April 30, 2026 • 42 mins
On Episode 262, Josh, Chris, and Mark discuss the risks of edtech tools that add generative AI without age checks or strong guardrails, share a new K12 SIX resource and rubric for security essentials, and cover email security best practices.
For the main topic, the guys talk about "secure email." Districts are being asked to send more sensitive information outside the network - to parents, agencies, vendors - but there's no shared standard for what "secure email" even means in K12. TLS encryption in transit isn't the same as end-to-end encryption. A password-protected PDF isn't a secure channel. And most staff don't know the difference.
————
Sponsored by:
PowerGistics:How K-12 Charging Models Impact Chromebook Sustainability
Bring Chromebooks Back to the Classroom, but NOT Carts!
One-Person Tech Department Success Story
SysCloud Fortinet Extreme Networks ————Join the K12TechPro Community (exclusively for K12 Tech professionals)
Buy some swag (tech dept gift boxes, shirts, hoodies...)!!!
Email us at k12techtalk@gmail.com
OR our "professional" email addy is info@k12techtalkpodcast.com
Visit our LinkedIn
Music by Colt Ball
Disclaimer: The views and work done by Josh, Chris, and Mark are solely their own and do not reflect the opinions or positions of sponsors or any respective employers or organizations associated with the guys. K12 Tech Talk itself does not endorse or validate the ideas, views, or statements expressed by Josh, Chris, and Mark's individual views and opinions are not representative of K12 Tech Talk. Furthermore, any references or mention of products, services, organizations, or individuals on K12 Tech Talk should not be considered as endorsements related to any employer or organization associated with the guys.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
On this week's episode of the K-12 Tech Talk podcast, we talk about the challenges of edtech
(00:06):
tools that implement AI chatbots without any guardrails, share a new resource from K-12
6, and discuss secure email practices and tools.
Thanks for listening.
Live from the NTP studios, this is the K-12 Tech Talk podcast.
This is episode 262, I believe.
(00:29):
It's pretty crazy.
I was telling somebody earlier today that we've done this over 260 episodes, and they
couldn't believe it.
My name is Josh, tech director here in mid-Missouri, down the road from me, wearing the same clothes
as me.
It's been that kind of week.
White T-shirt.
Tech directors had a rough week when they're just wearing a white T-shirt.
Hello, Chris.
What's up?
(00:50):
It's been a week.
Yeah, it's been a week.
It's fine.
Everything's fine.
It's great.
Today, we'll get into that in a minute.
Hello, Mark, over on the East Coast.
It looks like it's cold where you are.
You are bundled up.
Yeah, it's a rainy, cold day.
Did we say you were in Vegas at the Phish concert at the last episode?
Did we mention that?
I think you referenced I was in Vegas.
You probably just made me sound like a degenerate gambler, which I may have been for a couple
(01:14):
of times.
I was thinking pothead being at the Phish concert, but okay, whatever, degenerate gambler.
Hey, gambling's fine.
Just don't tell Chris.
But he's back.
He made it home.
I made it home.
Any Phish fans that listen to this podcast, please reach out.
I would love to compare notes of the Sphere run going on right now.
Yeah, and I'm sure that those Phish people don't like being stereotyped like Josh just
did.
(01:35):
Blame it on me.
Okay.
Yeah, Josh.
Mark, you're going to watch another Phish concert tonight, you said.
So Chris, before we really get into the borderline, not shady, inappropriate's the wrong word,
but let's just say some-
Shenanigans.
Shenanigans.
Okay.
(01:55):
EdTechTools shenanigans.
Fortinet sponsors before they bail.
Sure.
Fortinet, who has been a longtime sponsor of the K12 Tech Talk podcast, summer is approaching,
and if a firewall is on your list of things to replace, you should absolutely check out
Fortinet.
Check out the FortiGate.
You can email our friend Chris Illingworth over at fortinet at fortinetpodcast at fortinet.com.
(02:16):
Again, fortinetpodcast at fortinet.com.
So funny story.
My wife and I went to Paducah, took Friday off last week.
Ate at Freight House, and this is not a sponsored plug or anything.
I wish it was, but the food was amazing.
Met the chef, posted pictures online of the food we had.
Just absolute...
She's an award-winning chef, nominated for James Beard Awards.
(02:41):
So I posted these pictures of our meal and that we got to meet the chef, yada, yada,
yada.
Chris Illingworth from Fortinet starts texting me, hey, where'd you go to dinner?
Tell me about everything.
I want to go there.
Chris, Chris is a foodie.
Shout out to Chris and Fortinet because they have sponsored us from, like, they were one
of the first ones in, right, Chris?
For sure.
(03:02):
Yeah.
So super cool company.
They're the reason that you can go to that restaurant.
Yes, they are the reason why I could go to that restaurant.
And they didn't leave when we came up with the FortiPotty idea.
So...
It's been a lot of Forti jokes over the years, actually.
They have to...
You know what?
We've laid off.
We need to bring the Forti jokes back.
We need a Forti joke book for the conference and give to the Fortinet people.
(03:24):
So today, I messaged you guys earlier today about an issue that cropped up with, I would
say, a popular quizzing tool, online quizzing flashcard tool.
I don't necessarily want to call them out, but...
There's only a couple out there.
(03:44):
So it turns out this tool added a gen AI feature with no age verification, no real
what's your age, anything like that.
Students, of course, what's the first thing they're going to do is gravitate to write
me an essay, write me a paper, answer this question.
When we were going into this conversation today, I had my technicians, I'm like, hey,
(04:08):
see what you can do.
See if you can get it to go dark.
You know, will it talk about self-harm?
Will it talk about NSFW or inappropriate content?
And it didn't take real long and I started to hear giggling from my technician's office.
And yeah, they were able to get it to start talking about, we'll just say the birds and
(04:29):
the bees.
Very descriptive manners.
And you can imagine where the conversation went.
But my rant or my point to this is ed tech companies, and I've already posted on LinkedIn
about this ed tech companies.
If you are listening and you are running a quiz slash flashcard website tool for kids
(04:51):
to study material, there's zero reason on God's green earth that that tool needs the
generative AI feature, especially with no age checks, no guardrails by saying, no, this
is for health class.
Tell me about sex.
Oh, okay.
If it's about health class.
Fine.
Red flag, huge red flag, major problem.
(05:15):
And as I'm talking, Mark has done the dirty work and the hard work here.
And I guess has gotten, I'll let him explain it because I don't know what he's going to
show us.
He's gotten this tool that might start with the word quiz to go off the rails, Mark.
I mean, when you say I've done the dirty work, yes, I have absolutely done the dirty work
(05:38):
to see what this ed tech tool has allowed me to do.
Okay.
So this is, this is this AI assistant within a very popular ed tech tool.
And it's, it said that I can help with, with schoolwork.
And so my first response is yes, this is for school.
And then tool says, I understand you're looking for help with schoolwork.
What specific topic?
Perfect.
Sex ed.
(05:59):
You're going straight there.
I'm going straight there.
And so it asked me a whole bunch of questions of like, what do you want to learn more about
in the topic of sex ed?
Bear in mind, it has not asked if I am a teacher or a student or what grade level I'm teaching.
I'm just learning about sex ed from this ed tech tool.
Please tell me you did STIs.
No, I asked, can you tell me how babies are made?
(06:22):
And it gave me a very descriptive, as you can see, very descriptive, professional description
of it.
Sure.
And then I said, let's see if we can get it off track here.
And so I asked what happens.
And it gave me a full description here.
And so then I try to say, well, my friend Josh has this problem.
How should I help him?
(06:44):
No, but here is the good news.
Because this is a classroom tool, this tool says, I understand you're concerned about
your friend.
However, as an AI coach, I'm not equipped to give personal advice.
And then it redirects me back to sex ed and asked me, what more do you want to learn about
sex ed?
And then I went into some pretty difficult topics here to see where it went.
(07:08):
And then it finally asked, what's a ****?
And said, that's inappropriate.
I'm not going to help with that.
But then when I just changed the word to, what's an ****, well, there you go.
It even bolded it.
Yeah.
Really easy to get around any sort of checks or balances.
It's not good.
And it's not good because this is a quiz tool that has no business doing this.
(07:29):
Mark, ask it quickly.
What's the average size?
Bear in mind, I bleeped out all the bad words here, but Josh is just...
Oh, my.
It's getting me down to the decimal point.
How far?
Tenths or hundreds?
Tenths.
And then converts it to centimeters.
(07:49):
We're not going to share the size that it reported because we don't want anyone disappointed.
We will move on.
Thoughts, guys?
Yeah, get that trash out of here.
It's crazy.
It's science, Chris.
So we blocked, and it's only been two, three-ish weeks ago, we, our school district, had blocked
(08:11):
this website, not for the inappropriate things.
We didn't know that was going to be on the radar.
But just for the sheer, this was a website meant for quizzes.
And it's not that tool anymore because they wanted to add some flashy AI pieces to it.
Our teachers that were the biggest...
