EdTech, Security Theater, and the Canvas Breach

And the costs of conflating better tech with better educational tools

Thomas Jefferson High School for Science and Technology. Source.

The Schoolhouse is a series from Education Progress featuring articles for and from teachers, parents, education officials, and others working in the education system.

---

I have loved EdTech for a long time.

And for a long time everything about it made my job easier. My love began slowly, though, starting with simple communications to students and parents, or sharing problem sets that students would complete on paper from their math textbooks. As the technology evolved, so did use of it: distributing PDFs, sharing lecture notes, accepting assignments, communicating even more with families, and giving students more ways to access materials.

I did not have to worry about printing allowances, or whether a student had a pencil, which are bigger concerns than many realize. As schools moved to 1:1 technology, computers became abundant. I could stop providing printed copies of my typed lectures. I could communicate with parents more easily. I could allow students to type instead of handwriting, which by the mid-2010s had become so atrocious that it could only be interpreted with the help of a cuneiform tablet.

Most of the time, tech was also something my students liked. With very, very few exceptions, most students preferred typing papers and essays to writing them out by hand. Students generally preferred typing notes, even though we now know that is often an inferior method of learning. Most students preferred being able to edit and revise their work. They preferred being able to turn something in at midnight if they had a basketball game that went until 10 PM.

But decreasing friction came at a cost. Today we are reckoning with a decade of having conflated technological progress with progress in education. It is easier to update our EdTech platforms than it is to improve learning outcomes, and technological development has become a metric all its own.

Technology Transfers

It’s hard to say how it could have gone differently, though. EdTech gave us — teachers and school admins — flexibility with deadlines. It let me personalize classroom and accommodation materials and made collection and distribution easier in almost every way. It was a lubricant in the wheels of education. For myself and for the hundreds of students I taught over the years, it made a lot of daily classroom work much less onerous.

Not only did I love it, but I was also an early adopter. I started with Weebly and classroom blogs, then began using Canvas/Instructure in 2012. I helped integrate EdTech into every aspect of classroom management and classroom practice, from using Microsoft Teams for video calling to early adoption of Google Classroom. I have done it all. And yet, even as I continue to use it for my classes this week, I also understand its limitations. I also understand what instructors give up when we move instruction online.

While I am the first to say I love EdTech, I am also the first to acknowledge that sometimes it really sucks. There are times when, over the past 15-plus years, it has failed. I have had to extend deadlines. I have had to rush to print things out because the Wi-Fi was down or a student system had crashed. There are times when tech does not do the job it promises to do, and times when using it makes you neither more knowledgeable nor more competent in your work.

As much as I am an early adopter of all things EdTech, I also — shockingly (to many) — paired that with a devoted use of notebooks and paper-based materials. I would have discussions online and still require students to take handwritten notes and submit problem sets, graphs, and illustrations drawn by hand, even when Word, Slides or Desmos might have provided me with something more visually interesting, technically polished, or easier to read. To this day I have not found a suitable technological alternative to a student taking handwritten lecture notes, or keeping notebooks of vocabulary, mathematics proofs, or market diagrams.

It is a paradox, then, that I land where I am today: increasingly convinced that we need to reconsider 1:1 EdTech in K-8 classrooms and return much of early technology use to a more intentional, lab-based model. I think there are real benefits to using technology in the classroom. But it has a major problem we need to consider more carefully moving forward: the problem of security theater.

Having managed EdTech admin accounts across Microsoft Teams, Instructure, GSuite, and other platforms, I know how much information we provide to EdTech companies: student names, ages, birthdays, ID numbers, email addresses, parent contacts, assignments, grades, accommodations, and messages. All of this goes into a black box system that only the technology advisor or administrator really sees and approves, often on behalf of every student opted into that system while every parent has little choice but to accept it. Public or private, across the country, this is now normal. But what happens when that data is breached?

We say it is unavoidable because we have to use EdTech. But is it really that unavoidable? I still enjoy EdTech, and I will continue to use it. But that does not mean that I believe we have to use it uncritically. Does it make certain parts of the job easier? Undoubtedly. Recent regulations for ADA accommodations for visual media and audio media used in the classroom make EdTech one of the greatest tools for inclusion. But I would also be a hypocrite if I did not also acknowledge that it also had a deleterious effect on student privacy. I do not think we can separate the benefits of EdTech from its harms. And one of its main harms is the commodification of student data and student profiles.

EdTech allows us to communicate with parents and stakeholders much more efficiently through a thin veneer of security. These platforms give the appearance of walls and barriers around student information. They tell us that communication is protected, that data are secure, that access is controlled, and that vendors are compliant. But this is a façade. The truth is actually far more complicated.

---

Taken from the Education Department’s Flickr.

Security Theater

Most EdTech companies claim to provide best-in-class security. But as administrators, we must rely on our technical advisors and on people more knowledgeable than us about how secure that information is. Most operate at a knowledge deficit. I devoted several years of my life to understanding cloud database structures, cloud data systems, multi-character key encryptions, and student information tagging, and while I have a much better understanding of what types of security EdTech platforms can provide, I also know just how much information most schools feel obliged to share with these platforms.

When I started using EdTech in my classroom there were no logins for students, no single sign-on, and no two-factor authentication. Student use of EdTech was often passive. Teachers used online blogs or personal pages to post materials for wide distribution. Students and parents could, if they wanted to, create their own accounts to access and participate in online discussions, coordinate material submission, or receive feedback, but accounts began anonymously in online systems and most of the coordination happened outside the digital world. Over time formalized systems were established to comply with FERPA as gradebooks and materials submissions moved online and became connected to unique student profiles.

