Want to see how you can mitigate risk with Orah's powerful student location & behavior management tools? Get a demo today.
Dr. Ashley Cross: Hello. Hello, everyone. Glad to have you joining us today. Feel free to open up the chat. Say hello. Let us know who you are and where you're from.
Alright, so we're going to go ahead and get things kicked off. So welcome, everybody. Today we have a very exciting sponsored webinar. We are bringing in some of our friends from Orah. Now y'all, Orah is used at over 500 independent schools across the country. And so they've got some really great insights on reducing risk at independent schools.
So we're really happy to have them today. If you have questions for them, be sure to put them in the chat. And their team is going to, be talking to us. They've got some really great stuff. So Ronan, if you want to go ahead and kick it off. Welcome! So glad to have you with us today.
Ronan Quirke: Thank you so much, Ashley.
And hello, everybody. yeah, my name is Ronan Quirke. I'm going to be your host today. I've got the easy job. I can just move things along, tee up some questions for our expert panel today, which I'm delighted to have. so today I'm going to maybe call on everybody to introduce themselves in a second, but just to to recap first on on what our topic is today is reducing risk at independent schools.
my my previous job before this was working at a bank. And, if any of you are familiar with banks, then pretty much half the conversations you have are about risk. well, so I thought I avoided that when I came to education, but I think it's definitely a topic which is probably important for us all to kind of to upscale on in the right way.
Hopefully don't spend half our time on, but there's definitely some emerging topics that we, we do want to, to, to discuss and cover today. So without further ado, to speak, we've got three, speakers, as I mentioned today, Cameron Shilling from McLean Middleton. and I think Cameron, you are based in New Hampshire, if I got my dot correctly.
Cameron Shilling: sort of, yes. Our, our law firm is located throughout Northern New England.
Ronan Quirke: Perfect.and Derek Carr from IMA Financial Group based in, you're in, in, in Denver, I believe, Derek.
Derek Karr: Yes, I actually reside in our corporate headquarters in Denver, Colorado. Awesome.
Ronan Quirke: And,Kurt, who's head of product here at Orah and our co founder, who's based in Tokyo.
And I'll kind of get you to introduce yourself in a second as well. And, myself, I'm a product manager here at Orah and, I'm the very tiniest. And it's also the farthest furthest corner of the map. Then here in New Zealand as well. So So, so thank you everybody for joining us. yes, so maybe I'm just kind of hand back to yourself Cameron, maybe you just want to give a quick intro and what's brought you hear today?
Cameron Shilling: Yeah, sure. so my name's Cam Shilling. I'm a cyber security lawyer. I've been doing cyber for close to 20 years. and that practice practice started out as being cyber and has since moved into privacy and AI, all of which I will touch on today.
McLean Middleton is a law firm of about 120 lawyers. we have a very large independent school practice that, obviously was founded in, in Northern New England, where there are a lot of, independent schools, but now we do work for schools really all over the country and all over the world, particularly with respect to the matters we're going to talk about today, which is cyber privacy and AI.
Thanks Ronan
Ronan Quirke: perfect. Thank you, Cameron. And Derek.
Derek Karr: Yeah, I'm Derek Karr, the National Education Practice Director here at IMA slash Bolton, are one of our partners out in Southern California. I've been working here for 3 years. IMA and Bolton were both my clients previous to my engagement with IMA, so I've known these teams.
For roughly about, 15 years now. So I get the pleasure of working with some of the best industry experts as it's related to, mitigating risk from an insurance brokerage perspective. we do work with roughly 250 independent private schools across the country. And I look forward to, today's discussion and see how I can, assist with any of the comments.
Ronan Quirke: Awesome. Thank you, Derek and
Kurt Meyer: Kurt. Hi everyone, I'm Kurt Meyer, Head of Product and co founder at Orah.yeah, we've been working with independent schools, for about 11 years now. we started in boarding schools, I myself went to a boarding school in New Zealand and, yeah, my co founder Paul and I, started off helping schools just keep track of where students were, which was You know, one of the core things that schools care about, and relating to the topic today of, safety and reducing risk, I think that's always been something that our customers have cared about and independent schools cared about.
So. Looking forward to sharing, some thoughts today.
Ronan Quirke: Awesome. Thank you, Kurt. And so, yes, we do have some topics that we want to go through, all with, I guess, a technology focus, or the backdrop is technology and how this all applies, to our, to our, to our roles in, in education. I'm hoping it's kind of going to be a little bit freewheeling in terms of, if there are questions, I think, probably given the nature of of the of of the session and just pop up those questions in and I'll jump into them straight away or feel free to jump in yourselves.
so yeah, so the the three kind of hot topics that we wanted to kind of go through today is cyber security, student safety, and then I guess. How that all plays into is liability and insurance as well. So it's kind of bringing our expertise out for that. So, yeah, maybe, Cameron, if you wouldn't mind just kind of, telling us in terms of what you're thinking in terms of cyber security and what you're seeing and what your advice and guidance will be to schools.
