1 00:00:00,000 --> 00:00:05,080 Good morning and welcome to my talk for If Only Your Grades Are Safe, OSINT and Higher Education. 2 00:00:06,300 --> 00:00:09,280 Before I start, I'll tell you a little bit about myself. 3 00:00:09,480 --> 00:00:11,460 I'm a data analyst who's involved in higher education. 4 00:00:12,120 --> 00:00:14,520 I have a big interest in data privacy and security. 5 00:00:15,320 --> 00:00:18,520 You can contact me at Twitter or at one of those emails. 6 00:00:21,100 --> 00:00:24,980 Also, I've gotten a lot of questions when people have seen this talk about why I'm doing it. 7 00:00:24,980 --> 00:00:30,000 You're just giving people resources to pull data for free. 8 00:00:31,000 --> 00:00:33,180 There's a big issue, which I will talk about. 9 00:00:33,680 --> 00:00:37,000 People are already taking advantage of this, and most people don't know that they are, 10 00:00:37,160 --> 00:00:38,660 and they don't know how to protect themselves. 11 00:00:38,920 --> 00:00:41,400 So that's pretty much the reasoning behind this talk. 12 00:00:44,380 --> 00:00:46,700 Have any of you ever thought about your education records? 13 00:00:49,020 --> 00:00:51,200 Do any of you know what education records are? 14 00:00:52,240 --> 00:00:53,800 Can you tell me what it is? 15 00:00:53,840 --> 00:00:54,480 I have a... 16 00:00:54,480 --> 00:00:55,840 Nice little book I can give you. 17 00:00:55,900 --> 00:00:59,040 If you look at FERPA, you're looking at the actual student ID numbers 18 00:00:59,040 --> 00:01:02,260 tied with the actual classes you're registered for, 19 00:01:02,420 --> 00:01:05,720 people that are financing your college education, things of that nature. 20 00:01:05,920 --> 00:01:08,740 There are certain rules on higher education, like on the data that's being available, 21 00:01:08,860 --> 00:01:12,080 where, like, hey, if I'm 18 years old, my parents are paying for my education, 22 00:01:12,160 --> 00:01:15,720 they still can't have access to my records, because that's actually protected information. 23 00:01:17,100 --> 00:01:19,120 It's education records go farther than that. 24 00:01:19,180 --> 00:01:21,840 It's everything that the college has collected on you. 25 00:01:22,020 --> 00:01:23,260 That is tied to the student. 26 00:01:23,520 --> 00:01:24,460 That is tied to... 27 00:01:24,480 --> 00:01:25,700 That is tied to a student, every single thing. 28 00:01:25,940 --> 00:01:26,460 So... 29 00:01:26,460 --> 00:01:26,960 Everything. 30 00:01:29,320 --> 00:01:31,860 This can even include things like your height and weight. 31 00:01:32,720 --> 00:01:33,560 Eye color. 32 00:01:33,800 --> 00:01:35,220 Your student ID picture. 33 00:01:35,640 --> 00:01:36,440 All of this. 34 00:01:36,840 --> 00:01:39,080 And it's maintained by an educational agency. 35 00:01:39,340 --> 00:01:40,360 Would you like a... 36 00:01:40,360 --> 00:01:40,840 Sure. 37 00:01:41,320 --> 00:01:46,860 So these records are maintained by an educational agency, an institution, or parties acting for them. 38 00:01:46,980 --> 00:01:54,180 And I'd like to point out that there are no federal rules who tell you what parties the educational institution can say, 39 00:01:54,180 --> 00:01:54,940 and they are working for them. 40 00:01:55,080 --> 00:01:59,560 So if they suddenly decide that they want to partner with Intellius, 41 00:01:59,680 --> 00:02:05,760 and they're being deemed as an educational party, or a third party that they can work with, 42 00:02:05,880 --> 00:02:07,320 there's nothing you can do about it. 43 00:02:08,840 --> 00:02:10,640 And they do not have to disclose it. 44 00:02:12,240 --> 00:02:12,680 So... 45 00:02:13,400 --> 00:02:17,140 Like I said, it's anything the educational institution has collected on you 46 00:02:17,140 --> 00:02:19,440 for the entirety of your stay at said institution. 47 00:02:21,160 --> 00:02:23,440 Some institutions, like community colleges, 48 00:02:23,440 --> 00:02:24,800 that have people that drop in and out, 49 00:02:24,860 --> 00:02:28,180 they tend to keep records in perpetuity and don't technically follow the 50 00:02:28,720 --> 00:02:32,420 year of graduation plus three years, seven year collection data cycle, 51 00:02:32,760 --> 00:02:34,380 because students drop in and out, 52 00:02:34,420 --> 00:02:36,800 and you may have a student who's been going off and on for 15 years. 53 00:02:36,920 --> 00:02:38,000 So they just keep everything. 54 00:02:39,120 --> 00:02:41,640 So if you've been going since you were 20 and now you're 45, 55 00:02:42,020 --> 00:02:46,000 they have all 25 years of those records of anything that you've done at that college. 56 00:02:49,620 --> 00:02:53,420 So this is the big fancy rule that's supposed to protect the privacy of student education. 57 00:02:53,440 --> 00:02:56,360 But there's a big loophole with this one. 58 00:02:57,000 --> 00:02:58,540 And it applies to all schools. 59 00:02:59,740 --> 00:03:06,180 I didn't even touch K-12 because I have an issue with looking at non-adult records. 60 00:03:06,800 --> 00:03:08,400 So that's just a boundary I won't touch. 61 00:03:08,540 --> 00:03:09,580 But this applies to all of them. 62 00:03:09,740 --> 00:03:13,160 So any place that's received any type of funding from the Department of Education, 63 00:03:13,420 --> 00:03:16,360 even a dollar, is subject to this law. 64 00:03:19,860 --> 00:03:22,560 So a lot of people I've heard, you know, when I started talking about it, 65 00:03:22,580 --> 00:03:23,420 they're like, oh, well, that's true. 66 00:03:23,420 --> 00:03:24,500 Federal law protects us, right? 67 00:03:24,560 --> 00:03:25,420 You don't have to worry about anything. 68 00:03:25,800 --> 00:03:27,620 You know, no one can just ask for this. 69 00:03:28,540 --> 00:03:30,340 Yeah, that's totally wrong. 70 00:03:33,200 --> 00:03:36,260 So FERPA protects everything but directory information. 71 00:03:38,040 --> 00:03:40,360 And you know who decides what directory information is? 72 00:03:41,280 --> 00:03:42,200 The college. 73 00:03:43,980 --> 00:03:48,280 So anything that falls under directory information by the educational agency 74 00:03:48,280 --> 00:03:53,400 or the institution or their third party can be disclosed without prior consideration. 75 00:03:53,420 --> 00:03:53,760 Consent. 76 00:03:58,920 --> 00:04:02,500 And basically this is information contained in an education record 77 00:04:02,500 --> 00:04:06,440 that is not generally considered harmful or an invasion of privacy if disclosed. 78 00:04:07,840 --> 00:04:11,940 These PII that they can disclose without telling you are your name, your address, 79 00:04:12,180 --> 00:04:16,880 telephone number, date and place of birth, honors and awards, dates of attendance, 80 00:04:17,320 --> 00:04:18,200 height and weight. 81 00:04:18,380 --> 00:04:20,020 Sometimes they include parents' name. 82 00:04:20,220 --> 00:04:23,100 They include international students. 83 00:04:23,420 --> 00:04:26,180 They include addresses and their parents' names and their international contacts 84 00:04:26,180 --> 00:04:28,020 in addition to their local contacts. 85 00:04:29,300 --> 00:04:34,120 I've come across some of them that have student ID photos that you can pull, 86 00:04:34,380 --> 00:04:38,180 very high quality JPEGs off to make your own ID. 87 00:04:39,180 --> 00:04:43,240 Height and weight, hair color, everything but your grades. 