District data breach poses threat to privacy

By Adarsh Burela, Evelyn Fu, and Faria Moiz

Private information about the Milpitas Unified School District (MUSD) teachers and admins was released through the district’s law firm, Lozano Smith Law Firm, on Jan. 23, 2020. Later, on Jan. 27, the staff was notified that their information was leaked, according to district emails from Assistant Superintendent of Human Relations Jonathan Brunson given to The Union by a staff member.

The data was requested by two Milpitas residents, namely Milpitas Resident George Liu, Schletzbaum said through district emails. The district handed the information over to the LozanoSmith Law Firm, who gave out the unredacted version to the recipients. The data include Milpitas Unified teachers’ social security numbers and other private information.

Schletzbaum elaborated on the process of filing for a request for information on MUSDstaff. He said they are legally allowed to ask for general information about teachers under the Freedom of Information Act (FOIA). But, teachers who no longer work here or substitutes should not have been included in the files.

“There’s a file going around the union where one of the people says that people who have retired who will still be on this file haven’t been notified,” Schletzbaum said. “Two days later, we finally got back that no, [substitute teachers] aren’t included.”

Attorney Gayle Ketchie who works for the Lozano Smith Law Firm was involved in the exchange. However, in an email, she refused to respond for comment because the issue is currently under litigation on both sides.

“Because this matter is currently under litigation, I am unable to comment,” said Ketchiein an email.

Liu said that on Nov. 25, 2019, he asked the MUSD for some information on the teachers working. He received a response with an attachment on Jan. 23, 2020 and claimed to have not glimpsed at the content of files, Liu said. He was later informed that some parts of data were mistakenly sent, such as the Social Security numbers of all teachers currently working and those of retirees. He was later told to delete the attachment from any location it could have been sent to.

“So I know the attachment but I did not even look at the content of the email, nor did I open the attachment. Only later on did the MUSD lawyer call me and tell me that the data [was sent] by mistake and that attachment included sensitive information like the Social Security numbers of older teachers,” Liu said during a phone call. “[The lawyers] sent me instructions[on] how to delete [the file], delete it from the inbox, delete it from the junk folder, I did everything I can to make sure all copies of the data has been deleted.”

Other than Liu, no one had received the attachment other than one of his friends, he said. Liu would not disclose the name of this friend, but he guaranteed that his friend also did not open the attachment either and has deleted the file, Liu said. In general, the situation was handled very poorly, and the fault lies with the law firm he continued.

“Before [Lozano Smith Law Firm] contacted me and told me [the file] contained sensitive information, I did forward it to my friend,” Liu said. “After [Lozano Smith Law Firm]told me, I told my friend ‘Okay, don’t open it.’ My friend did not open the email and did not open the attachment, and all the copies were deleted. [Lozano Smith Law Firm] is not doing a good job. They should be sued.”

Teachers’ Union Site Representative Brett Webber said he was elected by the teachers of MHS to represent them in union matters. This position also includes the conditions for teachers’interactions with the school district. Webber added that the Milpitas Teachers Association (MTA) has not met about this matter, so there is no additional information besides the email sent to all teachers.

“I have no additional knowledge, except what has been shared with us by HR, HumanResources, and the district,” Webber said. “I believe there are still a lot of questions that we would like answers to. I’m not sure that things have been settled. They have given us as much information, I think, as the district has.”

However, there was a meeting on Feb. 12, 2020 between the MTA and the law firm, Webber said. He added that after the meeting, the teachers would have more information than that which has been given by the district.

“There will be a meeting, I want to say [Wednesday] the 12th,” Webber said in an interview about a week after being notified. “There will be a meeting at which the law firm who caused the breach will be here to talk to us. And hopefully, by then, we will have more and better answers.”

The fault lies in the law firm even though it was the district who gave the information to them, Webber said. As for compensation, the law firm will provide two years of Equifax, a credit monitoring agency, for everyone who has been influenced by the data release, he added.

“So, what we have heard, and we’ve all been notified individually, the law firm will provide two years of credit monitoring for everyone affected,” Webber said. “The district office did what is absolutely normal and what is customary and what is expected of the district. So even though the district provided the information, the error lies with the law firm.”

From what he has heard from the district, the people who got the file deleted it, Schletzbaum said. He added that the law firm supposedly sent a cease and desist letter once they had noticed they sent the unredacted file. What was supposed to be on the redacted file was the names of the teachers, where they worked, their salaries, et cetera, which is public information.

“This is the lawyer for the law firm of the district. So as [the district’s] attorney, if they’redefending you about something or representing you, you need to give them all the information,” Schletzbaum said. “They’re supposed to be doing this stuff in secret. So they’re supposed to redact it and then pass it on to the attorney for whoever’s requiring the other stuff.“

Leave a Reply

Your email address will not be published. Required fields are marked *