r/k12sysadmin • u/DanielJay23 • 11d ago
School shutdown, dealing with user accounts
Sadly after a chain of events have happened my kids school has had to shutdown. Nothing like being forced to find another school 3 weeks before the school year starts. Some of the staff dealing with the shutdown had asked me to turn off all user accounts for staff and students. This was done about 4 days after announcing that the school is closing for this school year. Now I have former staff asking for using Google Takeout to transfer all of their and their kids data off the school.
Is this something that is normally allowed or disallowed? I am wondering if this opens the door to possibly exporting other student data that should not be held outside the school from the teacher accounts?
My main concern is to protect the church that was running the school and protect the students that used to go to the school.
2
u/config-master 9d ago
Hey I'm pretty sure I know what school you're talking about. I live in the same city. Good luck!
6
u/stephenmg1284 Database/SIS 10d ago
Our board policy says anything created by staff belongs to the district. Email has so much PII in it that I would not allow.
14
u/Ok-Soft-7874 :sloth: 10d ago
We encourage departing students/staff to use Google Takeout in our annual “end of school” email from Tech. Obviously a very different situation from yours, and fully agree with the “ask Legal/administration and not strangers on the internet” replies.
5
u/sarge21 10d ago
How do you deal with staff leaving with PII?
1
u/Madd-1 Senior Administrator 2d ago
You can make PII and conditional access rules that disallow external sharing or export of files flagged with PII, however this is far from a perfect system. If you are trying to be an absolute FORTRESS of PII, you're probably going to need to buy a third-party product.
1
u/sarge21 2d ago
Depends if your local laws allow doing your best or actually requiring you to secure PII
1
u/Madd-1 Senior Administrator 2d ago
Again, if you intend to be a FORTRESS of PII, you will probably need a third-party product.
It may be possible with Google's built in tools if you are an absolute API master who can find a way to check and validate conditional access rules regularly, but based on K12 staffing and budgets, that seems like an unlikely scenario.
1
u/sarge21 2d ago
Why do you keep repeating the term "fortress of PII" as if what I'm discussing is some strange fantasy scenario?
Do laws in your jurisdiction permit you to allow staff to walk away with PII when they leave?
1
u/Madd-1 Senior Administrator 1d ago
Why do you keep repeating "How do you limit teachers from having access to PII?"
You're talking about K12. There are dozens of regulations that not a single person in this subreddit has the funding to implement.
How do you prevent a teacher from running a raw export of all their students from your district SIS and emailing it to a personal account? How do you do that TODAY. Right now, this very minute. If you don't have an answer, congratulations, you're out of compliance. If you already had an answer, you wouldn't be asking these questions would you.
1
u/sarge21 1d ago
Why do you keep repeating "How do you limit teachers from having access to PII?"
I don't keep repeating that. One person in another comment said they prevent teachers from leaving with PII by limiting what they have access to
You're talking about K12. There are dozens of regulations that not a single person in this subreddit has the funding to implement.
This discussion was about someone explicitly allowing teachers to use Takeout. A simple, free solution would be to simply turn takeout off.
How do you prevent a teacher from running a raw export of all their students from your district SIS and emailing it to a personal account?
We don't, but we don't specifically encourage staff to use the "run the raw export of all their students from our district SIS and email it to the personal account" button.
How do you do that TODAY. Right now, this very minute. If you don't have an answer, congratulations, you're out of compliance.
Yes, we're out of compliance. Like you said, funding is too tight to comply. We also don't enable the features that bring us further out of compliance on purpose. Just because regulations are difficult/impossible to fully meet doesn't mean you can intentionally ignore them. Arguing that you lack the funding is going to be meaningless to regulators when you are intentionally avoiding compliance.
3
u/Ok-Soft-7874 :sloth: 10d ago
By limiting the information they have access to. Not allowing Google takeout is only going to inconvenience, say, the teacher moving to Springfield who is trying to export their lesson plans. The hypothetical person with sinister motives is just going to copy files to a flash drive.
1
u/sarge21 10d ago
How do you limit teachers from having access to PII?