88 00:04:43,400 --> 00:04:48,680 And in many cases, the colleges also consider your email address at the college protected. 89 00:04:49,500 --> 00:04:50,780 But everything else is fine. 90 00:04:55,780 --> 00:05:01,840 And the biggest caveat is it's released without consent unless the student has requested a 91 00:05:01,840 --> 00:05:05,020 privacy hold, and it means you can just go ask for it. 92 00:05:06,860 --> 00:05:08,820 And so I decided to do a proof of concept. 93 00:05:08,900 --> 00:05:11,620 I work at a college, but I do all of this research in my own time. 94 00:05:12,400 --> 00:05:15,660 And I'd gotten, the reason I did a proof of concept because, you know, 95 00:05:15,720 --> 00:05:20,160 I was hoping that maybe just my institution was the only one that was giving away this data 96 00:05:20,160 --> 00:05:21,360 when people would ask for it. 97 00:05:22,660 --> 00:05:23,400 And it's not. 98 00:05:23,420 --> 00:05:28,140 So I contacted 10 colleges and universities, just standard email. 99 00:05:28,820 --> 00:05:32,740 I didn't proceed with FOIA requests because they're a pain in the butt for the people involved. 100 00:05:33,160 --> 00:05:35,880 And I've had to, I'm on the, I've been on the back end of FOIA requests. 101 00:05:36,240 --> 00:05:38,700 I'm not going to do that to anyone unless I really need to. 102 00:05:39,960 --> 00:05:42,440 But three of them basically told me, go fill out a FOIA. 103 00:05:42,980 --> 00:05:44,700 Two said, go help yourself to our directory. 104 00:05:44,980 --> 00:05:47,800 Here's a special link that you can't get on the main page, but go right ahead. 105 00:05:47,880 --> 00:05:48,840 You can look up whoever you want. 106 00:05:49,300 --> 00:05:51,860 One of them said, give us 50 bucks and we'll give you whatever you want. 107 00:05:53,400 --> 00:05:55,340 So five schools did not respond. 108 00:05:55,500 --> 00:05:59,060 I figure a 50% return on my time, and if I went with the FOIA request, 109 00:05:59,200 --> 00:06:00,460 I would have probably gotten all of them. 110 00:06:03,800 --> 00:06:07,960 I was going to do a live demo until I realized how much of this information would just go out, 111 00:06:08,020 --> 00:06:09,040 and I didn't feel like doxing people. 112 00:06:09,560 --> 00:06:15,620 But this is all of the information down to, some of them told me which dorm room they were in 113 00:06:16,000 --> 00:06:21,440 and which dorm building they were in, and their home address as well. 114 00:06:21,860 --> 00:06:25,140 So I knew where they lived when they were on vacation 115 00:06:25,140 --> 00:06:26,420 and where they lived during the school year. 116 00:06:28,220 --> 00:06:34,380 They also did not like providing email, but for some reason they provided here. 117 00:06:34,440 --> 00:06:37,020 So it was explicitly stated that they didn't provide email, 118 00:06:37,080 --> 00:06:38,460 but email is listed if you look them up. 119 00:06:39,660 --> 00:06:43,140 This is UT Austin, big school, a lot of students, same thing. 120 00:06:44,800 --> 00:06:48,760 Some of the people I looked up included their home work numbers as well. 121 00:06:49,160 --> 00:06:51,680 They worked on campus, so I had where they would work on campus. 122 00:06:52,720 --> 00:06:55,000 And all you have to do with that is call to see when they're working 123 00:06:55,000 --> 00:06:55,960 if you're trying to find somebody. 124 00:06:59,400 --> 00:07:02,920 So a FOIA request, a lot of people think it's this big, complicated thing. 125 00:07:03,060 --> 00:07:06,840 This is basically an example of regular FOIA requests I receive. 126 00:07:07,080 --> 00:07:08,320 You just write it out. 127 00:07:08,440 --> 00:07:11,720 The federal government doesn't have any, like, specifics. 128 00:07:11,800 --> 00:07:15,920 You just have to request it, and you can make up whatever you want with why you need it. 129 00:07:18,560 --> 00:07:20,020 And this is what it will get you. 130 00:07:20,340 --> 00:07:21,760 So this is the information. 131 00:07:21,760 --> 00:07:21,840 This is the information. 132 00:07:21,840 --> 00:07:23,660 This is the information that was provided in response to that email. 133 00:07:23,800 --> 00:07:25,780 Hey, I'm marketing to these students, 134 00:07:25,820 --> 00:07:27,580 and I want to help them decide where they're going to school. 135 00:07:27,960 --> 00:07:31,380 We're not allowed to verify who's requesting this information. 136 00:07:33,120 --> 00:07:36,440 So all of this information was given, 137 00:07:36,600 --> 00:07:39,700 though we are not allowed to tell people when the degree was awarded. 138 00:07:40,660 --> 00:07:43,880 But one of the things you can do is you provide dates of attendance 139 00:07:43,880 --> 00:07:45,660 and the degrees and awards they received. 140 00:07:46,900 --> 00:07:49,960 If someone went to school for four years and they got a bachelor's degree, 141 00:07:50,420 --> 00:07:51,820 I can figure out when they got a bachelor's degree. 142 00:07:51,820 --> 00:07:56,560 And some of them are very helpful, 143 00:07:56,620 --> 00:07:59,140 and they will provide you all previous educational institutions 144 00:07:59,140 --> 00:08:00,680 those people have attended as well. 145 00:08:00,820 --> 00:08:03,520 You know, because you might need that for helping them 146 00:08:03,520 --> 00:08:06,600 at the fake school you're providing. 147 00:08:08,820 --> 00:08:10,500 Now, this one is my favorite. 148 00:08:11,340 --> 00:08:12,920 What 50 bucks can get you? 149 00:08:13,360 --> 00:08:16,480 So as per my previous emails, I sent out this standard email. 150 00:08:17,060 --> 00:08:20,160 It's at a domain that we purchased using a pseudonym. 151 00:08:21,320 --> 00:08:21,800 It's at a domain that we purchased using a pseudonym. 152 00:08:21,800 --> 00:08:24,900 There's nothing on it except for a little tagline under my email signature 153 00:08:24,900 --> 00:08:26,640 that said, data for tough decisions. 154 00:08:27,740 --> 00:08:29,700 Looks official, but it's basically, 155 00:08:29,860 --> 00:08:31,980 I'm writing a request, a listing of student directory information. 156 00:08:32,440 --> 00:08:34,800 What steps do I need to take in order to obtain this information? 157 00:08:35,160 --> 00:08:36,320 Additionally, is there a cost involved? 158 00:08:36,560 --> 00:08:37,340 Thank you for your help. 159 00:08:37,680 --> 00:08:38,860 I didn't tell them why I wanted it. 160 00:08:38,960 --> 00:08:40,500 I didn't tell them what I was going to do with it. 161 00:08:40,560 --> 00:08:41,360 I just said I wanted it. 162 00:08:42,400 --> 00:08:43,700 They were very helpful. 163 00:08:43,800 --> 00:08:46,580 They said, hey, give us $50 for programming, 164 00:08:46,660 --> 00:08:49,280 and we can get you anything on the directory that you want. 165 00:08:51,200 --> 00:08:54,180 So I request-quested every single thing that they could give me. 166 00:08:57,560 --> 00:09:00,160 They said I would provide all the data as soon as I got the money. 167 00:09:00,280 --> 00:09:03,840 I sent off a $50 Western Union money order from a P.O. box. 168 00:09:05,920 --> 00:09:08,120 I got a nice, helpful emailed receipt, 169 00:09:08,540 --> 00:09:11,040 and within 10 business days, I got an email that said, 170 00:09:11,080 --> 00:09:11,860 your data is ready. 