How Schools Can Stay Safe

Jeff Carlson: Okay.

Kevin Hogan: Hello and welcome to the latest episode of Tech and Learning Conversations. I'm, um, Kevin Hogan and I'm glad you found us. Now, if you work in a school district and you've ever wondered why cybersecurity keeps topping every survey of what tech leaders worry about most, even after all these years, and even after all the tools and training we have, today's guest has some answers. Jeff Carlson is the head of education strategy and advocacy at clever, which powers single sign on and rostering for somewhere between 75 and 80% of US schools. Before that, he was a special education teacher. His dad was a superintendent. His mom was a teacher who used CLEVER and assumed, like most people, that someone at her district was paying for it. Today we talk about why cybersecurity never gets easier. What the Coin State of EdTech report is really telling us, how the arrival of AI is changing the threat calculus for districts and what it actually looks like to build a responsible edtech governance culture from the inside out. Click through and listen. Okay, Jeff, thanks so much for taking the time to, uh, meet with me today. I really appreciate it.

Jeff Carlson: Yeah, thanks for having me.

Kevin Hogan: And I guess, um, there's so many different ways we can go about this conversation. I mean, CLEVER is such a, um, I would say ubiquitous part of any school, ah, district's, uh, infrastructure. Um, I would say probably a great majority of our readers, our listeners, are using it, if not implementing it, and purchasing it and making the decisions on whether and how to use it. But to start off, can you tell us a little bit about kind of the how the sausage is made? In other words, uh, while everybody has it, I don't think a lot of people kind of know how it exactly works. So you must have a cocktail party definition for that, right?

Jeff Carlson: Yeah, that's a great question. So it is. So we're between 75 and 80% of US schools, uh, both private and public, uh, use CLEVER in some way. Um, the core thing to know is that the things that schools know the most, the teachers and parents know the most about. CLEVER is our single sign on service. Um, a lot of folks within tech teams know about our rostering service that we provide. Those two services, since Clever's beginning 13 years ago, have been free to schools. So schools get access to those tools for free. What happens is the data that schools give to CLEVER through our API and through our process, just the data that the school wants goes to the separate vendors that they work with on the other side. And because we're able to give much cleaner data than a Whole Excel file, sometimes accidentally with PII in it. Or a kid moves from one teacher's class to another teacher's class at 3:30 on a Thursday. And they need to be able to get into everything at, you know, 8:30 on Friday. We update that for both the school and the vendor. But all of your major tech companies that work in education work with CLEVER and want that clean data. So they pay CLEVER for access to that API that gives them a clean way for the school to say you only need these three data fields. You don't need the whole download for our sis. And so those products have been, have been free to schools since um, clever's inception. And then the companies that we work with, that schools work with, um, take the data from us that schools have said, yep, these are the ones that that company should get. This is the data fields that that company needs. And that's how kids get into all of their, their different products over the course of the day. Teachers, um, you know, add the different products that they want into their teacher portal. Districts can do that as well. They may have a portal that says, hey, here's the things that we vetted where we've got a data privacy agreement. Um, and then in the last couple years schools have asked us to help them with a couple different cybersecurity pieces. Specifically multi factor authentication, uh, primarily for kids, so doesn't require a second device. Lots of cyber insurance companies are requiring that schools mfa, more folks. And we've seen a lot of the incidents that are hitting schools to sometimes have to do with, without folks being under mfa. Um, and then we're also doing some other identity management work with schools. Those are available for purchase, uh, at a per user basis. Um, but the core product that most folks know us for has been free to schools. A lot of times when I talk to schools, people assume there's been a check coming to Clever. On the school side, it's either just smaller or bigger than what they normally sign. My, uh, dad was a superintendent, my mom was a teacher who used clever. And they both assumed that somebody at their school district was paying us. And unless folks are using those specific cybersecurity tools, the core rostering and SSO stuff is free to schools.

Kevin Hogan: Well, it seems that, you know, with the most recent Cozen survey, uh, of superintendents and district leaders about like what keeps them up at night, it's that cybersecurity aspect of things. It always has been that way, I think as that Cozen report for the past 20 years, I mean even during COVID um, cybersecurity maybe even became more of a worry? Uh, yeah, that's right. Remote learning. Can you talk about like kind of where the state of play is there now and is that something that surprises you or is kind of give us your feedback with your interaction on why cybersecurity continues to be such an urgent matter?

