Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
On this week's episode of the K-12 Tech Talk podcast, Tennessee considers a pair of bills
(00:05):
that could ban classroom technology entirely.
Is this a step too far or just a necessary reset?
We also discuss space savers and tractor eggs while the Midwest tries to get a handle on
a new sophisticated phishing scam.
Thanks for listening.
Live from the NTP studios, this is the K-12 Tech Talk podcast.
(00:25):
This is episode 252.
My name is Josh, tech director here in mid-Missouri.
Down the street from me, back from Albuquerque, is Chris.
Hello, Chris.
What's up?
And we have Mark over on the East Coast wearing his Carhartt beanie.
If we were a video pod, he'd be so hip, but he has been digging out from 24 inches of
(00:49):
snow.
Hello, Mark.
Hey, I didn't get to go to Albuquerque.
You got snowed out, man.
I'm so disappointed.
I did.
I was supposed to go until like two, three days in advance, so unfortunately, Chris,
you had to hold down the fort without me.
Yeah.
Wait, wait till you hear the clips I got, the episode I recorded.
It's pretty much just me, bad mouth, and Mark the whole time.
(01:10):
Wow.
And Josh, too.
Both of you.
Both of you get lots of love.
Thanks.
I tried, but, you know, we had a little bit of snow up here.
Yeah, I didn't try.
We had nape testing that, yeah, whatever, nape.
I did have a great time at K-12-6 Cybersecurity National Conference with Doug Levin and all
(01:31):
the K-12-6 members and participants.
Did a two-hour workshop on passwords.
Mark, you prepped that thing.
I'd say we weren't fully prepped.
We were going to meet up and like get it going, and then snow came your way, and then I realized
that I was going to talk about passwords for two hours, but it was a great time and a great,
(01:53):
a great conference, and we thank Doug and that whole team for letting us be there.
You saw some of our friends while we were there.
You saw Neil and April and Barb.
Yes, and however we feel about sponsors and vendors, but like David with Manage Methods
was there, and he was just with you, Mark, in Colorado.
(02:18):
It is funny how you start seeing the same people in different states, and, you know,
it's good.
Actually, Dave and I sat down together.
He's going to be on that thing, bad-mouthing you guys as well, so we'll have a special
K-12-6 episode soon.
We really didn't talk about K-12-6 or cybersecurity, just a bunch of Josh and Mark jokes, but.
(02:41):
I'm sure Doug will appreciate that.
Yes, and I did.
I did do a great sit-down interview with Doug, but you guys will be excited for this.
I use that soundboard like a lot, like all the special effects.
Oh, no.
And I'll just tease this.
I couldn't figure out how to turn some stuff off sometimes.
(03:02):
When the episode airs, it's important to note that this is 100% Chris, and so all the...
Yeah, it's going to be like Chris edit or Chris non-edit.
Let's just let it go.
All the stupid DJ horns.
Mark, do you have some...
I did use those, yeah.
You have some snow shoveling tips for us, Mark.
(03:24):
Yeah, just hire someone.
Don't do it.
I did have...
Actually, it was funny.
I had a pair of teenage boys knocked on my door at like 8 o'clock that night with shovels
in hand.
They're like, hey, do you need any help shoveling?
And I'm like, I got a heating pack on my back.
I was like, where were you six hours ago?
(03:46):
Was it...
How many inches did you get?
Here we got about, I think we got about two feet, maybe a little bit less than two feet.
But then south of Boston, I think it was like three feet.
The news was showing helicopter clips of cars on the highway.
People just abandoned their cars and left them there for days on end, and schools are
(04:06):
closed like Missouri style for like a whole week because it was so bad.
So south Boston or south of Massachusetts and Rhode Island got hit the hardest.
Some of the videos that you were sending us were wild.
There was snow and you could see windshield wipers pointing straight up.
It's like, oh yeah, there's a car there, but you can't tell.
(04:27):
All you can see is the windshield wipers that are standing up.
Yeah.
Insanity.
Well, and we have a weird thing in Boston.
If you're from the Boston area, you know what I'm about to say.
We have a thing called space savers where after a snow emergency, you're allowed to
put something, a chair, piece of trash, whatever in your space that you've shoveled out.
(04:49):
And then it's yours for the next 48 hours.
Really?
Yeah.
So like on my street during the day, everybody goes to work and there's just a line of chairs
in dugout parking spots.
And that's that person's spot for the next two days.
So the time is up around 8 p.m. tonight, then everybody has to remove their space savers
(05:11):
and it's fair game again.
But yeah, you'll just find like random, I don't know, trash cans, chairs.
I've seen an Irish flag on a flagpole like in the middle of a spot before.
Like this is city sanctioned thing.
I think it's one of those like people just did it and the city just said, OK, fine, we'll
(05:34):
like not police this for 48 hours.