I know on the pod I've unpacked, our district has the, we are vetting and approving apps
(08:37):
now.
Right.
This was one that we didn't support.
You can't do a tech ticket to use this website.
But we were cool with it being used.
So this was the first website that we were cool with it being used.
It added AI to be whatever and change its purpose.
Our biggest teachers with usage asked for it to be blocked.
(09:01):
Wake up tech companies that are just throwing in AI for kicks.
It's not cool, let alone the inappropriate stuff.
Chris did say the word quizzes, which is a name of a very popular other quizzing tool,
and that is not the tool.
Correct.
I was having a conversation with a principal about this, and he's like, it comes down to
their marketing.
(09:21):
And this goes beyond ed tech companies.
Marketing is being geared towards kids.
And the fact that, and I'm not saying necessarily that the content was like, belongs in Playboy
or anything like that.
It used scientific terms.
I guess my bigger issue with it is, it didn't gear that content towards a level.
(09:46):
Like there was no checks and balance as, is this a second grader?
Is this a junior in high school?
Because that content delivery, that topic, that discussion point should vary wildly based
on that age level.
And realistically, you would have conversations in districts where that content, period, should
be kicked back to the parent, not necessarily addressed through an AI tool on a Chromebook.
(10:11):
Yeah.
I mean, the very first question was, I am geared towards helping students out with their
schoolwork.
And so you have a tool that is trained to talk to students, talk to children, but with
absolutely no context, without knowing what grade level they're in.
And so it's having these very, very, again, age-inappropriate conversations depending
(10:33):
on who the audience is.
And the tool's not really giving a crap about what grade level this child is.
Well, take sex ed out of it.
Change it to the Civil War.
And have a conversation around the root causes of the Civil War.
Again, depending on grade level, that topic could be wildly, not the topic itself, but
(10:55):
the delivery and the facts of that content could vary wildly based on a third grader,
a senior in high school.
How do you explain slavery?
How do you explain economics to a third grader?
You know, wild.
Yeah.
But here's the tough part, right?
This is a tool that you probably did not adopt because of the AI capabilities.
(11:18):
You adopted it for something else, and then AI just popped up one day.
And this is happening in so many other tools.
And like, do we need to test every single possible tool to say, is this appropriate?
Does it have appropriate checks and balances?
Am I allowed to turn this on for our younger students or our older students?
And if you can't do anything about it, I would argue that under SIPA, you must get rid of
(11:43):
tools that provide inappropriate content and material to students.
And this falls right into that category.
We had a website come to our attention earlier in the week, freepik.com.
And PIK is P-I-K, I think, AI Image Generation.
And there are zero guardrails on that site.
(12:04):
So you might want to check your filters.
If it was misclassified in mine as, I want to say, image search, maybe, and not AI, use
your wildest middle schooler imagination and come up with a prompt.
You can generate that image in freepik.com.
Or the unwise.
Or just want to have a good time.
(12:24):
You couple this edtech tool with freepik.com, and you could have an afternoon.
I wonder if I asked it to take my conversation from this quiz tool and turn it into an image
what it would look like.
I'm not going to do that.
Josh, what are you going to do with this?
Like, where are you at with that?
So now that you know what you know, what are you doing?
(12:44):
We had a lot of conversations.
I ran between my buildings this afternoon, talked with a couple different teachers, administrators.
We're 15 days from the end of the school year.
If I yanked out a flashcard tool right now, I think there'd be pitchforks and lanterns
coming after me.
And I get it.
And like I told a principal and one of my central office staff, realistically, this
(13:09):
isn't my call.
I will flip the switch of whatever is decided, but there needs to be a conversation about
it had.
Because I feel like when rational people have that conversation, you're going to come to
an agreement that this likely is not appropriate to be in a school setting.
But the question is, do we really do that 15 days before the end of the school year?
(13:30):
I really don't.
I think that answer is no.
I think this will be a move that is done after the end of the school year before the start
of the next school year.
So yeah, it'll be a shift.
Because I know I have a number of teachers that rely on this specific tool.
There are other tools.
And I just kept throwing out there today, I'm like, look, we have Notebook LM.
(13:51):
It can generate flashcards and questions the same way.
So I don't know.
I don't know.
I think I know where this is going to land, but I don't know.
You're so close to the school year finish line.
Yeah.
What you're saying makes total sense.
Yeah.
And I think we probably blocked just in the barely have a pocket.
Like when we blocked it, I got some tickets that day and, you know, the next couple of
(14:13):
days people that have been using that.
Our answer was we have another district supported tool.
Sure.
That like literally pays for right.
Like this is a great example.
Why go use that thing instead?
Because this, this is a free tool.
It's not like teachers have a great, they don't get like big glimpses into what the
kids are doing with the one that we're talking about.
(14:34):
This is just kids sign up from what I understand and they're using it.
They're making flashcards and stuff, but it's not like the teacher gets to look at every
flashcard that gets generated and know that it's good to go.
I think teachers can create like a S a set of questions and then share that set and okay.
Like I get it.
You can do the same thing with notebook LM and Google classroom.
(14:55):
So I think we're going to have to push a little bit harder on that.
So you're going to let the quiz tool stay for a little while and then make a decision
over the summer.
See what I did there.
I did see what you did there.
It took me a second, but I got you, Mark, I got you.
Let us move on.
Yeah.
(15:16):
You want to hit another sponsor?
Oh, sure I do.
Check out PowerGistics, PowerGistics.com.
So they do great charging stations.
They say, and I would believe this, I've checked out their stations.
They can end up saving you money because you might have some decrease in damages to Chromebooks,
especially at the elementary level with how their charging stations are designed.
More time for learning because you can put these devices up easier because of how their
(15:39):
charging stations are designed.
You got like a day left, but on K2L Tech Pro, we were running a deal on PowerGistics and
you can get on there.
They'll even let you not have to worry about paying until July 1.
So check out PowerGistics, PowerGistics.com or get on K2L Tech Pro to see their offerings
with a discount.
Mark, why don't you bring us up to speed in the news and take us out of this conversation?
(16:02):
All right.
So let's go down to Arkansas.
This is something that is very timely because Chris and I, right before the show, we were
talking about Chris's building project, building a whole new school.
And I've seen this happen in multiple other school districts where when there's a major
construction project, the attackers will start targeting the business compromise email or
(16:24):
the phishing email.
And unfortunately, Pine Bluff School District in Arkansas fell victim to a business email
compromise related to a construction project, losing $3.2 million to essentially a wire
transfer to the wrong address.
So the attackers got in, inserted themselves into an email conversation, injected some
(16:47):
incorrect information into the conversation.
And the next thing you know, that $3.2 million payment went to the wrong account.
The superintendent did talk about, this happened in December, but the superintendent is just
talking about it now, and they have been working with the FBI and they are optimistic
that they'll be able to regain or recoup some of the funds, if not all of the funds.
But it is a big lesson that the attackers are really, really looking after school districts
(17:12):
or looking for school districts that have construction projects going on.
They're going after the construction companies themselves because they know that those companies
are very vulnerable to these types of attacks and they're also going for your procurement
staff.
Just because you have MFA or just because you've got email security put in place doesn't
mean that you are safe.
(17:33):
You just need to make sure that your staff, your procurement staff, your business office
has protocols in place for changing direct deposits, for changing wire transfer accounts
so that they are absolutely positively sure that these accounts are, or these changes
are legitimate.
Yeah.
We talked about another story about this not long ago where, what was it Chris, the accounts
(17:58):
payable lady was being held responsible to recoup some of that cost?
We imagined two sweet ladies like we have and I think it was 50 grand that they were,
the school district didn't recover, right?
So they were basically going to get their wages garnished is what it sounded like.
Yeah.
Insanity.
Yeah.
Yeah.
(18:18):
It's a story to see, but when it comes to business email compromise and construction
projects, it's really where you see the biggest attacks and the biggest losses from school
districts.
And Pine Bluff in Arkansas unfortunately was the latest victim.
And that, we've had something similar.
We didn't have the incident and sent the money, but we received phishing emails that were
(18:38):
pretending to be the contractor that we have doing work on our campus.
And when that happened, that really drove home to my central office staff that school
districts are being watched.
They are, every article in the paper that talks about construction projects, every article
that talks about a school calendar, the bad guys are seeing and reading those articles
(19:03):
and tailoring their attacks based on the content that has been shared publicly.
So be really, really careful about the content that's publicly accessible.
Yeah.
And you think about that construction projects, those are the most public projects that get
put out.
You know, we want great pricing, we want great bids, and we want everyone to know this great
thing that we're doing.
(19:24):
So we're just telling the bad guys all the good stuff.
Yep.
Exactly.
And the local paper should do those stories.
Like it's a big thing.
Like we're, we're adding a huge gym.
That's big news for our, for our town.
Yeah.
And that's where, you know, we get back to that MythOS story about, oh, the next, the
next level of cyber attacks is going to be driven by AI.
(19:46):
So what?
