It was supposed to be operational six months ago, part of Florida’s wide-ranging effort to prevent the next school shooting: a sprawling new database that would merge people’s social media posts with millions of records on individuals who have been bullied, placed in foster care, committed a crime, or even been mentioned in unverified tips made to law enforcement.
The plan, however, has sputtered, an Education Week investigation found.
The two biggest reasons: bureaucratic delays, plus concerns over exactly how much sensitive information can legally be shared in the way lawmakers envisioned.
Documents obtained by Education Week via open-records requests show that over the past year, state agencies have discussed the possibility of sharing a breathtaking amount of data. That included more than 2.5 million records related to Floridians who received involuntary psychiatric examinations, records for over 9 million people placed in foster care, diagnosis and treatment records for substance abusers, unverified criminal reports of suspicious activity, reports on students who were bullied and harassed because of their race or sexual orientation, and more.
A data template provided by the Florida Department of Education in response to an open-records request suggests the scope of the database has since been narrowed, the result of worries that sharing some of those records might violate state and federal privacy laws. Officials from the department have not provided substantive responses to multiple requests over several weeks for information and clarification.
Nor have state education officials responded substantively to multiple requests to clarify the status of their effort to hire a company to monitor Floridians’ social media posts for possible threats. Earlier this year, the department scrapped and then restarted its bid process on the initiative, despite already being months behind a state-imposed deadline.
As the nation’s most aggressive attempt to date to expand digital surveillance in the name of school safety has run into hurdles, Republican Gov. Ron DeSantis has fumed. In February, he called the state’s halting progress “unacceptable,” part of an executive order demanding that the data repository be up and running by Aug. 1, before the start of the new school year.
Privacy advocates, however, say that kind of demand for immediate action, without a full consideration of the potentially harmful implications of such powerful surveillance tools, is what caused Florida’s troubles from the start.
“It was never a good idea to try to implement a database this big, in this time frame,” said Amelia Vance, the director of education privacy at the Future of Privacy Forum, a Washington think tank that has been closely tracking Florida’s response to the Parkland shooting. “The lack of forethought and consideration for what this will mean for individual children is really troubling.”
Widespread Data Collection
Education Week’s investigation found that across the country, social media and related monitoring services used by schools are generating vast torrents of information—some of which is alarming, but much of which is ambiguous, irrelevant, or ridiculous.
The Future of Privacy Forum is one of 40 organizations to sign on to a set of “principles for school safety, privacy, and equity” that warns of the dangers of such widespread data collection and surveillance in the name of school safety.
The concerns are exponentially more pronounced in Florida, thanks to an oft-overlooked provision of the Marjory Stoneman Douglas High School Public Safety Act, passed last year in the wake of the Parkland school shooting.
The law mandates that the state departments of education and law enforcement coordinate to develop a “centralized integrated data repository” that provides access to “timely, complete, and accurate information” from a variety of state agencies, plus social media.
To figure out what data should be included, the state education department surveyed more than a half-dozen Florida agencies, as well as a few school districts, according to documents obtained by Education Week.
The department outlined scenarios it said might indicate a potential school shooter, despite the lack of clarity in the field as to whether any such profile can be considered reliable. In a request sent to multiple state agencies, the department said it wanted to know about any data that might show feelings of anger and persecution; a desire for revenge; a history of substance abuse, violence, or mental illness; school disciplinary problems; and access to weapons. The agencies were asked to describe the records in their possession that might help identify such potential warning signs, as well as any legal barriers to sharing that information.
The scope of the data discussed in the responses from state agencies was eyebrow-raising:
- The Florida Department of Law Enforcement cited numerous relevant databases it administers, maintains, or has access to. One of them, known as InSite, is “meant to be the state’s criminal intelligence information sharing platform” and includes suspicious activity reports, tips, and other information that needs to be verified before law enforcement agencies can rely upon it.
- The state’s child welfare department described records covering 9 million people since 2004, including foster-care placement information and data collected by child protective services investigators. The information could be shared into the data repository, the department wrote, so long as the only other agencies involved were the departments of education, juvenile justice, and law enforcement.
- Florida’s Baker Act Reporting Center said it had more than 2.5 million records of involuntary psychiatric examinations done since 2000. It was also generating data on petitions and orders for involuntary psychiatric placements. But HIPAA, the nation’s main health-information privacy law, likely precludes release of such information, the center wrote.
- The state Department of Children & Families said it had more than 5.6 million records on 3.3 million distinct clients, covering “substance abuse and mental health outcome, demographic, and service data,” as well as client treatment records. HIPAA would likely restrict sharing, the department wrote, as would state statute—possibly unless the Stoneman Douglas Public Safety Act was amended.
- Florida’s Department of Juvenile Justice sounded an optimistic note about its ability to share information on the 422,000 youth in its database, including details of their offenses committed and supervision received.
