Confidential student information found exposed at old PMS

The Patriot has obtained an email sent Oct. 27 from County Administrator Jonathan Sweet to Pulaski County School Superintendent Dr. Kevin Siers. The email, which can be seen in its entirety below, notifies Siers that, when the county’s cleaning crews entered the old Pulaski Middle School, they found confidential student records laying in plain view on the floor.

The email reads as follows: 

Dr. Siers, 

I thought I would bring it to your urgent attention that when our crews entered the Pulaski Middle School to begin cleaning out the surplus items the school system left behind, there appears to be sensitive vaccination records that have student‘s names, addresses and social security numbers that are spread over and laying on the floors in the hallways.  I trust you are already aware that the school has been broken into multiple times and vandalized.  We fully suspect that the perpetrators of the vandalism are the ones who accessed these records and spread them all over the floors of the hallways. 

Please note, because of the tremendous amount of surplus left behind, we had no choice but to secure a trustee labor crew from the NRV regional jail to assist our public works, maintenance, general properties and CA administration crews.  The NRVRJ crew has already been onto the property prior to my knowledge of this situation. 

I am not sure if parents need to be notified of this series of events to be able to take appropriate precautions for their childrens identity security – I will leave those decisions up to you. 

Please be advised that County Administration does not want to be responsible for these records and would respectfully request that PCPS personnel retrieve these records and secure/dispose of them accordingly and at your earliest convenience.

———————–

In light of this letter, two questions come to mind.

First, were these very private student documents not properly secured when Pulaski Middle School closed down last Spring?

Secondly, and even more importantly, are these children in danger of having their identities stolen now or in the future? Could a PMS student’s confidential vaccine record or social security number be shared with unsavory or even criminal elements, as a result of what appears to be a security breach within the school system?

Sweet notes a crew from the New River Valley Regional Jail had visited PMS at least once before he became aware of the situation. This suggests that these confidential student records could have been carpeting the hallways of PMS for quite some time, which makes it all the more disturbing.

The National Center for Educational Statistics makes it clear that protecting information pertaining to students should be a top priority. 

“Student education records are official and confidential documents protected by one of the nation’s strongest privacy protection laws, the Family Educational Rights and Privacy Act (FERPA). FERPA, also known as the Buckley Amendment, defines education records as all records that schools or education agencies maintain about students. This and other United States ‘privacy’ laws ensure that information about citizens collected by schools and government agencies can be released only for specific and legally defined purposes.”

Virginia law also requires schools to maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information and makes use of appropriate administrative, technological, and physical safeguards.

The email from Sweet to Siers shows that whatever precautions were taken by PCPS, they were not adequate to keep information pertaining to PMS students secure.

Towards the end of the email, Sweet raises the idea of parents being notified of this situation, but leaves the PCPS Administration to make their own decisions about what, if anything, will be done.

This week a request for information under the Freedom of Information Act was sent to Sweet in an effort to garner more information on the matter.

Sweet responded:

“Per your FOIA request for information, I chose to simply provide a homogenized brief of what I have communicated and reported on regarding the subject matter of ‘records’ at the former Pulaski Middle School.  Below is the information you requested:

“Firstly, I want it to be known that I did not share my email communication between myself and Dr. Siers regarding this matter with any private citizen or the media, and am not certain who may have shared it.

“Simply put, the county was just looking to ready the building to begin the abatement process through the use of grant funding we competitively secured in order to take the next step of retrofitting the building into market rate apartments.  The awarded contractor let us know that the extreme amount of surplus materials left behind by the school board was so massive, that the abatement work could not begin until it was removed.  I communicated this message to the county team and to the school system, and effectively Dr. Siers communicated back to me that they were not going to assist us in any way with this effort.

“We were under the impression when the school board handed over the building that it was free and clear of all personal, personnel and sensitive parent, teacher and student information.  When we began cleaning out the massive amount of surplus left behind, county staff discovered certain materials and notified school personnel on Tuesday, 10-26-21, that there was possibly sensitive personnel records left behind in the Pulaski Middle School (PMS).  Those particular items were retrieved by school personnel later that day.  On Wednesday, 10-27-21, I personally inspected the extensive clean-out process and walked through the facility and noticed that a significant amount of what appeared to be medical/vaccination records remained spread across the floor of the hallways that had sensitive personal information on them, to include parent and/or children’s names, birthdates, addresses and social security numbers.  I did not look any deeper into the files, as I did not want to see any personal information that they contained.  I diligently communicated this finding to the Superintendent in a direct and private email on 10-27-21 marked ‘IMPORTANT’ upon returning to my office at approximately 9:30 AM.   I understand that school personnel then came to the PMS later that day and secured the records that were on the floors and removed them from the premises.  Following an unauthorized release of my private email to the Superintendent on social media platforms on Thursday, 10-28-21, I  understand that multiple school personnel then returned to the PMS on Friday, 10-29-21, to once again retrieve sensitive files/records/documents/etc. that remained in the PMS .  It is my understanding that PMS has now been thoroughly purged of any and all sensitive/personal/medical/personnel records.

It is fair to say that this matter rose to a level of urgency for County Administration after understanding that the PMS had been broken into on multiple occasions and the perpetrators are most likely the individuals who accessed those files and left them spread across the floor of the hallways.  The matter became even more urgent and time-sensitive considering that the volume of surplus the school board left for the County to clear out of the facility required us to not only use multiple County departments, but a New River Valley Regional Jail trustee crew as well.  The NRVRJ crew was likely on site multiple times while sensitive records remained visible and accessible within PMS.

With respect to what is being done in response, County Administration did all we could to notify the school system of these matters.  County Administration was never responsible for the safe storage of these records and were only working diligently to clear out the large amount of surplus items the school board left behind.  County Administration satisfied our obligations when we quickly notified the school system on at least two occasions of sensitive information being left behind and accessible within PMS.

I also notified Dr. Siers in writing to ensure that all sensitive information is accounted for and disposed of correctly before handing over Dublin Middle School.  I also encouraged that the school system take immediate action in doing so, considering the Dublin Middle School had also been broken into, accessed and vandalized as well.

Please note that County Administration’s only intent was to protect personal and sensitive information of teachers, students and parents while we conducted the herculean feat of cleaning out what was left behind in PMS by the school board.”

By WILLIAM PAINE, For The Patriot

 

School Superintendent issues statement:

Pulaski County Public Schools (PCPS) recently became aware that some legacy documents regarding students and former teachers were inadvertently left behind in a filing cabinet in the former Pulaski Middle School. The former middle school was broken into, but at this time we lack any evidence indicating that this incident created any risk for our students or teachers. However, out of an abundance of caution and a desire to do everything in our power to protect the PCPS community, we are providing complimentary 12-month credit monitoring for all students and teachers impacted by this event. We will be mailing letters soon that outline what precautionary actions our students and teachers can take to ensure their information is secure, as well as instructions on how to enroll in credit monitoring.

I want to reiterate – receiving a letter does not mean we believe that your information was stolen. Our actions solely stem from our desire to safeguard our community. We will share more information with the entire PCPS community as we learn more.

Kevin W. Siers, Ed. D.

Division Superintendent

Pulaski County Public Schools