Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
On this week's episode of the K-12 Tech Talk podcast, we interview Mark Keierlieber from
(00:06):
the 74 about his recent article on district flock cameras being used for federal law enforcement.
Then we bring in cybersecurity expert Michael Klein to break down the impacts on schools.
Thanks for listening.
Live from the NTP studios, this is episode 251 of the K-12 Tech Talk podcast.
(00:26):
You did it differently than Josh.
What did he say?
I don't know.
Live from the NTP studios, this is K-12 Tech Talk.
Josh left to go to a school board meeting again.
It's just me and Mark.
And I can't do it.
That's Josh's bit.
It's whatever.
(00:47):
It's his thing.
Yeah.
It's just not the same without him.
And we've had a crazy night, Mark, and we're going to unpack this, but we interviewed some
people.
I'll let you talk about them.
And then Josh left in the middle of the interview, which was very unprofessional.
And then he's been ghosting us in WhatsApp.
And then I had to leave.
(01:08):
Like I left you.
After that interview, I had to go run an errand.
So now we're recording this.
This is going to happen at the beginning of the episode and we're going to like it's just
going to be all messed up.
It's whatever, though.
It's a great episode.
I promise you that.
It is a really good interview.
You're going to want to listen to this one.
So I'm going to let you set it up a little bit.
But let me talk about meter really quick meter dot com slash K-12 tech talk.
(01:32):
Visit meter dot com slash K-12 tech talk, book a demo with them.
They can do your networking.
They can help you with Internet wired Wi-Fi cellular.
They are an enterprise solution for your school district.
They have great hardware, great software.
They're going to up or they're going to optimize your stuff.
Check out meter meter dot com slash K-12 tech talk.
(01:53):
All right, Mark.
What have you cooked for us tonight?
Well, if you listen to last week, we talked all about the Flock cameras, our article from
the 74.
Well, the guy who wrote the article is with us tonight, along with favorite one of our
favorite guests of the pod, Michael Klein from the Institute of Security and Technology.
(02:13):
Both Mark Kairlieber and Michael Klein have been on the podcast before.
But tonight we're talking about the Flock article in more detail.
In the last week, Flock cameras have just dominated my newsfeed from cities and towns
dropping them left and right, Ring Camera dropped their contract with Flock.
Yet at the same time, Flock cameras are being used to solve crimes left and right across
(02:36):
the country.
So this is a very, very topical issue right now.
And as you're going to hear in a minute, this has hit the front doors of our schools and
we're trying to figure out exactly what to do as a result of this.
Yeah, it's got layers to it and layers within the layers.
It's one of those kinds of things.
(02:57):
I felt like I did a lot of listening during the interview and a lot because we wanted
to yield to these guys and just listen to what they had to say and unpack it.
But my head was like spinning because it's a loaded thing.
I keep bringing up the whole Dark Knight, Batman with all the cameras and Alfred's getting
(03:20):
on to him.
Hey, Bruce, just because you can doesn't mean you should kind of thing.
And that's what it feels like.
And I think you can listen to this interview and you can read the article.
We talked about this, Mark, like it is talking about ICE.
It is talking about our government's crackdown on pursuing illegal immigrants.
(03:43):
You don't have to read the article and listen to this interview with your political hat
on because there's this big picture thing going on with just surveillance in general.
And just because we can, should we?
Did you feel that way?
I think you did.
Yeah.
I mean, I think you realize like this whole surveillance state has kind of snuck up on
(04:05):
us and we do have a massive network of cameras across the country that can track people and
for good or for bad.
And this article brings up another side of it that it's like, hey, while we are catching
criminals and helping with Amber Alerts, there is also this unintended consequence.
And as Mark Hyer-Lieber will talk about, there are schools that intended to help safeguard
(04:29):
their children and unknowingly became part of this surveillance network.
So it's a fascinating, fascinating piece and it is just blowing up across the news and
we're going to be hearing about it for quite a long time.
Yeah.
I'd love to know like, okay, there are X amount of schools in the nation.
(04:49):
And if you could pull the stat of how many of those schools, and I'm going to say it's
like 98, 99% have at least one camera, whether it's on a bus or the front parking lot.
But a lot of schools, we have cameras all over the place.
So again, when I was taking in these interviews, it's like, it reminded me of like my responsibility
(05:14):
at my school district with my school's content filter.
And you talk to a lot of techs about who decides what website gets blocked.
A lot of times a small school district, it's the one person tech department.
It doesn't go beyond that.
So you start thinking about your camera system and who decides who has what access to the
camera system.
(05:35):
Is it just the tech person?
Is it the tech person and the safety director?
Does the superintendent know?
Does the school board know?
Does your community know what access you give and what footage you give out?
Those are questions I know that, again, we're circling around in my head when I was taking
this in.