Jeff Carlson: Yeah, so I think that's right. I think it's like eight years in a row. At least the COSM report has had that feedback from tech leaders in schools. I think there's been one for a number of years. There was just limited capacity on school tech teams with expertise in that field. So you didn't necessarily have folks who were uh, confident about how to build a cybersecurity program at a school. And so that's why you saw a tech leader saying, I'm not sure what to do about this. And it's a concern for me because I don't have that actual basis of expertise on my team. We've also seen schools become in some years the most targeted industry. K12 has become the most targeted industry for a couple years. Um, and what we saw when we interviewed a lot of the same folks with uh, a uh, report that we did was that the thing that tech teams worry about most when it comes to an incident are that student data is going to be released.

Kevin Hogan: Right.

Jeff Carlson: We've seen a lot of incidents where maybe salesforce data gets released about contacts at a school or you know, none of us want this to happen. But if it hits the HR system and teachers data gets compromised, that's not great either. But the biggest concern that we hear from tech teams when they responded to our survey was that they're worried about student data coming out. And I was a special ed teacher with students with special needs. You've got health data, you've got comments that may be back and forth between, you know, mental health challenges that somebody may be going through through. And so that is a concern and it just really hasn't been fully addressed. We still see it happening to schools. We saw a pilot from the FCC about cybersecurity funding to schools, but it wasn't a full implementation and schools are still waiting for funding there. There are new types of threats we saw. I think it's an Eightfold increase in two years of folks worrying about third party vendors having an attack that then's going to hurt them. We've seen some very public incidents about that too. And so there's just new stuff every year that even if you've solved one thing, there's another thing. That's what clever wasn't doing a whole lot. Although people don't think about single sign on as a cybersecurity measure, but it is right even. And so that's long been a thing that we've done for schools. But with multi factor authentication, you want something that a fourth grade special education teacher is going to be able to make work in a classroom. It may not be the tightest, most, you know, locked down type of cybersecurity, but if we introduce that into schools, teachers are going to have to get around it because if something doesn't work, they need to do their primary job, which is to help kids learn. So we're trying to build tools that actually work in school and find that balance between the appropriate level security, but also things that will actually work so the kids can get through their school day. And that's a balance that I think schools are having to figure out each year, which is why it still raises to the, you know, rises to the

Kevin Hogan: top and it keeps getting more complicated. Right. With the proliferation of tools and.

Jeff Carlson: That's right.

Kevin Hogan: Apps and the uh, and the encouragement, I guess in general, I'm always talking with district leaders and we're talking about the effect of technology in schools and whether it's appropriate or not. And a lot of it comes from like whether it's a bottoms up innovation sort of way where the teacher's inspiring, hey, we want to use this tool. We found this versus the hey, the district leader is going to make you use this stuff whether you like it or not. Right?

Jeff Carlson: That's right. That's right.

Kevin Hogan: There's always this push pull there. Um, what advice do you have for our readers for those district leaders in terms of trying to manage that push pull?

Jeff Carlson: Yeah, I do think that we've seen more of a move, which I think is better from a security perspective of teachers may be needing to go through a process or building leaders needing to go through a process to get things like a, uh, data, uh, privacy agreement to make sure that applications have been vetted to have some cybersecurity protections there to understand what's happening with the data. Even something if it's a free tool where you don't have to log in and you're just going to a website, is that actually all that's happening when you go to that website? And so we work with a lot of schools that are doing things like moving more of the things that are used into the clever portal, um, or whatever other portal that their district is using. Right. Stop m going to the random web address. When I was a teacher, it was like, let's go to a to z learning.com and hope that the kid doesn't figure out how to go to another web address. We need to be past that. That was quite some time ago. You can tell from my increasingly gray hair that it's been a while since I was in the classroom. But we have tools that can help with that. I think we did an emergency, unintentional m implementation of ed tech in a lot of schools with a lot of teachers during the height of the pandemic. And what I see tech teams and academic officers figuring out now is what does it actually look like to do a more intentional rollout of the edtech that we want teachers to be able to have access to that doesn't shut out things like startups that may not have every T crossed and I dotted yet, but also make sure that the data that we have on there for kids and staff is safe and protected. We're thinking about ways that we can work with a lot of the vendor community to make some of that easier too.

Kevin Hogan: Right.

Jeff Carlson: What does SOC 2 certification look like more easily? There's obviously some coding tools that might come out of things, like a lot of the large language models. Can we make that easier for a company to get up to speed and have some of those cybersecurity protections, though, like you mentioned, we also know that a lot of the AI tools are going to make it harder to fight off some of the cybersecurity attacks too. So it's going to be a continual push and pull. But we do see increasing sophistication from schools about how they're thinking about these questions.

Kevin Hogan: Yeah, I think we got a full seven minutes before we mentioned AI.

Jeff Carlson: Yeah, I don't know how, which is

Kevin Hogan: pretty good, but I guess I got to go there. An important aspect. What sort of effect does that technology have on both your work at Clever, but as well as for those vendors out there? And, um, I would say the kind of responsible use you talked about policies and districts having that, um, do you see maybe an increasing need for the industry to have a responsible use policy on how these tools are being developed and put in?

