Giant database to track Hoosier students from school to workplace

Imagine a giant database filled with every Hoosier student’s elementary and high school achievement test scores, SAT scores, college degrees and eventually job and salary history.

State officials are preparing to build it. They want it to tell them exactly what happens to students who don’t finish high school or who switch majors in college. But the big payoff would be forecasting the job market and using that information to adjust the education system to deliver workers to meet the needs.

Gov. Mike Pence endorses the database, which fits nicely with his plans to narrow the gap between available high-skilled jobs and the number of properly trained Hoosiers available to fill them.

Many agree the goals are laudable, and officials say great care will be taken to strip the database of student names and other information that could identify a person.

Still, Big Brother concerns are creeping in. Some privacy advocates worry about possible security breaches and the reconnecting of personal identities to the data.

“I’m totally sympathetic with this effort,” said Indiana University law professor Fred H. Cate, director of the Center for Applied Cybersecurity Research at the IU Mauer School of Law in Bloomington. “Policy-makers ought to want good data to deal with issues like the brain drain. And the state invests a lot of money into education.

“But there are a lot of problems here,” he said, after reading the law passed in March to create the giant database. “I have a lot of questions about if they are taking the necessary steps to build privacy and security into these systems from the start.”

Sights on ‘big picture’

The mega data-sharing system — dubbed the Indiana Network of Knowledge, or INK — is intended to track students from elementary school through high school and college and into the workforce, and produce “big picture” job and education trend information.

That would be accomplished by electronically linking data from the Department of Education, Commission for Higher Education and the Department of Workforce Development, while trying to persuade employers to share job and salary histories.

“A lot of states are developing longitudinal databases on how students are performing and translate that into how well the education system is doing,” said Rep. Steve Braun, R-Zionsville, author of House Enrolled Act 1003, which established INK.

“But there’s nobody currently that is looking at the future job market effectively and using that to inform the education system,” he said. “That is obviously the greatest value in terms of closing the skills gap because it really aligns the education system with the job market.”

State officials say privacy and data security are top priorities that already guide the less-structured, data-sharing system that the state currently operates, called the Indiana Workforce Intelligence System. It began in 2006, with agencies basically having to re-invent databases for each project they launched.

“It’s clear the legislation was written in such as way to make sure privacy is protected,” said Teresa Lubbers, Indiana’s higher education commissioner. “You have to be concerned about privacy issues. There is nothing that doesn’t meet the code, standard, the law and the expectation of privacy.”

The law calls for INK to develop and implement a detailed data security and safeguarding plan. That plan would set access by authenticated users, and establish privacy compliance standards and procedures to protect system data if a breach occurs.

Yet some privacy experts and parent activists have serious questions about how well this data will be protected from misuse and from allowing personally identifiable information to be discovered.

A number of states and the federal government have been building databases with more granular data, about specific students, to find out what types of initiatives are effective and to track individual student’s paths through schooling and the workforce.

History suggests, Cate said, that almost nobody designs these types of data systems to offer adequate privacy protection. “It’s not that hard, it’s just not done very often.”

Parent activists like Erin Tuttle, an Indianapolis Catholic school parent and co-founder of Hoosiers Against Common Core, is equally concerned.

“The fear that people have is that it (data) will be shared and sold,” said Tuttle. “A lot of people don’t want their data out there because of all the violations and all the ways that it can be manipulated. Those things get hacked all the time.”

She realizes state officials say INK data won’t include personally identifiable information, such as names or Social Security numbers. But she said “re-identification” is possible by matching up several data points from different data bases.

“I don’t think people should be tracked all the way through the workforce,” she said. “I think it’s very dangerous. It really is one of those Pandora’s boxes.”

Cate said some fear such data systems also could be used for unadvertised purposes such as tracking down students with unpaid loans or who might be involved in terrorist activities.

“That fear is not totally an imaginary fear,” he said. “One of the first places the FBI turned after 9/11 (terrorist attacks) was to universities.”

Federal protections

The federal law protecting access to student information, known as FERPA, doesn’t allow the FBI to just call and ask for the data, he said. But one of the biggest concerns that make privacy advocates like him nervous, he said, is imagining the government already having access to such data without having to get legal permission to use it.

Those types of concerns, say state officials and other supporters of INK, are unfounded.

Under the new law, the data is protected under state and federal privacy laws, including FERPA, which the agencies involved have to follow. They say checks and balances are designed into the law through a five-member committee that will control and monitor the use of the data, decide what research will be done and who will conduct it.