Cameron Shilling: Thank you. So I want to, first of all, lay an overall framework for what schools are dealing with, from the global cyber security perspective. And there's, there's really three big areas. one is artificial intelligence. There is absolutely no doubt that 2025 is going to be the year of artificial intelligence for schools.
Faculty students already using it, clamoring to use it, AI being integrated into, existing applications that schools use your business applications. Also, you know, obviously, generative AI and general purpose, AI is going to be is being and is going to be used. It is. 2025 is going to be the year for this.
and I think, schools that are really considering this seriously realize that, this is a powerful technology that needs to be implemented in a planned way. it is not going to be a good idea to simply, allow faculty and students to start using AI for educational purposes. I mean, we obviously all think of the kind of ethical issues and the honesty issues with the use of AI, but we really need to think of, cybersecurity and privacy issues with AI.
and make sure we, we implement that in a planned way. And I do a lot of speaking just on the AI topic. I'll be at tabs in Boston later this year, but also, if you just Google me, you'll see, we do this. We try to do this topic about once a month, at least. So this, so AI is going to be the biggie.
However, the other two are probably more important, perhaps all the less noticeable, but the second is privacy. So You know, obviously, in 2018, privacy became, the, the front line of the cybersecurity world with, GDPR, and then privacy laws got adopted across 20 states. these laws apply if schools have students from those.
locations as well as obviously if they're in one of those 20 states, schools really need to get to the front lines on privacy. There's too many schools that just haven't done anything. and, and these privacy laws are not just about posting a privacy policy on your website. There's a lot that goes into it, including, Providing the right notices, getting consents.
All schools are in the, the consent area of privacy law because we handle information about about children. so, whereas 2025 is, you know, everybody's going to be clamoring for AI. If your school has not dealt with privacy yet, it is probably equally, if not more important. And the last piece is the actual security piece.
and The point I want to make about security is that, if you think you are on the leading edge of security, you probably really ought to think again. what was good for security six months ago is not still good right now. And I'll give a few examples. and by the examples, I hope. those those those technology folks on the line say, oh, oh, oh, yeah, I get it.
So, give you a first example Six months ago or a year ago We all thought that multi factor authentication was the way to protect our networks and our email systems but threat actors very sophisticated organized crime groups are stepping around MFA. and so now, and so MFA is, is, is about as secure as passwords used to be.
and so the new technology that schools have to move to is, is conditional access. In other words, only credentialed devices get access to networks, and, and email. And, and that I hope is one of those areas where you as technology people are thinking. Yeah, I don't have that. or I've been thinking to, thinking about putting that in place, or I have that for maybe some faculty, but not for all faculty and all students.
another example of this is, mobile device management. So again, we, many of us have implemented this for handheld devices or tablets. But MDM really needs to be deployed on all devices, including laptops, and that gives us a tremendous amount of security with respect to configuring security settings, ensuring that the devices are credentialed, ensuring that there is an advanced threat detection application on the devices, ensuring that.
that the devices are encrypted at rest, that users are not administrators. The MDM gives us a huge ability to configure really next gen,advanced threat detection on laptops, which is the primary area of cybersecurity risk. and the third thing I will talk about, and then I'll stop and pass the baton back to Ronan, is, is email security.
and particularly, sandboxing. we just can't rely on individuals to be good,good, or at least an infallible phishing defense. They just never will be. So sandboxes are, imperative. also the other thing that I really am working with schools to do is increase their licensing levels so that, they can implement things like geo fences on their email systems again, conditional access on their email systems, lengthy and robust access and activity logs.
So that when a compromise does happen, we have good visibility to it. So, again, I'll just, I'll, I'll, I'll end by saying that. what was good six months ago or a year is not leading edge now, and schools, as we all know, are being targeted. your vendors are being targeted, and we, we need to, as, as a school community, really move ourselves more to the leading edge on cybersecurity.
All right, Ronan, thank you for the opportunity to talk a little bit about that.
Ronan Quirke: Thank you, Cameron. I, when you were You're taking us through that. I was thinking to myself, putting my, my technology had on is,maybe we brought you to the wrong audience. Maybe because I'm sure everybody else on this call is agreeing.