171 00:09:12,000 --> 00:09:14,020 Where do you want me to send this Excel file to? 172 00:09:16,220 --> 00:09:18,140 I have issues with that, so I said, hey, 173 00:09:18,340 --> 00:09:19,200 I've got a security. 174 00:09:19,280 --> 00:09:21,080 If I ever upload, go ahead and securely upload this, 175 00:09:21,160 --> 00:09:22,060 but if I didn't have it, 176 00:09:22,080 --> 00:09:24,740 I would have gotten it directly into my fake email. 177 00:09:26,140 --> 00:09:29,680 And in that, on March 10th, 178 00:09:29,680 --> 00:09:31,940 I received 22,000 student records 179 00:09:31,940 --> 00:09:34,480 containing all of the information I had requested, 180 00:09:34,600 --> 00:09:36,440 including international student information. 181 00:09:37,920 --> 00:09:40,580 I had international student parent names 182 00:09:40,580 --> 00:09:42,340 because that's part of the directory information. 183 00:09:42,900 --> 00:09:44,980 I had international student addresses. 184 00:09:45,380 --> 00:09:46,500 I had their local addresses. 185 00:09:46,740 --> 00:09:47,520 I had ages. 186 00:09:47,740 --> 00:09:49,180 I even had lost students. 187 00:09:49,280 --> 00:09:49,840 I had their names listed on there. 188 00:09:51,480 --> 00:09:53,000 This is all completely legal. 189 00:09:54,180 --> 00:09:55,620 I didn't break any laws, 190 00:09:56,600 --> 00:09:58,640 and the federal government is completely aware of this. 191 00:09:59,480 --> 00:10:00,520 So what's the big deal? 192 00:10:01,560 --> 00:10:03,080 Most colleges and universities, 193 00:10:03,540 --> 00:10:06,560 I won't say all because I haven't seen every single one of them, 194 00:10:06,620 --> 00:10:08,100 but most, and in all that I've seen, 195 00:10:08,200 --> 00:10:09,680 automatically opt in students. 196 00:10:09,860 --> 00:10:13,000 It's much easier to not let a student opt out very easily. 197 00:10:13,560 --> 00:10:15,300 The paperwork is often hard to find. 198 00:10:15,520 --> 00:10:16,660 It can require multiple steps, 199 00:10:16,900 --> 00:10:19,180 and if you're an alumni and you find out about this, 200 00:10:19,280 --> 00:10:20,840 it sometimes requires extra steps. 201 00:10:21,600 --> 00:10:23,320 Personally, I went to a university 202 00:10:23,920 --> 00:10:25,700 in a city that I don't live in now. 203 00:10:26,300 --> 00:10:28,820 In order to get my data opted out, 204 00:10:28,860 --> 00:10:30,120 I'm going to have to take a full day off, 205 00:10:30,220 --> 00:10:30,740 travel there, 206 00:10:30,940 --> 00:10:34,140 and hopefully the alumni officer will be present that day 207 00:10:34,140 --> 00:10:35,980 because I've already gone twice and they haven't been there, 208 00:10:36,040 --> 00:10:38,580 in order for me to get my data to be opted out. 209 00:10:39,080 --> 00:10:40,820 I can't mail anything in. 210 00:10:40,900 --> 00:10:42,420 I can't opt out over the phone. 211 00:10:43,960 --> 00:10:45,700 And it's not well protected, 212 00:10:45,760 --> 00:10:47,820 and anyone can use it for a variety of purposes. 213 00:10:48,000 --> 00:10:48,960 I would hope that 214 00:10:48,960 --> 00:10:50,140 when you got a random email 215 00:10:50,140 --> 00:10:51,500 with someone who just had a tagline 216 00:10:51,500 --> 00:10:52,540 for data for tough decisions, 217 00:10:52,740 --> 00:10:54,320 they might ask a few questions instead of, 218 00:10:54,360 --> 00:10:55,300 can I have $50? 219 00:10:59,580 --> 00:11:01,800 So a lot of people don't think about it, 220 00:11:01,920 --> 00:11:03,740 but you can use this to construct a false identity. 221 00:11:04,800 --> 00:11:06,820 Just kind of to see what I could do, 222 00:11:07,200 --> 00:11:08,240 we took a friend's name 223 00:11:08,240 --> 00:11:10,080 to see how many fake identities we could come up 224 00:11:10,080 --> 00:11:11,180 that matched his current name. 225 00:11:11,440 --> 00:11:12,640 So you can give people, 226 00:11:12,740 --> 00:11:13,840 oh, I got all these degrees. 227 00:11:13,960 --> 00:11:14,940 I went here and here and here. 228 00:11:15,880 --> 00:11:17,060 Just as it occurs to research, 229 00:11:17,200 --> 00:11:18,660 using directory information, 230 00:11:18,660 --> 00:11:21,040 I was able to find six or seven degrees 231 00:11:21,040 --> 00:11:22,760 that we could put on his resume. 232 00:11:23,080 --> 00:11:25,280 Because when you call a college to verify a degree, 233 00:11:25,420 --> 00:11:27,420 you just have to tell them what year the degree was earned. 234 00:11:27,680 --> 00:11:30,600 Since degrees and attendances are posted, 235 00:11:30,880 --> 00:11:33,240 you can use that and falsify any of the information you want. 236 00:11:33,540 --> 00:11:35,560 You can use it to mess with international students. 237 00:11:35,880 --> 00:11:38,080 You can use it if you decide that you want to be a stalker. 238 00:11:41,980 --> 00:11:43,340 So this is scary stuff, 239 00:11:43,600 --> 00:11:45,620 but there's a whole lot more. 240 00:11:46,860 --> 00:11:48,380 So your directory information, 241 00:11:48,380 --> 00:11:49,360 can be provided, 242 00:11:49,480 --> 00:11:52,320 but treatment records can become education records 243 00:11:52,320 --> 00:11:55,640 when you receive treatment at a college or university. 244 00:11:56,540 --> 00:11:58,780 So how many of you know what HIPAA is? 245 00:12:01,180 --> 00:12:03,180 How many of you have ever had a HIPAA violation? 246 00:12:06,700 --> 00:12:07,780 Two of you, okay. 247 00:12:08,000 --> 00:12:09,960 It's pretty hard to do though, right? 248 00:12:10,120 --> 00:12:13,120 So HIPAA is supposed to protect treatment records. 249 00:12:13,680 --> 00:12:15,200 And student medical records 250 00:12:15,200 --> 00:12:18,060 are usually protected by HIPAA, usually. 251 00:12:21,600 --> 00:12:24,260 FERPA provides another gaping loophole. 252 00:12:24,640 --> 00:12:26,720 Records that should be protected by HIPAA 253 00:12:26,720 --> 00:12:27,820 can lose all HIPAA protection 254 00:12:27,820 --> 00:12:30,040 and become only protected by FERPA. 255 00:12:33,760 --> 00:12:38,380 So there are several ways 256 00:12:38,380 --> 00:12:41,400 that medical records and psychological treatment records 257 00:12:41,400 --> 00:12:42,760 can become education records. 258 00:12:42,960 --> 00:12:44,220 And when they convert, 259 00:12:46,620 --> 00:12:48,360 these records can become education records. 260 00:12:48,360 --> 00:12:49,020 They can lose all protection. 261 00:12:49,300 --> 00:12:51,360 So in education, 262 00:12:51,840 --> 00:12:52,400 here we go. 263 00:12:52,920 --> 00:12:53,880 This is the scary part. 264 00:12:54,260 --> 00:12:56,040 An eligible student's treatment records 265 00:12:56,040 --> 00:12:57,260 may be disclosed for purposes 266 00:12:57,260 --> 00:12:58,600 other than the student's treatment 267 00:12:58,600 --> 00:13:00,520 provided the records are disclosed 268 00:13:00,840 --> 00:13:03,020 under one of the exceptions to written consent. 269 00:13:03,360 --> 00:13:05,300 And one of those exceptions includes 270 00:13:05,300 --> 00:13:06,920 when the medical records convert 271 00:13:06,920 --> 00:13:09,040 to FERPA protected education records. 272 00:13:09,260 --> 00:13:12,460 And that occurs sometimes when anyone but the doctor 273 00:13:12,460 --> 00:13:13,520 that the student is seeing 274 00:13:13,960 --> 00:13:17,120 or a designated outside provider looks at the records. 