enjay

The form / conversation with IT Manager needs to through Why? How? What? in that order: Why - why are we doing this? So students can get a better understanding of temperature, pressure, mass... How - how do we want to do it? By enabling students to see realtime data during practicals What - what product or solution can assist with this? Data loggers. Brand X would be best because they're cheaper/more functionality/better compatibility with our network.

I wonder if they're playing on the fact they don't know which schools'/students' records were actually shown to another person, therefore they can't contact those schools to say it happened.

I also reported it, and I've had that follow-up you posted. I got one last Wednesday (?) with different wording, but the same sentiment. It included "a small number of parent or teacher users could be served up with the incorrect information" and "There is no evidence of a malicious attack or data breach.". Unless they're claiming the information served up wasn't real data, I don't see how it couldn't have been a breach.

That's roughly how things go here too, but without the template document, the HOD just discusses it with their SLT link. A pro forma would be good to ensure all basic questions are covered (and to add some accountability for how they'll adopt $Thing and make sure they're using it in 12 months. Care to share yours?

Does that rule out Chromebooks too? I can't imagine many professionals use Chromebooks (unless they work for Google!)

The ClassCharts app on my phone has just updated too, so they're clearly fixing things in the background, and quickly.

I suspect the same. Of course that's not the ICO's definition of a data breach!

I got the same email others have posted on here (the one which denies a data breach, despite our screenshots to the contrary), but that was in response to a ticket I raised with them when we spotted the problem. It looks like they're replied to schools who emailed them but made no other statement. Our DPO advised us to contact the ICO directly, which we've done. I think the DPO is also reporting on the collective behalf of their other schools too.

Agreed. I was told one parent got 5 students every time, but all the screenshots I've seen show one or two pupils, and when there are two they are siblings so I suspect Parent A got given Parent B's access. Logging out and back in would have then given them Parent C's access.

They might not know which schools had their data shared to other parents and which didn't. On closer inspection of some of the screen shots I've been given, we have some instances where the students at the top attend School 1 but the announcements come from School 2! In each instance where there is more than one child included, they're siblings... but not necessarily at the same school which is interesting, it seems like Parent A got mixed with Parent B when they logged in. Has anyone had direction from their DPO about what we should say to parents at this stage?

Fair point. I'm not familiar with the view of ClassCharts, but you're right - all the screen-shots I have been sent are of the "Dashboard" home page. Interesting to note when looking at these that they show siblings, not two random students, and don't show the correct child at all.

Which brings us back to my earlier question about Computer Misuse Act. If I open the app for my kid's school and see 5 other kids in 5 other schools, I know I'm not meant to see that information. So, am I breaking any laws by clicking through to that data and screenshotting it? It's like if you sent me an email intended for someone else - if during the first paragraph I realise it's not for me and reply so, that's fine, but I shouldn't carry on reading the whole email and any attachments and then notify you. I'll happily tell ClassCharts what we saw and notify the schools in question directly, but not if that incriminates me or the parents who (hypothetically...) sent me screen shots.

Do any of us have a known breach? I know our parents have seen other students' data, but I don't know for fact any of my school's data was exposed. Obviously, I can make assumptions, but...

Where does Computer Misuse Act stand on clicking through to information you know you're not meant to have, then screenshotting it? I've been cautious with this in the past.

They've not even acknowledged my email. It's concerning that people who phone up are being given different advice.

That banner is no longer on the site...

We're single school too, and our parents were seeing up to 5 other schools/children. If they logged out and back in, they got a different 5 schools and 5 children.

It can't be siloed, because you could have a parent with children in two different ClassCharts schools, so they would need access to both schools from the one app.

Yes, if special category data is made available in ClassCharts. In short, I think people were getting the same view they would if they were actually the parent of the children in question.

One of our AHTs has responsibility for the T&L side of things, but strategy regarding infrastructure development is my responsibility.

Agreed. We have a whole bunch of things taking data out of SIMS (Locker, Wonde, Go4School, Azure AD sync, Google sync, ParentMail, SchoolCloud, Admissions+ and no doubt more), it would be expensive to have a separate VM for each of those tasks, especially since each service only runs for a handful of minutes every day.

You forgot to mention two fibre runs into each building by totally different routes, so when a digger/tree/squirrel goes through one, they can still connect (and even then, the internal cabling is still a single point of vulnerability). Oh, and two server rooms of course.

While we're talking downtime, have you seen "Servers containing critical data should have ... backup servers (onsite or in the cloud) and network cards that switch over seamlessly when one fails"? Hands up who has that setup in their school.

I said "most" not "all". As for the Flash resources in Boardworks, they replaced them when I said we couldn't support Flash any more. There was a brief period of compromise where Science had a standalone Win7 laptop which was used until a suitable alternative resource could be found, but this was on the understanding they had until that laptop died to find new resources. English have a couple of USB DVD drives.

We work in IT, so most things from 2008 are irrelevant!