BYOD, CIPA Filtering, and a Teacher's Free App Request

CIPA conditions E-Rate discounts on an internet safety policy that includes a technology protection measure blocking visual depictions that are obscene, child pornography, or harmful to minors, plus monitoring and education. The measure applies to internet access provided over the district's network to minors; it does not hinge on who owns the device. An open, authenticated-to-nobody SSID that NATs straight to the internet is therefore both a policy gap and a likely audit finding, and the parent complaint is exactly the evidence a reviewer or complainant would cite.

Minimum fixes:

• Require identity on BYOD. Use 802.1X with student directory credentials, or a captive portal tied to the student information system, so every session maps to a person.
• Filter at the network egress rather than per device, so all traffic - district-owned or personal - traverses the same policy engine. Add controls for known circumvention proxies and encrypted-DNS bypass where feasible.
• Log and retain per board policy, and state plainly in the acceptable use policy and BYOD agreement that personal devices on the district network are filtered and monitored.
• Notify families and publish the updated policy.

This preserves BYOD, which is a legitimate program, while closing the compliance hole. Shutting the SSID down is not required and would shift students onto cellular networks where no filtering exists at all.

Not a flat no, and not an automatic yes. Three separate issues are in play.

• COPPA governs operators collecting data from children under 13. Seventh graders are 12 or 13, so a subset of the class is covered, and the school-consent route has conditions the vendor may not meet.
• Illinois student data law requires a written data privacy agreement between the district and the operator before covered student data is transferred, and it restricts use for targeted advertising. The vendor's stated ad-sharing practice conflicts with that.
• FERPA would treat the vendor as a school official only with direct district control and a written agreement defining purpose and use.

Practical response: check the district's approved-app inventory first. Ask the vendor whether it will sign the district's data privacy agreement and disable advertising sharing; many will for a school account. If not, offer the teacher an equivalent district-approved formative tool, or set up accounts with no personal information - a class code and a display name only, no birthdate and no email. Give her a five-day turnaround through a defined app-review workflow so she is not blocked mid-unit, and log the decision so the same question does not recur.

Weeks 1-2: technical containment. Confirm that egress filtering already applies to all VLANs including guest; implement 802.1X or captive-portal authentication on BYOD; verify logging. This is the highest-risk item because the evidence of an unfiltered path is already in a parent's complaint.

Weeks 2-4: policy. Draft revisions to the acceptable use and BYOD policies, brief the board, and publish family notice. Board action takes calendar time, so start it in parallel with the technical work.

Weeks 3-5: data governance. Inventory the top tools by teacher usage, prioritize those holding student records, and obtain signed agreements or replace them. Stand up the app-review request form and a published turnaround time.

Week 6: staff training on the new workflow and on what may not be uploaded to personal accounts.

Week 7: internal audit. Walk the network and document that filtering, authentication, and policy are in place, since that evidence file is what supports the funding request.

Week 8: file, with the network description in the application matching what actually exists. Build the evidence file as you go rather than reconstructing it at the end.