- The Florida Department of Education likewise cited a wide range of potential data: Students’ course schedules. Their participation in scholarship and dropout-prevention programs. Whether they’ve ever been homeless. Their immunization status. Possibly the Individualized Education Plans of students in special education, and any history of restraint and seclusion. Whether a student had ever been bullied or harassed based on their protected status, such as disability, race, or religion.
- And a handful of school districts responded with a wide range of information that might be relevant, including information on student health services, disciplinary histories, and survey responses. State and federal data-privacy laws could, however, be a barrier to sharing much of that information, the districts wrote.
Critics expressed alarm at the state’s approach, saying it appeared driven by narrow concern for what was legal, with little apparent consideration for what was appropriate and ethical.
“It sounds like a fishing expedition for information about Floridians,” said Rachel Levinson-Waldman, a lawyer with the liberty and national security program at the Brennan Center for Justice at the New York University law school.
Far-Reaching Approach
Officials from the state education department did not respond substantively to requests for an interview or more detailed information.
A “data template” spreadsheet, dated July 30, 2018, and provided by the education department, suggests that officials settled on a somewhat more limited range of data to populate the state’s initial data repository.
Among the information outlined in the template:
- Data from the state education department on a wide range of behavioral and disciplinary incidents, including gang involvement, alcohol or drug possession, physical attacks, sexual assaults, and vandalism.
- Information from the state education department on students identified as victims of bullying and harassment based on their protected status.
- A wide range of criminal history information, including the InSite activity reports for which law enforcement requires further verification.
- Information from the Florida Department of Children and Families on individuals’ histories of foster care placement.
State officials proposed that the system would be accessible to each Florida school district’s threat assessment team. In order to make the effort legal under the federal Family Educational Rights and Privacy Act, or FERPA, the teams’ members would need to be designated as “school officials.”
Liberal use of the “school officials” exception to FERPA in a wide variety of other contexts has prompted criticism from privacy advocates. Earlier this year, U.S. Education Secretary Betsy DeVos and the federal education department sought to clarify the conditions that must be met in order for law-enforcement officials—including the school resource officers who are often part of districts’ threat assessment teams—to be classified in this way.
The current status of Florida’s effort to stand up its new centralized integrated data repository is unclear. State education officials did not provide more detailed information in response to multiple requests for clarification.
Experts who manage and study other such integrated data systems around the country have previously expressed concern about Florida’s far-reaching approach, telling Education Week last year that such systems should not be used for surveillance.
Privacy advocates also worry that data ostensibly collected for the purpose of helping children may now be used to monitor and punish them.
“This could deter people from reporting bullying, harassment, and substance abuse problems,” said Vance of the Future of Privacy Forum. “It undermines basic privacy principles, and it could undermine the trust that people need to have in government programs.”
Social Media Monitoring
Further complicating matters, all the state records identified for inclusion in Florida’s new data repository are required to be merged with information generated by monitoring social media statewide.
To date, though, Florida’s process for selecting a vendor to provide that service has been rife with problems.
In its “Intent to Negotiate” document, first released last August, the state education department said it wanted a service that could provide around-the-clock, real-time monitoring of sites including Twitter, Facebook, Instagram, YouTube, Google+, Vimeo, and Tumblr. The department also said it wanted the ability to target searches using specific keywords and geographic areas.
The purpose, state education officials wrote, was “to help school districts monitor threats of violence against students, employees, and schools,” as well as “signs of bullying, thoughts of suicide, and other issues regarding a student’s well-being.”
Eight companies submitted initial bids. One promised “real-time situational awareness” of active-shooter situations. Another touted its leadership team’s experience “serving the U.S. Government in intelligence gathering, active monitoring, analytics, and near-perfect actionable intelligence to keep our children and communities safe.”
The state education department announced Dec. 10 that it would award a contract worth an estimated $4.5 million over six years to a company called Abacode. Officials liked that the company was looking ahead to new threats on the horizon.
“Imagine if a malicious actor took over a school’s information page or cloned the school principal’s account and promulgated disinformation for the purpose of spreading panic or staging a physical attack,” Abacode wrote in its bid.
Less than two weeks after the award was announced, however, a company called Social Sentinel, which already claims hundreds of K-12 school districts as clients, (including 15 in Florida) protested the decision, in part because unclear language in the state education department’s initial invitation to negotiate led respondents to quote prices that were calculated in dramatically different ways.
The state responded by cancelling its award to Abacode and announcing its intent to rebid the project. Social Sentinel protested that, too. The urgency of preventing the next Parkland meant it should immediately get the state contract, the company argued, because it is “the national leader on social media monitoring for school safety” and was already in use by “hundreds of school districts in 30 states,” including 15 in Florida.
During an administrative hearing, a judge disagreed. The state education department’s decision to “cut its losses” was reasonable under the circumstances, Judge Robert E. Meale wrote. The move to rebid the contract could proceed.
State education officials did not respond to multiple requests to clarify the current status of the bid process.
