Internet Explorer 11 is not supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Miami-Dade Grapples with Cyberattacks and Shady Contract

In addition to dealing with the cyberattack that is affecting thousands of teachers and students, County officials also must explain the missing signature on the $15 million contract for faulty school software.

(TNS) — While the nation’s fourth-largest school district continues to grapple with network outages and cyberattacks that have crippled online learning, Florida's Miami-Dade County Public Schools revealed Wednesday that it never signed the $15.3 million no-bid contract with K12, the for-profit company at the center of the district’s unprecedented crisis.

School district chief financial officer Ron Steiger dropped that revelation at a School Board meeting to discuss the failures of K12’s online platform, My School Online. Tens of thousands of students and teachers have been unable to access the system in what has been a disastrous start to this pandemic-challenged school year.

But the contract with K12 was never executed, the CFO said, and is missing only one key signature: Superintendent Alberto Carvalho’s. The district hasn’t paid K12.

The school district has refused to make the contract public under Florida’s public records law. School Board members have been asking to see the contract, but the district has yet to provide it. The district has cited an exemption that allows districts to purchase curriculum without board approval.

The narrative has changed since Carvalho said Tuesday that there was “no mystery to the contract.” He said it hadn’t been released to the public because he wanted School Board members to see it first — which violates the state’s government-in-the-sunshine laws.

Those laws also require records to be turned over in a reasonable amount of time. My School Online was part of the district’s reopening plan, which the state approved on July 17.

The school district has signed a data management agreement with K12, founded in 1999 by Wall Street financier Ronald Packard, who left the company amid litigation over his pumped-up projections. Packard’s $10 million investor was Michael Milken, the former junk bond king convicted of fraud and whom President Donald Trump pardoned earlier this year.

School Board members, overwhelmed with complaints and outrage from families that a third straight day of teaching and learning was lost to technical difficulties, demanded answers. Some saw a way out of the contract with K12.

“How did we get here and how do we fix this and how do we get kids learning ASAP?” asked board member Marta Perez.

“Was it a handshake? Was it a pat on the back? Was it an email? Was it a wink?” asked vice chair Steve Gallon on how the contract came to be.

Perez motioned to hear directly from K12 representatives, but the vote failed in the committee. Some board members said it wasn’t appropriate to hear from K12 since they weren’t involved in the procurement. Others said they voted no based on School Board attorney Walter Harvey’s advice.

“If we weren’t involved in the takeoff, truly I can’t be involved in the landing,” said board member Lubby Navarro. “This did not come through the board so I trust our superintendent and our cabinet to resolve this.”

She added, “If this is not the platform that is serving our students and our community, then we need to look for a solution immediately.”

It’s possible the district could abandon K12 altogether. Chief Academic Officer Marie Izquierdo said district officials have crafted a timeline to continue or end its relationship with the company.

“We do have a long weekend ahead of us,” she said.

But Izquierdo gave a warning: The alternative would be to revert to the plan that worked when the pandemic started in the spring, when every teacher used whatever platform they felt most comfortable using.

Parents, however, complained that it was too confusing to navigate multiple platforms. Back then, the district could only measure one-time log-ins, not sustained participation — which is supposed to be a feature offered by My School Online.

The issue, Izquierdo said, is that the school district does not have a uniform learning management system like other school districts have. Broward County, for example, uses a system called Canvas. A request for proposals for a learning management system went out in January and won’t be secured until November or December.

An email was sent out at 9:30 p.m. Wednesday to all secondary teachers asking them to use Microsoft Teams and Zoom until Sept. 11. The district will then assess if grades six through 12 will use K12 beginning Sept. 14 or stick with Microsoft Teams and Zoom.

Izquierdo said the K12 platform was not “operating effectively” on a national level for grades six through 12.

“I don’t believe everything I’m told on the 6-12 side of the house right now,” she said.

She also acknowledged issues with the platform for kindergarten through fifth grade, but said K12 told the district those issues specifically impacted only Miami-Dade while other districts across the country experienced problems in grades 6-12.

In an emailed statement, K12 said network outages did impact the My School Online platform.

Asked if the issues were national or limited to Miami-Dade, a K12 spokesman said in an email: “Yes, we have had some sporadic issues with other schools.”

The spokesman said K12 understood the district’s decision to stop using My School Online for grades six through 12 and that they are working with the district “to strengthen the system to allow for a smooth transition across the K12 platform.”

“Teachers have the ability to choose the platform that best meets the needs of their classroom,” the spokesman wrote. “Whether this is the K12 platform, or an alternative while the system is strengthened, we are working closely with our partners to ensure that students have a continuous option for their education.”

The company also confirmed that it pledged to donate $100 for every teacher who set up their virtual classrooms by Sunday night via the Foundation of New Education Initiatives, a nonprofit Carvalho chairs.

Board chair Perla Tabares Hantman, who is also vice chair of that foundation, asked if qualifying teachers will still receive that money if the district decides to part ways with K12.

“Regardless of steps that are taken ... that commitment to the teachers shall be satisfied,” Carvalho said.

Wednesday saw some improvement in teachers and students logging on and staying on. Some schools and teachers have given up on the platform and pivoted to Zoom, while some did not, making for an unequal learning experience. School Board attorney Harvey raised the issue of equity.

Izquierdo said that by 8:38 a.m., 35,000 students were on class connect via K12, and 100,000 students had logged in. At 8:50 a.m., there were 80,000 students online and 170,000 students logged into the K12 platform. Those figures don’t include the students and teachers on Zoom using Microsoft Teams.

Miami-Dade Schools has approximately 275,000 students and nearly 20,000 teachers.

Those log-ins took place despite 12 cyberattacks that occurred from 8:19 a.m. to 10:59 a.m. Wednesday, district officials said, and more attacks continued throughout the day.

District officials have determined the cyberattackers have demanded no ransom, and some of the attacks came from outside the U.S.

Sen. Marco Rubio, R-Florida, has requested a briefing with the Department of Homeland Security on cybersecurity as it relates to school districts.

“It now appears that hostile actors, including foreign cybercriminals, are now targeting online classrooms in order to further disrupt the lives of Americans,” he said in an emailed statement.

Miami-Dade Schools Police Chief Edwin Lopez said his officers are trying to link the digital addresses to physical addresses in the U.S. so that federal agents can find the hackers.

Lopez didn’t say what countries the foreign hackers are believed to be from. He also said detectives aren’t certain if the attacks were coordinated. It appears the hackers are just trying to disrupt the system, he said, not profit from the attacks.

Doug Levin, a cybersecurity expert and president of EdTech Strategies, said the publicly released details of the incident show it is a typical DDoS attack — a distributed denial-of-service — where computer servers have been flooded with “junk traffic” that prevents legitimate users from logging in.

Based on prior DDoS attacks on schools, if the instigator is not seeking financial gain, it makes it more likely that the individuals could have a connection to the school district.

The fact that some of the attacks appear to be coming from overseas, he said, could mean that the servers blocking the school’s system are based there — not necessarily that the instigator is.

Comcast, Miami-Dade’s server provider, released the following statement Wednesday:

“Miami Dade County Public Schools today reported that they continue to be targeted by cyber attacks. While we are working hand in hand with the school district on this matter and continue to monitor this around the clock, the security measures we are providing are helping to mitigate the impact of these ongoing attacks. “

©2020 Miami Herald. Distributed by Tribune Content Agency, LLC.

From Our Partners