Oregon Department of Education risked breach of private student data, audits find
Parent Coalition for Student Privacy - http://www.studentprivacymatters.org/
Two separate audits found the Oregon Department of Education didn't do enough to ensure that its huge cache of data on more than 600,000 students remains private.
Hundreds of people in school districts and in state government have access to some or all of that data. That means keeping it safe is a daunting technological challenge.
A report by the U.S. Department of Education's Office of Inspector General found Oregon at risk of being unable to "prevent or detect unauthorized access and disclosure of personally identifiable information."
A state audit, made public Thursday, also found insufficient security measures to keep confidential student data confidential.
"The department does not provide an appropriate layered defense," auditors wrote.
Neither the state nor federal department issued a notice about the federal audit. The Oregon Department of Education provided it to The Oregonian/OregonLive in response to a public records request.
Oregon Department of Education officials say they have taken careful and technically advanced steps to protect data, and are constantly updating and upgrading those efforts.
Oregon student data in their possession has never been breached, said Susie Strangfield, the department's chief information officer.
But state and federal auditors both identified weaknesses in the steps and procedures the agency has used to ensure cyber security.
Federal auditors named several highly technical details; state auditors disclosed only general information, saying they listed precise problems in a confidential letter to state education department, to avoid flagging them for hackers.
The data doesn't include students' home addresses, health records or discipline Oregon Department of Education risked breach of private student data, audits find | OregonLive.com: