UPDATED 12.13.23—Pro Tip: Don't Believe Everything Fairfax County Public Schools Tells You
This article was published 12.12.23. It was updated 12.13.23 to include the message from Superintendent Michelle Reid, which FCPS posted to its site.
The one thing that can be said about Fairfax County Public Schools (FCPS) is that it is consistent. When it engages in noncompliance, rather than engaging in immediate transparency and honesty, it crafts messages that lead the public to believe something else happened and that someone else is at fault.
Why am I mentioning this?
Evidently Superintendent Michelle Reid sent out a letter dated December 7, 2023, to parents throughout the division, letting them know that FCPS failed to secure their students' private information and explained it in the following manner:
"This matter occurred on or about October 19, 2023. During an in-person review of information related to the reviewer's own child, information relating to other students was unknowingly made accessible to a parent who retained an electronic copy of that information. Thereafter, the parent redacted the information related to other students and published the redacted information. Since learning of its publication on November 1, 2023, FCPS has worked to contain and secure the deletion of the information involved in this matter."
A few days later, on December 12, 2023, a message from Superintendent Michelle Reid appeared on FCPS' site. Although her name was signed to both the letter sent to parents and to the message posted to FCPS' site, the messaging and tone are vastly different. However, both the letter mailed to parents and the message posted to FCPS' site are similar in that both left out important information and were written in manners rendering them open to interpretation rather than in manners ensuring everyone reading them ends up on the same page regarding the facts. To my knowledge, the Dec 12 message wasn't distributed until close to 7 pm December 13, 2023, sandwiched in between a larger email titled "Winter Resources for Families".
What Did FCPS Fail to Mention?
The letter relates to me finding information for over 35,000 kids within my own kids records, as well as emails and other records proving FCPS 100% engages in some questionable actions. In addition to being the editor of this site, I'm a parent. As a parent, I invoked the right we all have to access our kids' educational records. What Superintendent Michelle Reid left out of her letter follows below.
First, let's start off with this:
I have not and will not ever publish private information about kids.
Now let's break down the statement itself.
FCPS states:
"During an in-person review of information related to the reviewer's own child, information relating to other students was unknowingly made accessible to a parent who retained an electronic copy of that information."
What did FCPS leave out?
During an in-person review of information I was told was my kids', and which an FCPS paralegal and IT expert helped me access and advised me on copying, I copied records that were supposed to be my kids, and did not know I was copying information about 35,000+ other kids, as well as other records.
There were not 35,000+ independent records. Instead, there were a few dozen files of varying sizes, primarily with emails and attachments to emails within the files. In addition, there were discs with recordings. I was under the impression that the former were copies of old FERPA requests I'd made. I copied them since I'd lost records through the years. The latter was supposed to be recordings of meetings related to my kids.
FCPS states:
"Thereafter, the parent redacted the information related to other students and published the redacted information."
What did FCPS leave out?
This reads as if I redacted and then published all the information related to other kids.
No. I published the following, some of which does contain redactions:
Emails showing that FCPS' legal counsel and leadership knew that the program it pushed on kids who have Dyslexia for years isn't actually intensive enough for kids who have Dyslexia, and that another FCPS counsel advised FCPS staff that they wanted to testify to a hearing officer that the program is actually intensive enough;
Emails showing that FCPS' Jane Strong added FCPS legal counsel John Cafferky to an email just to keep it "privileged" and that FCPS has taken other actions to prevent parents access to their own kids' records;
Emails showing that FCPS has made educational decisions related to kids based on whether their parent is vocal or working with someone who is vocal;
Emails showing FCPS retaliated and intentionally denies independent educational evaluations (IEEs) at public expense, even though it paid out evaluations to the same providers at the same rate years before;
Emails showing some of FCPS lawyer John Cafferky's due process hearing practices;
Legal invoices showing how much FCPS spends on lawyers;
and more.
FCPS states:
"Since learning of its publication on November 1, 2023, FCPS has worked to contain and secure the deletion of the information involved in this matter."
I'd love to know what this means myself. Maybe it means FCPS is trying to figure out a way to get back the emails in which it admits it spent years pushing a reading program on kids who have Dyslexia, even though it knows the program isn't intensive enough? Or, maybe it means that it is trying to figure out how to contain the emails indicating it retaliated against families and intentionally refused to pay independent educational evaluations (IEE) at public expense, even though its rates had been out of date for years?
What else did FCPS leave out?
- FCPS refused me in-person access to my kids' records for over a decade.
- FCPS lost a state complaint, which resulted in me finally being provided access to review my kids' records in person.
- FCPS had months to pull together the records. However, since FCPS adamantly insists that it maintains records in accordance with its own guidelines, pulling everything together should have been just a matter of putting everything in one room.
