Acceptable Use Policies
Acceptable Use Policies
image source: www.compuquip.com
Acceptable use policies in schools are important to outline the intended uses for the technology provided by a school district. Not only should policies outline what students and staff should not do, but how they can most effectively use the technology and programs to which they have access. Analyzing example acceptable use policies and comparing them to the policy provided by my school made me realize that our policy could be updated in several ways.
The acceptable use policy from my school consists of five sections. There is some mention of students and staff at the beginning of the policy, but it only has spaces for parent and student signatures. The first section discusses the purpose of technology use, which is to provide experiences and resources outside of the classroom. The next section is about the opportunities and risks of technology use. This section mentions that websites on the Internet may contain material that is not appropriate for school, and that students may only access technology for educational purposes. Following this section, there is a "Do" and "Do Not" list under "Privileges and Responsibilities." This list is pretty simple and short. On the second page of the policy, the consequences listed for violating the rules is "5 days/1 week up to 10 days/2 weeks without computer use" but does not define which violations result in "x" amount of days the student would lose computer access. The final sections are for parent/guardian and student signatures. Overall, the policy is overly simple and does not give specific details about the consequences of violations and is not written in student-centered language. There is no language regarding the use of AI, although students do not have access to it in our small, closely monitored classroom. It could definitely be revised to be updated, clear, and allow for students to take more responsibility for their technology use. There should also be a form that outlines technology use for staff in this specific environment (the classroom), although there is a separate general policy for this in the handbook for all employees of the organization. I believe that teachers, administratiors, students, and parents, should all be active participants in creating a new technology policy.
There are several great ideas for updating my school's policy that I found in the example acceptable use policies. For example, the Manawa acceptable use student form is very student-centered. The statements for each section begins with "I" statements and includes a line for student initials next to the sections. The statement is broken down into easily defined sections with wording that students can understand. The damage and repair charges are also clear. The document ends with sources used to develop the policy, which demonstrates good digital citizenship and a commitment to not plagiarize. This policy is very organized, straightforward and geared towards students specifically. These are characteristics I would like to implement in a revised acceptable use policy for my school.
image source: K-12 Cyber Incident Map
In revising the acceptable use policy, I would make a separate form for staff and students. After exploring the K-12 Cyber Incident Map of the Chicago metropolitan area, I realized how many of the incidents are related to misuse by school staff. For example, at Chicago Public Schools, one employee left her position with about 70,000 peoples' personal information from a private database. Another former CPS employee improperly shared a Google folder containing ratings and evaluations of teachers, in addition to student names, IDs, grades, and test scores. I was surprised to also learn that data breaches occurred involving the benchmarking test Aimsweb. There were many other incidents including the displaying of inappropriate images on Zoom calls during remote learning, a student suing a school district due to being expelled from hacking into the grading system, and the leaking of personal student information. This incident map illustrates the need for policies for adults and not just students. If there are clear policies to follow, many incidents like these would not occur.
To summarize, writing a clear acceptable use policy for every person that uses technology within the school is a way to ensure the benefits, drawbacks, and consequences are understood. Technology is here to stay and schools should use the incorporation of technology as a learning opportunity for both students and adults.
Resources
The K12 Cyber Incident Map. K12 SIX. (2023, February 13). https://www.k12six.org/map
Manawa School District . (2018, June 7). Technology Acceptable Use and Safety Form.
I like threat maps because they are an easy tool to understand for almost everyone and can appreciate the one you added! I like this one for a global view:
ReplyDeletehttps://cybermap.kaspersky.com/
I found this quote of yours to be very apropos for the landscape:
"one employee left her position with about 70,000 peoples' personal information from a private database" what is really sad about this is that often times there is a data dump of innocent people in these kinds of breaches. The issue herein is that parents wont find out that the innocent have their data breached and credit cards taken out and home loans and etc. in their name, until years later. That system has very little mercy and it is a "guilty until proven innocent" modus operandi to prove it was fraud when it comes to banking. The AUP for districts should have in place a method to resolve data breaches. Ie. data should be given on zero trust frameworks that way if it is compromised the bad guys can't use it. Ie. Encryption for all data devices and terminals should in the AUP's imho. That way when employee X takes home the laptop with everyones information on it and leaves it in the car for a thief / hacker to steal..... yeah. The data is secured because it requires a passkey to open. With a termination command hardcoded to erase the data from the device after 2 failed attempts to unlock it. Just thoughts.....It was a good write up you did! Kudos.
Hello,
ReplyDeleteI love that you point out the need for inclusion in these policies. It is extremely important that all stakeholders have a seat at the table when these policies are developed. In my district's policy, it is very easy to see that it was developed with the utilization of only one voice, the administration. It is also scary to see what the failure of the governance of these policies can lead to. Thank you for pointing that portion out. A greater light should be shed on the fact that educators are stewards of some very sensitive information. Data breaches are not always commercial in nature and we should all be safeguarded from any potential actions of individuals within our organizations, whether intentional or unintentional.
When adults are educated on how to stay safe it makes it that much easier for them to help the students stay safe. Thanks for sharing your thoughts on how to improve Acceptable Use Policies.
ReplyDeleteLooking at the Chicago Public School acceptable Use policy I don't see anything in detail about punishment for breaking it other than "may be subject student to discipline in accordance with the student code of conduct." Which can't seem to find on the CPS website.
ReplyDeleteI vaguely remember those incidents in the news. The thought process in my head was two-fold. One how can one person have access to all that data/information without having a large group of people to overseeing them? Next was this is going to be a big lawsuit that going to cost tax payers a lot of money.
I haven't heard of a cyber attacks attacking CPL. Maybe it hasn't happen as it is extremely difficult (at least for me) to access any staff information on my computer/phone outside my email and Microsoft Teams for interviews as it requires physical access to a staff computer to get anything.