And I think when you listen to this, like take that in, just think about that bigger
(05:57):
picture thing about what we're doing with our school camera systems, because this article
brought up a lot of, again, things that make your head spin.
Well, let me plug one more sponsor and then we can jump into it.
visor.cloud slash K-12 Tech Talk.
They can manage your one-to-one program, asset inventory, barcode checkout and track device
repairs.
(06:17):
visor.cloud slash K-12 Tech Talk.
Josh, we miss you.
We wish you were here.
This is the first time that we have had, I guess, two guests on with us at once.
So we're going to be herding some voices here.
You're going to hear five voices with you as always.
(06:38):
I'm Josh.
Chris, Chris, you're here.
Hello.
Yeah.
And there's two more.
There's a lot going on right now.
Yeah.
There's two Marks.
We'll start with Mark number one.
Our Mark.
Hello, Mark.
Hi.
And Mark Kierlieber.
Is that right?
Or whatever.
Kierlieber.
Okay.
Sorry.
Yeah.
(06:58):
I got one of those names too.
So you are from the 74.
And we'll start off with you.
Yeah.
So Mark is online with us as well.
We'll get him.
We'll get to him in a minute.
But Mark, we'll start with you.
And Mark number one, our Mark, kind of brought this story or this topic to us last week.
And it has to do with flock cameras.
And we mentioned on last week's episode, my town has a number of flock cameras around.
(07:22):
Home Depot just installed like eight flock cameras in my town in their parking lot.
Didn't realize Home Depot was such high.
I didn't realize the parking lot was such high crime, but whatever.
So flock cameras are not a new thing.
And if you've been paying attention at all in the security world, you saw a pretty big
issue with flock cams.
(07:44):
What Mark, about a month and a half ago, two months ago, that story kind of came out about
the breach or the unattended access of the flock cameras?
Yeah.
There's been a number of articles over the last year, actually, around flock and privacy
concerns and surveillance.
The reason we're here is Mark Kylieber brought that story to the front door of school districts.
(08:05):
Mark, why don't you give us a quick summary of this article that you launched in collaboration
with the Guardian and what can you tell us about the issue?
Yeah, absolutely.
Thanks for having me on and to discuss this issue.
So school districts across the country, same with police departments, have contracted with
flock for what are called automated license plate readers.
(08:27):
These are cameras that are put in school parking lots along busy thoroughfares.
And they're designed to collect data about your license plate and the make and the model
of a car.
And it's all fed into a large nationwide database that police agencies across the country provide
(08:49):
access to other police agencies across the country, too.
This came to my attention when some advocates who have been tracking flock for many years
shared with me hundreds and thousands of audit logs from a handful of school districts in
Texas and said, hey, you know, this is exactly how, you know, law enforcement all over the
(09:16):
country are searching cameras and it's for all kinds of purposes unrelated to campus
safety.
And the big one, of course, standing out is immigration enforcement.
So I focused a lot of my attention on one school district in particular.
It's the Alvin Independent School District.
(09:38):
It's not a particularly large school district, but in a one month period between early December
twenty twenty five and early January twenty twenty six, law enforcement agencies across
the country queried their flock cameras more than seven hundred and thirty thousand times.
(10:02):
Holy cow.
I thought you were saying seven hundred.
And I thought that.
Yeah.
Seven hundred is a big number.
Yeah.
But seven hundred thousand.
Yeah.
And so I did an analysis on these seven hundred and thirty thousand searches focused specifically
on the frequency in which law enforcement agencies were conducting immigration related
(10:26):
searches, because basically these audit logs that I received, they include a field where
agencies across the country have to state a reason for their search.
And that could be a criminal investigation or it could be a civil immigration case.
And I found that outside law enforcement agencies were actually conducting searches of school
(10:50):
district cameras more often than the school districts themselves, which certainly raises
a question of why the cameras are there to begin with.
So I also found that in that one month period, one school district's flock cameras were searched
by 30 out of state or out of community, because some of them are also in Texas, law enforcement
(11:14):
agencies more than six or six hundred and twenty times for immigration related purposes.
And so I called up a bunch of these police chiefs and sheriffs, deputies and said, well,
what were the, you know, what were the purposes of those searches?
And they, you know, several of them said, well, you know, we're part of the 287G program,
(11:36):
which is a federal collaboration between ICE and local law enforcement agencies that deputizes
local local officers to act in federal immigration enforcement capacity.
In other cases, it was actually less formal, just, you know, oh, you know, a deputy happens
(11:59):
to know the local ICE officer and the ICE officer called him up and said, hey, I know
that you have access to these flock cameras.
Can you run a query for me?
And, you know, I think what's really interesting is that, you know, when when a police officer
is conducting a nationwide search on these cameras, they're not necessarily targeting
(12:23):
these school districts.
They're not looking for information specifically at these schools.
But this is truly what we call like mass surveillance.
You know, this idea that one police agency can run a search and that search actually
queries thousands of cameras across the country, you know, school district cameras, perhaps
(12:48):
Home Depot cameras, and then pulls back those results.
So I guess that's that's the overview.
So to clarify the flock cameras in the school districts that are being queried by law enforcement,
they're not necessarily searching specifically for that school district.
We don't necessarily think that the law enforcement is going after the community, that particular
(13:11):
community.
They're just doing a broad search.
And that's catching the school districts cameras in that search.
Is that correct?
Yeah, that's correct.
I mean, it's it's it's a dragnet, right?
It's this idea that school districts are installing surveillance cameras, and joining a national
(13:31):
network and providing that national network affirmatively with outside law enforcement
agencies and allowing those agencies to run, frankly, whatever kind of search on those
cameras and any other cameras in the country that that they want.
And that was gonna be my question was kind of Mark's point, too.
I guess it's fair to say that Allen's flock camera wasn't disproportionately targeted
(13:58):
more than any other flock camera, like the eight or so that are in my town.
They likely all had seven hundred and thirty four thousand hits to them over that same
period of time.
Is that fair to say?
Or do you believe that that Allen camera was disproportionately hit, hit or queried more?
So to answer your question directly, no, I do not believe that it was hit disproportionately
(14:21):
more.
And in fact, that is perhaps the tip of the iceberg.
The idea that like, you know, this story and in this analysis, this data analysis,
I looked at the data, you know, seven hundred and thirty thousand searches for one school
district.
But there's a reason to believe that other school districts across the country who also
(14:45):
contract with flock are also having their cameras queried by the exact same law enforcement
or perhaps other ones that aren't querying the independent school district.
And part of the reason is that the the owners of each individual flock camera network are
(15:05):
able to choose the sharing parameters and they can opt into a national network.
They can opt into a state network.
They can they can pick and choose to to share their flock network with the municipal police
department in their community, maybe, you know, the county sheriff's office, or they
can choose to just say, you know, did you have a chance to talk to some of the districts
(15:29):
that were kind of caught up in this this net of surveillance?
And if so, how did they respond to this?
I would imagine this is probably a surprise to most districts that I didn't realize that
my little old camera in the parking lot was was queried hundreds of thousands of times.
I was going to say, I wonder if default settings are wide open or if it's all right.
Right.
(15:50):
Yeah.
I mean, so here's the thing.
I did not get a chance, an opportunity, despite my best efforts to to interview officials
at the school districts specifically involved.
I did.
I have and I have since spoken to school officials from various communities about their use of
(16:13):
flock cameras.
And they're certainly turning to, you know, the utility of these cameras and, you know,
talking about issues like child abduction cases and, you know, to justify it and saying,
hey, you know, like I know that there was there was one example in my article of a police
department specifically in this case saying, well, you know, there was this high profile
(16:36):
child abduction case where this toddler was, you know, taken from his parents at gunpoint
and, you know, by using this large network of flock cameras, they were able to track
down perpetrators 60 miles away from the child's home.
And the argument being that, you know, if if this network wasn't interconnected, then
(16:59):
once the child left, you know, that police agency, local police agencies, jurisdiction
or stepped foot outside of, you know, the last camera in town, that their investigation
will go cold.
But I think that there is some some reason to question whether or not school districts
(17:22):
and it's certainly a question that I have as well, whether they understand how far their
data are being shared and whether or not they they understand that they're that they're
being included in the national network.
Well, I looked at one of my local towns that has flock cameras, their law enforcement department
has flock cameras and they have a public portal where you can see how it's being used.
(17:46):
And I noticed that they actually specify is not used for immigration purposes.
So is it possible that flock customers can say, hey, I do want to share my cameras with
local law enforcement.
I want to be able to help with any sort of, you know, Dr. Child, Amber Alerts type things.
But here are the reasons here are the purposes or the specific law enforcement agencies I
don't want to give access to.
Is that something that's possible for school districts to do?
(18:10):
According to according to Flock, it is.
And according to Flock, schools can also, with a new setting that was recently rolled
out, specifically restrict access to or specifically restrict the cameras from being from being
used for an immigration enforcement purpose.
(18:33):
So take that for what it is.
But I'm assuming if local law enforcement has access to a school district's cameras,
then national or federal law enforcement can simply call up that local law enforcement
and say, I'm looking for this car.
What can you tell me?
Well, so that's exactly right, because, you know, the story does document a case where
(18:55):
the administrative, yeah, the administrative assistant to a school district police department's
chief had actually provided U.S. Border Patrol access last year to a flock, their flock network.
That alone, you know, I'm not entirely, you know, I would like to have a greater understanding
(19:17):
of, you know, what that was done for and how those federal officials used that access.
