Schneier on Security
A blog covering security and security technology.
« Fear and How it Scales |
| Friday Squid Blogging: Squid Sacrifices Arms to Avoid Predators »
August 24, 2012
Internet Safety Talking Points for Schools
A surprisingly sensible list.
E. Why are you penalizing the 95% for the 5%? You don't do this in other areas of discipline at school. Even though you know some students will use their voices or bodies inappropriately in school, you don't ban everyone from speaking or moving. You know some students may show up drunk to the prom, yet you don't cancel the prom because of a few rule breakers. Instead, you assume that most students will act appropriately most of the time and then you enforce reasonable expectations and policies for the occasional few that don't. To use a historical analogy, it's the difference between DUI-style policies and flat-out Prohibition (which, if you recall, failed miserably). Just as you don't put entire schools on lockdown every time there's a fight in the cafeteria, you need to stop penalizing entire student bodies because of statistically-infrequent, worst-case scenarios.
G. The 'online predators will prey on your schoolchildren' argument is a false bogeyman, a scare tactic that is fed to us by the media, politicians, law enforcement, and computer security vendors. The number of reported incidents in the news of this occurring is zero.
H. Federal laws do not require your draconian filtering. You can't point the finger somewhere else. You have to own it yourself.
I. Students and teachers rise to the level of the expectations that you have for them. If you expect the worst, that's what you'll get.
J. Schools that 'loosen up' with students and teachers find that they have no more problems than they did before. And, often, they have fewer problems because folks aren't trying to get around the restrictions.
K. There's a difference between a teachable moment and a punishable moment. Lean toward the former as much as possible.
O. Schools with mindsets of enabling powerful student learning usually block much less than those that don't. Their first reaction is 'how can we make this work?' rather than 'we need to keep this out.'
Posted on August 24, 2012 at 1:18 PM
• 25 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"...The 'online predators will prey on your schoolchildren' argument is a false bogeyman...the number of reported incidents in the news of this occurring is zero..."
*Cough* Lower Merlon School District *cough*
I believe your addressing "Robbins v. Lower Merion School District" in your cough cough comment. Which would be disingenuous to the topic at hand. These are point regarding an institutions practice of designing effective policies.
The issue is when the institution is the perpetrator. Largely a different topic.
Actually, I'd take issue with "E". I remember school routinely penalizing the 95% for the actions of the 5% in pretty much all areas of discipline.
While I am in agreement most of the points here, I do take exception to G. This does occur. It happened to my daughter - she came close to being the victim of a predator. It also happened to a friend's sister and she wasn't so lucky. Check out our stories at www.webwisekids.org. See "Katies Story"
The solution is not draconian measures but openness and education and in this I am in complete agreement with the author. I believe this can be done without exaggerating the extent of the problem.
Full disclosure - I was so grateful for the help and support that we received from Webwise Kids that I'm on their Advisory Board.
Very good. I'd say most of that applies to anything done in the name of "safety".
Jason! That's exactly what I was going to say. The whole group being punished/penalized for the actions of a few, or even one, seemed almost the rule back when my kids were in school--especially K-8.
Nice list. My issue is that I don't see a single thing on the whole thing that will make a school administrators job safer or easier. My guess is that if anything happens and you are following this list instead of being appropriately terrorized, you will have an amazing time justifying your actions after the fact.
Humans: smart enough to see our flaws (on other people), not smart enough to avoid them in ourselves. I'm not even sure school administrators can aspire to this high.
G is there because the reactionary behavior to the relatively rare instances of this happening have certainly contributed in an increase in this type of crime. Kids are less likely to report indicating behaviors out of fear that parents/adults will freak.
As you say, Lucien- open, calm, and proactive discussion of appropriate and safe behavior, as well as what to watch for and why, is the best prevention against predatory crime.
We can learn from teaching sex education in schools.
If we simply disconnect schools from the internet, don't mention the internet and have a zero-tolerance policy for anyone bringing an internet connected device to school - then there is no way that the school can be responsible for any online threat.
I can appreciate K. I remember back in school, when students misbehaved in the computer labs, they were denied access thereafter. I can only assume this still happens.
There's nothing like punishing a student by banning them from an education.
"E" sounds like an NRA talking point, as the gun-control discussion would have a very similar aspect.
From the article: "L. If your community is pressuring you to be more restrictive, that’s when it’s time to educate, not capitulate."
Administrators of schools operating from public funds can't take a stand against the public. In the public sector, a sufficiently strident small group, or a single lawsuit, can easily prompt political action that gets them reprimanded or fired, and then the bad policies get implemented, regardless.
The advice in this article would be more compelling if schools were in a 'marketplace': Find a reasonable balance between safety and effectiveness, and you'll end up producing a more attractive product (wider, more balanced education), and attracting more paying customers (parents who want their kids optimally educated).
@pfogg: Educating people is somewhat different to "taking a stand against" them. Educating is not just telling people you're right (and they're wrong). That's browbeating, not educating.
@Lucien: "Very close to " does not count. It uses the language of fear to imply "as good as" when it was definitely not so. (Hint: Was your child raped? How many more steps were needed to that outcome? At how many point could that outcome have been prevented?) What counts is actual numbers of children that fell victim to this and they are low enough for this to be a non-issue when compared to other, very real, dangers.
