Jersey City school district admits student info was taken in data breach

By Terrence T. McDonald/The Jersey Journal
Email the author | Follow on Twitter
on June 23, 2014 at 4:49 PM, updated June 23, 2014 at 4:59 PM

After telling Jersey City parents two weeks ago that the school district was investigating a possible data breach of personal student information, and then saying two days later that there was no data breach, school officials now allege that a local charter school did indeed improperly access the personal information.

In a letter sent to parents on Friday, School Superintendent Marcia V. Lyles said a district investigation has concluded that M.E.T.S. Charter School officials have admitted they "accessed" the district's computer system to obtain personal information on district students.

The district subsequently restricted the charter school's access to the system and is meeting with its software vendor to determine the extent of the data breach and how to protect student information, according to the letter.

"The district will continue to work to ensure that our student information is secure," Lyles said in the letter, adding that the district has alerted the state Department of Education about the matter.

Board of Education member Ellen Simon, speaking on behalf of the nine-member board, said the data breach was done "without district knowledge or consent."

"The district acted diligently and in good faith," Simon said in an email. "I'm not sure the same can be said about M.E.T.S., at this point."

Repeated requests for comments from M.E.T.S. officials have not been returned.

The investigation into the data breach began after district students received mailers from M.E.T.S. advertising the Sherman Avenue charter school and an upcoming open house, mailers that were addressed to students.

The district has given conflicting stories when asked how M.E.T.S. obtained the students' personal information.

At a June 11 districtwide meeting, Lyles told parents that she believed the charter school obtained that information by accessing names, addresses, phone numbers, dates of birth and possible even social security numbers of district students via district computers, according to parents who attended the meeting.

Two days later, the day The Jersey Journal published a story on the controversy, the district released a statement saying there was no data breach at all, adding that M.E.T.S. officials told the district it had the information courtesy of a list the district gave the school three years ago.

"Additional checks of the district's data systems also indicated that there was no breach, nor could M.E.T.S. Charter School staff have accessed district information from the district's current system," district spokeswoman Maryann Dickar said on June 13.

But that's not the case, according to Lyles' newest letter, which says the district's June 13 statement denying there was a data breach was based on the word of M.E.T.S. officials who initially said they never accessed district computers.

Asked about the discrepancy, Dickar told The Jersey Journal that "much of what was reported out of (the June 11 meeting) was second- or third-hand and not necessarily accurate." Asked about her June 13 statement that the district checked its data systems and found no breach, Dickar did not respond.

Joel Torres, whose 11-year-old daughter received one of the M.E.T.S. mailers, told The Jersey Journal he thinks there "might be more" that the district isn't acknowledging.

"If I hadn't made a fuss about it at the Thursday Board of Education meeting, it would have been swept under the rug," Torres said.

Link

(Despicable if this is true - and METS was sent a a warning letter in 2013 from the state for poor academic performance.) (Read latest letter here where probationary status was extended in 2/2014.)

Jersey City school district probing apparent data breach involving students' personal info

By Terrence T. McDonald/The Jersey Journal
Email the author | Follow on Twitter
on June 12, 2014 at 7:42 PM

The Jersey City school district is investigating how a Sherman Avenue charter school obtained personal information about district students, data that parents believe the charter school used to mail the students and their parents registration forms last month.

Schools Superintendent Marcia V. Lyles revealed some details of the investigation at a citywide meeting with parents last night, with attendees telling The Jersey Journal that Lyles said METS Charter School obtained students' names, addresses, phone numbers, dates of birth and possibly even social security numbers.

METS may have accessed the information via district computers that weren't safeguarded to keep outsiders from obtaining student data, Lyles said, according to parents who attended the meeting.

"We are currently trying to determine what happened," district spokeswoman Maryann Dickar told The Jersey Journal in an email. "We have had conversations with METS Charter and we expect resolution early next week."

Two phone calls seeking comment from Ian Fallstich, METS' principal, were not returned.

Joel Torres, who heads School 27's PTA, said the METS mailer came addressed to his wife and his 11-year-old daughter, who is starting sixth grade in the fall. The mailer contained a flier touting METS' academic programs, a registration form and details on two open houses for prospective students and their families.

"This is personal information on my kid," Torres told The Jersey Journal. "I'm not really happy that people are getting information like that."

Lyles told parents last night that district schools should be able to access data on their own students, not on other schools' students. But district officials investigating the possible security breach discovered that they were indeed able to access student information from outside computers, Lyles said, according to parents who attended the meeting.

Sangeeta Ranade, the school board's president, told The Jersey Journal that the district takes data privacy "seriously" and its attorneys are looking into this apparent data breach.

"Five of our sitting board members are (public school) parents so this issue is real for us," Ranade said in an email. "District policies strictly limit student data to internal use, but we will use the findings of the investigation to determine if there are things we need to do differently."

METS, which stands for Mathematics, Engineering, Technology and Science, opened its doors in September 2011. It plans to serve over 500 students in grades 6 through 12 starting in the fall.

LINK