But after 48 hours, they're going to, you know, they're going to remove stuff from the
street.
Can you, what was like, what was your thing?
Yeah.
What was your space saver?
Oh, I have a driveway, so I'm parked in the driveway right now.
But if I look out my window, there's just chairs, folding chairs for the most part on
(05:54):
my street.
What would happen if you tried to go take one of those spots?
Don't.
Just don't.
You'll have the person's name scratched in the side of your car.
It's not OK.
You do not take someone's space saver when there's a chair in a parking spot.
You leave it alone because you know that your car is going to get keyed if you if you try
(06:15):
to take it.
I feel like Boston has a Boston, a lot of undertones in just like if I was a Midwesterner
that moved and was Mark's neighbor next week and knew nothing about space savers, I feel
(06:35):
like I would get shot because I would I would be the angry guy out there like, what in the
world?
Why are these people putting their chairs out here?
This is ridiculous.
I'm moving them and parking my car here because he moved his car.
Well, when you drive around the day after a snowstorm, it's everywhere.
Like every parking spot that's available has something in it.
(06:56):
So it's very obvious that this is a thing.
I'm not going to move it.
It sounds like a.
Oh, yeah, it'd be interesting.
Yeah, it's a thing.
Huh?
All right.
Well, Chris, hit our sponsors before we lose everybody.
Eaton, check out Eaton.
And if you can remember, they've been sponsors with us before and they're back.
(07:19):
They always have some fun stuff to share with us.
So they want you to indulge yourselves in a chocolate, no chocolate inspired infographic
to discover a flavor of cloud based battery backup for every location, including K-12.
So I'm going to put a link to this.
(07:41):
And it's, you know, they have they have these games and these different things to do to
suck you in.
So a chocolate inspired infographic.
If you don't know what that means, you got to click the link to find out.
So we're going to learn more about Eaton, their battery backups, their power management
stuff over the course of these next six episodes.
All right, Mark, you have curated some news and there is a news story out that kind of
(08:09):
shook a number of tech directors to their core this afternoon.
And it'll be interesting to get your take on this.
Let's get into that one first.
This is West Gayuga and I apologize if I got that name wrong.
This is out of Ohio.
A school district fell for a phishing scam a couple of years ago.
They sent some payments totaling about $41,000 to a fake vendor, one of those fake vendor
(08:36):
scams back in October, November of 2024.
The state auditor's office has come back and said, hey, we provided you guidance on what
should be done.
And so even though the district recouped about $36,000 from insurance, they were left with
about with a $5,000 loss.
And so these treasury auditor, excuse me, the auditor for Ohio has said that the two
(09:00):
specific people who did not follow protocol in accounts payable in the district treasurer
are liable for that $5,000.
So now you have district staff who are personally responsible for the recovery of that $5,000.
I have not heard of this kind of thing.
I was very surprised to see this level of reach by the auditor's office at the state.
(09:27):
What the article, what I've read about this, I've read a couple of articles, I can't find
what the guidance was that the auditor's office said in the first place.
So in April 2024, they had sent an email to districts about here's what to do during a
compromise scam and warning districts about this.
I would love to see what their guidance was and whether or not this was very obvious and
(09:52):
was acknowledged by districts, or if this was just one of many, many, many emails that
got lost in someone's inbox.
So interesting to see if that will happen in more places.
I mean, you would have to assume it would be something like verifying the change with
an offline conversation with that vendor, right?
Like to me, that's the first thing that comes to mind.
(10:14):
Beyond that, I don't know what else the state could say.
Well, because it says, the release says the district didn't follow guidance and standards
issued by the auditor's office, hadn't adopted cybersecurity policies or employee training
to recognize such payment redirect schemes.
Like did they like maliciously, like intentionally refuse to do that stuff?
(10:39):
Well, but Chris, you know, business offices across our state don't all do the same thing.
Like if someone tried to redirect a payment, a wire from your district, would your business
office hang up and try to call the vendor and make sure that that's a legit request?
(11:01):
I feel like that's what we're talking about here.
But so the ripple that this caused in a discussion group that I'm in today was that personal
liability for a professional act.
And if the auditor is going after those two individuals of the business office individually
(11:23):
to split that $5,000 repayment, so just assume $2,500, I assume that means the district isn't
going to foot that bill.
Should we as technical folks, technical leaders, have some sort of professional liability insurance?
It makes me really think I should.
(11:46):
Yeah, right.
Well, just because you have professional liability insurance doesn't mean that the insurance
company would pay for something like that.
Because again, if they did not follow training and protocol, fair.
But if they weren't trained, well, and I think this is the point of the article is that the
state is saying it was your responsibility to make sure that this guidance is followed
and trained and therefore you didn't do it.