They're just saying we just, we just need the funding. We need to relay that message to our stakeholders. you're obviously going to be doing that at tabs. but do you, do you feel. Is is it more the school's leadership that needs the education or is it a bit of mix of that? There's there's folks in technology that need to understand this a bit more to,
Cameron Shilling: a while ago, I would have said that, there were some education needed that in the technology area.
Now, not so much. I think really, I do more speaking to boards and heads and business managers, to make sure they understand just You know, how vulnerable the school is and what the cost of that will be. Also, and this is what I'll say on cost. There's a lot and technology folks know this. There's a lot that can be done without necessarily incurring a larger spend.
and really the issues are more cultural or operational. so, you know, your Google, you know, your G suite. licenses are probably have the ability to geofence and increase your log retention and possibly even go to conditional access, but you have to overcome some cultural hurdles. And again, that is what I am very good at talking to heads and faculty and business leaders and the like, and helping, helping technology people move past some of those cultural barriers.
Ronan Quirke: Awesome. Thank you. That that's, that's super useful and insightful. Thank you. Appreciate that. All right. Well, we'll zip through these. so Kurt, I'll maybe pass to you and just talk to get your thoughts on that. Do you want me to keep going with this deck or do you want to take over control?
Kurt Meyer: yeah, I can take over control of the date.
Ronan Quirke: You all will just have a big my face in your screen for a moment, bear with that.
Kurt Meyer: Let me know if you can see that.
Perfect. yeah, thanks so much. I've got a few slides. So, I tried to keep it brief for each slide.so to continue from, Cameron's. Insights. I think one of the most important things a school can do is pick the right technology partners. so you can have all the internal, security systems, but if you are sharing your data with another party who.
doesn't have those same practices, then, you know, the, the risk is, opened up again. so a few things you can look for is, security certifications. it's really hard to, you know, get a really deep understanding of the security practices of another company, on a case by case basis, but, security certifications help you just understand, Whether or not they meet a certain level, understanding where the data is stored.
I'm sure you'll, know that and, understanding who else, the vendor is sharing the data with. So I just want to provide a couple of, a few examples of how ORS approached this. so we have been certified for ISO 27001 and 27018, for The last five years, we were one of the first companies, I think, in New Zealand to get the ISO 27, 018 certification.
and I can attest that it's a very rigorous process. We have to be audited every year and it's not just. technical security, but, organized organizational security as well, and ensuring that we're upholding, you know, all of our, privacy obligations within each region.our data is stored in, the US, Australia, and the UK.
So we can pretty much, align with Most, most of our customers in terms of where they want their data to be stored.and we give detailed kind of diagrams of, you know, how, how we approach that, in terms of who we're sharing our data with, within our privacy policies, we, we try to, map out where, where the data is going, who's the controller, who's the processor at different stages.
So that is quite clear for everyone. Looking. And so that's how we. Approached, you know, those areas around cyber security.
Cameron Shilling: I think that's great. I can't tell you how helpful it is when we do vendor management to have a vendor that's open about this that has an industry certification is audited as opposed to doing a self certification and is really willing to give this type of information. This is so for the schools out there.
This this is a very good sign when a vendor is, is able to provide this information.
Kurt Meyer: Amazing. Thanks, Cameron.so, so once you've chosen the right, technology partner, you know, there's a few areas that technology can help. one of which is knowing where your students are. so working in boarding schools, that's always been one of the core, problems that schools have, is knowing where your students are, and that's really at the, the heart of keeping students safe.
because you can, you know, you can't really say, you know, you can keep them safe if you don't know where they are. so simply knowing who is on campus. being able to find a student when they're not in the classroom and, using that understanding to be able to account for students in an emergency.
so that's probably one of the, the, the big, the, the problems that we've focused. Like the better part of the last 10 years on is helping school solve that problem of understanding where students are. so we had we're able to keep account of students in different locations, not using GPS, although that's something that we've considered.
I think schools might be more open to it. these days, but it's it's being able to, understand where students are through all the different touch points that you might have across the school. So it could be, filling out absences, or going on leave, or going on field trips, or teachers taking class attendance, or checking into different, buildings on campus, or off campus.
So just, just creating interfaces for all those different touch points to capture that information of where a student is and, reconciling it to make sure that's up to date and flagging if students are missing. So if students are not, absent in class, for example, that's Very easy for an administrator or, you know, an advisor or someone to understand that that student needs to be followed up on and, you know, to update where they actually are.