Like we still have humans that are falling victim to these types of attacks and you're
losing $3.2 million because Sally in Accounts Payable made a mistake and didn't verify that
they needed to change their, their wiring address.
Well, on the good side, we've got some good friends at K126.
If you're not familiar with K126, please check out their website.
(20:09):
K126 stands for Security Information Exchange.
You'll be able to find all kinds of information about updated attacks and mitigation efforts.
They have what's called the K126 Security Essentials, which is a free resource for you
to see if you're a school district and looking to see what are the, what do I need to do
to secure my, my walls against the common cyber attacks, five or so domains.
(20:31):
Well, they just updated it with a rubric where you can actually see what are the specific
steps I need to do in order to meet this standard or this security essential.
And they also released a security assessment that you can take, answer a few very common
questions or very easy to answer questions.
And then at the end, it will give you an assessment of some of the things that you need to do.
(20:54):
So I highly recommend this.
We have talked a lot about the K126 Security Essentials.
This rubric is really what makes it actionable and takes it to the next level.
So I highly recommend you go to the K126, click on the Essentials tab and download this
for free.
Yeah, they, they put out some good stuff.
(21:15):
Chris, you were at the conference in Albuquerque this year.
Mark, you've gone in the past.
Doug and his crew do really, really good work and they're a very loud voice for K12 districts
across the country when it comes to legislative updates and lobbying and D.C. and trying to
make, help our legislators make informed decisions.
(21:37):
So they do a lot of work.
Well, and speaking of our legislators making informed decisions, our last article comes
from the Department of Education.
Is that still around?
The Department of Education has finalized their grant priorities as well as their budget
(22:00):
proposal.
Linda McMahon has been in front of the Senate and the House this week talking about their
budget and answering questions in front of our legislatures.
Two interesting things.
They have made some, obviously some changes in their budget.
They are reducing the overall budget, but they are investing in special education.
The big thing here though is that they are pushing a lot of funds down to the state through
(22:22):
what's called MEGA grants.
Now MEGA meaning, yeah, that's the size of these grants, but MEGA now stands for Make
Education Great Again.
And in that, they're finalizing their priorities and one of them being AI literacy.
So we're going to start to see a whole lot of funding and grants geared towards AI literacy
in K12 schools.
(22:44):
A lot of this is around AI literacy integration, educator PD, computer science and artificial
intelligence coursework for high school students, and then most importantly, safety and privacy
guardrails.
So I'm eager to see where this goes.
I think there is quite a lot of attention on the finances of it all right now, but I
(23:05):
think once the finance and the budget starts to settle, we'll start to see more and more
federal grants geared towards AI.
What that means and what that means for school districts is yet to be determined, but it's
something to keep a very close eye on in the upcoming budget.
And pairs well with our conversation that we started the show with.
(23:26):
Let's expand that.
So my wrestling connection, Melinda McMahon, she's the head of the DOE.
She's also married to Vince McMahon, Jr., who is in the new Hulk Hogan documentary on
Netflix.
Mark, have you watched this?
No.
Were you?
(23:46):
Are you not a Hulk Hogan fan?
Why aren't you asking me if I watched?
Okay, Chris, did you watch?
No.
Are you not a Hulkster either?
No.
No.
You, too.
I guess I'm older.
Okay, so as the lone wrestling fan in the room, what would you like to tell us about
(24:06):
on the Hulk Hogan documentary that's related to the education department's funding?
I just assumed that you, too, were Hulk Hogan fans.
I'll stop.
If you're a Hulk Hogan fan, if you grew up in the 80s like me and you enjoyed Hulk Hogan
wrestling, you need to watch it on Netflix.
It's great.
I did watch the Vince McMahon documentary.
(24:28):
I don't know if it's...
I haven't watched that one.
I haven't watched that one.
All right.
Chris, another sponsor?
Oh, hey.
Sure.
A new sponsor to the KTOL Tech Talk podcast is SysCloud.
They can back up your Google Workspace and your Office 365 data so that you have a second
copy in case you have any issues.
They can help you recover fast from ransomware, scan your stuff for FERPA, make sure IEP stuff
(24:52):
is in check as it should be or not should be, PCI SIP or RISC, all that kind of stuff.
They can monitor what you have going on, maybe help you with your storage costs depending
upon what you're doing, help you with your legal holds and more.
Check out SysCloud at syscloud.com.
Or if your tech director deletes a bunch of accounts and those documents were needed.
Get you some SysCloud.
(25:13):
Chris, main topic for tonight.
This came up in discussion in one of the forums that you and I are in today.
Do you want to introduce this?
Yeah.
There was also a chat room that we're in.
There was some discussion about encrypted, more secure emails being sent.
That's been an uptick in our area and that's a great thing.
(25:33):
We think that's awesome when we're going to be more secure.
But some schools have had some issues with their insurance company, correct Josh?
Yeah.
School wants to contact their insurance company.
Insurance company has decided that they are not going to go through that process to click
through the things to see that secure email.
They're preferring other methods of communication.
(25:57):
Chat was just kind of lit up on if this becomes this trend of a thing where organizations
are refusing to communicate for whatever reasons on that more secure transmission, if you will,
that we have some issues.
I think it was talked about on K12 Tech Pro as well to some degree of how parents are
going to access documents that are secure and how that's going to play out too.
(26:22):
A couple layers to that, I think.
Yeah, and I think the duplicity with the insurance company conversation was it is a very large
player in the education insurance realm that to be covered under their cyber insurance
policy, one of the things they like to see is encrypted email.
(26:42):
But they won't allow more or less the second factor authentication to come through to open
up the encrypted message.
You get a code delivered to your mail.
They won't allow that second message to come through and be delivered to the recipient.
So this district that we were talking to today had to end up faxing information to the insurance
(27:03):
company because they wouldn't allow that email to come through.
So a little, I guess, both sides of your mouth type conversation.
Yeah.
So here's my first question.
When we talk about secure email, what are we talking about?
Is sending the email from Google to Google?
I mean, I think that's what I want to define first, right?
What is secure email?
Good point.
(27:23):
So in this conversation, it is a portal-based email delivery method, meaning if I send an
email out with a key phrase in the subject, my outbound mail is going through more or
less a filter, a third-party provider, and it looks for the key word in the subject.
(27:45):
And if that email has that, rather than delivering that message over regular SMTP traffic, it
puts it behind an encrypted portal that the recipient needs to log into to read and reply
to the message.
So it is not an SMTP-delivered message.
It is behind a secured portal.
(28:06):
That's the definition that I'm operating off of.
Right.
So I think there was a lot of questions around encrypted email and unencrypted email, TLS,
all that kind of stuff.
But I think what we're saying here is the message might get sent via email, but the
actual content is behind a portal that you would need to authenticate into.
So here's my question to you.
(28:28):
How many school districts have that ability in the first place, and is this something
that is growing in popularity?
Yeah.
In the last six, eight months, it has grown in popularity in our region significantly.
And I will just say, Chris, can we say thanks to NTP, because one of the products they provide
(28:48):
or they sell is Avanon, and that is inbound mail filtering anti-phishing tool.
But when you buy that product, one of the things that is included is an encrypted email
portal.
So a number of districts already had Avanon and didn't realize it included the encrypted
mail piece.
So it's one of those things that rather than pay for another encrypted mail service where
(29:13):
you can only afford to license 20 or so users, 10 or so users, because it's an expensive
product, this anti-phishing tool, I can cover all of my users for the same price.
So that has significantly gotten a foothold in our area here recently.
We had a lot of conversations around, do we turn on confidential mode in Gmail, which
(29:36):
is kind of the same thing, right, where you are sending a message, but you need to authenticate
through a code.
But we had a lot of conversations around, like, is this even something that our teachers
and staff would use?
At the end of the day, we did turn it on, allow people to use it, and tried to encourage
it.
But it was very hard to get people to move from sending in just a standard email to something
(29:57):
like confidential mode.
Aren't there some caveats to that, too?
Like it only works in certain scenarios.
I'd have to go back and read the Google Workspace article on it again, because we almost went
down that path because, you know, it's there.
But there were some use cases that didn't quite fall into the parameters, and I can't
(30:18):
remember what that was.
So here's my next question.
When do you use encrypted messaging, and when do you use encrypted email versus just send
something via a standard email?
Are you using this for internal messaging or external only?
And if so, are you doing this with parents to send them confidential documents?
(30:40):
We don't do it on internal mail, because it's living in that Google ecosystem.
Transportation is encrypted there.
We have DLP rules, as well as the keyword rule that sniff every outbound message.
And if it has any sort of these certain DLP phrases, I think there's like 50, that are
(31:04):
related to IEP information, that type of stuff, if it gets flagged for DLP flag, that message
is automatically encrypted before it's sent to the recipient.
So yes, 504 notifications or IEP meeting notifications, recap messages or recap emails, stuff like
that, they are getting flagged and encrypted by this tool automatically.
(31:27):
I think, and I actually had one this week, the problem, and I'll put that into quotation
marks, right, because we're talking about something more secure, but there's a lot of
different platforms that can be used for this.