(12:07):
I can't tell if these two individuals were the ones that fell for the phishing scam or
if they're the ones responsible for not training and communicating to other people.
Yeah, insurance, and that's worth a point, Mark.
Insurance isn't going to cover neglect or not following policy and procedure.
(12:28):
But it was a topic of discussion, Chris.
You and I can join different bargaining groups, even though we're not certified teachers.
We can join those groups and get professional liability insurance and legal representation
afforded to us.
If that's something you're interested in, it might be worth checking out your state
(12:48):
teacher organization to see if they would allow you to join.
But it's definitely one of those things because there was a story.
What was it?
A couple of years ago, there was a ransomware incident, and again, state agency was trying
to hold IT leadership financially responsible for actions either taken or not taken in that
(13:10):
process.
Again, they're not going to cover neglect or ignoring the rules.
But that came up for discussion back then was, okay, is this time for some sort of personal
protection outside of what the district would carry for directors and officers insurance?
I don't know.
(13:30):
It's worth a conversation, I think.
And if it's not too expensive, it might be worthwhile.
It looks like this school district might be about 2,000 kids.
So 2,000 kids, Ohio.
I think I can relate that to my school district, Missouri.
So I think about the two ladies that would be these two ladies at my school who have
(13:55):
a lot of burden on their shoulders with finances.
But to be honest, they're not paid probably their worth, their value.
So to say that they're now responsible for five grand, that's a significant impact to
their livelihood.
That is a crazy thing to kind of wrap your head around.
The article says the school district had inadequate cybersecurity policies, and they were faulting
(14:19):
these ladies for it.
Yeah, I have a hard time thinking through all of that and telling someone to pay up.
That's a lot.
I don't like it, guys.
I don't like it.
Yeah, I don't like the feeling.
But again, it would be interesting to know more clarity from what exactly is that recommendation
(14:40):
from the auditor's office that they're referencing.
I don't know.
What else you got, Mark?
Let's go down to Tennessee, and then I'll leave you with a fun story.
So Tennessee is considering two bills.
I think these are very, very interesting because it kind of signals where a lot of state legislatures
are looking right now when it comes to screen time and student technology use.
(15:01):
So let's talk with the one that has not gone anywhere.
This one has been proposed, but it has not passed through the Education Commission.
Tennessee Bill HB2393, as introduced, will prohibit school districts and public charter
schools that are serving students in grades K to 5 from accessing any digital devices
in school.
So let me clarify what that means.
(15:24):
Students in grades K through 5 in schools, if this bill were to go through, would be
prohibited from using school technology as well as personal technology during school
time.
So throw out all the school devices.
Is there a carve out for standardized assessments or anything?
So there's a couple of other components to this one.
(15:44):
First is it would ban students from using devices.
It would also ban employees from using a digital device to provide instruction.
So it also prohibits a teacher from using a laptop or any sort of like digital presentation
device.
Or a smart board or interactive panel.
Correct.
Sounds like 1994.
(16:05):
And third, it would also prohibit assessments from being delivered in an electronic format
except in certain circumstances.
So they're basically listing there's a few special education or cognitive assessments
that might be delivered online.
But no more online assessments, no more teachers using technology, and no more students using
technology.
K-5.
K-5.
(16:26):
There has been some discussion to move a K-8.
But right now the bill as introduced is K-5.
Good luck to you, Tennessee Techs.
Yeah.
It has not moved anywhere.
It is stuck in committee and they have decided not to take action on it at this point.
So it is just a proposed bill.
I was just talking, looking at a completely non-related Missouri bill and my wife was
(16:52):
looking at it.
It was something to do with school nurse stuff.
I won't get into the weeds with it.
But we did some investigations on who had proposed it and yada, yada, yada, ends up
being this, you know, a representative that read some book and had some thought and then
he made a bill out of the thing.
And the logic and the reasoning is nonsense as far as all that I know about it, right?
(17:17):
And this stuff, I say that to say this stuff is really bothering me.
Where does that come from?
It's 2026.
Show the data that that's going to be any kind of great thing for the guy.
I was just doing this leadership meeting thing today at my school district and I love being
(17:40):
a part of those because although I'm just tech person and they're talking about curriculum
and all this stuff and getting the buildings aligned together and not necessarily talking
about tech, I got to go into classrooms and just observe and I got to go to third, fourth
and fifth grade today and I got to see student with a work, physical paper workbook, working
(18:02):
through math, teacher using a smart board, working through that problem electronically.
It was beautiful.
And you can see the learning taking place and it just makes sense.
So like what, you know, what's the school going to do?
They're going to ditch, like let's just go back to chalkboards.
I don't know.
Someone has a bad idea and those with bad ideas are making these bills.
