Cyber Education in Canada is Broken, Here’s How to Fix It

I spoke on a panel about cybersecurity at the Canadian Edtech Summit the week before. The event had an online component so I started a poll aimed at the education administration and technology companies in attendance. Recently the SEC in the US sued a company for their failure to respond to cybersecurity problems that they were very much aware of that resulted in many clients’ data being spilled onto the darkweb. This raises an interesting policy question: should school boards and provincial education ministries be held legally responsible for cybersecurity in Canadian classrooms? Canadian educational ministries and their school boards have increasingly adopted cloud based solutions to reduces costs on what used to be locally managed technology integration, but with internet based ‘cloud’ solutions come cybersecurity responsibilities. This US decision will likely influence our lax cyber responsibility policies in Canada and I was curious what the people implementing these technologies (often poorly) thought of the potential for liability penalties for failing to protect student data (which often also includes staff and family personal data too).

I expected the people delivering online edtech (school boards, ministries, not-for-profits and private edtech companies) to recognize that cybersecurity is very much their responsibility if their technology is vulnerable online. Especially if they are going to demand that students use online learning tools. This should be especially obvious when our ‘clients’ are vulnerable sector children whose safety should be a primary concern.

Most did recognize the importance of taking responsibility for their technology delivery, but I’d love to have a chat with the quarter or so who thought they should be putting student learning online while bearing no legal responsibility for it. One of those people could well be managing your local school board‘s technology department.

If we’ve got a problem with the people delivering online edtech understanding that they are responsible for cybersecurity, we need to back the bus up and clarify those responsibilities with policy – legally binding policy.  I recently saw a memo which said data privacy wasn’t even a paid job in the school board and is done outside of regular work responsibilities by IT staff, most of whom have no cybersecurity experience. Until we begin taking public sector cybersecurity seriously we will continue to see our public services being disrupted by breaches and system failures.

NIST’s cybersecurity framework offers a technical policy approach to cybersecurity that clarifies what organizations need to do to provide viable online security. ISED has a Canadian version called ITSG-33 which is more policy focused.  This isn’t an all or nothing thing with a solution for every problem. Any time you put data online you risk being hacked, but by following these best practices you can at least know you’ve taken reasonable steps towards preventing abuse. What you want to do is get up to Tier 4 of the NIST framework where you’re proactively defending against threats, but public education in Canada can’t get out of tier two because “implementation is still piecemeal”, and no one has “the proper resources needed to protect themselves.” Our cyber failures in Canadian education are the result of both policy and a subsequent lack of funding. I’d hope that we’d follow best practices in protecting student data, but that ship sailed years ago. If that carrot isn’t available, then a legal policy stick might be the only thing left that prompts ministries and schools to make data privacy a priority.

The Solution: A Viable 21st Century Canadian Education Ecosystem

As both James and Kyle mentioned in their talks, technology moves so quickly that large public services are always going to struggle to keep up, but an agile edtech sector could help with that. Startups and small businesses can pivot to keep up with technology emergence in a way that larger organizations struggle with – that’s why Google and the rest buy agility rather than trying to produce it in-house. The problem has been Canada’s pigeon hole approach which doesn’t aim to produce a coherent ecosystem of interrelated programs that provide a comprehensive Canadian shield.

As mentioned, the issue of regional school boards and provincial ministries making it difficult for anyone outside of these insular systems from collaborating with them is a key problem. We can’t leverage digitally literate industry partners if they have no way to effectively communicate with education delivery systems.

The solution is to connect the federal government with the Council of Ministers of Education, Canada and The Insurance Bureau of Canada and design a centralized approval process that connects Canadian not for profits and industry edtech expertise with provincial ministries and clears the way for access to credible cybereducation materials and best practices through internal communications with education systems across the country. Instead of individual boards doing cyber badly, a national partnership with a wide range of technology specializations and strengths would work together to build solutions at scale while also ensuring that these solutions are prioritized. This relationship would also prompt meaningful updates to curriculum instead of the current ‘in a bubble’ approach that produces material well short of what is needed to prepare graduates for our technically challenging future.

I made this graphic after last year’s CPI conference at University of Waterloo, where I first met James, Cheryl and Cyber Legends.

In such an environment a startup like James’ Cyber Legends, or an internationally partnered and long running national competition like CyberTitan would pass NIST levels of cyber-review nationally and then be welcomed into a Canada-wide edtech ecosystem that works through each provincial and territorial education ministry directly into school boards. Any edtech company working outside of this framework would find itself where we all do now: on the outside unable to make any significant change. But those who meet this national standard would be considered trusted internal partners with access to federal funding and direct internal access to provincial education at both the ministry and district levels. No more trying for years to find a person who may (or most likely doesn’t) exist in a local school board who is in charge of cybereducation.

This ecosystem would reward collaboration. Members that don’t want to collaborate would find themselves removed. Those that want to do want to partner to build a more secure and digitally literate Canada would work with other members to produce complementary resources that allow teachers from all corners of the country to develop meaningful digital skills, including the difficult ones to deliver like cybersecurity.  These members would find funding and partners who ensure that their programs are successful and always ready to keep up with the impressive rate of technological change we’re all dealing with. This would also give those providing federal funding clear guidelines for who they should be supporting.

The stick would come through policy changes that are both legal and regulatory. Any school board (and by association ministry) not making use of these secure, partner provided resources for improving student data protection would find themselves both liable for any breaches, and also uninsured. Educational cybersecurity would no longer be a political blame game. Local implementation would still very much remain the purview of school districts, and ministries would remain very much in charge of funding their province or territory, but with focused federal support many of the associated expenses would be reduced through the centralization of resources. These savings would also be a carrot. With national cyber standards and partnerships that leverage the strengths of all members of Canada’s education ecosystem (federal government, private industry, national not for profit, education ministries, and local school boards), Canadian students would enjoy access to more Canadian made digital learning opportunities that raise digital fluency in a meaningful way, and they could do this while also exploring cybersecurity in a way that creates a more secure Canada. Imagine what all these cyber-aware students could do for our national security.

We have a habit of regionalizing our approaches to government in Canada, but in the face of wildly asymmetrical threats like cybercrime and (increasingly) international cyber espionage, we need to push back against this culture and build a collaborative defence. In doing so we would also create much richer digital learning opportunities in our schools that make Canada more secure and competitive in the networked, global economy.

The Solution: collaboration doesn’t end locally, regionally or even nationally in Canada

I’m attending The Global Forum for Cyber Excellence’s inaugural Global Conference on Cyber Capacity Building in Accra, Ghana at the end of November. 

I’m presenting a research paper a former student and CyberTitan (Louise Turner) and I have written about the disruption quantum computing will cause to cybersecurity encryption in the coming years. Doing this research with Louise has been both eye opening and very intellectually satisfying, but after 20+ years in the classroom I’m still very much a cyber-educator first and a cyber researcher second. It’s why I invited one of the next generation of cyber professionals to write the paper with me.

Looking at the program for the conference, the lack of talent and focus on developing cyberskills both in the population and in those interested in pursuing work in the industry isn’t a Canada only problem, it’s a global one. If we can repair Canada’s internal cyber-education system, we can then work with international partners to help them do the same. The cyber battlefield inherently favours the anonymity of hackers damaging our systems with impunity for their own gain, but through collaboration the defenders could become mighty.

As the GFCE so eloquently puts it: “Nations should work together and support each other with these capabilities, so that no country is left behind in their digital evolution. After all, a chain is only as strong as the weakest link.”  Look for the Accra Call: a global action framework that supports countries in strengthening their cyber resilience being announced during the conference.