Schools could be better protected against cyber attacks if FCC approves changes pushed by 1100 districts

WJLA | By Lisa Fletcher | December 19, 2023

WASHINGTON (7News) — Across the country, schools are under attack, increasingly held hostage to ransomware and other vicious online assaults costing more than $10 billion a year in downtime alone.

The 7News I-Team discovered there is a giant pot of money, that could help schools defend themselves but the Federal Communications Commission (FCC) would have to act decisively.

“Let’s be clear: We need to be taking these cyber attacks on schools as seriously as we do physical attacks on critical infrastructure. Schools are the infrastructure of learning in America,” said US Secretary of Education, Miguel Cardona at a cybersecurity summit this fall, hosted by First Lady, Jill Biden.

In August, US Secretary of Education, Manuel Cardona joined First Lady Jill Biden to convene school administrators, educators and private sector companies to discuss best practices and new resources available to strengthen school cybersecurity. (Office of the US Secretary of Education)

From Prince George’s County, Md. to the Los Angeles Unified School District, cybercriminals are pummeling schools with ransomware and other attacks costing taxpayers billions, shutting down learning for sometimes weeks and jeopardizing the security of families and faculty.

“Schools and libraries have a treasure trove of private information that these cybercriminals are trying to access,” said John Windhausen, Executive Director of the non-profit Schools Health and Libraries Broadband Coalition, or SHLB. His organization is one of those leading the charge to protect schools now.

Contracts, tax forms, and passports, along with social security numbers, birth dates, and addresses for students, parents, and staff are up for grabs on poorly secured networks that are easily taken hostage.

This is why more than 1,100 school districts including in Virginia and Maryland, along with nearly two dozen groups, signed a letter asking the FCC to react now.

The US Government Accountability Office says the scale and number of cyber attacks increased during COVID-19, as more schools moved to remote learning and increased their reliance on IT services. (7News)

Recently, the FCC announced a three-year, $200 million trial to study how to best help schools secure themselves. Advocates for improved cybersecurity for schools said there’s a much quicker and more efficient way to help schools immediately protect themselves. The FCC collects $3 billion every year in fees from telecommunications companies to help schools build out their broadband networks. Some of that money could be used to help schools secure those networks right now, they said if the FCC agreed to make immediate adjustments to the framework for the use of those funds.

“We wish the FCC would move a lot faster,” said Windhausen.

Windhausen said waiting another three years gives criminals that much more time to exploit school districts and their students.

“The FCC will have to do a report to explain what happened over those three years. So that could add another year or two to the process. And in the meantime, schools and libraries are suffering increasing numbers of cyber attacks,” said Windhausen.

The FCC will be taking comments on E-Rate funds and their use for school cyber security through early next year. (7News)

According to the cybersecurity firm Emsisoft, nearly 2,000 schools in the U.S. were hit in 2022 — almost double the year prior — from 1,043 in 2021 to 1,981 in 2022.

And according to the cybersecurity firm, Sophos, schools are now the most targeted industry for cyber attacks, outpacing healthcare and government.

Windhausen said as the attacks continue to rise, without schools having access to the FCC E-Rate Funds, the cost to students and districts will extend far beyond the ransoms of cyber criminals.

“It’s not a matter of if a school or library gets attacked, it’s when. And so school systems are going to have to devote more resources and training to prevent these attacks in the future unless they receive more funding from the federal government,” said Windhausen.

We’re told the FCC will be considering a variety of proposals as stakeholders file comments early next year.

Based on a 1997 FCC definition, schools have access to E-Rate funds for “basic firewalls.” The problem is that “basic firewalls” no longer exist, making the money even for that, off limits. But Windhausen said some things could be done immediately. He said FCC Chairwoman Rosenworcel could immediately update the definition of “basic firewalls” to include advanced features and functions and that would give schools access — right now — to tools to help fight cyber attacks while the FCC mulls over longer-term options.