Jackie Dowd, the governor’s special assistant for career innovation, has heard the privacy concerns. But she says the new law sets up the best structure to control data use and to ensure agencies are following strict privacy policies under state and federal laws.

“Each agency has responsibility for and maintains control of its own data,” she said. “The data is not for sale.”

While the data-sharing system allows researchers to track a certain person, Dowd said, it’s not possible to identify that person. The longitudinal data system won’t hold a person’s Social Security number or student access number used by the education department, nor will it hold medical or criminal records. In addition, she said, data sets with small numbers of individuals — which would allow for easier identification — won’t be used.

“The law sets up the governance structure that we know to be a really good practice for purposes of security of the data and use of the data and putting together public reports,” said Dowd.

But Cate doesn’t like how the governance system is set up.

“I don’t want decisions on how all of this data is going to be used to be handled by a five-person committee,” he said. He’d rather put those decisions in the hands of the legislature or attorney general’s office.

While the privacy protection of FERPA is good, he said, it may not good enough in this circumstance. The law has been changed to allow more authorized users of student data, he noted. Also, educational institutions that violate the law can be penalized by the U.S. Department of Education withdrawing federal aid, but he questions who is going to enforce FERPA violations against this state database.

Based on reading the law, Cate also said he didn’t see enough evidence of what he calls “privacy by design” — designing privacy into the system, rather than adding it later. “You really want rules, to build a system so it’s appropriately protective, with policies and procedures in place to prevent wrongdoing and to detect it if it occurs.”

The perfect example of what can go wrong is what Edward Snowden was able to do, he said. The former Central Intelligence Agency employee and former contractor for the National Security Agency disclosed thousands of classified documents to media outlets.

“The government didn’t seem to notice he was collecting 1 million documents,” said Cate. “If the NSA didn’t notice, what steps is the state of Indiana taking to detect somebody who is collecting or using the data inappropriately?”

State precautions

Molly Chamberlin says many provisions exist under FERPA, the state’s new law and existing practices to keep data protected and out of the wrong hands. She is now chief assessment and accountability officer with the Center for Education and Career Innovation, and she’s also worked in top data positions for the state education department and higher education commission.

“FERPA states who has legitimate interests to access identifiable data,” she said. “There are very few individuals. It is still fairly limited on how and when and for what purposes data can be shared.”

Provisions exist, Chamberlin said, that allow data to be shared to entities working on behalf of those with a legitimate educational interest in the data, but those entities have to sign data-sharing agreements, destroy data when it’s no longer used and are susceptible to penalties.

She stopped short of saying privacy breaches could never happen.

“I wouldn’t say there’s never a risk of identifying information (being released),” she said. “Despite everything that’s put in place, information can be misused.”

Seeing the benefits

To many involved in supplying or using the data, the overall and long-term benefits to the state and to students make the data-sharing system worth it.

“It will allow us to see trends, to see where Hoosiers go after school,” said David Galvin, spokesman for the Indiana Department of Education. “It will help with budgeting and directing course work. And it will show our strengths and weaknesses and where the state can focus its resources to help Hoosiers get the jobs they need to improve their quality of life.”

Jeff Terp, executive vice president and chief operating officer of Ivy Tech Community College, doesn’t see a down side – only benefits.

Does he have privacy concerns? “None whatsoever. We share data now with others and there are no privacy issues.”

When this data-sharing system is fully in place, Terp said Indiana will be competitive with states like Florida and Texas, who are national leaders in tracking educational and workforce data.

Now, colleges like Ivy Tech can tell students what their entry level jobs will pay, based on the job market, he said. What he can’t track is how well students in a certain field do after graduation and exactly what jobs they take.

“It’s almost theoretical versus actual data,” he said.

The “big picture” information about educational and job trends will be invaluable to state lawmakers, government officials and policy-makers deciding how to spend taxpayer dollars and develop educational and job programs, Terp and others agree.

“It will allow the state to track the return on investment – the number of people trained, the better jobs they get and how much more revenue they generate for the state,” he said.

Call Star reporter Barb Berggoetz at (317) 444-6294. Follow her on Twitter @barbberg.

Who would oversee the database?

The oversight committee would include:

• State superintendent of public instruction

• Chief of the Commission on Higher Education

• Commissioner of the Department of Workforce Development

• A representative of private colleges and universities

• A business community representative

The governor can also appoint other committee members and must name an executive director of the database initiative by July 15.