And once you have a, an accurate understanding of where students are, then that puts you in the best position to account for them in an emergency. so within Orah, you can launch an, emergency. role to take account of students, but you've already got a Good understanding of where they are.so that that's just a few of the features that we have it or that can help you address better understanding where students are.
and the other area is being able to monitor student behavior.so a lot of, you know, safety issues are actually related to student behavior students, you know, harming themselves or harming other students and being able to track it.their behavioral patterns and just have awareness of, you know, if there are any at risk students can help, help you sort of engage with those students and respond earlier.
so things like, notifications that trigger, when certain behavioral issues or patterns emerge, being able to have effective communications and collaboration with other staff members to address those concerns. and being, being able to track them to ensure that they've been treated properly.
so we, at Orah, we provide a few dashboards, one that's more focused towards attendance and one that's more focused towards, well being.so the attendance dashboard can, identify different attendance concerns or patterns. So, if a student's constantly, showing up late. Or missing class, then that can be a precursor to some underlying behavioral issue.
so you can, you can generate a concern and, collaborate with other staff members to dig into it a little bit more and just, just close the loop to make sure that someone's checked in and that you'll. You know, tracking the status of that student.we also provide a way for students to, track their mood and emotion.
It helps build, emotional intelligence. It's using a a framework that, yeah, helps students build their emotional vocabulary, just understand the different dimensions that, contribute to the way that they're feeling.and so the student's getting some, some agency out of it from using the app.
But As a school, you're also collecting quite rich information about, you know, what this sort of emotional climate is looking like at your school. And again, you can set up triggers to, flag students who are, showing patterns that, you might consider concerning. And then you can dig a little bit deeper, engage with students and, yeah, ensure that you have that follow up process in place.
so that's the wellbeing and behavior side. And the final sort of area that, you know, we look at is communications. so in an emergency event, or, you know, just just generally communicating with students. one of the biggest issues is just making sure you have the correct contact information. And, if you have that like being at being able to actually get in touch with the student.
That that's the big one that we come across, but there's also, another need to have, like auditable, records of communications between students. and staff members. A lot of schools use like social media apps, things like that, which, you know, have privacy concerns, doesn't have administrative controls that you really need, to ensure that you've got proper access, to all that information.
so it's, yeah, it's, it's often difficult to find something that, at least in one platform that can cover those. different aspects. So, we, we do have a communications module as well. And yeah, we spend a lot of, energy just making sure that you have the right information. For all of your contacts and students and faculty.
and so you can get reports about, you know, what, what channels or what, contact points are available for each person. And you're able to just ensure that that's always up to date.so we often sync with the SIS, but, you know, we can, we can also do mobile verification as well, just in case there's any issues with that number.
so that, that gives a good base, you know, you've got the most accurate contact information, you can use that in emergencies, but we also have a, a chat platform as well, where students and faculty can, converse and all of those conversations are auditable so that, an administrator is able to, you know, look at, look at any thread to see, you know, what was said.
and all the access controls can be, set up as well so that, you know, the right teachers are assigned to the right classrooms and, you know, you don't get any of those overlaps.so that, that was a, a really quick run through of a few key points that, you know, I, I've seen over the years and that I think is important that we've been investing a lot in, in Orah.
And, that's it from my end. I hope that was helpful. I'll hand it back to Ronan.
Ronan Quirke: Thanks, Kurt. appreciate that. we, so that's. We talked about cyber and we talked about cyber again with you a little bit, Kurt, and then sort of some aspects of student safety that we've been focused on. And Derek, maybe, maybe we can call on you to kind of to maybe bring that all together from your point of view.
Derek Karr: Yeah, boy, when we talk about risks. In assessing risk for institutions across the country. It's such a broad spectrum. today we're going to focus on kind of a, in particular area, and I'll tie it into a little bit of, of how cyber bullying and some of the new initiatives that are as a result of that, playing into a lot of the liability suits that we're seeing, across the country, in one of our carrier partners, United educators releases a top 10 list of risks assessed by K through 12 institutions across the country.
And it's not uncommon to see this list pretty consistent, but what you will see is the concerns kind of move around that top 10 list. And this year enrollment still remains as one of the top concerns. Data security is number two. I think that's a pretty consistent risk that institutions are facing.
Operational pressures, recruitment and hiring, public safety, facilities and deferred maintenance, and then number seven, student mental health. which I'm going to talk a little bit more in depth about today, and then also just general premise safety and then sexual misconduct and transportation kind of rounds out the list as kind of the top 10, risks that institutions are facing.
each institution kind of has a different level, where they place that list, but I, if I'm guessing if each of you, were to kind of conduct your own top 10 risk, it may be in a different order, but those top 10 risks would probably be on that list. So what in mental health is causing, a lot of liability suits and what types of claims are we seeing, oftentimes students are alleging that their mental health issues are being brought on, due to challenges at.
their, their institution that they're participating with. And the three areas that I think, which was highlighted just recently, that people need to kind of pay attention to to identify at risk is the anxiety, the depression, or an eating disorder. Those are three, very common signs to kind of, be triggers to identify students that may be at risk for a mental health, related issue.
those types of issues kind of, culminate into a variety of different claims and, what those students typically are alleging that, result in claims against your insurance companies often revolve around Just educational services or day to day operations at the school. So if you think about it in that manner, it makes sense.
