Blackboard LEARN security vulnerabilities

Sandra is back after a three week blogging hiatus.

The Australian edition of SC Magazine, which focuses on IT security, reported that Blackboard Learn had serious vulnerabilities. The report revealed that "security vulnerabilities have been found in the world’s most popular educational software - holes that allow students to change grades and download unpublished exams, whilst allowing criminals to steal personal information." Initial concerns reported to Blackboard by Australian university managers were ignored or dismissed, which led to the publication of an advisory by AusCERT, a non-profit security organization funded by Queensland University. Blackboard then responded with its own advisory.

Blackboard Learn is used widely by U.S. universities and by the U.S. military. Inside Higher Ed also reported on the security concerns:

Matthew Maurer, a spokesman for Blackboard, told Inside Higher Ed via e-mail that the article was correct that there was a security flaw, and that this problem was not unique to Australian universities. But he said that the article (which has been circulating among some American IT officials) had an "exaggerated fashion" in describing the problem. "There's not a single reported case of exposure, just the theoretical," he said. Maurer said that many of the issues were very quickly fixed, and that the company is now providing information to colleges and universities so they can see that there are not serious problems remaining.

Commentary
While there may not have been a single reported case of exposure, there was a significant security flaw. Universities purchasing online learning systems and students paying tuition to access online courses should have assurance that the products do not have this level of security holes to begin with. Security issues affecting other U.S. online education initiatives remain a concern.

Previous postings on this topic:

Student Data Collection: Purpose, Costs, Risks?
Education Reform and Privacy Concerns Collide

ED WEEK: In Common Core, Little to Cheer About

Andrew C. Porter has been an education reform advocate, supporting common core standards and assessments; however, he has changed his mind and expressed his current assessment in a recent Education Week article.

"In short, I hoped that new national curriculum standards would be better than the state standards they replaced, and that new student assessments would be better, too."

"I wish I could say that our progress toward common-core standards has fulfilled my hopes. Instead, it seems to me that the common-core movement is turning into a lost opportunity."

Common Core Standards

Using a "recognized content analysis tool," Porter participated in an analysis of the common core standards comparing them to existing math and English language arts standards in over 20 states. The resulting findings were "unexpected and troubling."

"The common-core standards do not represent a meaningful improvement over existing state standards."

When comparing these standards to those countries who are described as beating U.S. students and international exams, he finds other countries focus more on basic skills and less on higher order thinking skills. He wonders if the standards fail to achieve the "right" balance.

Common Core Assessment

Porter finds equally troubling concerns with regard to the common core assessments:

"But what I know so far about the work of the two multistate consortia developing the assessments isn’t promising. It sounds as if the new assessments may ignore state-of-the-art research and technological advances, settling for tests that are much like the ones we already have. Meanwhile, innovative work on assessments that’s been going on in the states has ground to a halt while everyone waits to see what the consortia come up with."

Porter concludes the common core et al may end up "much ado about nothing." He is, however, one more in a mounting number of voices questioning the effort.

From a taxpayer's point-of-view - who pays, who benefits?

North Carolina student data revealed online: State Longitudinal Data Systems Revisited

A phone call from a parent alerted North Carolina Department of Public Instruction officials that private data on school students was posted online.

"Data housed on a N.C. State University computer server that contained private information for about 1,800 schoolchildren from Richmond and Wilson counties was inadvertently made available online, university officials said Tuesday.

The data, gathered from 2003 to 2006 as part of a research study on classroom practices, included names, Social Security numbers and dates of birth. The three affected elementary schools are the now-closed Ashley Chapel in Richmond County and Gardners and Wells in Wilson County."

Read more on this breach of data here.

Although the source of the error is not described, the news report alludes to a computer "glitch" of some type. How seriously should this breach be taken? Could student data be hacked, repackaged, sold, and revealed?

Recent reports reveal an Anonymous group of overseas hackers have threatened attacks on U.S. law enforcement computer systems. Of the 70 attacks claimed by the group, only Arkansas and Louisiana attacks have been verified. Officials say that no sensitive data was accessed.

Last month the U.S. National Security Council released a report in which it named cyber crime as a major threat to national security, and costing the U.S. $1 billion annually in losses.

With Race to the Top dollars, states have been developing State Longitudinal Data Systems using federal parameters and guidance. However, the Los Angeles Times reports that California's Governor Brown recently decided to reverse that State's decision in development of the SLDS saying districts had the data they needed.

In a February 2010 letter, U.S. House Representative John Kline wrote Secretary of Education Arne Duncan last year regarding this initiative:

"As part of what you described as a "cradle to career agenda," the Department of Education is aggressively moving to expand data system that collect information on our nation's students. I am concerned by recent reports that indicate the Department's hasty pursuit of this goal could compromise student privacy rights."

Kline goes on to say: "The Department's efforts to shepherd states toward the creation of a de facto national student database raises serious legal and prudential questions. Congress has never authorized the Department of Education to facilitate the creation of a national student database."

Read Rep. Kline's full letter here.

Teacher performance pay is described as the rationale for this massive data collection initiative. Does a performance pay structure through data collection outweigh the costs, risks, and privacy considerations?

For facts and details on SLDS, go to Truth in American Education.