

Afternoon Briefing

Daily

Chicago Tribune editors’ top story picks, delivered to your inbox each afternoon.

“Why did Battelle have that much old data sitting around when it seems to say in the contract that they should be getting rid of data once they don’t need it?” Creswell said. “Who’s checking up on whether this contract between CPS and Battelle is being enforced? So that is very worrisome.”

The enforcement arm of SOPPA is the Illinois attorney general. A spokesperson for Kwame Raoul said his office hasn’t taken any actions specifically related to SOPPA.

“We aren’t aware of any SOPPA violations being reported to the office,” the spokesperson said in an email.

Creswell pointed to a lack of resolution about concerns raised over College Board selling student information. Nine state lawmakers sent Raoul a letter in 2019, urging him to investigate the organization, which administers the SAT test and oversees the Advanced Placement program for high school students.

A Raoul spokesperson said this week that his office “looked into this issue” but has “not initiated a law enforcement action. We continue to monitor and encourage students to file complaints with our office.” Complaints can be submitted through a form on the AG’s website, the spokesperson said.

College Board AP Central is described as an approved vendor on CPS’ SOPPA site, but the contract was not available as part of the listing, as of press time, nor were the data being shared.

tswartz@tribpub.com