275 00:13:17,120 --> 00:13:19,600 So if you go in and look at your medical records, 276 00:13:20,120 --> 00:13:22,440 you've converted your records from HIPAA protected 277 00:13:22,440 --> 00:13:23,440 to FERPA protected. 278 00:13:25,280 --> 00:13:28,380 How many of you went to school not in your hometown? 279 00:13:29,740 --> 00:13:30,480 Few of you. 280 00:13:31,360 --> 00:13:34,100 A lot of people sometimes get treatment on campus 281 00:13:34,100 --> 00:13:35,640 because it's easier than trying to fit a doctor 282 00:13:35,640 --> 00:13:37,460 in your schedule, or you may not have health care 283 00:13:37,900 --> 00:13:39,400 outside of what's provided at school. 284 00:13:39,840 --> 00:13:42,480 Or you may have a doctor back home 285 00:13:42,480 --> 00:13:45,480 who has not yet made it to the 21st century 286 00:13:45,480 --> 00:13:47,100 and still uses paper only records. 287 00:13:47,100 --> 00:13:50,260 If you walk into that medical office and say, 288 00:13:50,320 --> 00:13:51,940 hey, while I was in college, 289 00:13:51,980 --> 00:13:53,360 I discovered I had a thyroid issue. 290 00:13:53,580 --> 00:13:54,920 Can I have my medical records? 291 00:13:55,000 --> 00:13:57,160 So over the summer, while I'm not here for three months, 292 00:13:57,220 --> 00:13:58,260 I can continue my care. 293 00:13:59,320 --> 00:14:01,860 Those records lose all protection except for FERPA. 294 00:14:07,140 --> 00:14:11,160 And to top it off, if they disclose it in any way, 295 00:14:11,740 --> 00:14:13,300 they also lose protection. 296 00:14:13,480 --> 00:14:15,260 And it's totally legal for the university 297 00:14:15,260 --> 00:14:17,080 to decide that your medical records can't be protected. 298 00:14:17,100 --> 00:14:18,220 They can't be disclosed. 299 00:14:22,620 --> 00:14:25,160 So the DOE should be on this, 300 00:14:25,240 --> 00:14:26,300 because it's not a good thing. 301 00:14:26,460 --> 00:14:31,280 But the DOE says that, well, yeah, tough luck. 302 00:14:31,480 --> 00:14:32,500 It's totally legal. 303 00:14:32,680 --> 00:14:33,540 I don't really care. 304 00:14:36,600 --> 00:14:39,560 So the DOE has not moved forward with it. 305 00:14:39,660 --> 00:14:41,520 There was a call to action in August 2015 306 00:14:41,920 --> 00:14:44,800 as a result of something I'll be talking about in a minute. 307 00:14:45,280 --> 00:14:47,080 They asked for feedback that was due, 308 00:14:47,100 --> 00:14:48,320 October 2nd, 2015. 309 00:14:50,620 --> 00:14:51,920 Nothing has been changed. 310 00:14:52,360 --> 00:14:56,300 This is where you can actually find the press release for it. 311 00:14:56,580 --> 00:14:58,000 But there's no comments. 312 00:14:58,520 --> 00:15:00,060 There's been no update to the law. 313 00:15:00,300 --> 00:15:02,160 It's never even gone in front of the legislature. 314 00:15:02,420 --> 00:15:04,860 They just quietly waited for the next big thing 315 00:15:04,860 --> 00:15:07,520 to move forward, and it kinda got pushed under the rug. 316 00:15:09,380 --> 00:15:11,520 And before people say, no, this is not something 317 00:15:11,520 --> 00:15:13,540 that can actually happen, it's not really a big deal, 318 00:15:14,060 --> 00:15:16,340 well, this loophole has been exploited publicly. 319 00:15:18,340 --> 00:15:21,360 So FERPA and the rape of Jane Doe was where this loophole 320 00:15:21,360 --> 00:15:23,040 first came to light for a lot of people. 321 00:15:23,740 --> 00:15:26,600 And during the course of this, I may actually slip 322 00:15:26,600 --> 00:15:28,180 from saying allegedly raped to raped. 323 00:15:28,500 --> 00:15:30,680 They did not move forward with a conviction 324 00:15:31,180 --> 00:15:34,680 of the alleged rapists, but there's enough proof 325 00:15:34,680 --> 00:15:35,860 in all of the court documentation 326 00:15:35,860 --> 00:15:37,240 that you can decide for yourself. 327 00:15:38,060 --> 00:15:40,740 But Jane Doe was allegedly gang raped by three members 328 00:15:40,740 --> 00:15:42,140 of the university's basketball team 329 00:15:42,140 --> 00:15:44,400 over a 12-hour period in March, 2014. 330 00:15:44,400 --> 00:15:47,340 She reported it to both the local authorities 331 00:15:47,340 --> 00:15:48,300 and the campus authorities. 332 00:15:49,260 --> 00:15:51,940 The university decided not to investigate 333 00:15:51,940 --> 00:15:54,320 and put the investigation off until after 334 00:15:54,320 --> 00:15:56,360 the NCAA basketball tournaments had started. 335 00:15:59,380 --> 00:16:01,060 After the tournaments were completed 336 00:16:01,060 --> 00:16:03,040 and they had done all of the things they needed to do, 337 00:16:03,120 --> 00:16:05,260 they formally began investigation without disclosure. 338 00:16:06,220 --> 00:16:07,920 Again, that's not really illegal. 339 00:16:08,160 --> 00:16:09,340 They can do that if they want to. 340 00:16:09,460 --> 00:16:10,780 It's just not very ethical. 341 00:16:11,960 --> 00:16:14,380 The local district attorney decided not to move forward. 342 00:16:14,380 --> 00:16:16,460 Due to the low possibility of a guilty verdict, 343 00:16:16,660 --> 00:16:18,840 part of the issue is the rape kit had degraded 344 00:16:18,840 --> 00:16:23,760 because of the long gap in the formal investigation 345 00:16:23,760 --> 00:16:25,880 and some other issues with documentation 346 00:16:25,880 --> 00:16:28,440 because it was almost six weeks after the rape 347 00:16:28,440 --> 00:16:30,160 before the investigation began on campus. 348 00:16:32,060 --> 00:16:33,480 Eventually, the college decided, 349 00:16:34,020 --> 00:16:36,200 well, we should probably suspend them 350 00:16:36,200 --> 00:16:37,240 because they weren't good. 351 00:16:40,160 --> 00:16:42,360 After the suspension, they decided they were guilty 352 00:16:42,360 --> 00:16:44,040 of sexual misconduct and banned them 353 00:16:44,040 --> 00:16:45,160 from campus up to 10 years. 354 00:16:46,520 --> 00:16:48,520 Then, the university administrators, 355 00:16:50,640 --> 00:16:52,860 seeing and hearing that there was going to be a lawsuit, 356 00:16:53,960 --> 00:16:55,840 compelled the university counseling center 357 00:16:55,840 --> 00:16:57,660 to hand over all of her medical records 358 00:16:57,660 --> 00:16:59,080 from her psychological treatment 359 00:16:59,080 --> 00:17:01,020 from the trauma associated with rape. 360 00:17:01,760 --> 00:17:04,020 She filed her lawsuit in January, 361 00:17:06,140 --> 00:17:08,600 and it came to light that they'd pulled her records 362 00:17:08,600 --> 00:17:09,720 and they were no longer protected. 363 00:17:10,080 --> 00:17:11,480 They defended their rights and saying, 364 00:17:11,560 --> 00:17:13,280 well, you know, FERPA said we can use them 365 00:17:13,280 --> 00:17:14,120 for whatever we want. 366 00:17:14,220 --> 00:17:16,520 She was going to sue us, so we had to protect ourselves. 367 00:17:17,820 --> 00:17:20,540 The cases moved to the court, and during that time period, 368 00:17:20,600 --> 00:17:23,360 her rapist was able to get a hold of all of her medical records 369 00:17:23,890 --> 00:17:25,240 dealing with the trauma of the rape, 370 00:17:25,300 --> 00:17:27,900 and he was able to see what kind of therapy she had gone through. 