Protecting Data in the Eye of a Storm
Superstorm Sandy swept the East Coast in late October, leaving not only residents and businesses without power and struggling to stay afloat, but thousands of schools in the region without power as well. It reminded administrators of the need for comprehensive emergency plans to ensure student, staff, and data security.
The storm marked the biggest disruption for the New York City school system since the attacks of September 11, 2001, officials reported. And just 30 miles east of Manhattan, the Long Beach Public School District in Long Beach, N.Y., on Long Island, was flooded with Atlantic Ocean water. The district’s six schools and 95 percent of the homes in the beach community of 35,000 people were damaged, impacting not only students but also the majority of school staff, who live in town. Though schools were closed to students for two weeks, district leaders and technology officers worked to ensure that data systems were safe using emergency generators and backup systems. Despite the loss of electricity, water, phone lines, and sanitation services for days, no school data were forfeited to the storm, according to Long Beach Public School District Superintendent David Weiss.
When Hurricane Katrina hit Louisiana in 2005, members of the Consortium for School Networking (CoSN), a professional association for school system technology leaders, were alarmed at how unprepared most school districts were for the storm, says CEO Keith Krueger. “Technology is increasingly not an optional thing—it’s at the heart of everything, from payroll to learning,” Krueger says. “When there is a natural or man-made disaster, you need to be ready for the unexpected, and think through what you would do in a crisis.”
To solve this problem and help prepare for future storms like Sandy, in 2008, CoSN created a technology disaster recovery checklist of 10 items to help school leaders organize their emergency plans. The first, and most critical, is to identify and contact personnel in charge of recovery efforts, such as district superintendents and technology leaders. Another key step is to re-establish payroll quickly, as staff will need to be paid on time more than ever to survive.
“Whether it’s been flooding along the Mississippi or hurricanes or tornadoes in the Midwest, it’s been a useful resource for helping people think things through,” says Krueger. “Its greatest value is for those who aren’t in the middle of [a disaster].”
District leaders need to carefully develop emergency plans before a storm like Sandy looms on the horizon. “Disaster planning for technology begins long before the National Weather Service puts out its first storm alert,” says Brian Lewis, CEO of the International Society for Technology in Education. “Most critical of all is having a strategy for protecting the valuable and confidential data that are the backbone of any school or district, such as student information, employee payroll information and server-based curriculum resources.”
Districts can use the following strategies to ensure their data systems are safe:
• Move to cloud storage. Cloud information is data saved to an off-site storage system that can be accessed anywhere with an internet connection, according to Denise Atkinson-Shorey, a senior consultant at CoSN. Companies like Trustwave and Credant offer several data protection services, including cloud solutions.
• Purchase a backup generator or server. However, a generator that powers a large data center, such as one supporting more than 50 schools in an urban area, could cost more than $100,000, Atkinson-Shorey says.
• Partner with other districts. If money is tight, administrators can find another district that is geographically far enough away to hopefully not experience the same disaster, and agree to back up each other’s data, says Atkinson-Shorey. When backing up servers, administrators usually work with districts of the same size in their state, but the data could also go out of state. No matter the location, both districts need to have a robust broadband infrastructure to ensure connectivity. Another option for administrators is to designate a room in another district for their own backup equipment, she adds.
After Hurricane Irene hit the East Coast in August 2011, Long Beach Public Schools installed a generator in the high school where the internal servers are housed, including the district email system, which was restored a week after Sandy hit. The district also backed up the financial system off-site so payroll stayed on schedule. As a result, the district did not lose any electronic data during Hurricane Sandy. However, while teachers protected classroom computers by moving equipment on top of desks, flood waters rose high enough that many lost paper files kept in bottom desk drawers and cabinets, Weiss says.
Newark (N.J.) Public Schools, the largest system in New Jersey with 71 schools and 37,500 students, prepares for storms like Sandy with quarterly drills to test emergency systems to ensure staff and payroll information is secure and accessible from outside the district, according to Paul Mailloux, the district’s chief technology officer. All of the equipment in the district’s two network centers, located about four miles apart in Newark, use battery power to adjust for power fluctuations, which allows the machines to automatically shut down if power is lost.
The 450-plus servers can be managed remotely, and data are backed up between the two centers, one of which also has a generator. Financial data are also backed up to a disaster recovery site about 30 miles south of the city, so if the servers are unable to function for an extended time, the district can still access important payroll information online, Mailloux says.
It isn’t just natural disasters that require school emergency plans. “Unfortunately in this country, we’ve seen a number of incidents like campus shootings, and in those moments, how you are going to notify parents and students? What kind of emergency plan do you need, and how can you use tools like SMS [short message service] text messaging and websites to alert people?” says Krueger.
Communication Is Key
In developing and implementing emergency plans, communication is key so community members know what tools and opportunities schools have, and how they will be used, says Atkinson-Shorey. Schools nationwide that have implemented a SMS system of notification for weather-related school closures and early dismissals have seen fewer complaints from parents saying they heard too late, Krueger says. Schools should also contact their district telecommunications provider to ensure they are a priority to be restored in emergency situations, and consider how to make use of devices like tablets and smartphones to spread information, Atkinson-Shorey adds.
At Long Beach Public Schools after Sandy, the extended loss of electricity and internet was unexpected, and the emergency system was overloaded, Weiss says. Though the district website was updated, many cable wires were down and many residents were unable to get online. School leaders discovered that SMS messaging was the most reliable communication with parents and staff. “One of our weaknesses was that we were too heavily reliant on home phone numbers for staff and student contacts,” says Weiss. “We had been in the process of collecting cell numbers, but they were not readily available to us” since the power was out.
The district created a web page a week after the storm for parents to provide their contact information, which staff members then entered into an off-site student management system. With help from a parent phone chain, the district heard from about 2,500 families, out of 4,000 students total, with new email addresses and cell phone numbers.
Newark Public Schools use web-based system Blackboard Connect that can be accessed anywhere with an internet connection, and sends emergency notification messages to every contact listed for students via phone, email, and SMS text message. “Having emergency contact information accessible in a format that is usable regardless of the type of emergency that occurs is important—you can’t rely on electronic files if you can’t get on the internet,” says Mailloux.
“The unexpected is perhaps inevitable,” says Krueger. “You’ll never be completely prepared, but the more you can think through scenarios ahead of time, the better decisions you’ll make.”
To view CoSN’s IT Crisis Preparedness Initiative, visit www.cosn.org/itcrisisprep.
Alison DeNisco is staff writer.