But by and large, you're not talking about cases where law enforcement agencies are directly
accessing these camera feeds.
They're actually going to their partners in the local law enforcement and asking basically
(19:40):
a side door, right, asking for access to that data.
I'm curious if you know just how many flock cameras are out there in the United States
and if you even know how many school districts are using flock cameras.
So I actually asked a spokesperson at Flock today or yesterday how many, if they could
(20:05):
tell us how many school districts are currently using flock.
And I didn't get an answer on that.
I do have access to this really awesome tool called GovSpend.
It's a government procurement tool that allows me to basically look at how public entities,
including school districts, are spending their tax dollars.
(20:26):
That indicates that at least 100 school districts across the country have flock cameras.
I'm not entirely sure how many school districts, you know, how many, you know, how many cameras
each school district has.
I know that the Alvin Independent School District had eight flock cameras and they're not particularly
(20:48):
a big district.
There's too many numbers to go around, but we're talking about hundreds of thousands
of flock cameras in thousands of communities across America.
More than likely, if you live in America and you own a car, you are captured by flock cameras.
(21:09):
Okay.
Maybe we use this as an opportunity to pivot to Mike Klein, the Institute of Security and
Technology.
Mike, you've also been on the podcast before, talk about issues of cybersecurity in schools.
How big of a problem is this issue of security cameras in school districts being shared with
law enforcement, either local or federal?
(21:30):
Yeah.
Thanks for having me, Mark and Chris and the team.
So I would back up and kind of frame it a few different ways, right?
So I think that this falls within a broader conversation of how do we govern data in our
schools and how do we ensure the safety and security of our students, right?
And so sometimes there are conditions under which schools are either going to be legally
(21:54):
or just because of safety, compelled to share information with a local police department
to be able to support ongoing investigations, right?
That's just something that's been, if you've been an IT director, you know that happens,
right?
And so local police may reach out and say, Hey, we're having this issue.
We like, do you have footage of this particular part of your school at this particular time?
(22:15):
And then you go through your routine, right?
You figure out like, okay, cool.
Can I share this with them?
Is this appropriate?
Maybe check with your council or your superintendent to make sure that's okay.
But this falls within that broader conversation.
I think one challenge here is that there are a few different policy issues at play here,
right?
So I think the world for a lot of school districts has changed over the course of the last 10
(22:35):
years, because so many things that used to be on premise and something that we owned
and controlled are now in the cloud and are a SaaS solution, right?
And so in that world, you ultimately don't necessarily own the data.
You are kind of relying on these other parties to be able to help you secure that data and
not have others access it that you don't want to access it, right?
(22:56):
So that's one component of challenge.
Then the relationship between the federal, state, and local governments and police has
changed a lot in the last year, year and a half, right?
So I think, especially with this surge in federal immigration enforcement, there have
been some states that have been very supportive of this.
There have been other states that have been actively trying to push back against this.
And so there is that challenge of when you provide access to, let's say, your local police
(23:21):
department, will they be compelled or just through their existing relationships or through
the state's fusion center, will they be in an ongoing sharing relationship with state
or federal law enforcement, right?
And so I think that's one challenge is to help figure out, if I'm a school district
IT director, one, what are our current practices, right?
(23:44):
So what do we currently do in collaboration with our local police department and potentially
our state police?
And what does our school board and superintendent think is the right relationship, right?
Because I think that's a big part of the conversation too.
This is really a decision for the school board and the superintendent informed by the technical
(24:05):
and privacy analysis that you as an IT director can bring to the table, right?
So I think that's a big piece of it.
The other part is trust with communities, which we haven't really talked about yet.
This is something where I think, depending on your community, its makeup, and any number
of different pieces, it's going to be a real challenge to have trust if you have people
(24:27):
feeling like they're being surveilled when they come to drop their child at school, right?
Or if you have students who are driving themselves to school because they're high schoolers now
and they're from a mixed status family, or maybe they themselves are undocumented, that's
going to put them at risk.
And again, this is a conversation for kind of local policy, state policy, federal policy.
I'm not saying there's a right or wrong answer for exactly the way we should do this, but
(24:50):
I think there is an important trust relationship here, not just with your town, but also with
the families you serve and making sure that they feel safe bringing their children to
school.
The other thing I would add here is that I think there's a big difference between providing
ongoing access to whether it's your school surveillance cameras or whether it's the FLOC
or other kinds of technology to law enforcement or responding to requests, right?
(25:16):
So if someone says, hey, can you help me understand this thing, right?
That's different than here is the feed directly from our school district.
You have access to it forever, right?
Because I think FLOC is one piece of the puzzle, but if you've been in a school district,
you've been getting all the calls from people who are trying to sell you AI enhanced facial
recognition for all of your video surveillance in your school.
(25:38):
So you know exactly who was walking down the hallway and doing this thing.
If you're then sharing that with local police and local police are sharing that with federal
law enforcement, including immigration enforcement, that means that you're potentially taking
a child in your school district, sharing their face that's been identified with police that
then could come in and deport them, right?
So I think there are many layers to this beyond just the license plate reader that we need
(26:02):
to really think about.
And again, that's not to say we shouldn't have video surveillance ever in schools.
There are safety concerns.
That's understandable.
That's not to say we should never have a license plate reader.
I don't personally see the value in how that serves us right now, but I understand that
people could, right?
So that's a policy decision that you could make.
I think the challenge, Mark, that you were identifying is also that even if you can say,
(26:25):
I don't want this used for immigration enforcement purposes, you have to trust that that's what's
actually being done.
My guess is that what that means is if you fill out that field and tick a box that says
this is for immigration enforcement, it can't be used for that.
If you are not being truthful or you come up with another reason to search for that
license plate, it's going to go through, right?
(26:46):
And so I think there are pieces here where what we might normally have thought of, I
think what the language is used in the court often is a presumption of regularity, right?
There's the idea that like, we just assume that people are going to do the right thing
and follow the law if they're law enforcement.
It's not always the case right now, right?
And so I think it's important for us just to consider, you know, maybe it is okay to
(27:09):
have the sharing with your local law enforcement agency, but you want to understand, do they
have a 287G relationship where they are acting as law enforcement that can do immigration
enforcement too?
And if your town has decided that's okay and that you have to share that, that's a decision
for the town to make, right?
That is one of those challenging things about being sometimes an IT director is that you
(27:31):
may not agree with the policy, but if that is the combination of law and policy in your
local community, you know, you can push back, but you can't necessarily make that decision
on your own, right?
And so it really is a back and forth and helping people understand the possible impacts to
the community in this kind of world that we live in right now.
I mean, I think back to the times where I would get requests from law enforcement for
(27:55):
access to footage, we had the opportunity to face-to-face talk to law enforcement, hear
from them what they're trying to do.
And I can think of specific examples where a bad guy would run through a school campus
and we want to secure our kids and yes, there's benefits to doing so.
I think what you raise though is making sure that you have the opportunity to know when
(28:18):
these cases are being brought up, that you have the opportunity to review and know that
your camera footage is needed, and then you have the opportunity to say yes or no.
And a lot of times when it comes to law enforcement, there's not really a discussion, there might
be a court order.
But what you bring here is that the cloud environment has opened up those doors quite
(28:38):
a lot.
And that has not only opened up the number of people that can access your footage and
your cameras, but also change the dynamic of permission.
And we're no longer asking to view your camera, we're just doing it without you knowing.
Yeah, I think that's exactly right.
And the couple of other things I would add that I think are just kind of, when I think
back to being kind of in a district thinking about this problem, I think one of the pieces
(29:02):
that we think about all the time, and I've heard you guys talk about it on the pod, right?
Is thinking about data sharing agreements, right?
And do you have that data sharing agreement with this vendor to make sure that they've
signed off and said they can protect the data and do all these things?
I think a similar conversation is important to think about here when we share data with
other town agencies, right?
And just making sure that we're really clear, like, hey, you know, we absolutely believe
(29:24):
we should be sharing this data with our local police.
This is the writing, this is the written agreement we have, that makes very clear the purposes
for which that data can be used, right?
So at least then you have a kind of set process and protocol.
And I think again, coming back to that question of like, least privilege, right?
So making sure that only the people who need access can have access, and also only for
(29:47):
the specific thing they need, right?
Just because you might need that one license plate in that moment at that time on that
day, does not mean you need a constant feed of that information.
Or if it does, then it can't be shared beyond our town, right?
So figuring out what those boundaries are that make sense within your context.
What we're talking about here, though, with license plate readers is external cameras.
(30:08):
And you always hear the old phrase, there's no expectation of privacy when you're in public.
This has changed quite a lot.
There's no more driving down the road without your license plate being caught on a camera.
You're on dozens of security cameras every single day.
Is it too late to put the cat in the bag?
(30:29):
Or are we in a surveillance state?
Have we walked ourselves into a surveillance state without even realizing it?
I'll go with my personal perspective here.
So my personal perspective, I think, is that we are in a very highly surveilled environment.
And that's just the truth, right?
From the web traffic that we have to the data brokers that can find and sell our data to
(30:54):
any number of other ways that we can be tracked, it absolutely is something that is a concern.
I think a couple of pieces here that are really important, though, right?
I think, one, we should never despair that we can't improve things.
Because I think that giving in in that way is absolutely just to lose the fight for democracy,
right?
Because I think that is ultimately a question of like, do we have control of our own lives
(31:16):
and data, right?
But I think on a more practical level, the question for, I think, a school district becomes
like what is within my locus of control, right?
And the things within my locus of control have to do with how I protect the children
and the families and the staff that are in my school district, right?
And so I think in that context, it becomes, again, a question of, you know, I think you're,
(31:40):
you know, the expectation of privacy thing is correct.
That was the case 50 years ago, there just weren't surveillance cameras everywhere.
They weren't all networked, and they weren't putting facial recognition on things, right?
And so then the question becomes like, do you want to contribute to that ongoing surveillance
in a way that is harmful?
Or do you want to try to find the benefits that do come from having some kind of surveillance
(32:00):
in some contexts, right?
But just not in others.
And I think this came up, you know, in many interviews I've heard as well, where when
I think about like, even like ring doorbells is another example, right?
So if I don't have them myself, but I understand someone wanting to have like an external view
of who's coming up to their home.
I understand that idea, right?
I do not understand the idea of having video cameras in my own home, right?
(32:22):
Like internally, right?
And so I think then there becomes an inside outside conversation too, where like, just
because there's no expectation of privacy, maybe when you're outside, when you're inside
a school building, it's a little bit different for kids though, right?
Like, do we really want to broadcast everything?
Like would you put that on an open IP and just like stream that to the world?
Probably not, right?
That would be a FERPA violation.
(32:43):
Do we really want to open everything up to that?
So I think we can think about what feels appropriate versus what feels like taking several steps
too far, I think.
A lot of people listening to this episode are probably the ones in their school district
configuring the cameras and hanging them up on the walls and may have been the ones who
write the specifications for the RFP.
(33:03):
You know, for the tech directors and CIOs and CTOs out there who are listening to this
and saying, wait a minute, I didn't intend for our security camera system to become a
national issue.
You know, where do you go from here?
What kind of advice do you have for somebody who is looking at their flock camera settings
or any other sort of cloud camera settings and saying, what should I do about this?
(33:26):
Yeah, I think it's a great question.
And it's a really, it hits home because I literally remember doing the RFP for a camera
system and hanging them in our office in various places to see like, okay, what kind of coverage
do we get?
How does it zoom in and all that kind of stuff, right?
And so I think for me, there's a couple pieces.
One, this is a really a place where kind of secure by demand and private by demand comes
(33:48):
to mind for me.
So I think about like, what can we demand of vendors in terms of helping us get an audit
of the things that we're sharing, right?
So flocks should be able to tell me exactly who this data is being shared with.
And it shouldn't be hard for us to ask for that information, right?
And so I think a piece of this puzzle currently and maybe moving forward is to be able to
(34:08):
say like, okay, as I am right now, give me a baseline, who has access to this data?
Is it just me internally?
Have I shared it with only my local police department?
Is it shared with the state or is it completely open, right?
And then I think there's another piece of this, which is demanding those secure by default
pieces and private by default pieces.
(34:29):
I understand why flock has an incentive to have everyone share all of the data because
that is the value that they bring.
I understand why police departments also want everyone to share all of their data because
that's how you see the license plate everywhere.
Like I think there are really valid reasons for this.
However, in a school context, maybe there's a special set of settings where it's like,
(34:49):
okay, I'm a school.
This should default to private unless I choose to share it otherwise, because this has information
about kids or this has information about families and we don't feel that that's appropriate,
right?
So figuring out what are those guardrails, that's a really great place to have those
conversations with people like your student data privacy consortium, right?
Like what is the local state organization that helps you with those data sharing agreements?
(35:12):
Because that could really become a powerful piece of the puzzle here, right?
When we think about sharing data with a student information system like power school or others,
we think about who has access to this data and what are the secure ways that we can do
that.
I think one other piece of the puzzle is getting a sense from your superintendent and school
board about what they feel like the relationship should be.
(35:32):
And also from the lawyer and most often your school district doesn't have their own lawyer.
Everybody hires the same law firm for the state to like do school law, right?
So getting a conversation with the lawyers about like, so what are the right and left
bounds here?
If our school district wants to share everything, what does that look like?
If our school district wants to restrict as much as possible, what does that look like?
(35:54):
Because then you get the guardrails that you can provide to your superintendent to be like,
hey, here's the state of play.
Depending on where we are in our school district politically, in terms of policy and other
things like that, here's where our exposure is, right?
Because largely this is a question of how do we follow the law and set policy that feels
appropriate?
And it's hard for us as tech directors to know the combination of the tech, the policy
(36:18):
and the law.
And so being able to have that conversation where like we get the tech, we're starting
to understand the policy by working with our school board and our superintendent.
And we understand like what the law says we can and can't do.
So then we can really have a smart conversation about this.
And I know that's really challenging for the STEM teacher who also serves as IT director
and is potentially driving a bus as well.
(36:40):
I get that.
And so maybe this is a place where states can also have a really powerful role in supporting
their school districts on this kind of thing.
And Mark, there's probably some districts out there that have implemented flock cameras
and your article has been sent to their inbox a dozen times in the last week.
Anybody who has flock cameras on their campus, what can we say to them?
(37:04):
What are some of their next steps that they could take after reading your article?
Yeah, absolutely.
Well, my article is primarily based on analysis of a document called the network audit log.
And flock actually provides this network audit log to all flock customers that includes the
(37:27):
school districts.
And that's how I got access to this document.
And it on a month-to-month basis outlines how every law enforcement agency in the country
or whoever has access to that camera network is utilizing that camera network.
Now there are some questions on the utility of that network audit log.
(37:51):
Keep in mind, we're talking about this Alvin Independent School Districts network audit
log being 733,000 entries in a one-month period.
So there are certainly a resource constraints for a school district or for a law enforcement
agency or for anybody to frankly get a really good sense of how outside law enforcement
(38:15):
agencies are using their camera networks.
But it's certainly a good place to start.
And I think that, you know, this document that I have access to is a document that the
school districts can also and their law enforcement agencies also have access to.
And this could be an opportunity for educators to get a sense of, well, how exactly are cameras
(38:38):
being used?
Because that information is in their hands.
This is more of a technical question.
Does a school district see detailed information as to why the records were accessed and used?
Or is this more just, hey, just an FYI, the law enforcement agency down the street searched
your audit logs?
(39:00):
Yeah, it's not detailed.
So the network audit logs, they specify the name of the law enforcement agency that conducted
the search, the dates that they conducted the search, the window that the search was
conducted for.
Like, you know, we're trying to find, you know, a camera at six o'clock in the morning
(39:22):
or whatever, because there was a break in at this parking lot, whatever.
And the most utilized field for me and for researchers is this reason field where there
are a bunch of basically, you know, formulaic reasons that people can put, you know, as
(39:42):
a justification for their search.
And that can be immigration, criminal or immigration, civil, or it can be like, you know, trespassing.
So while the reason field might not be particularly specific for a school leader, it still does
(40:03):
provide an opportunity for them to get an understanding of how often other law enforcement
agencies that may be, you know, in a different time zone are tapping into their cameras.
Just curious, is lost dog an option under the reason field?
Or is that just rinked?
You know, you know, that's a pretty good question, but no.
(40:29):
Yeah, one quick thing I wanted to mention, and I think what I did is I think what a lot
of us are going to tend to do, which is like start to dive down the rabbit hole of like
the technical solutions to the problem.
One other thing I do want to say is like, let's back out for a second and think about
like you come to your next district leadership team meeting, right?
(40:49):
I think one of the questions that you could ask, or we could think about is like, what
happens if someone from, someone like Mark, Kyra Lieber, gives us a call and says, hey,
we noticed that, you know, this law enforcement agency queried your flock data, it led to
the detainment of a parent of one of your students.
(41:12):
Can you comment on that for us, right?
How do you even respond to that?
Because I do think that we really need to be thoughtful too about like, if you are opting
into this, which again, 100% legal, right?
To my knowledge, this is legal for you to do.
Do you understand the impact on the community if someone is taken, right?
(41:33):
And is that okay?
Right?
In your community?
Is that a kind of reputational and relationship risk that you're comfortable with?
Or how are you going to manage that risk?
Right?
Because I do think that that's important.
Another piece of this is, you know, if you have a student, we don't ask our students
if they're documented or undocumented, it's currently against the law, you're not supposed
to do it.
You're supposed to serve all children, right?
(41:53):
As like part of the law, since the 80s, right?
That being the case, what if, you know, someone searches for a student, specifically because
they know that this student is now 17 or 18, they're in your career and technical education
program, and they're driving themselves to school, and they get caught on the flock camera.
(42:18):
And then that's queried, and they come and detain that student, right?
Again, you facilitated this, right?
Whether you wanted to or not, that could happen, right?
And so I think just being ready for those conversations is a real piece of the puzzle.
Like, I'm not saying you absolutely should or should not use these technologies, or that
(42:39):
if you do, you should share it in this specific way.
But your organization really has to think about what are both kind of like ethical and
also kind of relationship and legal risks that we open ourselves up to when we do this.
You know, in some districts, that might mean, you know, a quarter of the students' families
don't feel comfortable bringing them to school, right?
(42:59):
It means students might stop coming to school.
And so I think there are kind of downstream effects to this, that if we don't think about
them on the front end, can get lost in the technical conversation about the specific
configurations that I think are also important to think about.
For both of you, what do you hope this article sheds light on, and what change would you
(43:22):
like to see when it comes to surveillance in schools?