So a failure of a critical exam or a program expulsion, that that's a significant trigger from a mental health perspective.dissatisfaction with the disability accommodation process or the outcome. That's another big trigger for mental health that people need to kind of be aware of and make accommodations accordingly.
And the last, not too surprising, is discipline for inappropriate behavior. that's on the rise and unfortunately students have free time and they have access to wonderful Tools and resources through social media, the, the use of AI is a big portion of cyberbullying these days, and we'll talk a little bit about that here in a sec.
when we talk about kind of knowing where your students are, it's, it's probably easier to think about that on campus because there's There's easier ways to identify who's on campus through taking attendance and in those different scenarios, but when they go off campus, oftentimes you're out of your care, custody control, and it's creates a bit of anxiety for everybody that's involved.
Some of the things that you might be able to think about of kind of keeping track of students when they're off campus. I'm assuming that the majority of the institutions participating today are probably closed campuses. They're not an open campus format. But still, you know, students come and go, as well as other people on campus.
but knowing where the common places where students gather off campus, for social aspects is a good, area to start to kind of think about where are my students when they're off campus, off campus events, whether it's a sporting event or a musical event or any other event, knowing where those students are and.
And making sure that, their, their code of conduct is kind of being communicated to them so that they know they still are representing their school when they're off campus in that capacity. Getting your community's involvement is a key aspect of, helping you identify where students are. it's always a good practice just to have a solid community based relationship so that they can help you and assist you.
They can have a point of contact when they see something array or They recognize something that could be, detrimental to a student's health. And then the Student Code of Conduct, off campus. Making sure that there is some sort of policy or procedure that clearly identifies kind of what the Student Code of Conduct is when they're off campus.
those are just some common things that we, we like to see people, kind of have in their, their policies and procedures. So when we talk about real world implications, of addressing these risks, obviously the student safety and well being is number one. We all want our students to be healthy, happy, and be in a positive learning environment.
that's why they're attending school and we want to make sure that we contribute to that. also staying true to your mission statement is a key, attribute to that. So, that's why we want to address these, the risks. The other aspect, though, when you think about what goes wrong in these instances is the reputational risk of the institution.
unfortunately, when something bad happens, whether it's a, a student being severely injured or, in the case of suicide, we've, we've seen a number of suits that are brought where the institution has been dragged into a negative publicity from the media's perspective. so knowing how to address those concerns and identifying is a, is a key attribute as well.
Just some kind of simple things to keep track of, kind of a checklist, so to speak, as it relates to mental health for students, making sure you are clearly in communicating your accommodation process, a number of students will have or ask for accommodation process, make sure you're clearly communicating that with, with them, that, it's either acceptable or it's not acceptable, or, every, both parties are in agreement as to what those accommodations are.
And then following up on that, actually doing what you say, agreeing to it, and making sure that those accommodations are being,actually met, and from the student's needs as well as the institution's needs. You need to publicize the counseling resources. I can't stress this enough. there's just too many pressures on our Children today in the world and a lot of them are seeking help and guidance to kind of navigate that.
So making sure that they know the avenues that they can go to clearly communicate their concerns or their moves. it's just a really solid step in our risk management process. Documenting student behavioral, whether it's negative or positive, I think it's good. And I think a lot of people don't necessarily think about the positives.
But, often times it's good to, to focus on both. And making sure that, you know, students are focusing on the positive things that are going on on campus and in their environments. As much as the negativity and addressing those when those things arise or show themselves. One thing that's, very important to make sure that you're in compliance with is, FERPA.
the Family Education Rights and Privacy Act, and, and knowing what you can and cannot do from a, from a privacy purpose of communicating or talking about students mental health needs, those are, an important factor that you've got to consider in talking to your legal counsel and making sure you're compliant with that, is something that I highly recommend, everybody consider, on a pretty regular basis, not just, one, check the box and it's done, but actually review those policies and continue to update them as you see fit.
student safety is still our, our biggest worry from a perspective. It's what keeps me up at night. I'm constantly thinking about, you know, what, what avenues can we do? And we often want to utilize risk management policies and procedures, training and avoidance, prior to we start to engage what we call a risk transfer of purchasing, purchasing an insurance policy to kind of, give some sort of, way to transfer that risk from a financial perspective.