371 00:17:29,600 --> 00:17:33,400 This is still in court, and I guess the university decided to stop 372 00:17:33,400 --> 00:17:37,040 because they were starting to get people a little bit angry at them, 373 00:17:37,080 --> 00:17:37,660 and they settled. 374 00:17:37,820 --> 00:17:40,200 They paid her $800,000 and said, 375 00:17:40,240 --> 00:17:42,680 hey, we'll pay for you to go to school for four more years here 376 00:17:42,680 --> 00:17:43,400 where you were raped. 377 00:17:43,500 --> 00:17:45,280 You really want to come back, don't you? 378 00:17:45,660 --> 00:17:47,980 And they changed the policy for admitting students 379 00:17:47,980 --> 00:17:50,260 with a history of sexual assault and misconduct, 380 00:17:50,440 --> 00:17:53,720 but they didn't do anything about their misuse of records 381 00:17:53,720 --> 00:17:57,220 because, as they put it, it was completely legal under FERPA, 382 00:17:57,300 --> 00:17:59,820 and they were not hit with any DOA fines for doing so. 383 00:18:02,860 --> 00:18:04,360 So why does this all matter? 384 00:18:06,420 --> 00:18:08,580 The university accessed her medical records, 385 00:18:08,660 --> 00:18:09,900 including her mental health records. 386 00:18:10,060 --> 00:18:12,660 They also accessed her sexual health records, 387 00:18:12,660 --> 00:18:14,440 including her medical records from the student center. 388 00:18:14,720 --> 00:18:17,540 Women are encouraged to go every year to get an annual exam 389 00:18:18,220 --> 00:18:21,100 because an STI test is part of that annual exam. 390 00:18:21,240 --> 00:18:24,060 For most women, it's just part of the whole part and parcel. 391 00:18:24,300 --> 00:18:25,900 They use that as part of their defense. 392 00:18:26,100 --> 00:18:27,880 Look, she's been tested for STIs, 393 00:18:27,940 --> 00:18:29,880 never mind that it's considered standard of care. 394 00:18:30,440 --> 00:18:34,120 They pulled the records in anticipation of the lawsuit without consent. 395 00:18:34,320 --> 00:18:36,100 She never knew those records were breached. 396 00:18:36,340 --> 00:18:38,200 I mean, not necessarily breached, 397 00:18:38,240 --> 00:18:39,600 but she never knew those records were pulled, 398 00:18:39,740 --> 00:18:41,440 and she continued to go for therapy. 399 00:18:43,020 --> 00:18:45,200 Then they converted them to education records, 400 00:18:45,300 --> 00:18:49,120 which meant that the lawyer for the student 401 00:18:49,120 --> 00:18:50,800 who was considered the alleged head rapist 402 00:18:50,800 --> 00:18:53,480 could pull all these records and review them with his client. 403 00:18:54,700 --> 00:18:58,280 And then they were once again used against her in court. 404 00:19:01,280 --> 00:19:02,920 So what does it mean for you? 405 00:19:03,700 --> 00:19:07,420 Well, your confidential medical records could become records anyone can look at. 406 00:19:08,000 --> 00:19:09,500 They could be used against you. 407 00:19:09,580 --> 00:19:12,260 It could potentially be used to negatively affect you in the future. 408 00:19:13,280 --> 00:19:16,320 During college, a lot of people go through trying times. 409 00:19:16,540 --> 00:19:19,360 People who may not necessarily have issues other times in their life 410 00:19:19,360 --> 00:19:22,360 may suffer from depression, suicidal ideation. 411 00:19:22,440 --> 00:19:23,500 Your brain is still developing. 412 00:19:23,760 --> 00:19:26,880 Or you may get involved with a sorority or fraternity, 413 00:19:26,920 --> 00:19:29,340 or you may start binge drinking just because that's a cool thing to do. 414 00:19:29,600 --> 00:19:32,460 If that appears on your records that you sought treatment for that, 415 00:19:32,500 --> 00:19:36,700 that can be used against you at some point to deny you medical coverage. 416 00:19:37,220 --> 00:19:39,060 It can be used to deny you a job. 417 00:19:39,340 --> 00:19:42,520 It can be used to say that you're a bad fit for a position. 418 00:19:42,660 --> 00:19:45,500 That has nothing to do with what you did when you were in college. 419 00:19:47,180 --> 00:19:48,360 I have a question. 420 00:19:48,480 --> 00:19:48,640 Yeah. 421 00:19:48,880 --> 00:19:49,780 Or should I wait? 422 00:19:49,900 --> 00:19:50,540 No, you can go ahead. 423 00:19:50,760 --> 00:19:51,940 So regarding Jane Doe, 424 00:19:52,600 --> 00:19:59,380 isn't the conversion of HIPAA to FERPA without explicit consent a HIPAA violation? 425 00:19:59,740 --> 00:20:00,000 Nope. 426 00:20:00,320 --> 00:20:02,460 In the case of educational institutions, 427 00:20:02,660 --> 00:20:05,200 if you've received care at an educational institution 428 00:20:05,640 --> 00:20:09,360 and anyone at that educational institution looks at those records, 429 00:20:09,520 --> 00:20:12,000 as long as it falls within certain parameters, 430 00:20:12,660 --> 00:20:15,620 as long as it's accepted because it's the educational institution looking at its own records, 431 00:20:16,240 --> 00:20:18,480 it doesn't constitute a HIPAA violation. 432 00:20:20,000 --> 00:20:20,400 Yes? 433 00:20:20,560 --> 00:20:22,660 What about that opting out of the HIPAA? 434 00:20:28,100 --> 00:20:29,080 You can opt out. 435 00:20:29,200 --> 00:20:32,480 There's some certain caveats which I'll talk about, 436 00:20:32,600 --> 00:20:34,960 but the next one is this is what you can do about it. 437 00:20:35,140 --> 00:20:40,580 So you can opt out of data sharing at any institution of higher education that you've ever attended. 438 00:20:40,580 --> 00:20:41,940 So this is what you can do about it. 439 00:20:42,020 --> 00:20:44,800 But there are some caveats to the opting out. 440 00:20:45,400 --> 00:20:50,020 When you opt out, that means that someone like me can request the data 441 00:20:50,020 --> 00:20:53,620 and I'll be told, no, these people, you know, I'm not going to get those records. 442 00:20:53,740 --> 00:20:56,120 I won't know that they've ever existed because they're a blank slate. 443 00:20:58,060 --> 00:21:04,500 However, if your college or university is involved in any type of evaluation program, 444 00:21:04,840 --> 00:21:08,780 your data can be shared with the outside evaluator even if you've opted out 445 00:21:08,780 --> 00:21:10,540 because it's part of a grant program. 446 00:21:10,540 --> 00:21:12,420 And it supersedes your opting out. 447 00:21:15,600 --> 00:21:17,300 Does that include accreditation? 448 00:21:17,700 --> 00:21:18,260 Yep. 449 00:21:18,300 --> 00:21:21,100 Or like LOST, AACSD, and FHL? 450 00:21:21,140 --> 00:21:21,420 Yeah. 451 00:21:21,960 --> 00:21:22,520 Yep. 452 00:21:23,500 --> 00:21:24,060 Yeah. 453 00:21:24,280 --> 00:21:27,620 So I want you to think about that. 454 00:21:28,240 --> 00:21:34,400 Unless you've gone to a completely private college that receives no funding from the Department of Education, 455 00:21:35,160 --> 00:21:39,160 even when you opt out, your data can still be accessible to some people. 456 00:21:40,540 --> 00:21:45,680 Opting out provides you a lot, a big safety net, so someone can't just go request it like I did. 457 00:21:46,500 --> 00:21:48,660 But other people can still see your data. 458 00:21:49,060 --> 00:21:58,040 Anytime there's grant funds or anything like that, these are considered, opt outs aren't considered at all. 459 00:21:59,360 --> 00:22:00,560 They make a note of it. 460 00:22:01,100 --> 00:22:05,340 Two percent of the students opted out, but it's not a guarantee that your data is completely safe. 461 00:22:07,000 --> 00:22:16,660 And the Department of Education and the grant fundees and no one else is interested in protecting those students who don't want their data shared. 