Cognitive Security Architecture for Intelligent Tutoring Systems (2026) describes the heightened need to protect student information in an age of AI and Quantum Computing, the technical architecture to do so. and the decisions about what student profiles and capabilities need to remain in analog/paper format.
I agree, and I think the recommendations are important, especially the analog-only default for the highest-risk categories of student information.
But I also think we need to ask an even earlier question: why are we collecting, digitizing, linking, and retaining so much student data in the first place?
The Google-affiliated paper Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations https://arxiv.org/abs/2603.28846 was a wake-up call for me about how quickly we are moving toward a post-quantum security environment, and how many vulnerabilities may emerge in systems we currently treat as secure.
In this case, the call is coming from inside the house: Google is also one of the most embedded platforms in school technology ecosystems in the world.
A compliance-based model is not enough. A vendor-security model is not enough. A “click to consent” model is not enough.
For K-8 students especially, the standard should not be “can we secure it?” The standard should be “does this help children become better readers, writers, thinkers, mathematicians, scientists, neighbors, and citizens?”
If the answer is no, then the data should not be collected, digitized, linked, retained, or routed through a third-party platform at all. Better security cannot substitute for a clear educational purpose.
That is the paradigm shift I think schools need now: not better integration, but intentional disconnection.
Yes the paper was written partly because of the 2009 Google readiness deadline for Quantum, and also because of "store now, decrypt later".
Take a look at Table 2 in the paper, you'll see why we have to walk this fine line: we need longitudinal performance data about learning, so we have to decide what's worth digitizing., and what's too dangerous to do so.
That's all regardless of the pedagogy itself, of course.
Aaaanddd that's why we make these recommendations :-)
https://curriculumredesign.org/wp-content/uploads/Cognitive-Security-Architecture-for-Intelligent-Tutoring-Systems-CCR-Deniaga-Fadel.pdf
Cognitive Security Architecture for Intelligent Tutoring Systems (2026) describes the heightened need to protect student information in an age of AI and Quantum Computing, the technical architecture to do so. and the decisions about what student profiles and capabilities need to remain in analog/paper format.
I agree, and I think the recommendations are important, especially the analog-only default for the highest-risk categories of student information.
But I also think we need to ask an even earlier question: why are we collecting, digitizing, linking, and retaining so much student data in the first place?
The Google-affiliated paper Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations https://arxiv.org/abs/2603.28846 was a wake-up call for me about how quickly we are moving toward a post-quantum security environment, and how many vulnerabilities may emerge in systems we currently treat as secure.
In this case, the call is coming from inside the house: Google is also one of the most embedded platforms in school technology ecosystems in the world.
A compliance-based model is not enough. A vendor-security model is not enough. A “click to consent” model is not enough.
For K-8 students especially, the standard should not be “can we secure it?” The standard should be “does this help children become better readers, writers, thinkers, mathematicians, scientists, neighbors, and citizens?”
If the answer is no, then the data should not be collected, digitized, linked, retained, or routed through a third-party platform at all. Better security cannot substitute for a clear educational purpose.
That is the paradigm shift I think schools need now: not better integration, but intentional disconnection.
Yes the paper was written partly because of the 2009 Google readiness deadline for Quantum, and also because of "store now, decrypt later".
Take a look at Table 2 in the paper, you'll see why we have to walk this fine line: we need longitudinal performance data about learning, so we have to decide what's worth digitizing., and what's too dangerous to do so.
That's all regardless of the pedagogy itself, of course.