(18:24):
I think it comes from extremes and there are classrooms or there might be schools that
are overusing education technology and I think we've all been in those circumstances as well.
And so I think that that's where the legislature is coming from or certain legislators.
And this isn't unique to Tennessee, there are other states that are considering taking
stronger action about overuse of ed tech.
(18:47):
I don't disagree with the need to take some sort of action.
I just think for me personally, I think this should be a conversation that's happening
in the classroom level so that students and teachers can apply the right tools to the
right setting.
I know you guys out in Missouri, you're considering a 45 minute limit.
I understand.
I think 45 minutes is a good amount of time.
(19:07):
I don't think that students should be spending too much more than 45 minutes, but I don't
think that that's a decision that should be a state law.
Yeah, why do we need a law?
Right.
I think it's a goal that schools should strive to meet.
Yeah.
How about school board and super and principals talking to teachers and we trust public school
and K-12 to do the right thing and you nip the teacher that always has the Chromebooks
(19:33):
out the whole time.
Yeah.
I don't need a stinking law.
Right, right.
Then from there, take it to school board to say, hey, we're going to be very careful about
adopting too much technology.
We don't want to flood our teachers with overpriced ed tech tools and then that they feel they
have to use or we feel we have to use them as well.
I think there's more practical approaches that you can take to still accomplish that
(19:57):
45 minute to an hour max time period, but I don't think that the state legislature is
going to really help the problem.
I think it's just going to add a lot of confusion and then you know that inevitably there's
going to be a school district that finds a rule to put on their Chromebooks and laptops
that locks them down after 45 minutes a day and causes chaos in a classroom.
(20:21):
That's come up in discussion over on K-12 Tech Pro.
I think somebody was asking if there is a way to have that counter going for by account
instead of device and more or less disable or suspend the account and once their counter
is reached, maybe a subtle nudge of like, hey, I think you should take a break right
(20:47):
now.
Go, you know, touch grass, get some fresh air.
But like this whole hard law, hard lock down the devices thing up to 45 minutes.
Yeah, I well, I work in K-12.
So obviously I believe in K-12 and I believe in K-12 teachers.
I don't need my daughter's teachers to have technology that makes a screen not work.
(21:12):
I just I trust the system.
I trust the teacher.
And if I don't trust the school I'm at, I should pull my kid and go somewhere else or
homeschool it for the matter of it.
But get out of here with this stuff with K-12.
It's stupid.
Yeah, Chris, you're not going to homeschool your kids.
No, I believe in K-12.
(21:34):
If I homeschool my kid, the screen time is going up.
That is that is 100% accurate.
Yes.
Are you good?
What's what's the school in Texas, Mark?
Oh, Alpha School.
Alpha School.
You could pay $65,000 a year to attend Alpha School and have your kid taught.
It's only two hours a day, but, you know, we we have my youngest we we gave her an iPad
(21:58):
and we have the screen time thing set on there.
But we gave her the passcode just so she can override it whenever she needs to.
That's what we would do.
That's how we fight the system with teachers of this thing.
Just let's just tell them how to override it.
It's like Mark and the brick.
I was going to say I do that on my own.
(22:19):
I have my limits on on the I would say wasteful and destructive apps.
I am 100% on board with shutting those apps down.
If you're if you get a kids on YouTube for way too long or TikTok, just shut it down.
But at the device level is is a hard one to implement.
Is our group chat in your in your distracting app list, Mark?
(22:40):
Is that why you go?
No, I take all my communication stuff out because I can't.
Yeah.
Yeah.
I think the thing that gets me about a lot of this is just I'm I'm I'm yet to see like
the the data that says that, you know, if it's 25 minutes or 45 minutes or take it all
away, I just think it's yeah, it's that polarized thing where we're like, oh, we have too much
(23:03):
tech.
So didn't let's just take it all away.
And it's not even fair to do that yet because of all the COVID we're still and I hate talking
about COVID stuff all the time, blaming that, but we're still recovering from that.
So it's just not even fair to just act like the problem.
The problem came because the world got shut down with COVID and then we did the technology
spray and pray stuff and we're rebounding and kids are learning how to learn again still.
(23:27):
And we're going to recover for a while.
It's funny.
That article came out this week about this is the first generation that is cognitively
worse than the last generation.
And everybody's quick to blame screen time, AI, digital learning, whatever.
And I was having a conversation with our leader, senior leadership team.
I'm like, yeah, but this is also the first generation to go through a global pandemic
(23:49):
in how many centuries?
Correlation is not causation.
There are many other factors that have taken place that have affected this generation.
Yeah.
I mean, to play devil's advocate, there was an article in the Guardian a couple of weeks
ago about like all this ed tech that we purchased is very expensive, but is it actually effective?
(24:10):
And the data suggests that maybe it's not as effective as we thought.