So we've seen this uptick in my neighbor or whatever agency my school district is working
with, they're sending us an email that is of a different product than what we might
(31:51):
be used to.
And in a good way, a lot of times the tech department's getting contacted because our
user is on a higher alert, because this thing looks weird, like it's this thing that they're
clicking on, they can't see the email, it's coming from a different thing that they weren't
expecting, so they're doing the correct thing to report it.
(32:11):
But it's sometimes hard to like quick look at that and know like, oh, this is this proper
thing that I should be signing into, I should be making this thing send me a code or however
that is that that email is going to be opened up.
I think that's the kind of the problem, the friction, the tension point with upping our
security game with email, it changes a lot.
(32:32):
I have a friend that their school district implemented a solution like this, I guess
supposedly the tech department didn't do a whole lot of communication that it was changing
and being implemented.
So it was doing the thing where all new emails, if you hadn't received an email from the outside
from a particular person that you were getting screened all those emails more, and they like
(32:53):
do more validations.
And again, that's a great thing.
But just cause some tension with faculty, staff and how this stuff plays out, even though
it's more secure.
Interesting.
So my question to you, Josh is, you know, we're, I don't want to say this is the wrong
approach to encrypt emails to parents and to send to use this encrypted services.
But we're, whoa, we're going from putting report cards and sensitive IEP documents in
(33:18):
a backpack, putting on the back of a kid and putting them in the bus and thinking that
that's the safest way.
And so it feels like we're going from, you know, from zero to a hundred overnight in
doing this.
I wonder if there's a school district that does not have an encrypted service, they can't,
you know, afford it at this point, if there's a better way or a better practice to get into
(33:41):
to be able to email documentation in a safe manner.
If you have any recommendations for that.
I really don't know because it's, you know, it's one of those things that heaven forbid
there's a email account compromise on either side, on the teacher side or the parent side.
If the parent's email account's compromised and there's IEP information or diagnosed or
(34:02):
discipline information in that account, and now the threat actor has that information,
who's at fault?
Is the district at fault for sending that to the parent?
Parent culpable for having a weak password?
So is the question going to get asked in that process of why was this sent over email?
(34:22):
I don't know what the answer to that is.
And I'll be the first to say it's extremely difficult to break habits if your teachers
are used to sending that type of communication, no fault of theirs.
But if you're only operating off of a key phrase to encrypt a message, it's really,
really hard to establish that habit of, oh yeah, I got to put secure in the subject so
(34:45):
that it gets encrypted because I'm sending a discipline referral or I'm sending an IEP
recap message or, you know, something along those lines.
I don't know what the appropriate or right best answer is really.
I know I typically do have the best answers.
In the vein of the infinite campus breach, our SIS person was trying a similar thing
(35:08):
to what we had talked about.
If you're going to identify a student by their person ID or the most SIS ID, you know, the
state ID, whatever.
So she was trying to communicate a little differently than maybe previous practice via
email internally where she wasn't, you know, doing initials or doing a name.
I was trying to talk to a person in an office based upon a number and it was explained to
(35:32):
me that it was a pretty funny email exchange because we were then testing that office's
ability to look that person up by a number as opposed to a name.
And again, that whole thing we've talked about before where you're trying to be more secure
and now you've lost just like the, this is the, if you just said it was little Johnny
and just said it, this problem would be fixed already.
(35:54):
But because we were trying to do things more secure, there was a back and forth email exchange
for a while.
So again, we're getting to the spot where we need to be more secure.
We need to do more.
But like you're saying, Mark, what's the sweet spot that's just going to make sense that
a parent can take on or a grandma can take on if a, if a grandma can't click through
a secure encrypted email well on report card time, she's probably not checking the report
(36:16):
card anymore.
Well, to report, to speak to report cards, we don't even send them.
They're only available in our parent portal.
So if you have a parent that struggles or doesn't have a parent portal account, how
are they getting that?
Yeah.
Well, I think that's, that's a great point, right?
So when you think about how you get medical information from your doctor, they're going
to send you an email that says you have a new message in the portal and you log into
(36:39):
your medical portal to get it.
You know, there is, there's something to say about, can we just direct parents to say,
you can find your child's information, their report card in the family portal of the SIS.
And most districts have that by now.
But then you run the challenge of, well, what about a parent who is not going to log
in the portal or just needs the IEP?
They're on the move.
So I think, I think there's definitely a healthy balance.
(37:00):
I would say for me, the biggest thing that we need to do in K-12 is start by minimizing
the amount of information that we do send over email and minimizing the amount of times
that we send somebody an email out of, or with data in an email out of convenience,
rather than just saying you can find this record in the SIS.
I do think parents, it's a whole different ball game because our job is to engage parents
(37:22):
and get them involved.
And sometimes that means making the information as easy as possible.
But I would say start with internal staff and minimizing the amount of internal staff
communications that involve student data over email, whether or not it's encrypted or not,
you're making a copy of that document.
You're making a copy of that file by putting it in email.
(37:43):
So I feel like you're saying, make a phone call, return to in-person meetings and give
them the piece of paper.
Is that what you're saying?
Always.
Yeah.
I mean, less email is best for everybody.
But...
Well, hey, that goes hand in hand with screen time limits.
We're going to put screen time limits on staff too then.
I mean, might as well.
I'm on board with that.
If I get a limit in the number of emails that I have to get every day, I'm happy.
(38:09):
Would your spouse, teacher agree with that, that she needs a restriction in screen time?
I cannot get my spouse to remember to take her cell phone with her.
She is the opposite of somebody who's addicted to a cell phone.
She is addicted to leaving her cell phone behind.
So...
Nice.
Yeah.
Yeah.
(38:29):
Hey, I do have a funny story to share that was today that did not impact all my faculty
staff, but many, talking about reducing screen time.
This is how you do it.
I implemented...
So we have laptops everywhere.
And we have a hard time with updates sometimes with getting, in particular, the teacher demographic
(38:52):
to do a reboot occasionally.
No.
No.
They'll just shut the lid.
And I don't eat my own dog food when I complain about this too.
So I did a thing that the last day of the month, we are going to force a reboot.
And I'm waiting until end of day.
I think I put it at...
It was after 2.30, okay?
(39:14):
That is a pretty good idea if you choose the right time zone.
So I accidentally put that bad boy at UTC.
So around noon today, we had many, many laptops rebooting without prompt.
Really good time.
Shout out new technician, Alex.
(39:35):
He actually discovered the time zone setting that I did.
Smart.
Oh.
Reducing screen time.
That's what I'm all about.
Hey.
It's the trend.
I did get a text from her principal.
She was in the middle of doing some stuff.
I don't believe she had the ability to save quickly.
And there is a difference, if you don't know.
UTC and any other time zone, there are differences.
Huge difference for us.
(39:55):
It's like six hours.
Yes.
I would have loved it if Chris was on like a Zoom meeting with a whole bunch of people
and then just boxes start disappearing as people's computers reboot.
Why am I the only one here?
And that's because I don't apply the settings to myself, you know?
Right.
Exactly.
Yes.
I figured.
Yes.
Chris's computer has been on for 200 days.
(40:16):
As for you, you've been on for an hour.
What happened?
I don't know.
Anyway.
It's probably a good thing you don't work at the same district as your wife because
I feel like those policies, like that would be, that would, that would cause some complaints.
Yeah.
Yeah.
It's good.
We don't work together anymore.
Well, any, any other sponsors tonight, Chris?
(40:37):
Yeah, for sure.
Extreme Networks.
Email Dominic Mayer.
That's dmayer at extremenetworks.com.
It's summer.
A great time for swapping out your networking.
So check out Extreme Networks.
We've used Extreme for years now, have had great luck.
Our friend Dominic is a great guy, known Dominic for many, many years, dmayer at extremenetworks.com.
Any closing thoughts or closing stories, gentlemen?
(40:59):
No, sir.
All right.
Chris, Mark?
I got nothing.
All right.
Chris, we got any trips planned?
Hayden is in Nebraska as we speak, hanging out.
Are they called Nebraskians?
Nebraskans, right?
Nebraskans.
And then our pal, Nathan with Cato Tech Pro, he's going up to the Actum conference.
(41:22):
That's in the next week or so.
That's May 11th.
And then fast forward, boys will be in Georgia in July, July 6th through the 10th.
After that, July 19th through the 21st is Midwest Tech Talk.
Looking forward to those things.
So that was episode 262.
If you have any comments about that quiz that lets people use generative AI, shoot us an
(41:47):
email, k12techtalk at gmail.com.
If you've got a conference you want us to come speak at, let us know.
Send us your feelings on the Hulk Hogan documentary if you watched it.
I'm really enjoying it.
If no other thoughts, we will close for this week.
We will see you next week.
Thanks for listening.
(42:17):
The views and opinions expressed on the K-12 Tech Talk podcast are the personal opinions
of Josh, Chris, and Mark, and do not represent the views or opinions of our sponsors or other
organizations that we're affiliated with.