Also, children are generally not stupid. Protecting them from dangers they can grasp only makes them more vulnerable because it denies them an important learning experience. Stop crippling children that way! The only way for them to be reasonably safe is if they develop a sense for danger. They cannot do that if they are protected from any and all dangers.
You obviously don't live in USA.
@Karellen - For anyone working in generally visible public sector jobs, any sort of resistance to following current public sentiments, at least if it can't be explained by blaming circumstances beyond the administrators' control, is perceived as 'taking a stand' against public opinion. Resistance in this sense would include 'educating the public' if currently desired policies weren't implemented while the education was going on.
If the sentiment is "we're frightened, this is awful, do something", a public administrator is likely to have to implement bad policies long before 'education' would have any effect.
@Otter - I'm speaking exclusively about U.S. schools, as I have no direct experience with others.
@pfogg Ahahaha, that's funny.
When I was in 3rd grade we took legal action against my school district for violating federal mandates regarding my autism (namely, the part where they have to make reasonable sanctions to accomodate it, such as not calling the police when I raise my voice in class). Their punishment was... oh, wait, nothing. The only thing that happened was that I was allowed the privilege of going to another school district.
You see, in this grand state of Nebraska, schools can only suffer legal repercussions if they appeal the initial decisions. Now, I need your guys' help here, because I can't possibly see a loophole here. As far as I can tell that system is perfectly secure!
You better believe they're still abusing disabled kids. Most recently I heard from a kid who was locked in a closet for upwards of 3 hours.
Unfortunately I can't reveal the district because my mom owns a store in the area, and the people on the school board very much have the clout in town to get her shut down. Same reason she can't openly support liberal causes (because, yeah, you probably could have guessed these people are also conservatives).
Isn't half of security CYA? And if you're somehow responsible for security, it's a heck of a lot easier to set it at most restrictive and move on to the next problem. It's up to other stakeholders to push back, or fight it out with stakeholders of differing opinions. Most security controversies on this board can be boiled down to the CYA effect.
In corporations the profit motive tends to push back overzealous security officers, but in other areas, the people who are fearful are going to push a lot harder than the people who are inconvenienced or trying to uphold some ideal. So you pander to fear, set it at deny all, then go from there.
On an unrelated note, my college used to block mail client SMTP. So you'd have to send mail through the online interface.
Thankfully, they did realize that the real problem was Exchange Server and switched to Gmail the next year.
+1 for the voice of reason.
...and why was this list "surprisingly sensible"?
Great points. However, H. is not totally accurate. For many institutions that receive federal money in regards to technology or E-Rate discounts, they have to adhere to CIPA, http://www.fcc.gov/guides/... Draconian or not, schools get audited regularly for all sorts of stuff.
Not commenting on the validity of the point of view, i would like to provide some context, recalling that this is directed towards superintendents, not people who are on the ground.
B. Not all teachers are competent in the use of computing technology. The coordinator therefore has to work in this context, not an idealization of the upper administration. Often the idea that the technology coordinator works for upper administration, not for the teachers is the cause of the problem.
C. Recall that most students in most school districts are under 13. Most resources a pushed to this audience. It may hurt the minority of students who are 14-18, but there it is.
F. In a lab situation 100% safety is often achieved. School have gone for years without a serious injury in a chemistry or electronics lab.
G. School introduces tools and resources slowly. We do not give a soldering iron to a student without instruction on it's use. Most school are not going to take a field trip to the federal prison. I know this is hyperbole but really effort is taken to allow children to grown, not just throw them in the ocean and make them swim.
I. Everything happens within a context of intentional scaffolding. Expectations are set high, but a framework is carefully built to allow students and teachers to reach those expectations safely.
N. A decreasing number of teachers live, or even grew up, near where the students live. Teach for America, for instance, often will move teachers across a number of states to teach in urban environments in which the are absolutely unfamiliar. If you teachers do live in the community, more power to you, but many do not.
Q. I do not know what the definition of trust here. Do your trust a teacher to spend the night with a kid, or even stay in the same room unaccompanied with a kid? Discuss.
V. Exactly. Use the Intertubes to teach, do not just throw them in front of it like a TV.
Y. Schools need to use this hyperconnectivity to teach, and students need to learn it as a tool. How many people do you know who just the computer to play games and the phone to get dates?
Again, I do not disagree with anything in particular, just wondering where he is coming from in terms of context.
@curtmack: Just so. Elected officials worry about public opinion (locally, due to elections, and regionally, due to higher-ranking office-holders). Complaints that don't have a cost in public support for elected officials can be ignored, and it's safest to do so (since any change might have such a cost). You stay elected if you judge these things well, and get booted if you don't. The appropriateness of the policy isn't a direct consideration, either way. My original point was that an appeal to reason won't lead a Vicar of Bray to adjust his position or take any kind of stand.
The solution, I think, isn't to become the one with the most leverage on policy, as that's hard to arrange, even harder to maintain, and just makes you the authority that has to be bypassed when you happen to be in the wrong. The trick is to switch to a system where there's more than just one approach available, so you can pick the one you like best.
Wow, G. could not be more wrong. Go work at a significantly large PD for a week in the crimes against persons unit or juvenile unit and see how many solicitation complaints come in. The list you give of people bringing attention to this are those that have access to the actual data regarding the threat. If it isn't in the news ... it's probably because it happens all the time. What percentage of car accidents make it into the news paper?
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.