And oftentimes, as you relate to mental health, it's going to be your general liability policy that's going to step in and play a part in helping you figure out those types of claims and kind of pay for those damages that may occur. But the other aspect of that is the reputational risk that needs to be contemplated, because it's your reputation at the end of the day is what matters most.
And not having a plan is where your reputation is going to take the biggest hit, so. Making sure that you, you understand what your policies and procedures are, having them reviewed by counsel on a regular basis. Engage your insurance brokerage to understand if you're missing a, say a, a personal device use policy.
there's samples out there that can be clearly implemented in a fairly quick manner and, can be reviewed by counsel very quickly. Cybersecurity still, being one of the top concerns for institutions across the country. It's, it's a little ironic in the sense that, you know, institutions tend to have a lot of security as it relates to their, IT network.
However, they tend to have lengthier claims, meaning that the time to process these claims tends to be longer than the industry average. They also tend to be more expensive. and they can have ramifications just your day to day operations that are significant. An example of that was here in Colorado, the Aurora Public School District's IT network was hacked and the security systems for their facilities was impacted, mostly, meaning they couldn't use electronic locks to lock or unlock buildings.
Their, ability to enter grades into, the platform that they were utilizing for, power school, I believe is what their platform that they were using for checking grades and keeping track of those things. They weren't able to do that. So there's different avenues that can affect you from a cyber perspective that need to be contemplated.
Keeping reliable data, I think is most important having backups. is really key to that in your emergency management plans. It's related to your cyber. It's really the lifeline of your organization to make sure that it's operational. We think about this in the fires in California recently, where we had a couple of campuses completely burned down and they lost their entire network and their infrastructure.
they think that they can get up and running fairly quickly, but their facility that they were going to be utilizing as their backup plan burnt down as well. So you have to contemplate all of that and having a storage system to where you can still have your network off site and be able to be up and running quickly is something that needs to be contemplated, in your emergency response.
what is kind of, an emergency response? So a sound, response to that, you know, you have to be able to identify what the elements of a, of a crisis really is. So defining what a crisis is, is a key avenue to that, a clear statement on the plans, objectives. So whatever risk management strategy or emergency management plan that you've, Got drawn up that there's a clear statement as to what the objectives are to get the institution up and running as quickly as possible.
Listing the key audience, I think it's incredibly important to make sure that your is a part of that emergency plan. I think it's very relevant that that's going to be 1 of the 1st things that the sooner you can get that up and running the sooner you can get back to. I'm conducting a learning environment.
I think it taught us that remote learning is still an avenue that can be used. there is a significant argument against it as to whether the quality is as good. I would argue that it's not. I still am a firm believer that in person is a little better. But having that option, keeps you afloat and keeps your tuition dollars, within your institution to keep this, the survivability of the institution for long term.
One of the other little areas that I wanted to just briefly talk about is combating cyber harassment. And unfortunately, the statistics as it relates to students involved in sexual predatory practices as it relates to cyber through social media is pretty disturbing. And if you start to think about kind of, the number of students in, in.
the involvement of that, you know, 20 percent of all students have, by the age of 17 have experienced some sort of sexual explicit text message and 17 percent of them have seen an image of that. One of the uses of AI lately, is disturbing where they can actually take, pictures of other students and utilize that into these, these, these sexual harassment or cyber bullying incidents.
where they can nudify the, the image of somebody. So, they don't even have to have a naked picture of them anymore. They can use. Software through A. I. To actually create that. So that's a fairly disturbing thing to think about. so you kind of need to think about from, what is your policies and procedures around cyber and how do you combat cyberbullying is a big part of that.
So some of the ideas that I have for you today, just to kind of keep that in perspective, is to adapt a technology use policy that defines misconduct and states the consequences. I think that's a key component to that. I always have a caveat, always review that with your legal counsel to make sure that you're not doing something that's going to violate a right of a student in that capacity.
it's always best to update your sexual harassment policy basically every year, just because of the new technology that's out there. new ways to get to people. those are things that need to be contemplated in your, sexual harassment policy. Establish procedures for responding to complaints. oftentimes these are third party applications.
You don't think it's a factor of your institution, but we've seen a number of suits where institutions have been dragged into it for failing to respond or act in an appropriate manner, when the, the notion of these types of incidents occurs. And then educate your students, parents, as well as your educators.
Make sure that everybody's on the same page, like, hey, talking about this is a good thing, and combating it is the most important thing. We want to protect everybody's rights. We want to make sure that it's a safe learning environment and that that kind of behavior cannot be tolerated in any sort of fashion.