So yeah, there are folks that say, well, there's no evidence to show you, to prove that ed
tech is effective.
I just take a step back and say, look, that's up to the teacher to decide what's effective
for each student in their classroom.
It's one of the reasons why I'm not a fan of district licenses for ed tech apps, because
(24:33):
it kind of forces us to use more tech and more tools and apply tools to everybody in
a blanket approach.
I'd rather just leave it up to the teacher to apply the right tool in the right circumstance.
And then those of us outside of the classroom support that agency and that usage.
But I will be the first to say there are pockets where ed tech is overused.
(24:57):
The alpha school I think is the most horrific thing that's happening in education right
now where we're just going to plant a kid in front of an AI bot and think that he's
going to learn chatting with an AI.
It makes my skin crawl, but here's where we are.
I will say, and again, to play devil's advocate like you, Mark, there is research and what
some author that I really enjoy, Adam Grant, has published some research around cognition
(25:21):
and retention of information when handwritten, when you're taking handwritten notes versus
taking electronic notes, whatever modality that is, that there is research that shows
you retain information when you handwrite it better than when you electronically take
notes.
So there is a good bit of research around that.
(25:44):
And I remember back when I was pushing to go one-to-one Chromebooks in our middle school
and high school and I got, I won't say argument, but a little tit for tat with our assistant
superintendent who is now the superintendent and my boss who I get along with great.
She was saying, show me the research where Chromebooks improve outcomes.
(26:05):
And I can be a little bit of a smart mouth and I said, show me the research that smart
boards improve outcomes.
And I was asked to leave her office.
But again, at the end of that, you're like, people are deciding that again, the teacher,
the teacher knows that the principal knows that we don't need a law to tell us that from
(26:29):
a lawmaker that doesn't know if it's good or whatever.
That's like the Missouri one that they're wanting to limit screen time, but then they're
wanting to throw back cursive all the way back in, which is also some slap at schools
that still will do some cursive, like, you know, even, even like the cell phone thing
that we passed in Missouri school, a lot of schools were already doing those cell phone
(26:52):
things.
We didn't need law to do that.
You just need more of communities to adopt to that and take it on.
We didn't need a Missouri blanket law to hit us all.
We were already doing it.
However, I will say it gave schools an easy out to say, instead of the principal or the
superintendent making this decision, if a mad parent wants to raise hell, point them
(27:15):
at the state legislature.
This isn't, this wasn't the district districts have a very easy out with that conversation.
Now the way it is.
I agree with that.
And I can appreciate that.
Yeah.
Yeah.
You know what else I appreciate is incident IQ.
If you're leading your it and K-12 right now, the job is not getting simpler.
(27:35):
You have a lot of devices to manage, a lot of support tickets.
You're thinking about cybersecurity.
You're thinking about refresh cycles, screen time, all the things.
That's where incident IQ comes in.
They are an IT service management platform built for schools.
They can do your asset tagging, your workflows, your reporting, your help desk, and more.
You can learn more at incidentIQ.com.
(27:56):
Don't you guys like that?
Yeah.
A great segue.
Mark, what were you going to say before you were interrupted?
Well the, the second bill that is proposed, there's more bills and it's all Tennessee.
This is all Tennessee right now.
This is another bill that the education committee did move forward.
So this is, it's not an official bill, but they are proceeding with this one.
(28:18):
They had a good 18 to one vote.
So there's a lot of support.
This is around again, more technology in schools, but this is one I could definitely get my
support on.
So HB 1886 has a number of provisions.
It basically kind of takes SIPA and moves it forward to a new level.
Schools must move towards a whitelist style of browsing by allowing access to websites
(28:41):
deemed acceptable by the school district or charter school.
So this is basically the school district has to say, here are the tools that in websites
that we are going to allow students to go to.
Providers must also filter or block content that is violent or frightening to the students'
age or maturity, if there is no educational value, anything that is promotion, promotive
(29:06):
of self-harm, which I would assume is already happening.
But I think what they're getting at is that students are going to open websites like YouTube
and get into self-harm content, which is very technically hard for districts to proactively
block.
I would also say if you're working from an allow list rather than open and blocking things,
(29:30):
some of that's going to be addressed by that.
And Josh, our buddy Jay over at K-12 Tech Pro, I think he's like two years in with his
middle school.
I think it is just doing an allow list.
I think it's for middle school.
Yeah, I think so too.
And he had some struggles at the beginning.
You got to figure out what that list looks like.
(29:52):
I just talked to him last week and he said it's been going well.
Actually, now that you say that, I think we do that at our intermediate building because
it got so ridiculous a year and a half ago, two years ago.
I think we moved to that method as well.
I like it.
A couple more provisions in here.
(30:13):
I think you're going to like a lot of these.