- FCPS has breached the privacy of my family repeatedly since 2018 and I've made FCPS aware of breaches since 2016. In addition, I've filed complaint after complaint with VDOE and SPPO in an effort to stop the noncompliance.
- Given I've been so vocal about FCPS' breaches—and given the fact that the breaches continue to happen—one might assume that FCPS would triple check everything in advance.
- When I did the review, a FCPS paralegal was with me the entire time and a FCPS IT tech came in, too. They helped me find recordings that FCPS had withheld from me for years, and which FCPS previously told VDOE that it had provided to me in an accessible format. The paralegal and IT tech confirmed that the recordings were not saved correctly, hence I finally had proof that FCPS provided false information to VDOE and that VDOE accepted what FCPS said, based on FCPS' testimony rather than VDOE actually doing an investigation.
- I copied old FERPA requests while looking through paper records, since I'd lost info through the years. I DID NOT know that I was copying records for over 35,000 kids. FCPS had repeatedly told me these records were my kids' records.
- I did see a paper record that had other kids' names. I copied it because the info for other kids was benign (ADDED 12.21.23: benign = it had a few names in the corner of a page, and no other information) and the majority related to my own kids. I was planning to say something after I finished everything. After years of being denied access, I just wanted to get through everything for my own kids.
- Later, I realized what happened and immediately filed complaints with Office for Civil Rights and Office of Inspector General at U.S. Department of Education because VDOE, FCPS, and SPPO had all failed to stop the years of breaches. At an OCR lawyer's suggestion, I filed with SPPO. In addition, I filed complaint with the Department of Justice and with the Federal Bureau of Investigation.
- I did not contact FCPS immediately because I knew FCPS would try to hide it. Indeed, after I filed a complaint with VDOE, FCPS said the breach was a one-off. FCPS neglected to tell VDOE that after I found the records and after I filed a separate complaint with VDOE, FCPS emailed me an unredacted record for another student and then about two weeks later Robinson HS emailed thousands of report card records to one parent.
- I contacted a journalist I trust, with hope that she would do a comprehensive story that might gain the attention of leaders who would stop the noncompliance, and that more parents would consider speaking up to stop the noncompliance.
What of the Records?
You have to ask FCPS what records it provided and what it did with the records I eventually found.
I did not keep all the records for other kids. Hence, for those of you who have contacted me, I can't tell you what FCPS put in my kids' records that relate to your kid/s.
For families/kids/lawyers I know, I set aside any info I ran across, redacted the info specific to their children, contacted them to let them know what happened and asked if they wanted the records sent to them. If they said yes, I sent them the records that were redactly specifically to their kid.
I spent days without sleeping to redact these records so these families knew, because based on experience, I had no confidence that FCPS would admit what occurred and/or share exact records.
What Now?
Parents can consider filing a FERPA-related complaint with VDOE and/or SPPO.
In addition, parents can consider contacting FCPS leadership:
Superintendent Michelle Reid: mcreid@fcps.edu
FCPS Counsel John Foster: jefoster@fcps.edu
I mention John Foster because he was all over emails from 2020, which I remembered last night, after a parent made me aware that FCPS is working with Experian as the place parents can call for more info.
This mention triggered a memory from 2020, when FCPS was hacked.
At the time, my info was included in what was hacked. I contacted Experian over and over and no one could tell me anything. I later started contacting FCPS leadership over and over. FCPS eventually provided me a generic list of info that might have been obtained by the hacker. I said no and wanted specific info.
FCPS' internal emails—something I also found within my kids' records—indicate that in addition to not having something in place to prevent hacking, FCPS didn't have anything solid in place on the reactive end. In addition, they chose to try to get away with providing generic info rather than providing the actual info that was hacked, and which individuals have a right to know about.
Their emails indicate, too, that if someone contacts them after weeks of not being provided answers, any request is considered a "demand".
Eventually FCPS provided me the info hacked.
I share all of this with hope that what I experienced with FCPS and Experian in 2020 might help you now.
FCPS has a history of providing misinformation.
Hence, when FCPS advised me of something, I've found it best to verify everything FCPS says. Too often, the truth relies elsewhere.
While informing the public of a data breach is appropriate, you should have also done two other things. 1. You should have informed FCPS immediately. Trust was the reason you cited, but it appears that you didn’t because of pride. 2. Immediately deleted all records not about your child. Sifting through them for information whether it be for people you know or not is unethical and a breach on the same order as those you accuse.
Exposing data breaches is important. The way organizations learn to reduce them requires that they be aware. The sooner the better, because it isn’t the organization in many cases that is the victim, it is the rightful owner.