And then know your state laws, because each state jurisdiction will vary and differ, and it's important that you understand, what the consequences are for your jurisdiction. and I think that's an important facet that you need to be engaged with your legal counsel to make sure your, your policies and procedures are in, in ordinance with that.
So with that, I'm going to turn it back over to Ronan. I know that's a lot of information I threw out there. A lot of, different directions we can go, but happy to take questions at the end if, if necessary as well.
Ronan Quirke: Thanks Derek. yes, that was super useful. It feels like, I would want, I was making some notes, but I would want that, that checklist and to be working my way through it, there's a lot of topics to, to cover there, but.
All necessary, and I think I also picked up on your point. It's it's not about just having that list. It's about being able to to show what you're doing about all of those things within your institution. And if you're doing that, Not only does it protect you from liability, it also, it's a habit that you get into in terms of operationally, then refreshing, making sure that you're actually following those practices as well.
So, yeah, a little bit overwhelming if you're not doing any of those things, but I'm sure most institutions are. I guess it's just about you taking a bit of more of a strategic approach, right? Just working through that list, looking at all those topics and just making sure that you've got yourself covered.
Okay, we're, we're, we're setting close to time. and if anybody has any questions, please do shed them out.we've, I guess there's 2 ways we could go with this. And I don't want everybody to rephrase sort of repeat what they've already told us and even shorter amount of time. But, Maybe, maybe Cameron, Derek, you could, if you had a child that was starting a new school, and you're, you're checking out these schools.
I think you folks would be the best people to evaluate a prospective, school for your, for your child. But what would the sorts of questions that you would be asking without sort of having to deep dive in everything? What would you like to see in that first conversation that give you a sense that that school is addressing risk?
Cameron Shilling: I'll, I'll, I'll lead off on that. so, and I have had, I, I attended an independent school and both of my kids did, although, I think I definitely was pre tech revolution and they were kind of leading in the early stages. So if I were doing this over again, the first thing I would do is I would take a look at the school's privacy policy.
And ask myself, is this a modern day privacy policy? Are they telling me that they come into compliance with privacy laws that will also tell me a little bit about what their security posture is? because, under privacy laws, any organization, including schools that handle sensitive personal information.
Which includes information about children and health information and other types of stuff. The schools, they have to engage in a cyber security process that the privacy laws call it data privacy impact assessment.and so, you know, I'd ask questions to the school, like, you know, do you post your DP?
It's called the report. Do you post your report? Is it, you know, do you make it available to. Parents and prospective parents. you know, what can you tell me about what the school has done vis a vis cyber security? And the answers you get to that are going to be illuminating for a school that has done that has really, moved down the curve on cyber security maturity.
Those answers come easily and they're happy to tell you because this is something that the school is going to be proud of. other schools, you know, Might have considered it, but they might not be as far down the maturity curve, but they're still going to have some answers. And then schools that that that haven't done anything usually flounder.
I'll I'll also want, you know, want to know what what applications will my child be using? You know, what applications will be using, will be using to register them? what applications are they going to be using to sign on? are you a Google school? if so, you know, how do you control your, your, your Google suite environment?
so I'm going to kind of get a census to the applications they use, and. For me as a cyber security professional, I'm going to, I'm going to, that's going to tell me not just by based on what they use, but based on what how the school describes it to me, whether or not they have done the type of work, on assessing their vendors that kind of Kurt was talking about, for instance, You know, if, if I say, you know, what, what, what, college, application, uh,you know, college application are using and they say to me, Naviance and, you know, we, we have a data processing agreement and we've reviewed their SOC to report or their ISO certification audit report. You know, I'm going to know a lot.
Whereas if they, you know, they kind of flounder on that, it's going to tell me where the cybersecurity maturity at the school is also, you know, look, I'm a, I'm a cybersecurity lawyer. So a lot of my questions are going to be probing in deep. and a lot of schools. Are not necessarily there yet. so really, you know, you want to determine, is this a mature cybersecurity mature school?
Is this or is this a school that is starting to take this seriously? Either of those are going to kind of be in this, in the strike zone. Those are going to be the norm. Really, it's the schools that the schools, you got to be a little bit.careful with are the schools that don't have any answers to these questions that flounder that don't really have anything that is, you know, basic block and tackling like a modern day privacy policy.
those are the schools that, you know, are gonna, you know, scream out loud and loud and clear that that they haven't take taken these matters as seriously as they should have.
I'll piggyback on that a little bit. And, one of the questions that I would be asking would be, what is the use of technology? What is the technology use policy in academics at your institution? And how is that kept in check? you know, how are they utilizing AI in the, in the process for education and how are they mitigating that for learning purposes?