Schools may create email addresses for students in grades pre-K-5, but only as a data identifier
for logging in.
They are strictly prohibited from using email accounts to send or receive actual emails.
Every district and charter must contract with a third party to perform an annual compliance
(30:33):
audit of their internet policy.
Policies must also be published on the website.
And this is where I think Josh is going to get super excited.
If a student under 18 accesses a prohibited website, the school must notify the parent
or guardian immediately.
That's a funky conversation.
Mark, what was the age group that they couldn't use email at all?
(30:55):
Grades K-5, pre-K-5.
We don't allow that.
I don't think we allow that.
It's one of our recommendations when it comes to protecting student accounts too, is just
turn off email accounts for younger kids.
They don't use them.
Now, heck, our elementary kids don't even know their passwords because they log in with
Clever Badges.
Oh, there you go.
(31:17):
That is a bill that's proposed.
It's moving.
I like that one a whole lot better than the first one.
Even at U, there was one about refreshing your internet safety policies twice a year
in there too.
That's great.
That's stupid.
I think they're just trying to say, look, you need to keep up with this kind of stuff.
It's not the kind of thing that you're going to recycle your policy once a summer.
(31:38):
You do need to monitor and manage it.
Kudos for one of Tennessee's bills.
The other one, eh, maybe needs a little bit more work.
Interesting.
I got one last story.
Oh, my.
Is it another bill, Mark?
No.
It better not be a bill.
This is not even related to technology.
I saw this one.
I had to do a whole bunch of research.
(31:58):
I went down a rabbit hole of like, what is going on?
Space savers?
Parking spot space savers?
It's very obvious I don't live in an agriculture-heavy state, but the FFA, the Future Farmers of
America Organization, this is FFA week.
At the start of FFA week, some districts celebrate by having students drive their tractors
(32:20):
to school.
Yes.
I'm going to link a couple of stories in the notes here.
I just had to ask, do you guys have students driving tractors to school?
We don't.
We don't have an FFA club.
This actually came up in conversation about just the amount of districts in Missouri that
have FFA.
There's 520-ish districts in Missouri.
(32:42):
I think just over 300 have FFA clubs because a number of districts, as part of FFA week,
those clubs were cooking amazing breakfasts and lunches for their teachers.
We had some friends of ours were posting about they got to eat massive pork chops and mashed
potatoes.
I will say, Mark, to your tractor comment, our friend-
(33:05):
Which we don't appreciate.
Our friend Darcy in Nebraska has talked about this and said that I believe her kids did
it when they were in high school and their local school districts completely do participate
in drive your tractor to work day or week or whatever it is.
(33:27):
Do you realize how expensive those tractors are?
Yes.
That's the rabbit hole I went down.
These are high school students driving like half a million to million dollar tractors.
The pictures on the side are right.
It's just kids sit on tractors like happy to be coming to school.
My thought was like, hey, I think their parents may be needing that tractor during the day.
(33:50):
Also, these things are massive.
They're like taking up two lanes of the road.
Police need to just let the residents know like, please don't drive to work today.
It's going to be chaos with-
We have tractors on back roads here in Missouri every once in a while, like when I go back
and forth to the lake and you just know, like, you know how to deal with it.
They'll take up both lanes.
(34:11):
They'll pull over to the shoulder so you can pass like it's, yeah, it's not uncommon.
My father-in-law has two very early vintage, completely redone John Deere tractors and
they're really pretty.
They're pretty pieces of machinery.
(34:32):
I learn something new every day.
By the way, check out meter.com slash K-12 tech talk.
Go to meter.com slash K-12 tech talk to book a demo.
They can do your network infrastructure, full stack networking, internet wired, Wi-Fi and
cellular.
They can design your stuff, get your hardware going, your software going, optimize your
operations to deploy and scale whatever you're needing, they can do.
(34:55):
They are an E-rate eligible service as well.
Check out meter.com slash K-12 tech talk.
You can tell Mark's a city slicker.
We need, we need some.
When's the last time you, have you only seen a tractor on the internet?
No, I mean, I've seen tractors in real life on the internet.
(35:16):
Mark, have you seen a tractor egg?
What is that?
The big round hay bales and fields because they come out of the tractor.
Yeah.
Okay.
Okay.
Yeah.
He hasn't.
No, I have seen that.
I just didn't know that you call them tractor eggs.
I mean, growing up, that's what we'll, that's what, yeah, that might be a Josh family thing.
(35:39):
I don't know.
Well, we got space savers out here.
You guys got tractor eggs out there.
We're all the same country.
All right, Chris, you want to get to our listener email.
This has been, God, this has been such a hot topic over the last 10 days.
It is ridiculous how bad this problem is.
And I don't really, I think I'm just going to kick it to you because this was on K12
(36:01):
tech pro.