Brian, Thank you for your comment. I’ve been making FCPS and VDOE aware of privacy breaches that have been occurring since 2016. Yet that awareness didn’t stop the breaches. I spent the last five years filing complaints with VDOE and SPPO. Both found FCPS in noncompliance, yet, the breaches continued. This time, when I realized what happened, I filed complaints with Office for Civil Rights and Office of Inspector General at U.S. Dept of Ed., and contacted the Dept of Justice and Federal Bureau of Investigation, with hope they might step in where FCPS, VDOE, and SPPO have previously failed. I did delete records, too. I hope you’ll consider filing a complaint with SPPO and/or VDOE since we’re on the same page about awareness is necessary. In this case, FCPS has been saturated in at least seven years of awareness, so contacting those above FCPS might be something to consider. Thanks again for your comment, Brian. Best, Callie
How does it feel to be a complete scumbag needlessly disrupting the lives of tens of thousands of families? Shame on you. If you had any integrity, you would stand tall in front of the tens of thousands of parents who would now like a word with you.
Robert, Thank you for your email. Filing a complaint with SPPO and/or VDOE is something you might consider in an effort to address FCPS’ past seven years of needlessly putting families through privacy breaches. I’ve filed complaints repeatedly for the past five of those years, but the breaches continue. Perhaps if more parents speak up, FCPS could be held accountable for its many FERPA breaches, in addition to the other noncompliance for which it is at fault. Thanks again, Robert. Best, Callie
I find it hard to believe that you had access to 35,000 student records and you thought they were all related to your kids In your frustration and anger — justified or not — you have exposed thousands of families to a great deal of stress and insisted we trust you to delete and protect us. I can’t file a complaint against you for exposing my child. Add to that the money that will now go to lawyers rather than providing special education services. Where is the win?
Thank you for your email. FCPS’ thumb drives and discs were supposed to hold my kids info. There was nothing on them indicating they contained info for 35,000+ other kids. There is never a “win” when it comes to noncompliance. However, there can be accountability. Parents have the right to file complaints with VDOE and/or SPPO to address FCPS exposing the records of thousands of students through carelessness and years of failing to have a system in place to ensure protection of student records. Thanks again. Best, Callie
Callie.
After I received the notice from FCPS, I thought of you. I wondered when a post like this would appear that could provide more insight into this event, and voila! I’ve been following your struggles to keep FCPS honest for some time now. Earnestly and deeply, I and my family thank you for your efforts and wish you patience, strength, and increasing courage.
I am dumbstruck by the simultaneous incompetence and smugness/condescension that emanates from the FCPS administration. I will be following your suggestion to file a FERPA-related complaint.
While I agree in principle with comments above about handling sensitive personal information, it is painfully clear that FCPS has proven to be FAR MORE reckless and irresponsible with sensitive personal information than anything you say you have done.
Stay strong!
Zaven, Thank you for your kind words and for your understanding of the history behind the breaches. Please know I never have and never will publish private information about children. My focus is on stopping the breaches. That I’m on year seven of making FCPS, VDOE, SPPO, and others aware of the breaches is mindboggling – as is FCPS’ failure to clean house and ensure a system is in place to prevent breaches. Best, Callie
As one of the parents of the children that you were given information about, this is extremely disturbing. I feel as if my daughter’s fight for a fair education that I have been fighting for the last seven years was finally getting somewhere. She had just gotten her IEE and the results are as disturbing as this breech of her privacy information. I have a team that is fighting against the unfair way that my daughter’s education has gone in her elementary school, due to a principal that acts as if she is personally affected if my daughter gets an IEP. I am concerned as I think that you received information about both of my children, medical information and a sexual assault that they have records of. I stayed up crying last night at the unfairness of this situation and the fact that if you can get the information, how many other people can get the information. Data integrity is extremely important especially to victims of sexual assault and we have a protective order that was issued that made it where our address and phone number were supposed to be protected at all costs.
I am aware of another such situation that is having a huge impact on the family involved where the Elementary School gave out personal information to a father that was in prison because of his sexual assault on his own children and the school sent him all of their personal information and now the family is receiving death threats from the father.
