Guidelines for Safer School Web sites

As the new school year begins for the summer, there is one key task that schools and school districts should address– the redesign of their school Web sites.

When the school newsletter was sent home with students, exposure was limited to those families with kids in school. Now that most schools have public Web sites, the information on them can be viewed by 2.3 billion Internet users around the world. Many schools have not absorbed the full consequences of this expansion and often expose considerable amounts of personal information about students, alumni, and teachers, putting them (and the student's families) at considerable risk.

In the example below, the athletics pages expose student’s names, jersey numbers, practice times, game schedules, and photos.

In general school Web sites show:

• Who is participating in school activities (student body, after-school clubs, and the like). Sites give first and last names of minors living within the very defined geographical area of a school’s boundaries, as well as clues to the interests and hobbies that are useful for predators who are casting about for a way to strike up a conversation.
• When and where after-school activities are held (such as meetings, practices, and events). This gives information that anyone can use to find the student after school.
• Student achievements honoring those who have won an award or in some way distinguished themselves. These almost always include the student’s name and often other information that identifies them.
• What students look like. Photos of teams, clubs, student councils, and teachers, most identifying their names in a caption.

All of this is great information to share with other students and with families of students to create a sense of community, but is it appropriate for others without school ties, those in surrounding communities—or the world?

When you know that a student likely lives within the geographical boundaries of the school district, a full name or photo provides too much information. A simple phone book look-up will likely provide their address. These key pieces of information may also unlock other information about a child. For example, a simple search on the child’s name gleaned from the school Web site can, for example, be used in Web services like MySpace, Friendster, and Facebook to provide even more information that can be used for criminal purposes.

How to make school Web sites safer

To improve Web site safety, the administrator must begin by establishing policies regarding Internet safety and then make the Web site itself safer. There are two ways to do this: implement a two-tiered access to information or remove personally identifiable information from the Web site. I recommend the two-tier approach. Keep in mind that once information is made public, it is likely to remain public.

Establishing Internet safety policies

These policies should be disseminated to every teacher and to every student and their family. Specific policies should detail:

• What information the school may share about its staff and students.
• When and how to report Internet abuse – whether it’s bullying, plagiarism, inappropriate use of school computers, or other forms of online abuse by either students or teachers.
• The types of filters and other restrictions the school has put in place so students and their families are clear about the level of monitoring available.
• Guidelines for appropriate Internet usage and the consequences for failing to adhere to the policies. Students and their parents should be required to sign off on their agreement of these.

Setting up a two-tier Web site

The Web site’s first tier should be entirely public and show school hours, location, emergency school closures, etc, and any general policies and procedures.

The Web site’s second-tier information should have limited access. Second tier information includes anything that could be used to identify an individual, like names, club members, photos, biographies, practice and game schedules, event times and honors, principal's letters, etc. There are two ways to give access to the second tier of information.

• Require a user ID and password. This is more secure, but is more cumbersome to administer.
• Use an approved list of e-mail addresses that is created at the beginning of each year to include relevant parents and students. Only people who are on the list can access the second tier of information on the website, and they can access it without having to remember a password).

The University of California Santa Barbara protects its students, teachers and alumni by requiring a User ID and password to get to directories, events, class notes, and the like.This way they have all of the benefits of community, without incurring unnecessary risk.

Setting up a Web site that removes all personally identifiable information

If a school does not want to build a two-tier Web site infrastructure, they should remove any information from their existing Web site that identifies students. This will make the Web site a much less satisfactory communication and connections tool, but at least it stops exposing students to risk. Keeping personally identifiable information from the school’s existing site includes:

• Using student first names only.
• Not displaying photos, especially if names or identifiers like numbers are shown.
• Not posting any information relating to locations and times for practices or meetings that would make it easy to find a student. Instead, send this information home with the student.

Linda