FCC wants to improve cyber protections for schools, libraries

Ransomware attacks and cybersecurity threats against schools are multiplying and have led to some dramatic consequences.

Last year, the Los Angeles Unified School District was hit by a ransomware attack that resulted in hackers posting 500 gigabytes of stolen data online, after the district’s superintendent refused to pay the ransom. The attack compromised about 2,000 student assessment records and other data. The district has remained mostly quiet on the attack as it continues to investigate the cause.

That hack of the nation’s second largest public school district is indicative of a wider trend, where schools are among the leading targets for cyber gangs and ransomware attacks. Global research from British cybersecurity company Sophos found that 80% of schools suffered ransomware attacks in 2022, up from 56% in 2021. The Sophos report said the findings show that ransomware is “arguably the biggest cyber risk facing education providers today.”

The spate of attacks has alarmed the federal government, prompting the Federal Communications Commission last week to unveil a pilot program that it hopes will help K-12 schools better protect themselves and their broadband internet networks from cyber threats.

The three-year, $200 million Schools and Libraries Cybersecurity Pilot Program will collect data and information from participating schools in an effort to learn more about which cybersecurity and firewall services will have the biggest impact in helping schools and libraries protect themselves, while ensuring the most efficient use of program dollars. The initiative also will provide funding to eligible schools and libraries to defray the costs of those cyber and firewall services to protect their networks and data.

Advocates welcomed the FCC plan but said given the escalating cyber threats that schools and libraries face, the timeline needs to be much shorter to allow institutions to harden their defenses more quickly. John Windhausen, executive director of the Schools, Health & Libraries Broadband Coalition, said in a statement that the initiative is a “crucial step forward,” but the three-year timeline “does not match the urgent need for cybersecurity protections.”

“In the past two years, dozens of schools and libraries have fallen victim to cybercriminals, endangering student information and compromising the integrity of these crucial community resources,” Windhausen continued. “We want to ensure the program is swift and efficient in fending off such attacks. We will encourage the FCC to shorten the pilot to a one-year trial to provide schools and libraries with the resources they need as quickly as possible.”

The FCC’s effort is the latest in a series of actions by the federal government. The Cybersecurity and Infrastructure Security Agency issued a joint advisory on the subject in 2020. President Joe Biden announced new actions to combat the cyber threat in August, with the Department of Education, Federal Bureau of Investigation and National Guard Bureau among the agencies to outline the steps they want to take to get the problem under control.

Cyberattacks on schools are getting increased attention at the state level as well. Last week, the chief information officer for Minneapolis Public Schools, which experienced a ransomware attack in February, testified before state lawmakers about the need for a statewide platform for flagging cybersecurity concerns and sharing best practices, along with more state funding. 

The consequences for students can be enormous. A Government Accountability Office report last year found that learning loss from cyberattacks can range from three days to three weeks, and it can take up to nine months to recover that learning.

The FCC pilot will be established under the agency’s Universal Service Fund program, which helps subsidize telecommunications services with a view to promoting universal access.

The program would be separate from the FCC’s E-Rate program, which makes telecommunications and information services more affordable for schools and libraries. FCC officials said that distinction would “ensure gains in enhanced cybersecurity don’t come at a cost of undermining E-Rate’s success in connecting schools and libraries, and promoting digital equity.”

The effort is part of FCC Chair Jessica Rosenworcel’s Learn Without Limits initiative, which looks to ensure connectivity so everyone can access high-speed internet and close the learning gap that was exacerbated during the COVID-19 pandemic. Related initiatives have included supporting the installation of Wi-Fi on school buses, helping libraries in Tribal areas better access E-Rate funding, and allowing schools and libraries to apply for E-Rate funding to promote off-site Wi-Fi hotspots and wireless internet.

Rosenworcel said in a statement the pilot will complement existing efforts from CISA, the departments of Homeland Security and Education, and others, but that the threat of ransomware attacks is “too big and complex for one agency to handle alone.”

“Ultimately,” she continued, “we want to learn from this effort, identify how to get the balance right, and provide our federal, state and local government partners with actionable data about the most effective and coordinated way to address this growing problem.”