Incident: Cyberattacks Cause Widespread School System Failures on First Day

Published Date: 2020-09-22

Postmortem Analysis
Timeline 1. The software failure incident happened on the first day of school for many American schoolchildren after Labor Day, which was on a Tuesday. The incident was reported in an article published on September 22, 2020 [Article 104687]. 2. Estimation: The incident occurred on September 8, 2020.
System 1. Server issue in Philadelphia [104687] 2. Statewide software problem in North Carolina [104687] 3. Lack of guidance from state and federal education officials [104687] 4. Cloud-based web filter in Virginia Beach [104687] 5. Cyberattacks targeting servers in Hartford, Conn. [104687]
Responsible Organization 1. Cyberattackers targeted some 200 of Hartford's servers with ransomware, causing the software failure incident [104687]. 2. Glitches and cyberattacks, including deliberate attacks by a 16-year-old student in Miami-Dade County, contributed to the software failure incident [104687].
Impacted Organization 1. Students in Houston, Hartford, Virginia Beach, Philadelphia, North Carolina, Seattle, Chicago, Dallas, Baltimore, Washington suburbs, New Jersey, New York City, Cherokee County, and Miami-Dade County [104687].
Software Causes 1. Server issue in Philadelphia causing trouble logging on for students [104687]. 2. Statewide software problem in North Carolina on the first day back [104687]. 3. Students in Seattle being kicked out of class calls or having difficulty connecting to text chats and camera feeds [104687]. 4. Issue with the cloud-based web filter in Virginia Beach blocking students and teachers from logging in [104687]. 5. Cyberattacks targeting servers in Hartford, including the one managing school bus routes, leading to a delay in the first day of school [104687].
Non-software Causes 1. Lack of guidance from state and federal education officials [104687] 2. Pressure from teachers' unions and concern from parents and health officials [104687] 3. Rising virus caseloads [104687] 4. Teacher shortages, ventilation issues, and delayed guidance from the state [104687]
Impacts 1. The software failure incident led to the first day of classes being called off in Hartford, Conn., due to a ransomware attack targeting the city's servers, including the one managing school bus routes [104687]. 2. Students in Houston faced a website crash, leaving many unable to access online learning platforms, causing disruptions and frustration among parents and children [104687]. 3. Technical glitches, server issues, and software problems in various districts across the U.S., such as Philadelphia, North Carolina, and Seattle, impacted students' ability to log in, connect to classes, and participate in online learning [104687]. 4. The lack of preparation for online learning over the summer resulted in widespread technical issues, including students being kicked out of class calls and facing difficulties connecting to text chats and camera feeds [104687]. 5. The software failure incident in Virginia Beach blocked students and teachers from logging in for their first day of classes due to an issue with the cloud-based web filter, causing disruptions before service was restored [104687]. 6. Deliberate cyberattacks in Miami-Dade County disrupted online classes for days, leading to the arrest of a 16-year-old student in connection with the cyberattacks that contributed to the glitches [104687].
Preventions 1. Adequate preparation and testing of the online learning platforms during the summer months could have helped prevent the software failure incident [104687]. 2. Implementation of best practices and coordinated purchasing plans for virtual learning platforms with guidance from state and federal education officials could have mitigated technical issues [104687]. 3. Improved cybersecurity measures to prevent ransomware attacks and deliberate cyberattacks could have safeguarded against disruptions [104687].
Fixes 1. Improved preparation and planning for online learning platforms during the summer months to address technical glitches and issues [104687]. 2. Providing guidance and support from state and federal education officials to assist school districts in implementing best practices for virtual learning platforms [104687]. 3. Enhanced coordination and communication between school districts and technology providers to address technical difficulties such as server issues and software problems [104687].
References 1. Interim superintendent Grenita Lathan in Houston [104687] 2. Professor of education Morgan Polikoff at the University of Southern California [104687] 3. District spokeswoman in Virginia Beach [104687] 4. Superintendent Aaron Spence in Virginia Beach [104687] 5. 16-year-old student at South Miami Senior High School in Miami-Dade County [104687] 6. Spokesman John Fergus for Hartford district [104687] 7. Parent Ally Fonte in Miami-Dade County [104687]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - In Miami-Dade County, the district experienced cyberattacks that caused glitches during online classes. A 16-year-old student at South Miami Senior High School was arrested in connection with cyberattacks that contributed to the issues [104687]. (b) The software failure incident having happened again at multiple_organization: - Various school districts across the United States faced technical glitches and software problems on the first day of online classes, including server issues in Philadelphia, a statewide software problem in North Carolina, and difficulties connecting in Seattle [104687].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the article where it mentions that the Virginia Beach school district faced technical difficulties on the first day of classes due to an issue with the cloud-based web filter that the district uses to monitor students' online activity. This issue was a result of the system design and setup, as the district uses this filter as part of its system design to ensure online safety and monitoring [104687]. (b) The software failure incident related to the operation phase is evident in the article where it discusses how online classes in Miami-Dade County were disrupted by glitches for days due to cyberattacks. A 16-year-old student was arrested in connection with cyberattacks that caused these issues, indicating that the failure was a result of the operation or misuse of the system [104687].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incidents reported in the articles were primarily due to factors originating from within the system. For example, in Miami-Dade County, a 16-year-old student was arrested for cyberattacks that caused glitches in online classes [104687]. Additionally, in Virginia Beach, a cloud-based web filter issue blocked students and teachers from logging in on the first day of classes [104687]. (b) outside_system: The software failures were also influenced by factors originating from outside the system. In Hartford, a ransomware attack targeted the city's servers, including the one managing school bus routes, leading to the delay of the first day of school for nearly 18,000 students [104687]. This external cyberattack disrupted the system's operations and highlighted vulnerabilities in the district's infrastructure.