462 00:22:17,900 --> 00:22:27,120 We recently had a data agreement, or we recently had a request come across where we were providing data to outside entity for the current students. 463 00:22:27,260 --> 00:22:28,760 About 44,000 students. 464 00:22:29,060 --> 00:22:32,780 Of those 44,000 students, only about 400 of them had opted out. 465 00:22:32,960 --> 00:22:33,140 Okay. 466 00:22:34,620 --> 00:22:38,620 And previously when I talked about it, it's sometimes hard to see or hard to find. 467 00:22:38,700 --> 00:22:41,400 The law only stipulates that it has to be put up in one place. 468 00:22:42,760 --> 00:22:47,200 Colleges sometimes look to put it at the very front of the course catalog for the semester in little tiny print. 469 00:22:47,380 --> 00:22:48,620 One of the first two pages. 470 00:22:49,080 --> 00:22:52,980 How many of you ever read that front part of the course catalog when you were planning your schedule? 471 00:22:54,320 --> 00:22:55,120 I never did. 472 00:22:55,360 --> 00:22:59,060 I just was trying to get my classes before they filled up with everybody else. 473 00:22:59,460 --> 00:23:00,100 You know? 474 00:23:01,620 --> 00:23:03,120 Some places will put it up. 475 00:23:03,140 --> 00:23:04,040 You can see it. 476 00:23:04,100 --> 00:23:05,380 But it requires jumping through hoops. 477 00:23:05,660 --> 00:23:07,480 One college I looked at an opt out. 478 00:23:07,760 --> 00:23:13,920 And in order to opt out, even if you're a current student, you have to go to their office with an ID. 479 00:23:14,760 --> 00:23:18,300 25% of their students are military members serving overseas. 480 00:23:20,620 --> 00:23:24,460 So how are you supposed to opt out when you can't physically be present? 481 00:23:26,380 --> 00:23:30,380 So currently, the only thing I can do is tell people to opt out. 482 00:23:30,840 --> 00:23:32,720 Tell everyone you know to do the same thing. 483 00:23:33,760 --> 00:23:35,320 Contact your higher education group. 484 00:23:35,740 --> 00:23:38,480 Right now, it's just a few of us saying, hey, this is a problem. 485 00:23:38,680 --> 00:23:46,200 But maybe at some point, if enough people start talking about this, they'll stop screwing people over and just giving their data away. 486 00:23:47,660 --> 00:23:49,060 Contact your congress critters. 487 00:23:49,400 --> 00:23:50,140 They're not people. 488 00:23:50,280 --> 00:23:50,700 I'm sorry. 489 00:23:52,380 --> 00:23:52,940 They're not. 490 00:23:53,360 --> 00:23:59,900 But if you contact them and bug them enough and tell them you should start talking about this or we're going to vote for the other critter, maybe they'll listen. 491 00:24:01,820 --> 00:24:10,160 Colleges have gone from a bastion of higher education, a bastion of learning to a place where student data is commoditized and just given out. 492 00:24:10,780 --> 00:24:19,820 Another issue is I anticipate we're going to see more requests for things like DACA students and student religion. 493 00:24:20,120 --> 00:24:29,740 I've already had to tell people we don't collect data on students' sexual identity or sexual preference because they wanted to use that to do a study. 494 00:24:29,740 --> 00:24:33,740 And how dare I not let them have their student sexual preference? 495 00:24:33,840 --> 00:24:35,900 I was like, that has nothing to do with education. 496 00:24:37,300 --> 00:24:40,600 We had another person who asked for a list of all Muslim students on campus. 497 00:24:43,320 --> 00:24:43,800 No. 498 00:24:44,460 --> 00:24:46,120 That's not a question we ever ask. 499 00:24:46,640 --> 00:24:50,180 We've received multiple requests for a list of all DACA students. 500 00:24:51,780 --> 00:24:55,140 I don't care about your immigration status when you come to school. 501 00:24:55,400 --> 00:24:59,360 I look at how you're doing and, like, report data on that. 502 00:25:00,240 --> 00:25:03,480 DACA status shouldn't be ever held. 503 00:25:03,620 --> 00:25:07,340 But the issue is, even with opt-out, I can be compelled to give lists. 504 00:25:07,580 --> 00:25:11,540 And with the current political climate, I'm not going to create a list of DACA students. 505 00:25:11,840 --> 00:25:15,840 Because if it exists, someone can ask me for it, even if they've all opted out. 506 00:25:15,960 --> 00:25:19,380 And someone with enough authority behind their name can make me give it to them. 507 00:25:24,680 --> 00:25:28,020 So this is kind of my what's next. 508 00:25:28,100 --> 00:25:29,720 I kind of wanted to see what other person wanted. 509 00:25:29,720 --> 00:25:30,840 I don't have all the information I can gather. 510 00:25:31,000 --> 00:25:38,880 But I'm also transitioning jobs because I'm hoping to set up kind of a resource center to help students start taking back control of their data. 511 00:25:41,440 --> 00:25:43,260 People don't know how to opt-out. 512 00:25:43,320 --> 00:25:45,420 And every college has a different opt-out procedure. 513 00:25:45,720 --> 00:25:52,820 And sometimes they're impossibly obstinate about letting you control what's about you. 514 00:25:54,000 --> 00:25:58,200 First, people in college now, my recommendation is don't use the student medical resources. 515 00:25:58,200 --> 00:26:01,700 Which is a shame because sometimes that's the only medical care you can get. 516 00:26:02,200 --> 00:26:06,400 But the fact that this sort of stuff can happen is a warning to everybody. 517 00:26:06,640 --> 00:26:10,440 Especially because opt-out won't protect that necessarily from some people who are asking. 518 00:26:12,520 --> 00:26:13,640 Any questions? 519 00:26:15,400 --> 00:26:19,340 Yes, very interesting talk, first of all. 520 00:26:19,780 --> 00:26:27,600 I'm from Europe and I find it fascinating to see how the educational institutions are organizing this. 521 00:26:29,620 --> 00:26:37,900 So in Europe we have the GDPR, the General Data Protection Regulation that is being effective in place in May next year. 522 00:26:38,320 --> 00:26:40,780 It also applies to educational institutions. 523 00:26:40,960 --> 00:26:50,920 So it probably means that for overseas students that the U.S. educational institutions also need to comply to the GDPR. 524 00:26:51,180 --> 00:26:56,760 So it's maybe an extra motivation for them or for you 525 00:26:56,760 --> 00:27:01,220 to basically push them to try to fix this from a legal perspective. 526 00:27:01,680 --> 00:27:07,720 I think, I am hopeful that they will do the right thing. 527 00:27:08,740 --> 00:27:17,500 But I don't know that they will because the loopholes still continue to exist despite uproar from colleges themselves. 528 00:27:17,760 --> 00:27:22,840 For instance, the college where the student was raped, the only reason that that information came to light 529 00:27:22,840 --> 00:27:26,740 is because two people from the counseling center filed a formal complaint. 530 00:27:26,740 --> 00:27:28,080 Against the university. 531 00:27:28,480 --> 00:27:32,920 Lost their jobs as a result because they said that they were prohibiting due process. 