PSA: Possible Breach/Exposure of Student Information Affecting Students in Ulster County Boces Region

Screen Shot 2015-09-30 at 10.12.15 PM

An incident has come to my attention that all  parents Ulster County BOCES region should be aware of. There has been possible breach/exposure of student information by New Wave Technologies, a vendor providing web based technologies to teachers for use in schools. The story is developing. Please see below for what we know right now.

It has come to light that Ulster County BOCES shared private student data with a for profit company NewWay Technologies to develop “new data visualization tools” that would allow teachers to analyze student test scores on iPhones, tablets, and computers.

National renowned student data privacy advocate Leonie Haimson discovered that New Way Technology was using the names and data of Ulster County students in it’s promotional videos which were taken down on September 29th. Numerous screenshots reveal the names of real students from districts throughout Ulster County. Each name is associated with an id number, a test score, and a school/school district.

While it appears that the real student names have been assigned to fake school districts or districts other than the one they attend, it is unclear if the test scores and student IDs have been changed.

This egregious violation raises many questions- Why would Ulster Boces share private, personally identifiable student data with a for-profit company? How and where else has this data been shared? In 2014 Rondout Valley CSD purchased this technology which was created by a partnership between New Way Technologies and Ulster Boces Superintendent Charles Khoury.

According to a 2014 press release on the company’s website:

“Dr. Charles Khoury, District Superintendent of Ulster BOCES, partnered with NewWay Technologies to develop new data visualization tools, using modern analytic technology, to present student state assessment data in a clean, easy to use, simplified meaningful way on any device (PC, MAC, iPad or any mobile device). … About Ulster BOCES: Ulster BOCES serves 8 component districts, Ellenville, Highland, Kingston, New Paltz, Onteora, Rondout Valley, Saugerties, and Wallkill. “

The extent to which student information is being shared and whether they are using real student test score data along with the student names is not yet known.

More information will be released when it becomes available.


2 thoughts on “PSA: Possible Breach/Exposure of Student Information Affecting Students in Ulster County Boces Region

  1. Reblogged this on Schools of Thought Hudson Valley, NY and commented:



    NEW PALTZ >> The use of student names by New Way Technologies in a training video for a data-sorting computer program has angered officials with Ulster BOCES and the Onteora school district.

    The comments were made in the week since the video was posted and taken down from the company’s website. Board of Cooperative Educational Services Superintendent Charles Khoury said the video was produced using data given to New Way Technologies representative Art Ardolino, who did use names but did not include student information or statistics from tests.

    “The names are not associated with the numbers,” Khoury said. “The names were scrambled from the data, so there was no relationship between the names and the data that appeared.”

    However, Khoury is upset that the names of students from some of the districts in the Ulster BOCES service area were used.

    “It was wrong,” he said. “Those names shouldn’t have been used. That wasn’t the purpose (for which) he had the data and he acknowledges that.”

    Ulster BOCES had paid New Way Technologies $9,500 per year to develop a program that would make it easier for school districts to sort through test scores.

    “I brought them in as a software consultant programmer back in 2013 … essentially to write programs to generate reports that had more graphics in them than the reports we were getting from the state,” Khoury said.

    Concern over the training video, which New Way Technologies also used as a promotional tool, arose when Khoury recognized the name of Onteora school board member Ann McGillicuddy’s son.

    “Through the superintendent I did write to the board … apologizing for the unfortunate release,” he said.

    McGillicuddy did not return messages seeking comment but Onteora district Superintendent Victoria McLaren said the board was unhappy with student names being used by the company.

    “We were obviously concerned that names of our students were shown on that training video,” she said. “We were pleased that the training video was taken down pretty quickly once we had questioned it and we were also relieved that the other data in that video that appeared was not real data related to any of the students’ names.”

    McLaren said it was not clear how extensively the Onteora student names were used compared with other districts.

    “The high school principal was able to recognize a couple of other names,” she said.

    Information was not immediately available on whether other students names were used but the program has been used on a trial basis by the Rondout Valley school district. District Superintendent Rosario Agostaro on Tuesday said the video had been taken down before he could review the names of students.

    “I have no access to it so I don’t know which kids were on it,” he said.

    Khoury said use of the names did not violate privacy laws because there was no specific data associated with the students.

    “It’s called directory information,” he said. “If it was connected to the data it would be significantly more of a problem, but directory information is subject to public release.”

    Officials with New Way Technologies were not available Tuesday for comment Tuesday.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s