Jeff Carlson: I do think so. I think we've seen some educators and districts be frustrated at, uh, products that have implemented specific, either staff or student facing AI tools without a very broad awareness campaign that that was going to happen. And so I do think that something where the school is deciding when and how that happens and that can happen at the Grade level. Right. So you can do that for grade bands. Um, instead of, hey, today you woke up and the app updated overnight and now everybody has access to this. That's not going to work. That's not going to build trust long term, um, both between the companies and the schools and families and communities that are sending their kids to these schools. Neither side of that trust factor is going to increase with that kind of work. So I do think we're seeing some of that. I think it actually doubles down on what we were talking about earlier. Vendors in particular need to be even more clear about their data privacy. What happens, where is the data stored? Because I'm not sure that we need a whole new set of AI regulations and policies. What we do need is very, very clear cut, straightforward, easy to understand data privacy agreements because of the amount of data that now comes into play when you're thinking about AI. And so schools need specific kind of standards about how they're, you know, what are they going to do, what's a red, yellow, green. In a lot of cases, we're seeing that for kind of AI implementations. I do think that a lot of the questions that need to be answered can come through very transparent conversations between a vendor and a school on various cybersecurity measures that are being implemented. Data privacy restrictions, what data do we actually need? Data minimization practices, things like that that actually help solve, not just for AI, but all of the other tools that frankly are using AI in some shape or fashion as well. Right. I think we're pretty quickly moving from having AI companies to just companies that are using AI. We used to have Internet companies, everybody has a website now. There's not such a thing as an Internet company. And so we can't assume that just because somebody hasn't told you they're using AI in this way that they're not using it in some way. So I think transparency is key for us at clever. We are looking at it. You know, our engineering and product teams are obviously thinking about it in their day to day work. Um, some of that work is also happening with our support teams. Are there ways that we can answer questions for schools more quickly when they've got a question? Um, but then also there are new ways that we're working with vendors to say, how can we help you in that transparency process with schools so that they know how you're using things? And so there's some conversations with folks about how we might be able to help with that as well. Schools look to us to be able to have those answers and work with vendors more quickly and efficiently and safely. And so that's definitely something that we're looking at as well.

Kevin Hogan: All right, well, here's another disconnect that I find uh, our readers, uh, uh, hopefully you can solve this problem as well. But when it comes to device manage management right now, especially with students bringing their own devices into school, um, you look at Los Angeles County, I think it was about three or four years ago, they made this big announcement about their new AI app and they're encouraging all the students to download and in the same week they're setting up a policy where students can't use their devices in school. So it's like there's a yin and to any yang to this, it's like uh, where is it? Have you seen any districts who have successfully establish a best practice when it comes to device management or in general? Do you have suggestions for our, our audience on how to deal with that disconnect?

Jeff Carlson: Yeah, I think the part of the push pull is to what you were talking about kind of top down versus bottom up that we were talking about at the school level. That's also happening at a policy level.

Kevin Hogan: Right.

Jeff Carlson: Uh, you've got states that have taken much more specific actions to help districts or to force districts to do things depending on where you are. And you have states that kind of have said we don't want to be too heavy handed and, or we just haven't gotten around to it yet because we're not sure how we should do this. I think if I were still in a school building, I would be thinking about making sure that staff and educators know the difference between the consumer AI tools and the tools that we have decided as a school organization to vet to purchase licenses for even things like toggling to make sure that if you're using one of the broadly available tools that also might be purchased by your, that you're logged into the right account. Right. And so even things like that and then, and making sure that on student devices that you're filtering is making sure that students can't go to those because we know that even if there's a device ban, there may be either burner phones or they're in their lockers or they're there at the end of the day when they get the phone back and they're waiting around for the bus and you're still responsible for usage during those periods, even more so if kids are taking devices home. And so I do think there's a lot of products and tools out there that Schools maybe haven't had to look at as intensively because they weren't doing quite as much filtering. But when it comes to an AI tool, you really have to think about that. We have seen districts, you know, you've seen, uh, I think it was Denver that said, hey, we've actually purchased built for K12 tools wrappers around some of these large language models. We're going to use those. We are not going to allow the use of the consumer AI tools on our network. I think that makes sense, especially right now where we have, we are dependent on these models to tell us when they're not going to release something that may be a little bit too scary. And as long as we're in that world, I don't want the kids, I love the kids that I help teach, uh, all those kids need to be protected from that kind of world right now. And so I do think there was maybe some initial excitement about the way that this can work. We really have to be careful when it comes to AI that we learn lessons from past tech rollouts that we don't over promise and under deliver. We have to make sure that we know exactly how this is going to impact kids. There are a lot of things that we can do at the educator level to do time savings, to do efficiencies that actually create more time between teachers and kids. And so again, one, transparency. Two, focus on enabling things for teachers before you start enabling things for students. And I would look to some of Those built for K12 wrappers or kind of intentionally built design for learners rather than just seeing how you can mash a consumer built tool into a school system.