This was on the Missouri discord.
I don't know what the count is, Josh, if it's seven, eight, probably more than that school
districts in Missouri hit with this, but let's talk about it.
So one day last week, I think there were seven districts in our region, Chris, Southeast
Missouri that were all hit with email account compromises.
(36:24):
So an employee receives a phish, they click the link.
It's a, you've received a new fax email and teacher clicks link and it takes them to a
really real looking Google login page.
They enter credentials, they're immediately prompted for multi-factor authentication,
(36:45):
whatever that looks like.
If that's a push notification or if that's a code, they enter that or approve that.
And immediately the threat actor has access to their account.
They just think it errors out because nothing loads.
So nothing suspicious takes place immediately.
But in the background, the threat actor is logging into their profile, creating mail
(37:08):
rules and starting to send out hundreds of phishing emails from that account to more
or less duplicate the same process over and over and over again.
And like I said, in the span, I know it was one day, there were seven or eight districts
that we were notified of, or actually all got emails from.
Since then, I, the districts that I know of are probably up to 15 or 20.
(37:30):
And then our state DESI came out and was like, Hey, if you got these emails, it wasn't us
kind of vibe.
And MoreNet, our state consortium sent out multiple emails because there were multiple
distribution lists that received these phishing emails, which included my business office
(37:50):
people.
So it's like they, whoever was doing this hit very wide swaths of users in the state
of Missouri very, very, very quickly.
Everyone was excited to get a fax.
Yeah.
Who knew?
(38:11):
Very excited to get a fax.
The topic that comes up or that we feel like it's important to communicate with our listeners,
with anybody, is what do you do in that scenario when your phone starts ringing from either
internal folks or your friends saying, Hey, like Mark just said, do you not have MFA turned
(38:32):
on over there?
You got an account compromised, sending out phish.
What do you do?
What's the first thing to do?
So Mark in his just unbelievable research ability, I think he has a thing called a search
engine.
I'm not real sure.
He has found, I didn't know Google had published recommendations on what to do with an account
(38:56):
compromise and so has Microsoft.
So research analyst, Mark, do you want to take this over and walk us through high level?
Because we've already been carrying on, God knows how long.
Quick tip, the high points here, you want to start with Microsoft since you said that's
the better of the two?
Yeah.
I mean, both articles or Microsoft and Google have produced articles of what admins should
(39:21):
do if they have a compromised account.
They're both very different because obviously environments are very different.
I think I like the Microsoft one because it actually gives you the PowerShell commands
and scripts to run in your environment.
But if you go through both the Microsoft and the Google environment, it starts with the
hard instructions on what you need to do to secure that account, disabling the account,
(39:45):
scrambling the password, removing any sort of rules or filters that have been created.
They're at the high level that both Microsoft and Google instructions are the same in revoking
access to sign in applications.
But if you are a Microsoft district or a Google district or both, I would just either go in
our show notes and click the links and bookmark this or just Google it.
(40:08):
It's not that hard to find these two articles, but you're going to want to have this thing
on hand the next time you do have an account that is suspended.
And you want to treat this like a checklist.
You want to go through and do step by step in the order that they're telling you to do
that so that you make sure that you are limiting the bad actor from the account.
(40:31):
What I do think that Microsoft, their article does a little bit better is it also talks
about the need to perform a deeper investigation.
If you read through the Google checklist, it alludes to needing to look for other accounts.
But the Microsoft article ends with a major step around performing an investigation, looking
at IP address, sign in location, sign in times to look for other accounts that may
(40:54):
also have the same symptoms.
So definitely bookmark these two articles and please treat them like a checklist the
next time you have a compromised account, student or staff.
So scary, scary story.
We were, I was contacted by a friend of Chris and I's yesterday afternoon and he's like,
(41:16):
hey, we just had this account compromise.
Can we chat real quick just to make sure I'm not missing anything?
So he tells me the story and we're going through things and these checklists are very viable.
And he had hit all the major points, like do you check for inbox rules to, you know,
they were either copy and mail out or trying to hide messages that came back.
(41:38):
He's like, yep, did that.
I said, do you clear sign in cookies?
Yep, did that.
He had done most everything.
I'm like, okay, what, what am I not thinking of that you saw or did that you, you felt
had a good payoff?
And he said, well, I'll tell you one thing that scared the hell out of me.
He said, we could tell through logs and admin console that the threat actor, one of the
(42:03):
very first things they did before they started sending out messages or anything else, because
they can do this in the background before they're caught, they went to see if they could
get into Chrome saved passwords.
Because once they log into the Chrome browser with that profile, they then have access to
any passwords saved in the Chrome browser password manager.
(42:27):
He said, thankfully, this person did not have any passwords saved in there.