532 00:27:33,620 --> 00:27:38,500 And raised enough of a stink that a journalist found out what's going on. 533 00:27:38,820 --> 00:27:44,560 So I hope that colleges will comply, but I have a feeling that it will be a battle. 534 00:27:44,640 --> 00:27:51,980 And I have a feeling that there will probably be a lot of lawsuits, especially from international and foreign students, regarding their data protection. 535 00:27:52,280 --> 00:27:55,560 For all EU students who are in those databases. 536 00:27:55,560 --> 00:27:59,320 Do those educational institutions are in violation of the GDPR? 537 00:27:59,440 --> 00:28:08,520 Yeah, there are often FERPA violations within some of the data that's presented. 538 00:28:08,640 --> 00:28:13,580 But as someone who works with the data, I can only advise. 539 00:28:13,700 --> 00:28:18,160 I can never tell, like, the decision comes from above of what to do with it. 540 00:28:18,920 --> 00:28:25,120 And I know consistently across the board, colleges across the US often violate FERPA. 541 00:28:25,120 --> 00:28:29,180 In order to provide data to consortiums and things like that. 542 00:28:29,420 --> 00:28:34,520 What are the fines for FERPA violations and HIPAA violations in the US? 543 00:28:34,840 --> 00:28:39,820 So none of these would be HIPAA violation because the way it is worded. 544 00:28:40,020 --> 00:28:44,000 But FERPA violations are up to $1,000 per student per incident. 545 00:28:44,420 --> 00:28:44,920 It's nothing. 546 00:28:45,120 --> 00:28:45,860 It's nothing. 547 00:28:45,960 --> 00:28:53,720 But a lot of times with the sum of data that they're passing out, it's 500,000 students. 548 00:28:53,720 --> 00:28:55,640 You know, it's 15 years of data. 549 00:28:56,120 --> 00:28:57,720 And that does add up. 550 00:28:57,740 --> 00:28:59,080 But it's just a slap on the wrist. 551 00:28:59,180 --> 00:29:00,660 And it doesn't really, you know. 552 00:29:00,680 --> 00:29:04,340 The college will find some other way to pay that fine and continue to do what they're doing. 553 00:29:04,580 --> 00:29:05,740 It doesn't affect change? 554 00:29:05,900 --> 00:29:06,940 No, it doesn't affect change. 555 00:29:08,160 --> 00:29:11,340 So I work at one of these universities. 556 00:29:13,460 --> 00:29:15,060 And we have medical centers. 557 00:29:15,100 --> 00:29:18,240 So it's actually odd because we're a private institution. 558 00:29:19,220 --> 00:29:21,080 So there's a loophole in HIPAA. 559 00:29:21,180 --> 00:29:23,120 Which means if you're not teaching college. 560 00:29:23,860 --> 00:29:30,520 There's a big gray area where if you're even, if I even have to deal with it at all. 561 00:29:30,900 --> 00:29:31,860 Which is odd. 562 00:29:32,020 --> 00:29:38,100 But in reading up on FERPA, one of the things for opt out that seems, maybe you know, but 563 00:29:38,100 --> 00:29:44,920 it seemed like it was a scare tactic was if you opt out and a potential employer calls 564 00:29:44,920 --> 00:29:49,380 to verify that you actually graduated there because you opted out, they can't tell you. 565 00:29:49,680 --> 00:29:50,160 Yeah. 566 00:29:50,220 --> 00:29:52,000 And I believe that is a scare tactic. 567 00:29:52,000 --> 00:29:57,900 Because you can provide, like you can contact your college or university and ask them to 568 00:29:57,900 --> 00:29:59,160 send a certified transcript. 569 00:29:59,620 --> 00:30:06,900 Which most employers who are looking for students are all too happy to receive a certified 570 00:30:06,900 --> 00:30:10,940 transcript because that's a better indicator than just calling some random person in a 571 00:30:10,940 --> 00:30:11,640 registrar's office. 572 00:30:11,940 --> 00:30:14,140 They also use it in some places as a scare tactic. 573 00:30:14,320 --> 00:30:17,980 Well, you know, you're going to have to have, you can't just log into everything easily 574 00:30:17,980 --> 00:30:18,940 with one password. 575 00:30:19,200 --> 00:30:21,980 You're going to have to use different passwords for all your logs. 576 00:30:24,080 --> 00:30:28,240 You know, because they use type of one type of a one login for every single thing. 577 00:30:28,800 --> 00:30:30,480 Honestly, that's poor security. 578 00:30:30,620 --> 00:30:33,660 Like you should be using different passwords for all the things you log into anyway. 579 00:30:33,980 --> 00:30:36,620 But they use it as a we're going to cut off your convenience. 580 00:30:36,760 --> 00:30:40,720 We're going to make it so no one will hire you as a way to prevent students from opting 581 00:30:40,720 --> 00:30:42,380 out because it's extra paperwork. 582 00:30:42,540 --> 00:30:43,380 That's extra thing. 583 00:30:43,440 --> 00:30:47,220 When I get a data request from an outside entity, I have to strip out all those students that 584 00:30:47,220 --> 00:30:47,660 said no. 585 00:30:48,300 --> 00:30:50,900 Personally, I would love to be like, I'm sorry. 586 00:30:51,740 --> 00:30:53,980 Here's four students who didn't opt out. 587 00:30:54,200 --> 00:30:56,420 But you've got an enrollment of 44,000. 588 00:30:56,500 --> 00:30:58,200 Yeah, but these are the ones who didn't opt out. 589 00:30:58,240 --> 00:30:59,960 So I can't provide you the rest of the data. 590 00:31:00,080 --> 00:31:03,800 Like that would be a dream for me because that would cut down some of the data sharing 591 00:31:03,800 --> 00:31:04,520 that we have. 592 00:31:34,240 --> 00:31:36,400 You can still supersede it. 593 00:31:36,440 --> 00:31:42,140 I sent an email to one of the UC colleges saying that I was interested in receiving 594 00:31:42,140 --> 00:31:46,500 some directory information so I could send students a scholarship application. 595 00:31:47,240 --> 00:31:50,880 And I was told I would just need to provide some funding for that. 596 00:31:50,880 --> 00:31:53,100 I don't know if it's going to be for programming, but that I would be able to. 597 00:31:53,360 --> 00:31:54,920 They actually violated the UC. 598 00:31:55,040 --> 00:31:55,420 So. 599 00:31:56,440 --> 00:31:57,420 University of California. 600 00:31:57,720 --> 00:31:58,140 Yeah. 601 00:31:58,360 --> 00:32:00,000 So there are. 602 00:32:00,000 --> 00:32:01,080 They can actually be fired. 603 00:32:01,640 --> 00:32:02,160 Yeah. 604 00:32:02,200 --> 00:32:10,280 There are so many because sometimes it's a mix of they don't care, a mix of negligence, 605 00:32:10,280 --> 00:32:12,660 and a mix of I work with really poor students. 606 00:32:12,760 --> 00:32:13,440 Here's an opportunity. 607 00:32:14,740 --> 00:32:16,900 I'll even counter that a little bit. 608 00:32:17,180 --> 00:32:20,860 I think there's just a lack of training that's given. 609 00:32:22,000 --> 00:32:22,480 Yeah. 610 00:32:23,400 --> 00:32:24,220 And people. 611 00:32:24,700 --> 00:32:26,500 Well, and people don't understand FERPA. 612 00:32:26,580 --> 00:32:29,420 When you start talking about it, a lot of people think it protects everything. 613 00:32:29,620 --> 00:32:31,540 Well, it's educational rights. 614 00:32:31,660 --> 00:32:32,040 You know. 615 00:32:32,280 --> 00:32:32,760 No. 616 00:32:33,320 --> 00:32:36,120 And one of the things is I don't have. 617 00:32:36,220 --> 00:32:40,060 I'm not accessible accessing K through 12 records. 618 00:32:40,320 --> 00:32:44,460 But you can request K through 12 records and see all of this information. 