Thank you for your comment. I’m saddened to hear that you’ve experienced what so many other families who have students with special education needs have experienced. With the IEE, was it comprehensive? FCPS has a history of approving IEEs at a specific rate, and neglecting to tell parents that IEEs aren’t always comprehensive. I wrote a little about VDOE’s 16-years-long failures to address IEE problems within FCPS here: “Updated 11.1.23—16 Years of Noncompliance: Virginia Department of Education Fails Students and to Perform Its General Supervisory Duties” The article is based on my own experience and that of friends, as well as internal FCPS emails I recently found within my kids’ records that support this. You do have the option of filing a complaint with Office of Civil Rights if you feel the principal’s actions are retaliatory and/or discriminatory. With the sexual assault records, this is not the first time FCPS has done this. The 74 wrote about one of the families that has experienced this repeatedly: “Alleged Rape Victim Presses Virginia’s Fairfax Schools for Answers on Records Disclosure” For the data integrity, you asked “how many other people can get the information”? That is a question for FCPS. To my knowledge I’ve been one of the most vocal parents on this issue for the past seven years. Yet, in an email AFTER the breach FCPS sent the letter about, FCPS emailed me and VDOE a record for another student that it failed to fully redact. If it is doing this with someone it knows has repeatedly tried to stop such noncompliance, what is going out elsewhere? Parents might consider accessing their right to do in-person reviews of their kids records to ensure what is suppossed to be in them is actually in them – and then to find out the location of anything that might be missing. Thanks again for your comment. Best, Callie
Callie,
Thank you for your time and the work that you do. I was very concerned after reading the letter from FCPS Superintendent Dr. Reid about this data breach. I contacted the number provided for more information only to speak with a rep from “Experian” who was unable to provide any additional information or answer any of my questions. Your post has provided much needed clarity on the situation. We really appreciate your hard work and dedication. Thank you!!
Richard, Thank you for your comment and your kind words. I shared my own experience with Experian and with attempting to obtain specific information from FCPS in the “Pro Tip” article. I found that going to the leadership directly proved the fastest way toward obtaining an answer. In addition, filing complaints is something parents can consider, with hope the noncompliance is eliminated and that FCPS money can be invested in students, training staff to ensure compliance, providing support staff to help teachers ensure compliance (to include ensuring provision of FAPE to every student), and making FCPS one of the best school systems in the nation for all students, no matter their backgrounds, needs, and/or abilities.
Thanks for providing more info on what happened but this is very disturbing as my child’s record is now exposed. Though my heart goes to you for your journey and struggles, I find it hard to digest that you actually went through these records looking for some information. Hoping and trusting you have deleted the records.
Michelle, Thanks for your comment. I did not keep all the records related to other kids – nor have I published, nor would I ever publish private student information. If you look at what I published, you’ll see records that primarily relate to FCPS retaliating, acknowledging that the reading program it pushed on kids for years who have Dyslexia isn’t intensive enough for them (but that they had already attempted to tell one hearing officer otherwise and were planning to tell another hearing officer otherwise), and invoices showing things like it paid lawyers to monitor this site to find out about privacy breaches, since many parents are afraid to speak and thus contact me instead of FCPS.
You mention “that you actually went through these records”. The word “records” is misleading. There weren’t 35,000+ records. There were a few dozen files that were supposed to be former FERPA requests I filed for my kids. The files weren’t labeled in a manner that indicated they contained info on thousands of other kids. Some of the files were related to just my kids. The ones that weren’t, to my knowledge had email after email and their attachments on them. For example, if I opened a file, I found pages and pages of emails all run together and their attachments. The majority of the emails I saw related to my kids. However, sometimes the emails mentioned other kids within the context of the emails. Because many of the parents who advocate for their kids help friends/neighbors/etc as supports, the names I recall seeing within the emails mainly were parents and other kids I know. The attachments I recall seeing almost all related to my kids. However, some were redacted and some weren’t. Hence, when I looked through the emails, what I mainly saw related to my kids. However, when I looked at attachments, that’s when I was surprised. There were some exceptions, with emails and attachments that were unrelated, but for the most part, those were the exception, not the rule. For the larger records, after verifying my kids’ info, I scrolled to the bottom to look at the cell number, to identify the number of students. I knew I was going to file another complaint given this is the 7th year I’ve known of breaches occurring over and over, and wanted to be able to provide an approximate number of students. That didn’t involve reading student info. It involved doing a search for my kids and then scrolling down to the bottom to find the number associated with the final cell. That’s mainly what were on the attachments I saw: lists, not individual records for individual kids. I hope this helps answer any questions you have.
Parents might consider contacting FCPS to do reviews of their own kids’ records. FCPS has a history of not advising the community of FERPA failures unless a complaint is filed and/or it is made public in another manner, hence none of us really know what has been released about any of our kids previously this past decade, and I doubt that in some instances FCPS knows because parents are afraid to speak out, just for the reason they are seeing with what happened here. FCPS knows I didn’t refuse to delete records and it knows that I didn’t publish personally identifiable public information related to students, nor did I publish personal records specific to individual students simply because, to my knowledge, I recall seeing maybe one record that fell in that category and didn’t publish it.