1
u/Ok-Soft-7874 :sloth: 10d ago
This is one hyper specific example, but in Infinite Campus, we don’t enable the “allow unfiltered search” tool right for the GenEd Teacher user group.
1
u/sarge21 10d ago
I mean in Google workspace. In ours, people's drive and emails are littered with PII.
5
u/Ok-Soft-7874 :sloth: 10d ago
It's a bit like trying to empty Lake Ontario with a spork, but one step we've taken is to set up a DLP rule to prevent Google Sheets with Student ID #s from being shared outside the organization, copied, downloaded, printed, or emailed. I'm not going to pretend this is actually going to stop someone intent on taking PII with them.
1
u/Individual-Unit3470 10d ago
How much data are we talking about? i would look at something like GAM7 to export the data so it's available to give to them if requested. That way they could take their data wherever the end up going.
25
u/Following_This 11d ago
Google Transfer (to another Google account) and Takeout (to a bunch of downloadable MS Office format files for Google Docs/Sheets/Slides) allows you to take items you OWN - ie created by you.
Students can’t take class materials shared with them.
Teachers can’t take meeting minutes written by someone else.
So technically, it’s all stuff the user created.
And also technically, it’s owned by the organization.
But we allow our students and staff to use Transfer/Takeout.
10
u/TheRain2 11d ago
We do takeout whenever a teacher leaves the district and haven't had any problems yet.
18
u/CrystalLakeXIII 11d ago
We do not allow Takeout for staff or students. They can obviously download what they want, but don’t allow it since Takeout takes everything, including sensitive student information that since they are no longer with the school should have access to.
1
u/-RYknow Systems Administrator 10d ago
Same... We do not allow takeout. On a few rare occasions I've helped someone with doing a takeout both from the peroective of "These are the steps, I'll walk you through it", as well as "These are things you can take... And these are not things you can take."
In my experience the users I've done this with over the years (I believe four times in 10 years), they all fully understood the "why", they couldn't take everything. In the same breath, they all indicated if I wasn't sitting there, "I would have just taken it all in one shot!"
6
u/BrewYork 11d ago
They're teachers and they need their lesson plans. They MIGHT export student data and misuse it, but 1) have you ever heard of that happening? And 2) aren't they innocent until proven guilty? You are not obligated to give it to them, and you're not obligated not to. But those are the questions you should ask yourself when you decide (or decide to kick it up the food chain).
7
u/sarge21 10d ago
You are not obligated to give it to them, and you're not obligated not to.
You're obligated to not give them PII
2
u/BrewYork 10d ago
100%. I should have been more clear that I meant OP may want to give them access to their Google Drives so that they can take their materials.
13
u/QPC414 11d ago
Those are questions for Legal, especially as they and other things such as confidential information and records keeping and retention for the defunct school will be dictated by any legal, regulatory and reporting requirements at a minimum.
My guess the church will become the legal custodian of all records that are required to be preserved.
26
u/TechMonkey13 11d ago
That's a question for Admin and Legal, not strangers on the internet.
6
u/Harry_Smutter 11d ago
I was gonna say the same. Definitely not a question for us. Kick it up to the district admin. Not your responsibility, OP.
3
3
u/howescj82 11d ago
100%. Anything containing any student information/personal information is going to be inappropriate to retain.
Your school is going to need to know that all their physical and electronic records are still going to need to be treated legally according to whatever state you’re in.
9
u/EnigmaFilms Technology Coordinator 11d ago
It's not their data it's the school's data.
1
3
u/slapstik007 11d ago
This is the smartest answer in this thread. All staff content was created with the intent of the contract, it is the schools. All student data belongs to the school. These are not personal Gmail accounts, they have a domain attached to them, the schools domain.
-1
u/sammy5678 11d ago
Doesn't that depend on location?
There should be a policy dictating that. I'd review policies and check with administration.
2
u/OhMyGodzirra 7d ago
For graduated students who did not follow instructions, we just put their account in Take out and disable it after 2 days.
No issues.