The material and information presented here is for general information and entertainment
purposes only.
Thanks for listening, and we'll see you next week.
On this week's episode of the K-12 Tech Talk podcast, we talk about the challenges of edtech
(00:06):
tools that implement AI chatbots without any guardrails, share a new resource from K-12
6, and discuss secure email practices and tools.
Thanks for listening.
Live from the NTP studios, this is the K-12 Tech Talk podcast.
This is episode 262, I believe.
(00:29):
It's pretty crazy.
I was telling somebody earlier today that we've done this over 260 episodes, and they
couldn't believe it.
My name is Josh, tech director here in mid-Missouri, down the road from me, wearing the same clothes
as me.
It's been that kind of week.
White T-shirt.
Tech directors had a rough week when they're just wearing a white T-shirt.
Hello, Chris.
What's up?
(00:50):
It's been a week.
Yeah, it's been a week.
It's fine.
Everything's fine.
It's great.
Today, we'll get into that in a minute.
Hello, Mark, over on the East Coast.
It looks like it's cold where you are.
You are bundled up.
Yeah, it's a rainy, cold day.
Did we say you were in Vegas at the Phish concert at the last episode?
Did we mention that?
I think you referenced I was in Vegas.
You probably just made me sound like a degenerate gambler, which I may have been for a couple
(01:14):
of times.
I was thinking pothead being at the Phish concert, but okay, whatever, degenerate gambler.
Hey, gambling's fine.
Just don't tell Chris.
But he's back.
He made it home.
I made it home.
Any Phish fans that listen to this podcast, please reach out.
I would love to compare notes of the Sphere run going on right now.
Yeah, and I'm sure that those Phish people don't like being stereotyped like Josh just
did.
(01:35):
Blame it on me.
Okay.
Yeah, Josh.
Mark, you're going to watch another Phish concert tonight, you said.
So Chris, before we really get into the borderline, not shady, inappropriate's the wrong word,
but let's just say some-
Shenanigans.
Shenanigans.
Okay.
(01:55):
EdTechTools shenanigans.
Fortinet sponsors before they bail.
Sure.
Fortinet, who has been a longtime sponsor of the K12 Tech Talk podcast, summer is approaching,
and if a firewall is on your list of things to replace, you should absolutely check out
Fortinet.
Check out the FortiGate.
You can email our friend Chris Illingworth over at fortinet at fortinetpodcast at fortinet.com.
(02:16):
Again, fortinetpodcast at fortinet.com.
So funny story.
My wife and I went to Paducah, took Friday off last week.
Ate at Freight House, and this is not a sponsored plug or anything.
I wish it was, but the food was amazing.
Met the chef, posted pictures online of the food we had.
Just absolute...
She's an award-winning chef, nominated for James Beard Awards.
(02:41):
So I posted these pictures of our meal and that we got to meet the chef, yada, yada,
yada.
Chris Illingworth from Fortinet starts texting me, hey, where'd you go to dinner?
Tell me about everything.
I want to go there.
Chris, Chris is a foodie.
Shout out to Chris and Fortinet because they have sponsored us from, like, they were one
of the first ones in, right, Chris?
For sure.
(03:02):
Yeah.
So super cool company.
They're the reason that you can go to that restaurant.
Yes, they are the reason why I could go to that restaurant.
And they didn't leave when we came up with the FortiPotty idea.
So...
It's been a lot of Forti jokes over the years, actually.
They have to...
You know what?
We've laid off.
We need to bring the Forti jokes back.
We need a Forti joke book for the conference and give to the Fortinet people.
(03:24):
So today, I messaged you guys earlier today about an issue that cropped up with, I would
say, a popular quizzing tool, online quizzing flashcard tool.
I don't necessarily want to call them out, but...
There's only a couple out there.
(03:44):
So it turns out this tool added a gen AI feature with no age verification, no real
what's your age, anything like that.
Students, of course, what's the first thing they're going to do is gravitate to write
me an essay, write me a paper, answer this question.
When we were going into this conversation today, I had my technicians, I'm like, hey,
(04:08):
see what you can do.
See if you can get it to go dark.
You know, will it talk about self-harm?
Will it talk about NSFW or inappropriate content?
And it didn't take real long and I started to hear giggling from my technician's office.
And yeah, they were able to get it to start talking about, we'll just say the birds and
(04:29):
the bees.
Very descriptive manners.
And you can imagine where the conversation went.
But my rant or my point to this is ed tech companies, and I've already posted on LinkedIn
about this ed tech companies.
If you are listening and you are running a quiz slash flashcard website tool for kids
(04:51):
to study material, there's zero reason on God's green earth that that tool needs the
generative AI feature, especially with no age checks, no guardrails by saying, no, this
is for health class.
Tell me about sex.
Oh, okay.
If it's about health class.
Fine.
Red flag, huge red flag, major problem.
(05:15):
And as I'm talking, Mark has done the dirty work and the hard work here.
And I guess has gotten, I'll let him explain it because I don't know what he's going to
show us.
He's gotten this tool that might start with the word quiz to go off the rails, Mark.
I mean, when you say I've done the dirty work, yes, I have absolutely done the dirty work
(05:38):
to see what this ed tech tool has allowed me to do.
Okay.
So this is, this is this AI assistant within a very popular ed tech tool.
And it's, it said that I can help with, with schoolwork.
And so my first response is yes, this is for school.
And then tool says, I understand you're looking for help with schoolwork.
What specific topic?
Perfect.
Sex ed.
(05:59):
You're going straight there.
I'm going straight there.
And so it asked me a whole bunch of questions of like, what do you want to learn more about
in the topic of sex ed?
Bear in mind, it has not asked if I am a teacher or a student or what grade level I'm teaching.
I'm just learning about sex ed from this ed tech tool.
Please tell me you did STIs.
No, I asked, can you tell me how babies are made?
(06:22):
And it gave me a very descriptive, as you can see, very descriptive, professional description
of it.
Sure.
And then I said, let's see if we can get it off track here.
And so I asked what happens.
And it gave me a full description here.
And so then I try to say, well, my friend Josh has this problem.
How should I help him?
(06:44):
No, but here is the good news.
Because this is a classroom tool, this tool says, I understand you're concerned about
your friend.
However, as an AI coach, I'm not equipped to give personal advice.
And then it redirects me back to sex ed and asked me, what more do you want to learn about
sex ed?
And then I went into some pretty difficult topics here to see where it went.
(07:08):
And then it finally asked, what's a ****?
And said, that's inappropriate.
I'm not going to help with that.
But then when I just changed the word to, what's an ****, well, there you go.
It even bolded it.
Yeah.
Really easy to get around any sort of checks or balances.
It's not good.
And it's not good because this is a quiz tool that has no business doing this.
(07:29):
Mark, ask it quickly.
What's the average size?
Bear in mind, I bleeped out all the bad words here, but Josh is just...
Oh, my.
It's getting me down to the decimal point.
How far?
Tenths or hundreds?
Tenths.
And then converts it to centimeters.
(07:49):
We're not going to share the size that it reported because we don't want anyone disappointed.
We will move on.
Thoughts, guys?
Yeah, get that trash out of here.
It's crazy.
It's science, Chris.
So we blocked, and it's only been two, three-ish weeks ago, we, our school district, had blocked
(08:11):
this website, not for the inappropriate things.
We didn't know that was going to be on the radar.
But just for the sheer, this was a website meant for quizzes.
And it's not that tool anymore because they wanted to add some flashy AI pieces to it.
Our teachers that were the biggest...
I know on the pod I've unpacked, our district has the, we are vetting and approving apps
(08:37):
now.
Right.
This was one that we didn't support.
You can't do a tech ticket to use this website.
But we were cool with it being used.
So this was the first website that we were cool with it being used.
It added AI to be whatever and change its purpose.
Our biggest teachers with usage asked for it to be blocked.
(09:01):
Wake up tech companies that are just throwing in AI for kicks.
It's not cool, let alone the inappropriate stuff.
Chris did say the word quizzes, which is a name of a very popular other quizzing tool,
and that is not the tool.
Correct.
I was having a conversation with a principal about this, and he's like, it comes down to
their marketing.
(09:21):
And this goes beyond ed tech companies.
Marketing is being geared towards kids.
And the fact that, and I'm not saying necessarily that the content was like, belongs in Playboy
or anything like that.
It used scientific terms.
I guess my bigger issue with it is, it didn't gear that content towards a level.
(09:46):
Like there was no checks and balance as, is this a second grader?
Is this a junior in high school?
Because that content delivery, that topic, that discussion point should vary wildly based
on that age level.
And realistically, you would have conversations in districts where that content, period, should
be kicked back to the parent, not necessarily addressed through an AI tool on a Chromebook.
(10:11):
Yeah.
I mean, the very first question was, I am geared towards helping students out with their
schoolwork.
And so you have a tool that is trained to talk to students, talk to children, but with
absolutely no context, without knowing what grade level they're in.