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The article mentions a server problem in Virginia Beach that disrupted the first hours back to school, which was due to an issue with the cloud-based web filter used by the district to monitor students' online activity [104687]. - In Hartford, a ransomware attack targeted some 200 of the city's servers with ransomware, including the one managing school bus routes, leading to the delay of the first day of school for nearly 18,000 students [104687]. (b) The software failure incident occurring due to human actions: - In Miami-Dade County, online classes were choked by glitches for days due to cyberattacks that were later found to be contributed by a 16-year-old student at South Miami Senior High School [104687].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - In Miami-Dade County, online classes were disrupted by cyberattacks that were contributed to by a 16-year-old student [104687]. - In Hartford, a cyberattack targeted some 200 of the city's servers with ransomware, including the one managing school bus routes, leading to the delay of the first day of school [104687]. (b) The software failure incident occurring due to software: - In Virginia Beach, students and teachers faced technical difficulties on the first day of classes due to an issue with the cloud-based web filter used by the district [104687]. - In Houston, students encountered technical glitches when trying to log into the district's online learning hub, indicating software issues [104687].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident in Miami-Dade County was malicious, as a 16-year-old student was arrested in connection with cyberattacks that caused glitches in online classes [104687]. (b) Non-malicious software failures were also reported, such as server issues in Philadelphia causing trouble logging on, a statewide software problem in North Carolina, and technical difficulties in Virginia Beach due to a cloud-based web filter issue [104687].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incidents reported in the articles can be attributed to poor decisions made by the school districts and education officials. The lack of guidance from state and federal education officials, the rush to find virtual learning platforms, and the absence of coordinated purchasing plans left many districts unprepared for online learning [104687]. Additionally, the article mentions that some districts faced technical issues due to a lack of sufficient preparation for online learning over the summer, as they were still focused on opening in person until circumstances forced them to switch to remote-only instruction [104687]. (b) Accidental decisions or unintended mistakes also played a role in the software failure incidents. For example, in Miami-Dade County, online classes were disrupted by cyberattacks that were not anticipated on such a large scale, leading to technical difficulties for students and teachers [104687]. The incident involving a 16-year-old student at South Miami Senior High School being arrested for cyberattacks highlights how accidental decisions or malicious actions can contribute to software failures.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incidents reported in the articles can be attributed to development incompetence. The articles mention that many school districts faced technical glitches and issues with online learning platforms due to a lack of sufficient preparation for online learning over the summer [104687]. Additionally, the lack of guidance from state and federal education officials left districts on their own to tackle the challenge of finding virtual learning platforms and signing contracts within a short timeframe, leading to technical issues [104687]. (b) The software failure incidents can also be categorized as accidental. For example, in Miami-Dade County, online classes were disrupted by cyberattacks that were not intentional on the part of the school district but were caused by a 16-year-old student who was arrested in connection with the cyberattacks [104687]. Furthermore, in Hartford, a ransomware attack targeted the city's servers, including the one managing school bus routes, forcing the district to delay the first day of school [104687].
Duration temporary (a) The software failure incidents described in the articles were temporary in nature. These incidents were caused by specific contributing factors such as cyberattacks, glitches, and technical difficulties, rather than being permanent failures due to all circumstances. For example, in Miami-Dade County, a 16-year-old student was arrested for cyberattacks that caused glitches in online classes [104687]. Additionally, in Virginia Beach, a cloud-based web filter issue blocked students and teachers from logging in on the first day of classes, but service was restored before noon [104687]. These incidents highlight temporary disruptions rather than permanent failures.
Behaviour crash, omission, byzantine (a) crash: The articles mention instances of crashes such as a website crash in Houston, a server problem in Virginia Beach disrupting the first day of school, and a server issue causing trouble logging on in Philadelphia [104687]. (b) omission: The articles describe instances where the system omitted to perform its intended functions, such as students being kicked out of class calls or having difficulty connecting to text chats and camera feeds in Seattle [104687]. (c) timing: There is no specific mention of failures related to timing in the articles. (d) value: The articles do not provide information about failures due to the system performing its intended functions incorrectly. (e) byzantine: The incident in Miami-Dade County involved deliberate cyberattacks by a 16-year-old student that contributed to glitches in online classes, showcasing a byzantine behavior of the system [104687]. (f) other: The articles do not mention any other specific behaviors of the software failure incident.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence delay (e) delay: People had to postpone an activity due to the software failure - The software failure incidents caused delays in the first day of classes in various school districts, including Hartford, Conn., Houston, and Virginia Beach [104687]. - Students in Philadelphia had trouble logging on due to a server issue, causing delays [104687]. - North Carolina schools encountered a statewide software problem on the first day back, leading to delays [104687]. - Families in Seattle experienced being kicked out of class calls or had difficulty connecting to text chats and camera feeds, resulting in delays [104687]. - In Miami-Dade County, online classes were choked by glitches for days, leading to delays in the educational process [104687].
Domain knowledge (a) The failed system was intended to support the education industry. The incident involved various school districts experiencing technical glitches, server issues, and software problems as they transitioned to online learning platforms due to the COVID-19 pandemic. For example, Houston students faced a website crash [104687], Philadelphia students had trouble logging on due to a server issue [104687], and Virginia Beach encountered issues with a cloud-based web filter [104687]. These incidents highlight the challenges faced by the education sector in implementing online learning platforms effectively.

Sources

Back to List