Kevin Hogan: Yeah, that's great stuff. That's great stuff. So, uh, to wrap things up here a little bit, um, I really think we established a state of play of where our districts need to be looking and that. You just stole my last question in terms of priorities of things. Um, but talk a little bit about what expectations our audience should have about the continuing. You can't call it an evolution. It's a phenomenon of just how quickly these technologies continue to evolve. Um, something where they might, even after listening to us talk here, might feel a little overwhelmed. Um, what would be those first steps that they should do once they get off of this, um, recording and have a tech team meeting tomorrow morning at 9:00'. Clock.

Jeff Carlson: Yeah. So I think the first thing is to take a breath and recognize that we ask K12 school systems to solve a lot of societal problems continuously that we haven't figured out outside of the school. System. We bussed kids around cities when we couldn't figure out redlining. Um, we haven't come to some agreements on what gun control looks like. And so we ask kids to walk through metal detectors and teachers like my mom huddle, hoard kids in the back of the classroom for drills. Um, this is a new technology where adults are fearful not just of what it might do with their kids, but also what it might do to their job. We are having regulatory debates at a federal level and a state level about how these tools should and shouldn't work. So it's not a surprise that that's also impacting the place where families send their kids their most trusted possession for, you know, the majority of their daylight hours. Uh, that's going to be a question that folks are asking. And so I think being very clear about what you're willing to do, what tools, you've actually looked at, how you're thinking about it from a school perspective, broadly communicating that, not just to your board, not just when somebody asks you, but beforehand, getting in front of parents that may be harder to reach, listening to their concerns, um, and having a continual dialogue and stating out loud that where we're at today is probably not even where we're going to be at the beginning of next school year. That, uh, we need to have this be an evolution instead of a policy that's going to be set and we don't have to think about it again. And to also be open to saying we may get this wrong and we may need to come back and make some changes. Because I think in a lot of things that have happened over the last few years, policymakers, family members, educators themselves, have felt like things have happened to them instead of with them. The more that we can say, hey, we're all in the same boat, we're trying to figure this out together. We don't have all the right answers, but we also know that we want kids to be prepared to go into a world where they need to have agency over the agents that they're going to work with. We can't pretend that this movement isn't going to happen. It may not happen quite as fast. Or maybe we'll figure out some regulations that are both workable, that enable innovation, but also keep us safe. Um, but we're all going to go through that together. And we've got to make sure that 8 year olds, 12 year olds, 17 year olds are going through it in an intentional way. And not just that. We look back in another couple of years ago. Oops, we should have really thought about that more carefully. We're definitely not going to get everything right. We're definitely going to wish that we had moved faster in some ways and slower in others. But letting folks know how we're thinking about it and letting them know how they can be part of that process instead of just waiting to see what's going to happen to them is definitely something we can learn from the past couple of iterations, whether it's social media or Covid shutdowns, lockdowns, and coming back in. AI is a quicker version of that in some ways, but there's some lessons learned from past things that we've done that I think can be applied here too.

Kevin Hogan: Yeah, well, great stuff. Uh, um, we could go on for a while on this, I'm pretty sure, but I am no Joe Rogan, so I want to try to keep things more concise and maybe finish up on that positive note. But you've really shared a lot of insights that I know our audience is going to, uh, appreciate and be able to use. So thank you and thank you for the work and thank you for the work that CLEVER does in space. Uh, it's hugely important and, uh, we'll look to you to, you know, continue to follow this story, which is, uh, while scary sometimes, overall I think a very exciting place. Yep.

Jeff Carlson: The best thing you can do with fear is try to understand where it's coming from and see how you can get over it one step at a time. So we're going to do it together with, with teachers and families and tech teams at the heart of all of it. So happy to be here. Thanks for having me.

Kevin Hogan: So thanks Jeff, for a conversation that covered a lot of ground, from the basics of how CLEVER actually works to some genuinely useful frameworks for thinking about AI governance in schools. If you took nothing else away, take this transparency first, data minimization always. And build for teachers before you build for students. Clever's core rostering and single sign on tools are free to schools. You can learn more about them@clever.com and for the full Cozen State of EdTech report, head over to cosn.org for tech and learning. I'm Kevin Hogan. I hope you share this one with your tech team. Leave us a review and we'll see you next week.