And so it's having these very, very, again, age-inappropriate conversations depending
(10:33):
on who the audience is.
And the tool's not really giving a crap about what grade level this child is.
Well, take sex ed out of it.
Change it to the Civil War.
And have a conversation around the root causes of the Civil War.
Again, depending on grade level, that topic could be wildly, not the topic itself, but
(10:55):
the delivery and the facts of that content could vary wildly based on a third grader,
a senior in high school.
How do you explain slavery?
How do you explain economics to a third grader?
You know, wild.
Yeah.
But here's the tough part, right?
This is a tool that you probably did not adopt because of the AI capabilities.
(11:18):
You adopted it for something else, and then AI just popped up one day.
And this is happening in so many other tools.
And like, do we need to test every single possible tool to say, is this appropriate?
Does it have appropriate checks and balances?
Am I allowed to turn this on for our younger students or our older students?
And if you can't do anything about it, I would argue that under SIPA, you must get rid of
(11:43):
tools that provide inappropriate content and material to students.
And this falls right into that category.
We had a website come to our attention earlier in the week, freepik.com.
And PIK is P-I-K, I think, AI Image Generation.
And there are zero guardrails on that site.
(12:04):
So you might want to check your filters.
If it was misclassified in mine as, I want to say, image search, maybe, and not AI, use
your wildest middle schooler imagination and come up with a prompt.
You can generate that image in freepik.com.
Or the unwise.
Or just want to have a good time.
(12:24):
You couple this edtech tool with freepik.com, and you could have an afternoon.
I wonder if I asked it to take my conversation from this quiz tool and turn it into an image
what it would look like.
I'm not going to do that.
Josh, what are you going to do with this?
Like, where are you at with that?
So now that you know what you know, what are you doing?
(12:44):
We had a lot of conversations.
I ran between my buildings this afternoon, talked with a couple different teachers, administrators.
We're 15 days from the end of the school year.
If I yanked out a flashcard tool right now, I think there'd be pitchforks and lanterns
coming after me.
And I get it.
And like I told a principal and one of my central office staff, realistically, this
(13:09):
isn't my call.
I will flip the switch of whatever is decided, but there needs to be a conversation about
it had.
Because I feel like when rational people have that conversation, you're going to come to
an agreement that this likely is not appropriate to be in a school setting.
But the question is, do we really do that 15 days before the end of the school year?
(13:30):
I really don't.
I think that answer is no.
I think this will be a move that is done after the end of the school year before the start
of the next school year.
So yeah, it'll be a shift.
Because I know I have a number of teachers that rely on this specific tool.
There are other tools.
And I just kept throwing out there today, I'm like, look, we have Notebook LM.
(13:51):
It can generate flashcards and questions the same way.
So I don't know.
I don't know.
I think I know where this is going to land, but I don't know.
You're so close to the school year finish line.
Yeah.
What you're saying makes total sense.
Yeah.
And I think we probably blocked just in the barely have a pocket.
Like when we blocked it, I got some tickets that day and, you know, the next couple of
(14:13):
days people that have been using that.
Our answer was we have another district supported tool.
Sure.
That like literally pays for right.
Like this is a great example.
Why go use that thing instead?
Because this, this is a free tool.
It's not like teachers have a great, they don't get like big glimpses into what the
kids are doing with the one that we're talking about.
(14:34):
This is just kids sign up from what I understand and they're using it.
They're making flashcards and stuff, but it's not like the teacher gets to look at every
flashcard that gets generated and know that it's good to go.
I think teachers can create like a S a set of questions and then share that set and okay.
Like I get it.
You can do the same thing with notebook LM and Google classroom.
(14:55):
So I think we're going to have to push a little bit harder on that.
So you're going to let the quiz tool stay for a little while and then make a decision
over the summer.
See what I did there.
I did see what you did there.
It took me a second, but I got you, Mark, I got you.
Let us move on.
Yeah.
(15:16):
You want to hit another sponsor?
Oh, sure I do.
Check out PowerGistics, PowerGistics.com.
So they do great charging stations.
They say, and I would believe this, I've checked out their stations.
They can end up saving you money because you might have some decrease in damages to Chromebooks,
especially at the elementary level with how their charging stations are designed.
More time for learning because you can put these devices up easier because of how their
(15:39):
charging stations are designed.
You got like a day left, but on K2L Tech Pro, we were running a deal on PowerGistics and
you can get on there.
They'll even let you not have to worry about paying until July 1.
So check out PowerGistics, PowerGistics.com or get on K2L Tech Pro to see their offerings
with a discount.
Mark, why don't you bring us up to speed in the news and take us out of this conversation?
(16:02):
All right.
So let's go down to Arkansas.
This is something that is very timely because Chris and I, right before the show, we were
talking about Chris's building project, building a whole new school.
And I've seen this happen in multiple other school districts where when there's a major
construction project, the attackers will start targeting the business compromise email or
(16:24):
the phishing email.
And unfortunately, Pine Bluff School District in Arkansas fell victim to a business email
compromise related to a construction project, losing $3.2 million to essentially a wire
transfer to the wrong address.
So the attackers got in, inserted themselves into an email conversation, injected some
(16:47):
incorrect information into the conversation.
And the next thing you know, that $3.2 million payment went to the wrong account.
The superintendent did talk about, this happened in December, but the superintendent is just
talking about it now, and they have been working with the FBI and they are optimistic
that they'll be able to regain or recoup some of the funds, if not all of the funds.
But it is a big lesson that the attackers are really, really looking after school districts
(17:12):
or looking for school districts that have construction projects going on.
They're going after the construction companies themselves because they know that those companies
are very vulnerable to these types of attacks and they're also going for your procurement
staff.
Just because you have MFA or just because you've got email security put in place doesn't
mean that you are safe.
(17:33):
You just need to make sure that your staff, your procurement staff, your business office
has protocols in place for changing direct deposits, for changing wire transfer accounts
so that they are absolutely positively sure that these accounts are, or these changes
are legitimate.
Yeah.
We talked about another story about this not long ago where, what was it Chris, the accounts
(17:58):
payable lady was being held responsible to recoup some of that cost?
We imagined two sweet ladies like we have and I think it was 50 grand that they were,
the school district didn't recover, right?
So they were basically going to get their wages garnished is what it sounded like.
Yeah.
Insanity.
Yeah.
Yeah.
(18:18):
It's a story to see, but when it comes to business email compromise and construction
projects, it's really where you see the biggest attacks and the biggest losses from school
districts.
And Pine Bluff in Arkansas unfortunately was the latest victim.
And that, we've had something similar.
We didn't have the incident and sent the money, but we received phishing emails that were
(18:38):
pretending to be the contractor that we have doing work on our campus.
And when that happened, that really drove home to my central office staff that school
districts are being watched.
They are, every article in the paper that talks about construction projects, every article
that talks about a school calendar, the bad guys are seeing and reading those articles
(19:03):
and tailoring their attacks based on the content that has been shared publicly.
So be really, really careful about the content that's publicly accessible.
Yeah.
And you think about that construction projects, those are the most public projects that get
put out.
You know, we want great pricing, we want great bids, and we want everyone to know this great
thing that we're doing.
(19:24):
So we're just telling the bad guys all the good stuff.
Yep.
Exactly.
And the local paper should do those stories.
Like it's a big thing.
Like we're, we're adding a huge gym.
That's big news for our, for our town.
Yeah.
And that's where, you know, we get back to that MythOS story about, oh, the next, the
next level of cyber attacks is going to be driven by AI.
(19:46):
So what?
Like we still have humans that are falling victim to these types of attacks and you're
losing $3.2 million because Sally in Accounts Payable made a mistake and didn't verify that
they needed to change their, their wiring address.
Well, on the good side, we've got some good friends at K126.
If you're not familiar with K126, please check out their website.
(20:09):
K126 stands for Security Information Exchange.
You'll be able to find all kinds of information about updated attacks and mitigation efforts.
They have what's called the K126 Security Essentials, which is a free resource for you
to see if you're a school district and looking to see what are the, what do I need to do
to secure my, my walls against the common cyber attacks, five or so domains.
(20:31):
Well, they just updated it with a rubric where you can actually see what are the specific
steps I need to do in order to meet this standard or this security essential.
And they also released a security assessment that you can take, answer a few very common
questions or very easy to answer questions.
And then at the end, it will give you an assessment of some of the things that you need to do.
(20:54):
So I highly recommend this.
We have talked a lot about the K126 Security Essentials.
This rubric is really what makes it actionable and takes it to the next level.
So I highly recommend you go to the K126, click on the Essentials tab and download this
for free.
Yeah, they, they put out some good stuff.
(21:15):
Chris, you were at the conference in Albuquerque this year.
Mark, you've gone in the past.
Doug and his crew do really, really good work and they're a very loud voice for K12 districts
across the country when it comes to legislative updates and lobbying and D.C. and trying to
make, help our legislators make informed decisions.
(21:37):
So they do a lot of work.
Well, and speaking of our legislators making informed decisions, our last article comes
from the Department of Education.
