The Shakopee school district is facing student privacy questions in light of charges that former Superintendent Rod Thompson gained access to school computer records after leaving the district.
The school board terminated Thompson’s contract one year ago and he was later charged with 21 counts alleging he embezzled nearly $74,000 over five years from the school district. He is scheduled to go to trial on those charges Nov. 21.
But on Monday, he was arrested again on four new misdemeanors alleging he accessed and altered documents via the school district's Google Drive as recently as last month.
According to the charging documents, the Shakopee school district discovered an unknown person was accessing files on its Google Drive account in May. Police traced the activity back to Thompson, who allegedly used an email address created in July 2012. Police allege he got into an Academies of Shakopee Master Plan Google Drive in January and in March changed the visibility on the file from "anyone" to "private," and the link sharing from "can view" to "none," which affected everyone's access to the document.
The complaint also alleges Thompson downloaded five files from the drive in April and accessed a file with the Academies placement list in May. That list included private student information, such as names, special education designations, ethnicity, gender and student ID numbers. The information is not public data under state law.
The Shakopee school district released a statement today saying it "adheres to all data privacy laws and protocols as required by the government."
"We take the sharing and storage of your student’s information seriously. We are actively exploring options to increase our ability to analyze staff use of Google Drive and improve the security of our processes."
In response to questions in the wake of Thompson's arrest, the district explained that occasionally, staffers collaborate with people outside of the district and use Google Drive to share documents such as curriculum, lesson plans and school work — not student data.
"We expect our staff to be professional and ethical when sharing," the statement said. "Unfortunately, in this case, the sharing was not."
Parents are now wondering if their students data was breached, and the district said a file with the names of next year's Shakopee High School students' names was accessed with some demographic data about each student, "but not information that could be used to steal identities."
To prevent this from happening again with former employees, the district said it will remind staff of their ethical responsibilities when sharing data and ask them to review sharing settings on the documents and remove anyone who doesn't legitimately need access.
"The reality is that the great majority of our Google Drive use is for sharing of things like curriculum, lesson plans, and school work — not student data," the statement said.
They also vowed to "thoroughly investigate any staff who are dismissed from district employment to note whether they might have personal accounts that could potentially have files shared to them."
Check out our extensive investigation into this case by clicking here.