So in my head that clicked, I'm like, oh my God, that's, that's horrible.
Like just makes me sick to think that an account compromise can then lead to God knows what
else.
And we all know our staff save personal account information on their work computers.
(42:48):
Fast forward about three hours.
I'm at home cooking, we had breakfast for dinner last night.
I'm cooking and a neighboring district calls me.
I don't hear from this gentleman a lot.
So I thought, oh, this is weird.
He had an account compromise and we're talking, he's like, hey, what am I not thinking of?
(43:08):
So we're stepping through the conversation that I just had three hours earlier.
And I said, hey man, one thing you probably haven't thought of are Chrome saved passwords
in the browser.
I said, you need to look in the admin console or at least at a minimum, go to that teacher's
machine or that person's machine and look and see if they have any saved passwords in
the Chrome browser password manager.
(43:29):
And his reaction was very similar to mine.
Oh my God, that's awful.
Yeah.
So that's, that's a huge negative because really there is zero, there are no secondary
levels of authentication or anything to get into that password manager.
You just have to know the computer password to get in.
(43:49):
That's the only verification.
So if a threat actor is doing this from his computer, of course he's going to know the
password on his computer.
So that's a major strike against Chrome, Chrome's password manager.
I don't like, I don't like thinking about this stuff.
Yeah.
It makes you want to rethink allowing Chrome's password manager.
(44:10):
Hey, also a shout out to K126.
They do have that k126.org slash compromise.
It's a combination of the Google and Microsoft stuff in one sheet.
So if you're reading between all these and if one hits your head a little better, that
might be the one for you.
Yeah.
Funky stuff.
(44:32):
Definitely have it in your run book.
Maybe print it out and put it in your IRP.
Have it someplace offline that you can grab and go kind of situation.
Make sure all your staff are trained on it.
We had a little bit of an incident this week and I was busy dealing with nape testing people
demanding hotspots and my guys were able to take action on an incident within minutes
(44:58):
and they didn't even call to ask me if they could do things.
They just did it.
And they did really, really good on that.
So it is absolutely legit to have it printed out, to have it readily available.
Sure.
I can think about the last time I had it was a student account that got compromised.
And again, your head is thinking through things and you might get nine of the 10 things that
(45:18):
you said that you were going to do right, but you're probably going to miss something
because you're caught up in that moment.
So I think this again speaks that we should be prepared maybe with a physical piece of
paper.
We'll link both Google, Microsoft, and the K-12-6 instructions in the show notes.
Get them all out.
Kill some trees.
All right.
Well, gentlemen, it's been a week.
(45:44):
Mark hopefully you thaw out soon and you don't have to shovel anymore.
Yeah, we're getting a little bit of a thaw this weekend and I think the snow comes back
on Tuesday.
So I give up.
Yeah, it's supposed to be beautiful here this weekend.
I'm moving to farm country next.
You just want to drive your tractor to work.
I just want a tractor.
(46:04):
Well, sure.
I can understand that.
Thanks, my tractor, sexy.
Isn't that a song?
That was a song, right?
You sound just like that guy for sure.
Yeah.
It's this new microphone I got.
Thank you for-
Hey, Mark, you're coming to Missouri.
You might see some tractors.
Yes.
In a couple of weeks, right?
In a few weeks.
March 12th to the 13th, the Midwest Tech Talk Security Symposium.
(46:28):
Mark supposedly will be there.
See some tractors along the way.
If it doesn't snow.
And a quick shout out to Fortinet, fortinetpodcast.fortinet.com.
They're going to be there.
Manage methods, managemethods.com.
They're going to be there.
So Fortinet for your firewall managed methods.
They can look at your stuff.
They can help you with some of these.
A good look at what your drive is doing, your Microsoft environment too.
(46:51):
And also Classlink, classlink.com.
Help with your SSO, your rostering.
They're proud sponsors of Midwest Tech Talk.
All right.
Well, share us with your friends.
Chris, what's our email address in case people want to send us pictures of their tractors?
Very professional.
Info at k12techtalkpodcast.com.
(47:11):
Send us your tractor pictures for Mark and maybe we'll buy him one.
I would love some tractor pictures.
All right.
Well, share us with your friends.
Let us know if you had an account compromise.
Give us that deep, dark story.
We'd love to hear about it.
If you don't want us to share it, we won't share it.
But I think the more of this people understand that we're all going through the same thing,
(47:35):
the better off we are.
So we will see you next week.
The views and opinions expressed on the K-12 Tech Talk podcast are the personal opinions
(48:02):
of Josh, Chris, and Mark, and do not represent the views or opinions of our sponsors or other
organizations that we're affiliated with.
The material information presented here is for general information and entertainment
purposes only.
Thanks for listening, and we'll see you next week.
And selling songs just to stay in the queue.