Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Education Sector Security. Show all posts
Ethical Governance
American Schools Cyber Security Data Privacy Concerns Education Sector Cybersecurity Education Sector Security Ethical Governance

New York School District Pauses AI Robot Teacher Plan After Privacy and Safety Concerns

 

A rural school district in upstate New York decided to cancel the plan to bring in a robot after teachers, state officials, and community members raised their concerns about the robot’s involvement in the classroom, student privacy, and the company’s ties to the adult robotics industry. Salamanca City Central School District decided to use nearly $60,000 from their budget to buy a stationary humanoid robot from Realbotix. 

The robot, which they affectionately named “Sally,” was meant to aid students in high school programs involving robotics, artificial intelligence, and other advanced technologies. It would also assist these students with programming, maintenance, updates, and troubleshooting. The plan to bring in the robot drew criticism from community members who knew about the connection between Realbotix and another company that makes adult sex robots. 

New York State United Teachers President Melinda Person argued that a robot from a company tied to the adult robotics industry has no place in the classroom. Other teachers also raised concerns about whether creating an AI-powered robot would lead to replacing human teachers with robots. Many others were concerned about student privacy. New York Education Commissioner Betty Rosa voiced her concerns about how the robot would function and what information it would collect from students. 

Even though the robot would not be able to teach lessons on its own, the robot was presented to the school board as a tutoring tool. The district has halted the implementation of the robot, and it is currently working with state officials to develop stronger student data privacy rules while also addressing community members’ concerns. Superintendent Mark Beehler has argued that the technology was always supposed to serve as an ancillary tool, and he stressed the importance of human interaction in education. 

The district stated that Sally will never be able to access a student’s microphone or camera or collect any personal information or data and send it to Realbotix. It will also not be able to access the internet or other unauthorized generative AI programs. According to the district, any information would be held on local devices while authenticating students’ identities. Realbotix also denied the accusation that the robot was modified from one of their existing sex robots. They argued that the robot was created specifically for the school district and was not modified in any way. 

They insisted that it used different hardware that was not repurposed from a sex robot. The company also clarified that it has no direct connection to Intima LLC, which owns RealDoll, a company that produces sex dolls and other adult-oriented robots. Realbotix stated that Intima LLC and Realbotix are different entities with different executives, workers, facilities, products, and strategies. Beeler strongly advocated for the technology and said it would give students in remote areas access to innovative opportunities without having to travel to urban centers to interact with new technologies. 

The district hopes that the robot, which will be called “Sally,” would inspire students to pursue robotics, AI, and other STEAM industries. However, many community members want the robot to be removed from the school because they believe students would benefit from increased human interaction rather than decreased human interaction. This debate over whether to bring in the robot has opened up a much larger conversation about student data privacy, ethics, and technology in the classroom.
Read more »
ShinyHunters
Academic Network Security Canvas cyberattack Data Breach Education Sector Security Phishing Threats Ransomware Attack ShinyHunters

Ransomware Attack Disrupts Grading Platform Used by LBUSD Cal State and LBCC


 

A cyberattack linked to the ShinyHunters extortion group temporarily disrupted educational operations across a number of educational institutions in the United States, causing concern over the potential exposure of sensitive student and faculty data. These institutions continued to restore access to Canvas this week. Although several universities and school districts have been able to resume normal access following recovery efforts coordinated by Canvas parent company Instructure, the incident continues to affect portions of the education sector. 

Administrators have assessed the broader impacts of the breach and reviewed claims regarding the compromise of data belonging to hundreds of millions of platform users around the world. After the incident was triggered on Thursday, teachers and students at Long Beach Unified School District, California State University Long Beach and Long Beach City College were suddenly unable to access Canvas, the cloud-based platform widely used for coursework, grades, assignments and internal communication, the operational impact of the incident became more apparent. 

According to district officials, they were informed earlier this week that Instructure, the company which provides Canvas, had discovered that certain user-identifying information related to customer environments had been accessed without authorization. In spite of the company's initial assertion that the incident had been contained and that core platform operations continued, educators later reported that login attempts redirected users to ransom-style messages allegedly associated with the ShinyHunters cybercriminal group upon attempting to log in.

Apparently, the notice instructed affected institutions to engage a cyber advisory firm and negotiate payment terms before a specified deadline otherwise compromised data could be exposed to the public. Despite the fact that the full extent of the intrusion is still under investigation, notifications sent to campus users indicate that names, email addresses, institutional identification numbers, and confidential communications may have been compromised. 

A response from Instructure was that portions of the platform environment had been disabled, the underlying vulnerability had been rectified, digital forensic specialists were engaged, and federal authorities, including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency, were coordinated. 

A significant number of academic institutions are experiencing the disruption at the same time, with final examinations at California State University Long Beach rapidly approaching. Since Canvas serves as the primary repository for instructional content, coursework, and student records, several educators have described the outage as operationally disrupting, even though some teachers have been able to maintain continuity by using externally hosted materials and collaboration tools through Google. 

Cybersecurity experts caution that, while the current incident has mainly disrupted colleges and universities, K-12 institutions have also faced repeated operational and data security challenges related to attacks against the education technology infrastructure. Researchers referred to the Los Angeles Unified School District cyberattack of 2022, when a ransomware-related intrusion disabled critical district systems over Labor Day weekend, disrupting internal communication, attendance tracking, and classroom instruction. 

Approximately 2,000 student assessment records, together with additional sensitive information, including driver’s license numbers and Social Security numbers accumulated over multiple years, were later published on the dark web as a result of the incident. Recovery efforts lasted for weeks during which administrative and technical staff restored systems and coordinated password resets for over 600,000 user accounts.

According to security researchers, incidents associated with platforms such as Canvas can create long-term phishing and social engineering risks even after services have been restored. A Norton security analyst, Luis Corrons, emphasized that information exposed by the company includes names, institutional email addresses, student identification numbers, and internal academic communications, which could provide threat actors with the necessary context to create highly convincing phishing campaigns impersonating legitimate school notifications regarding grades, coursework, financial aid, and password resets.

In addition to Anton Dahbura's concerns, the executive director of the Johns Hopkins University Information Security Institute advised institutions that residual risk may continue to exist after platform access has been restored, and cautioned against operating under this assumption. According to Dahbura, colleges and universities should encourage students and employees to change their passwords, review authentication tokens, and audit integrations with third-party platforms connected to Canvas environments. 

Likewise, colleges and universities should keep a close eye on follow-on phishing activity targeting them. Further, he emphasized that higher education is increasingly reliant on a single instructional platform, which represents a systemic risk as a whole. He advised academic institutions to develop resilience plans, implement additional security controls, and develop alternative instructional workflows that can support continuity during prolonged service interruptions. 

A centralized cloud-based learning infrastructure in the educational sector has further increased the cybersecurity vulnerability of the sector. As a result of a single third party platform compromise, thousands of academic institutions may be disrupted simultaneously if a single compromise occurs.

A continuing forensic investigation and recovery effort will require security teams on affected campuses to focus on credential protection, phishing monitoring, and access-review procedures, while assessing the degree of integration instructional platforms, such as Canvas, have made with broader institutional networks.
Read more »
Subscribe to: Posts (Atom)