Today, almost any tech-enabled tool requires the creation of a unique student avatar. That avatar is connected not only to individual students, but also parents, teachers, materials, assignments, and of course grades. Increasingly, these online learning systems are connected to student information systems, which also archive academic records, attendance records, discipline, and whatever other systems are connected across schools, districts, and state data collection systems. As schools have moved from being hubs for education to hubs for community services, our data systems additionally catalog vaccines opt-outs and immunization records, mental health appointments, social service referrals, health records, and other sensitive information housed in or coordinated through schools. While much of this is managed under HIPAA, anything shared from a HIPAA secure system willingly, but unknowledgeable, by parents goes into an SIS system or Cloud Platform that almost never maintains the same level of security.

I do not think most people understand what this landscape really looks like, or how it operates. Few grasp just how interconnected our school management systems have become, not just to each other but also to the numerous cloud platforms that schools and districts do not manage themselves. Most people, moreover, have no idea how much information schools are required to distribute across so many unique platforms including AWS, Azure, Box, Google Cloud, Dropbox, and so on. Families often have very little visibility into which privacy regime applies, which vendor holds the data, and what downstream integrations may touch it.

Clever was built to help manage the data coordination and login problem for districts, and it is used nationwide. But this is one example of a popular platform. There are many others managing, hosting, syncing, and transferring student data in the background. When we share and provide these student data profiles, we increase our exposure to bad actors. The issue is not just whether one database is encrypted. The issue is what happens when student identity, school records, assignments, messages, accommodations, grades, and third-party tools are all connected across systems.

What used to be securely stored in PDFs, PostgreSQL relational databases, and other encrypted storage systems is not suddenly insecure because of AI. Those systems can still be very secure when they are properly configured, access-controlled, and narrowly managed. The problem is that AI makes data exposure more consequential. Neural networks, transformers, and generative AI systems can now process images, scripts, text, tables, and scanned documents at speed. Their real power lies not simply in processing information, but in finding connections across information that once remained separate. This architecture is extraordinarily useful for science, research, and complex monitoring systems. But it also means that what we choose to collect, copy, sync, and retain is more vulnerable to reconstruction, linkage, and misuse than ever before.

We have built an education technology ecosystem where ease of access often depends on connecting more systems together. A student logs in once and reaches the LMS, email, documents, assignments, messages, third-party tools, assessment platforms, parent portals, and more. It all feels efficient, but every connection also expands the surface area of risk.

The Canvas Hack

Which brings us to last week, the ransomware hack of Canvas systems. Over 9,000 schools were impacted, and we still do not know the full scope of what was accessed or how exposure varied across institutions. But that uncertainty is itself part of the problem. The risk to any given school depends not only on whether it used Canvas, but on how deeply Canvas was integrated into its identity systems, messaging, student records, assignments, third-party tools, and student-facing communication systems. For some schools, the exposed information may have been relatively limited. For others, depending on how much information was shared with and routed through Canvas, the exposure may have been much broader. That is precisely the point. The danger is not just the platform. The danger is the degree of integration.

If this Canvas incident exposes anything, it is not that one login provider caused the breach, or that one type of school account was uniquely vulnerable. It exposes something broader: how deeply modern EdTech depends on linked identity systems, single sign-on, cloud platforms, browser-saved credentials, third-party integrations, and centralized student profiles. By allowing any company, system, or platform to manage student data at this scale, we give it more power than it deserves. And we engage in security theater.

We play-act that we are secure because the system looks professional, because the vendor has a compliance statement, because there is a login screen, because there is two-factor authentication, because the contract has been approved, or because someone in technology signed off on it. But vendor approval is not the same thing as safety. Single sign-on is not the same thing as safety. A privacy policy is not the same thing as safety. How did we let this become so ubiquitous in our education system?

It makes logging into everything easier. We can save passwords in our Chrome accounts and browsers. We can use Clever and other login systems to connect everything together. We can make a student’s digital school life seamless. But seamless is not always safe.

---

So where do we go from here?

Perhaps the problem of EdTech, laid bare for millions of students, teachers, administrators, and parents last week, is the wake-up call we needed. My suggestion today is simple: roll things back. Require EdTech only where and when it is actually needed. We need to look honestly at the value of EdTech in our schools, for students, and for the education ecosystem as a whole. Do endless EdTech subscriptions provide a real value-add for student learning? Do we need a 1:1 device program for every student at every level of instruction? Do we need every assignment, message, accommodation, assessment, and parent communication routed through third-party systems?

I am increasingly convinced that the answer, particularly at the K-8 level, is no. If we are serious about FERPA and COPPA, then we need to stop pretending that compliance is achieved because a vendor has a privacy policy, a district has approved a contract, or a parent clicked through a consent form they did not really understand. Compliance cannot be reduced to paperwork; it should mean minimizing unnecessary exposure in the first place.

For younger students especially, the default should not be full integration into an always-on EdTech ecosystem. The default should be to opt-out. Let’s bring back lab-based technology, limited-purpose tools, local storage where possible, paper-based alternatives, and far fewer student accounts connected across platforms. This does not mean no technology, but it does mean more technology with clear boundaries.

We need to care more about students’ realized learning, and we need to more intentionally ask which systems are essential in achieving that goal. Platforms that provide and extend access, accommodation, instruction, or communication — we can consider using those carefully. But many are not essential, and if one is not, we should cut ties with it.

In any case, what I have learned over the past five days is that the most meaningful technological revolution for schools may not be changes in security authentication, widespread use of AI, or the adoption of personalized learning platforms. It might just be refusing to collect, upload, connect, and retain data that schools did not need to hand over in the first place. Perhaps in doing so we can begin to reconstruct a model of education that works for the students in our classrooms, rather than one that quietly turns every child into a permanent digital profile.