Is that still around?
The Department of Education has finalized their grant priorities as well as their budget
(22:00):
proposal.
Linda McMahon has been in front of the Senate and the House this week talking about their
budget and answering questions in front of our legislatures.
Two interesting things.
They have made some, obviously some changes in their budget.
They are reducing the overall budget, but they are investing in special education.
The big thing here though is that they are pushing a lot of funds down to the state through
(22:22):
what's called MEGA grants.
Now MEGA meaning, yeah, that's the size of these grants, but MEGA now stands for Make
Education Great Again.
And in that, they're finalizing their priorities and one of them being AI literacy.
So we're going to start to see a whole lot of funding and grants geared towards AI literacy
in K12 schools.
(22:44):
A lot of this is around AI literacy integration, educator PD, computer science and artificial
intelligence coursework for high school students, and then most importantly, safety and privacy
guardrails.
So I'm eager to see where this goes.
I think there is quite a lot of attention on the finances of it all right now, but I
(23:05):
think once the finance and the budget starts to settle, we'll start to see more and more
federal grants geared towards AI.
What that means and what that means for school districts is yet to be determined, but it's
something to keep a very close eye on in the upcoming budget.
And pairs well with our conversation that we started the show with.
(23:26):
Let's expand that.
So my wrestling connection, Melinda McMahon, she's the head of the DOE.
She's also married to Vince McMahon, Jr., who is in the new Hulk Hogan documentary on
Netflix.
Mark, have you watched this?
No.
Were you?
(23:46):
Are you not a Hulk Hogan fan?
Why aren't you asking me if I watched?
Okay, Chris, did you watch?
No.
Are you not a Hulkster either?
No.
No.
You, too.
I guess I'm older.
Okay, so as the lone wrestling fan in the room, what would you like to tell us about
(24:06):
on the Hulk Hogan documentary that's related to the education department's funding?
I just assumed that you, too, were Hulk Hogan fans.
I'll stop.
If you're a Hulk Hogan fan, if you grew up in the 80s like me and you enjoyed Hulk Hogan
wrestling, you need to watch it on Netflix.
It's great.
I did watch the Vince McMahon documentary.
(24:28):
I don't know if it's...
I haven't watched that one.
I haven't watched that one.
All right.
Chris, another sponsor?
Oh, hey.
Sure.
A new sponsor to the KTOL Tech Talk podcast is SysCloud.
They can back up your Google Workspace and your Office 365 data so that you have a second
copy in case you have any issues.
They can help you recover fast from ransomware, scan your stuff for FERPA, make sure IEP stuff
(24:52):
is in check as it should be or not should be, PCI SIP or RISC, all that kind of stuff.
They can monitor what you have going on, maybe help you with your storage costs depending
upon what you're doing, help you with your legal holds and more.
Check out SysCloud at syscloud.com.
Or if your tech director deletes a bunch of accounts and those documents were needed.
Get you some SysCloud.
(25:13):
Chris, main topic for tonight.
This came up in discussion in one of the forums that you and I are in today.
Do you want to introduce this?
Yeah.
There was also a chat room that we're in.
There was some discussion about encrypted, more secure emails being sent.
That's been an uptick in our area and that's a great thing.
(25:33):
We think that's awesome when we're going to be more secure.
But some schools have had some issues with their insurance company, correct Josh?
Yeah.
School wants to contact their insurance company.
Insurance company has decided that they are not going to go through that process to click
through the things to see that secure email.
They're preferring other methods of communication.
(25:57):
Chat was just kind of lit up on if this becomes this trend of a thing where organizations
are refusing to communicate for whatever reasons on that more secure transmission, if you will,
that we have some issues.
I think it was talked about on K12 Tech Pro as well to some degree of how parents are
going to access documents that are secure and how that's going to play out too.
(26:22):
A couple layers to that, I think.
Yeah, and I think the duplicity with the insurance company conversation was it is a very large
player in the education insurance realm that to be covered under their cyber insurance
policy, one of the things they like to see is encrypted email.
(26:42):
But they won't allow more or less the second factor authentication to come through to open
up the encrypted message.
You get a code delivered to your mail.
They won't allow that second message to come through and be delivered to the recipient.
So this district that we were talking to today had to end up faxing information to the insurance
(27:03):
company because they wouldn't allow that email to come through.
So a little, I guess, both sides of your mouth type conversation.
Yeah.
So here's my first question.
When we talk about secure email, what are we talking about?
Is sending the email from Google to Google?
I mean, I think that's what I want to define first, right?
What is secure email?
Good point.
(27:23):
So in this conversation, it is a portal-based email delivery method, meaning if I send an
email out with a key phrase in the subject, my outbound mail is going through more or
less a filter, a third-party provider, and it looks for the key word in the subject.
(27:45):
And if that email has that, rather than delivering that message over regular SMTP traffic, it
puts it behind an encrypted portal that the recipient needs to log into to read and reply
to the message.
So it is not an SMTP-delivered message.
It is behind a secured portal.
(28:06):
That's the definition that I'm operating off of.
Right.
So I think there was a lot of questions around encrypted email and unencrypted email, TLS,
all that kind of stuff.
But I think what we're saying here is the message might get sent via email, but the
actual content is behind a portal that you would need to authenticate into.
So here's my question to you.
(28:28):
How many school districts have that ability in the first place, and is this something
that is growing in popularity?
Yeah.
In the last six, eight months, it has grown in popularity in our region significantly.
And I will just say, Chris, can we say thanks to NTP, because one of the products they provide
(28:48):
or they sell is Avanon, and that is inbound mail filtering anti-phishing tool.
But when you buy that product, one of the things that is included is an encrypted email
portal.
So a number of districts already had Avanon and didn't realize it included the encrypted
mail piece.
So it's one of those things that rather than pay for another encrypted mail service where
(29:13):
you can only afford to license 20 or so users, 10 or so users, because it's an expensive
product, this anti-phishing tool, I can cover all of my users for the same price.
So that has significantly gotten a foothold in our area here recently.
We had a lot of conversations around, do we turn on confidential mode in Gmail, which
(29:36):
is kind of the same thing, right, where you are sending a message, but you need to authenticate
through a code.
But we had a lot of conversations around, like, is this even something that our teachers
and staff would use?
At the end of the day, we did turn it on, allow people to use it, and tried to encourage
it.
But it was very hard to get people to move from sending in just a standard email to something
(29:57):
like confidential mode.
Aren't there some caveats to that, too?
Like it only works in certain scenarios.
I'd have to go back and read the Google Workspace article on it again, because we almost went
down that path because, you know, it's there.
But there were some use cases that didn't quite fall into the parameters, and I can't
(30:18):
remember what that was.
So here's my next question.
When do you use encrypted messaging, and when do you use encrypted email versus just send
something via a standard email?
Are you using this for internal messaging or external only?
And if so, are you doing this with parents to send them confidential documents?
(30:40):
We don't do it on internal mail, because it's living in that Google ecosystem.
Transportation is encrypted there.
We have DLP rules, as well as the keyword rule that sniff every outbound message.
And if it has any sort of these certain DLP phrases, I think there's like 50, that are
(31:04):
related to IEP information, that type of stuff, if it gets flagged for DLP flag, that message
is automatically encrypted before it's sent to the recipient.
So yes, 504 notifications or IEP meeting notifications, recap messages or recap emails, stuff like
that, they are getting flagged and encrypted by this tool automatically.
(31:27):
I think, and I actually had one this week, the problem, and I'll put that into quotation
marks, right, because we're talking about something more secure, but there's a lot of
different platforms that can be used for this.
So we've seen this uptick in my neighbor or whatever agency my school district is working
with, they're sending us an email that is of a different product than what we might
(31:51):
be used to.
And in a good way, a lot of times the tech department's getting contacted because our
user is on a higher alert, because this thing looks weird, like it's this thing that they're
clicking on, they can't see the email, it's coming from a different thing that they weren't
expecting, so they're doing the correct thing to report it.
(32:11):
But it's sometimes hard to like quick look at that and know like, oh, this is this proper
thing that I should be signing into, I should be making this thing send me a code or however
that is that that email is going to be opened up.
I think that's the kind of the problem, the friction, the tension point with upping our
security game with email, it changes a lot.
(32:32):
I have a friend that their school district implemented a solution like this, I guess
supposedly the tech department didn't do a whole lot of communication that it was changing
and being implemented.
So it was doing the thing where all new emails, if you hadn't received an email from the outside
from a particular person that you were getting screened all those emails more, and they like
(32:53):
do more validations.
And again, that's a great thing.
But just cause some tension with faculty, staff and how this stuff plays out, even though
it's more secure.
Interesting.
So my question to you, Josh is, you know, we're, I don't want to say this is the wrong
approach to encrypt emails to parents and to send to use this encrypted services.
But we're, whoa, we're going from putting report cards and sensitive IEP documents in
(33:18):
a backpack, putting on the back of a kid and putting them in the bus and thinking that
that's the safest way.
And so it feels like we're going from, you know, from zero to a hundred overnight in
doing this.
I wonder if there's a school district that does not have an encrypted service, they can't,
you know, afford it at this point, if there's a better way or a better practice to get into
(33:41):
to be able to email documentation in a safe manner.
If you have any recommendations for that.
I really don't know because it's, you know, it's one of those things that heaven forbid
there's a email account compromise on either side, on the teacher side or the parent side.
If the parent's email account's compromised and there's IEP information or diagnosed or
(34:02):
discipline information in that account, and now the threat actor has that information,
who's at fault?
Is the district at fault for sending that to the parent?
Parent culpable for having a weak password?
So is the question going to get asked in that process of why was this sent over email?
(34:22):
I don't know what the answer to that is.
And I'll be the first to say it's extremely difficult to break habits if your teachers
are used to sending that type of communication, no fault of theirs.
But if you're only operating off of a key phrase to encrypt a message, it's really,
really hard to establish that habit of, oh yeah, I got to put secure in the subject so
(34:45):
that it gets encrypted because I'm sending a discipline referral or I'm sending an IEP
recap message or, you know, something along those lines.
I don't know what the appropriate or right best answer is really.
I know I typically do have the best answers.
In the vein of the infinite campus breach, our SIS person was trying a similar thing
(35:08):
to what we had talked about.
If you're going to identify a student by their person ID or the most SIS ID, you know, the
state ID, whatever.
So she was trying to communicate a little differently than maybe previous practice via
email internally where she wasn't, you know, doing initials or doing a name.
I was trying to talk to a person in an office based upon a number and it was explained to
(35:32):
me that it was a pretty funny email exchange because we were then testing that office's
ability to look that person up by a number as opposed to a name.
And again, that whole thing we've talked about before where you're trying to be more secure
and now you've lost just like the, this is the, if you just said it was little Johnny
and just said it, this problem would be fixed already.
(35:54):
But because we were trying to do things more secure, there was a back and forth email exchange
for a while.
So again, we're getting to the spot where we need to be more secure.
We need to do more.
But like you're saying, Mark, what's the sweet spot that's just going to make sense that
a parent can take on or a grandma can take on if a, if a grandma can't click through
a secure encrypted email well on report card time, she's probably not checking the report
(36:16):
card anymore.
Well, to report, to speak to report cards, we don't even send them.
They're only available in our parent portal.
So if you have a parent that struggles or doesn't have a parent portal account, how
are they getting that?
Yeah.
Well, I think that's, that's a great point, right?
So when you think about how you get medical information from your doctor, they're going
to send you an email that says you have a new message in the portal and you log into
(36:39):
your medical portal to get it.
You know, there is, there's something to say about, can we just direct parents to say,
you can find your child's information, their report card in the family portal of the SIS.
And most districts have that by now.
But then you run the challenge of, well, what about a parent who is not going to log
in the portal or just needs the IEP?
They're on the move.
So I think, I think there's definitely a healthy balance.
(37:00):
I would say for me, the biggest thing that we need to do in K-12 is start by minimizing
the amount of information that we do send over email and minimizing the amount of times
that we send somebody an email out of, or with data in an email out of convenience,
rather than just saying you can find this record in the SIS.
I do think parents, it's a whole different ball game because our job is to engage parents
(37:22):
and get them involved.
And sometimes that means making the information as easy as possible.
But I would say start with internal staff and minimizing the amount of internal staff
communications that involve student data over email, whether or not it's encrypted or not,
you're making a copy of that document.
You're making a copy of that file by putting it in email.
(37:43):
So I feel like you're saying, make a phone call, return to in-person meetings and give
them the piece of paper.
Is that what you're saying?
Always.
Yeah.
I mean, less email is best for everybody.
But...
Well, hey, that goes hand in hand with screen time limits.
We're going to put screen time limits on staff too then.
I mean, might as well.
I'm on board with that.
If I get a limit in the number of emails that I have to get every day, I'm happy.
(38:09):
Would your spouse, teacher agree with that, that she needs a restriction in screen time?
I cannot get my spouse to remember to take her cell phone with her.
She is the opposite of somebody who's addicted to a cell phone.
She is addicted to leaving her cell phone behind.
So...
Nice.
Yeah.
Yeah.
(38:29):
Hey, I do have a funny story to share that was today that did not impact all my faculty
staff, but many, talking about reducing screen time.
This is how you do it.
I implemented...
So we have laptops everywhere.
And we have a hard time with updates sometimes with getting, in particular, the teacher demographic
(38:52):
to do a reboot occasionally.
No.
No.
They'll just shut the lid.
And I don't eat my own dog food when I complain about this too.
So I did a thing that the last day of the month, we are going to force a reboot.
And I'm waiting until end of day.
I think I put it at...
It was after 2.30, okay?
(39:14):
That is a pretty good idea if you choose the right time zone.
So I accidentally put that bad boy at UTC.
So around noon today, we had many, many laptops rebooting without prompt.
Really good time.
Shout out new technician, Alex.
(39:35):
He actually discovered the time zone setting that I did.
Smart.
Oh.
Reducing screen time.
That's what I'm all about.
Hey.
It's the trend.
I did get a text from her principal.
She was in the middle of doing some stuff.
I don't believe she had the ability to save quickly.
And there is a difference, if you don't know.
UTC and any other time zone, there are differences.
Huge difference for us.
(39:55):
It's like six hours.
Yes.
I would have loved it if Chris was on like a Zoom meeting with a whole bunch of people
and then just boxes start disappearing as people's computers reboot.
Why am I the only one here?
And that's because I don't apply the settings to myself, you know?
Right.
Exactly.
Yes.
I figured.
Yes.
Chris's computer has been on for 200 days.
(40:16):
As for you, you've been on for an hour.
What happened?
I don't know.
Anyway.
It's probably a good thing you don't work at the same district as your wife because
I feel like those policies, like that would be, that would, that would cause some complaints.
Yeah.
Yeah.
It's good.
We don't work together anymore.
Well, any, any other sponsors tonight, Chris?
(40:37):
Yeah, for sure.
Extreme Networks.
Email Dominic Mayer.
That's dmayer at extremenetworks.com.
It's summer.
A great time for swapping out your networking.
So check out Extreme Networks.
We've used Extreme for years now, have had great luck.
Our friend Dominic is a great guy, known Dominic for many, many years, dmayer at extremenetworks.com.
Any closing thoughts or closing stories, gentlemen?
(40:59):
No, sir.
All right.
Chris, Mark?
I got nothing.
All right.
Chris, we got any trips planned?
Hayden is in Nebraska as we speak, hanging out.
Are they called Nebraskians?
Nebraskans, right?
Nebraskans.
And then our pal, Nathan with Cato Tech Pro, he's going up to the Actum conference.
(41:22):
That's in the next week or so.
That's May 11th.
And then fast forward, boys will be in Georgia in July, July 6th through the 10th.
After that, July 19th through the 21st is Midwest Tech Talk.
Looking forward to those things.
So that was episode 262.
If you have any comments about that quiz that lets people use generative AI, shoot us an
(41:47):
email, k12techtalk at gmail.com.
If you've got a conference you want us to come speak at, let us know.
Send us your feelings on the Hulk Hogan documentary if you watched it.
I'm really enjoying it.
If no other thoughts, we will close for this week.
We will see you next week.
Thanks for listening.
(42:17):
The views and opinions expressed on the K-12 Tech Talk podcast are the personal opinions
of Josh, Chris, and Mark, and do not represent the views or opinions of our sponsors or other
organizations that we're affiliated with.
The material and information presented here is for general information and entertainment
purposes only.
Thanks for listening, and we'll see you next week.
Popular Podcasts
Hey Jonas!
Hey Jonas! The official Jonas Brothers podcast. Hosted by Kevin, Joe, and Nick Jonas. It’s the Jonas Brothers you know... musicians, actors, and well, yes, brothers. Now, they’re sharing another side of themselves in the playful, intimate, and irreverent way only they can. Spend time with the Jonas Brothers here and stay a little bit longer for deep conversations like never before.
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by Audiochuck Media Company.
Betrayal Weekly
Betrayal Weekly is back for a new season. Every Thursday, Betrayal Weekly shares first-hand accounts of broken trust, shocking deceptions, and the trail of destruction they leave behind. Hosted by Andrea Gunning, this weekly ongoing series digs into real-life stories of betrayal and the aftermath. From stories of double lives to dark discoveries, these are cautionary tales and accounts of resilience against all odds. From the producers of the critically acclaimed Betrayal series, Betrayal Weekly drops new episodes every Thursday. If you would like to share your story, you can reach out to the Betrayal Team by emailing them at betrayalpod@gmail.com and follow us on Instagram at @betrayalpod and @glasspodcasts. Please join our Substack for additional exclusive content, curated book recommendations, and community discussions. Sign up FREE by clicking this link Beyond Betrayal Substack. Join our community dedicated to truth, resilience, and healing. Your voice matters! Be a part of our Betrayal journey on Substack.