I'll let Mark take that one first, because Mark, you published the article.
Thank you so much for doing the research.
Yeah.
I mean, the purpose for this article, and certainly for any of my work, is simply to
(43:44):
drive, you know, drive attention to these issues.
I don't think that, you know, the general public really has a complete understanding
of the degree to which, you know, surveillance exists in our public, the degree to which,
(44:05):
you know, that surveillance information is feeding into larger national networks.
I don't think that many people realize that, you know, school districts, law enforcement
agencies in Indiana are conducting immigration-related searches on behalf of law enforcement, federal
immigration enforcement, and as a result, searching cameras in Texas.
(44:31):
So, you know, I think that people should take away from that, you know, their own perspectives.
And, you know, my job here is just to kind of shed a light on the issue and see where
it goes from there.
And I think for me, building on that, you know, in the wake of the 404 Media reporting
on this, kind of the broader perspective, not in the schools context, we've seen multiple
(44:57):
towns shutting down flock cameras, or getting rid of them, or closing their access.
And I think that that's a really important part of the conversation, right, is to think
about, like, where does this fit in terms of state and local policy?
And I think that we're going to start to see states likely moving in a direction of saying,
you know, potentially could say something like, you cannot use state funding to do X,
(45:20):
Y, and Z, right?
You cannot use these kinds of cameras, or if you do, you cannot share them in these
kinds of ways, right?
Obviously, the kind of, like, boundary between federal law and state law, and those pieces
are going to be always kind of flowing and clarifying.
But I do think that this raises that question in a really clear way, because every town
has a school district.
And so it's really important to think about what does this mean in our schools?
(45:44):
You know, if an HOA decides to buy a bunch of flock cameras for their little kind of,
like, enclave, that's one conversation, and one type of surveillance.
What does that mean when compulsory education, where every child needs to go to this place,
is being impacted by that same kind of surveillance and sharing?
You can't opt out of it, right?
In the same way that if I don't go to the HOA, and I don't belong, then I'm not a part
(46:07):
of that conversation.
So I think this is a really important part of that conversation.
And the other thing I think this really helps to raise for us is, as school district IT
directors, we have a really important role in helping to navigate that intersection between,
like, what does the tech do?
(46:27):
And then how does that actually play out in terms of its impact on people on the ground?
Because oftentimes, we're the only ones that understand some of the pieces of how that
all fits together in a way that maybe our school resource officer doesn't when they're
collaborating and supporting our local police department, right?
Or, you know, where our superintendent is talking to the community about things and
(46:47):
maybe doesn't understand the tech in quite the same way.
So I think it's a really important role for IT directors here, too.
Well, thank you both for coming on, Mike.
As always, thank you for your incredibly insightful advice.
And Mark, as always, thanks for exposing these crazy, insane stories that are impacting K-12.
We had you on a year ago with PowerSchool.
We had you on today.
(47:09):
And then a year from now, who knows what other explosive reporting you'll bring to our table.
Quit coming on here, Mark.
Well, I appreciate the opportunity and enjoyed talking with you both.
All right.
Awesome.
Thank you.
All right.
Thanks for listening.
We have some cool events coming up.
February 24th to the 26th, Mark and I will be in Albuquerque, New Mexico at the K-12
(47:30):
6 Conference.
We'll have the podcast table set up there.
And we're also doing a session.
And then March 12th to the 13th, we have the Midwest Tech Talk Security Symposium.
And Mark's going to come out and visit for that.
That's in Columbia, Missouri.
These events and more.
We have a pretty book.
2026 are brought to you by our sponsors.
(47:50):
And thanks to you guys that listen to this thing that we get sponsors that help cover
these trips.
So some quick shout outs.
A different kind of episode.
But we want to make sure our sponsors get their plugs appropriately.
Extreme Networks.
You can email Dominic Mayer at dmayer at extremenetworks.com for all your extreme networking
needs.
Fortinet.
Fortinet podcast at fortinet.com.
(48:12):
Get your FortiGate, your FortiAnalyzer, all that good stuff going with them.
Fortinet podcast at fortinet.com.
I have a FortiGate and a FortiAnalyzer.
They work great together.
Lightspeed Systems.
Check out their content filter.
Classlink for your rostering, your SSO, all that good stuff.
And last but not least is NTP.
(48:32):
Email our friend David Wren, Mr. Wren, dwren at ntp-inc.com for your SOC, for your EDR,
all your cybersecurity needs.
Thanks for listening.
(48:53):
The views and opinions expressed on the K-12 Tech Talk podcast are the personal opinions
of Josh, Chris, and Mark, and do not represent the views or opinions of our sponsors or other
organizations that we're affiliated with.
The material and information presented here is for general information and entertainment
purposes only.
Thanks for listening, and we'll see you next week.