619 00:32:46,920 --> 00:32:49,580 It doesn't apply to private schools, per se. 620 00:32:49,680 --> 00:32:50,540 But charter schools. 621 00:32:50,640 --> 00:32:50,840 I don't know. 622 00:32:50,840 --> 00:32:56,340 And public schools who receive federal and state funding are subject to FOIA requests. 623 00:32:56,520 --> 00:33:00,540 So you can send a FOIA request for all sorts of data on students under the age of 18. 624 00:33:00,960 --> 00:33:04,200 Well, my private college gets plenty of money. 625 00:33:04,420 --> 00:33:10,920 So I'd be shocked if there's very many private institutions that don't take advantage of 626 00:33:10,920 --> 00:33:12,000 free money. 627 00:33:12,280 --> 00:33:12,640 Yeah. 628 00:33:12,700 --> 00:33:16,860 And I think part of that is, you know, this is. 629 00:33:18,020 --> 00:33:18,940 Colleges are. 630 00:33:19,000 --> 00:33:19,680 A lot of times. 631 00:33:19,680 --> 00:33:22,780 Even, you know, they're trying to find money wherever they can. 632 00:33:23,020 --> 00:33:28,400 And sometimes this is, you know, complying with these grants or applying for these grants 633 00:33:28,400 --> 00:33:30,420 with all of these stipulations to give over everything. 634 00:33:30,580 --> 00:33:32,400 It's a way to fund further programming. 635 00:33:32,640 --> 00:33:34,800 And some schools don't really care. 636 00:33:34,960 --> 00:33:36,840 It's basically cattle in, cattle out. 637 00:33:36,940 --> 00:33:39,980 Other schools, especially smaller schools, are trying to help their students. 638 00:33:40,340 --> 00:33:44,660 But some of the smaller private schools have 70 percent of the students who have high need. 639 00:33:44,940 --> 00:33:48,200 And you're going to take money wherever you can and make sure the students go through 640 00:33:48,200 --> 00:33:49,440 the classes and complete. 641 00:33:49,680 --> 00:33:52,000 And so it's kind of a cycle. 642 00:33:52,220 --> 00:33:54,880 I mean, people have to start opting out. 643 00:33:55,000 --> 00:33:58,120 And then when they find out that their data has been shared when they've opted out, start 644 00:33:58,120 --> 00:34:00,520 making a fuss because it's not a lot of money. 645 00:34:00,940 --> 00:34:04,120 But if you have enough people yelling, hey, my data has been violated. 646 00:34:04,260 --> 00:34:05,160 Can you look into this? 647 00:34:05,260 --> 00:34:06,040 And they find enough things. 648 00:34:06,120 --> 00:34:08,820 At some point, if you have enough violations, it will hurt. 649 00:34:12,160 --> 00:34:13,240 Any other questions? 650 00:34:15,480 --> 00:34:15,880 . 651 00:34:19,260 --> 00:34:19,660 . 652 00:34:22,080 --> 00:34:22,280 . 653 00:34:23,420 --> 00:34:23,620 . 654 00:34:25,120 --> 00:34:25,320 . 655 00:34:25,320 --> 00:34:25,640 . 656 00:34:26,620 --> 00:34:26,820 . 657 00:34:28,900 --> 00:34:29,100 . 658 00:34:29,100 --> 00:34:29,160 . 659 00:34:29,160 --> 00:34:29,200 . 660 00:34:30,160 --> 00:34:30,360 . 661 00:34:30,360 --> 00:34:30,380 . 662 00:34:32,200 --> 00:34:32,400 . 663 00:34:32,400 --> 00:34:32,420 . 664 00:34:32,420 --> 00:34:32,440 . 665 00:34:32,440 --> 00:34:32,520 . 666 00:34:32,520 --> 00:34:32,600 . 667 00:34:32,600 --> 00:34:32,680 . 668 00:34:32,680 --> 00:34:32,700 . 669 00:34:32,700 --> 00:34:32,900 . 670 00:34:32,900 --> 00:34:33,000 . 671 00:34:33,000 --> 00:34:33,100 . 672 00:34:38,220 --> 00:34:38,420 . 673 00:34:38,420 --> 00:34:38,460 . 674 00:34:38,460 --> 00:34:44,420 a resource page. Um, eventually it'll be under cat bear intelligence. Um, but if you just, 675 00:34:44,480 --> 00:34:51,240 if you follow me and let me put it back to, yeah. So either follow me on Twitter or send me an email. 676 00:34:54,200 --> 00:34:58,520 Um, my, my husband in blue here is a DevOps engineer, so he's helping me set up a lot of 677 00:34:58,520 --> 00:35:03,380 the backbone. Uh, all of my programming is in, uh, SAS and R, so it's not quite as useful 678 00:35:03,380 --> 00:35:10,840 outside of the statistical areas. Um, but I'm going to be setting something up to try and, uh, 679 00:35:10,980 --> 00:35:15,940 explain FERPA in plain language to people who may not understand what it means for their rights, 680 00:35:16,120 --> 00:35:21,580 um, as well as explaining how they opt out and how to make sure your data is not being shared 681 00:35:21,580 --> 00:35:26,120 in plain language. And then, um, I'm hoping to have like a community effort and have people who've 682 00:35:26,720 --> 00:35:30,000 opted out and the procedures that they followed at their particular school. 683 00:35:30,320 --> 00:35:33,220 And so that people can look up and see, because they are, 684 00:35:33,380 --> 00:35:34,320 they're different across the board. 685 00:35:36,720 --> 00:35:41,960 So I'm not from the U.S., so I'm not aware of the laws here, but just wondering, 686 00:35:42,520 --> 00:35:49,320 uh, initially you said that if I have studied 25 years back, they should have my record even now. 687 00:35:49,580 --> 00:35:55,120 So is there a way to opt out as soon as I've done my graduation or as soon as the education is done? 688 00:35:55,280 --> 00:35:57,320 You can opt out as soon as you start college. 689 00:35:57,620 --> 00:36:03,000 No, so what I'm talking about is not opt out, basically a record cleanup. I don't want you to keep my record. 690 00:36:03,380 --> 00:36:09,940 Nope. They have to keep them as part of the DOE because of DOE funding and receiving financial aid 691 00:36:09,940 --> 00:36:14,300 and stuff. So they, they require you, you can't just have your, your data purged. Well, let me 692 00:36:14,300 --> 00:36:18,200 take that back. You can potentially do something that would put you in the witness protection 693 00:36:18,200 --> 00:36:25,160 program that would allow you to clean that record up. But I don't, yeah, I don't recommend 694 00:36:25,160 --> 00:36:32,740 that as a way to, to get that record removed. So, um, and not all schools follow, um, where I work, 695 00:36:32,760 --> 00:36:33,360 we have, we have, we have, we have, we have, we have, we have, we have, we have, we have, we have, we have, 696 00:36:33,360 --> 00:36:37,840 we have, basically we have records, what we call to the beginning, from the beginning of time, 697 00:36:37,920 --> 00:36:42,560 from when we started because we have so many students who do the, I go for a little bit and 698 00:36:42,560 --> 00:36:46,940 then life happens and I go for a little bit. And so you'll see that more in community colleges. 699 00:36:47,340 --> 00:36:51,580 Universities still hold on to some of the data because they have verification, you know, 700 00:36:51,580 --> 00:36:55,060 and they need the transcripts and things like that. So some data might be destroyed, 701 00:36:56,160 --> 00:36:59,580 but your transcripts and things like that stay around. 702 00:37:02,820 --> 00:37:11,440 Any other questions? Anyway, like I said, just follow me on Twitter. Just drop me an email. I 703 00:37:11,440 --> 00:37:19,040 have some business cards as well if you didn't get a snapshot of that. And eventually, I'm hoping to 704 00:37:19,040 --> 00:37:24,060 set up a public-facing page to help have kind of a crowdsourced, tell me how you opted out of your 705 00:37:24,060 --> 00:37:28,960 college so we can help other people and move forward with that. Thank you.