I think there's a lot of technology that has a lot of good, and I think it's important that students are exposed to that. At a fairly early age, even to further their academics. But at the same time, we want to make sure we maintain the reputation of the institution of providing top notch education to our students.
so I would focus on kind of what the usage of, technology is in the learning environment for students
Ronan Quirke: got it. Perfect. So so in in those two on the face of it, relatively simple questions about cyber security, about technology use, Yeah. The depth of the answer and the quality of the answer will really tell a lot about where, where that institution is in terms of the maturity curve.
So, that's also maybe, maybe that's something we can take away in terms of how could we in our own schools answer those questions. How, how, how good would we will we stand to that test, which is probably. pretty good place to leave it unless there's any, anybody with any last questions on that. Ronan,
Dr. Ashley Cross: can I, can I squeeze in one more question for Derek?
So Derek, we've been talking a lot about the students, with, with deepfakes, with cyberbullying, with some of these issues. And one of the conversations that, I've also been hearing is about should schools, do they need to think about how they're using Images of students. in the past, a lot of the schools just blasted everything, right?
Here's the first grade spelling bee winner. Here's the high school. We're going to live stream all the things, all the events. We're going to put out all the photos of our students constantly. Is that approach still okay? Is there any risk management that they need to think about or anything with policy that they also need to put in place?
Are they safe to operate business as usual?
Derek Karr: Well, I think it's important that you ask the question. you know, are you okay if we use your name, image, or likeness? the NIL and, colleges and universities is kind of defining that. As we know, it will trickle down into other institutions, even to the K 12 level at some point.
you're trying to mitigate the risk as it's responsible, but at the same time, you keep in perspective that the learning environment is, is if, if my student won the spelling bee, I'm going to be pretty darn proud of that student. And, you know, having their image posted on the, on the school's website as the, the winner of the spelling bee to me, that's something that the institution should be proud about, but at the same time, you need to be able to communicate with the parents and get permission that you can utilize that.
So there is some legality that needs to be considered there. you need to contact your attorney with your, privacies. policies and procedures and make sure that, you know, students are aware of them as well as the parents. It's usually a part of the student code handbook that's usually provided to them of whether you're giving permission to use that and the ones that are not giving permission, then you need to make sure that you are aware of those and more than just one or two people are aware of those, but the institution as a whole is aware of that.
And I'll add a bit of a finer point to that too. So, a photograph of a child is personal information because it's identifiable to that child. So, schools have to be getting. Explicit consent to use a child's photo. Now, we used to call those media releases. Sometimes we still do. Sometimes we've kind of transitioned to privacy law language and call them waivers and consents.
But, either way, it's got to be an explicit consent to use the personal information about children that usually is going to come in the form. Of at least an enrollment agreement, but probably some other specific media releases and the like. The other thing is, I think most particularly K through 12 schools, and we do a lot of work with in that in that space are going to put the vast majority of child images behind some sort of, access firewall.
So, There will be, of course, pictures of children and sports teams and, academic classes and stuff like that, that's on the publicly visible, website or on a, on a publicly visible site. And for that, there are usually almost always explicit consent about posting, information there. And it's always done without the child's name, or a very truncated version of the child's name.
But then, 98. Or more percent of any sort of information about children, including images are going to be behind some sort of required login. So parents can see it. parents can view it. Parents can share it amongst parents within the student information system, but parents can't download it. Can't forward it.
the public can't access it, that type of stuff.
Dr. Ashley Cross: Excellent. Thank you. Yeah. Audience, any final questions?
All right. If you think of one posted in the chat or feel free to interrupt. but y'all, thank you, Orah. We really appreciate your support of ATLIS. This was excellent content today. I knew I took a ton of notes. and I really enjoyed the breadth of all of your different things that you covered today.
So thank you to all of our presenters and for everyone being here with us today. Y'all, if you found this content valuable, and you want to dig into some of these things more, I just dropped a lot of links in the chat. So. One of them is an exemplar of a school. It's Montclair Kimberley Academy, and it's one of the ATLIS schools.
It's Bill Stites over there. He does a really good job with transparency of privacy and tools. so if you're looking for a great example of that, check that out. we have some other things that are coming up immediately that again, piggyback right off of this topic. So we've got some great upcoming webinars, Tech Academy, and of course the ATLIS annual conference.
We have pre conference sessions that address. Both the cybersecurity and the digital wellness, aspects of this. So again, we hope to continue the conversation and thank you so much, Orah for, hosting this community event today. We appreciate your support and for being here with us.
Kurt Meyer: Yep. Thank you so much.
Thank you for having us.
Dr. Ashley Cross: All right, everybody have a great day and we will see you soon. Take care all.
‍
‍
