Incident: Title: Cyber Attacks Disrupt Miami-Dade County Public Schools Virtual Learning

Published Date: 2020-09-03

Postmortem Analysis
Timeline 1. The software failure incident happened in September 2020 [104744].
System 1. My School Online (MSO) virtual learning system 2. Distributed Denial of Service (DDoS) protection software [104744]
Responsible Organization 1. The software failure incident was caused by a Miami high school junior, 16, who carried out cyber attacks on the Miami-Dade County Public School (MDCPS) computer network [104744].
Impacted Organization 1. Miami-Dade County Public Schools computer network [104744] 2. Students and teachers of the Miami-Dade County Public Schools [104744]
Software Causes 1. The failure incident was caused by a wave of cyber attacks orchestrated by a Miami high school junior, 16, who used an online application to carry out distributed denial of service attacks on the Miami-Dade County Public School (MDCPS) computer network [104744].
Non-software Causes 1. Lack of proper warning or caution from the Florida Education Association regarding the use of the virtual learning system [104744]. 2. Issues with the $15 million contract related to the virtual learning platform [104744].
Impacts 1. Students and teachers were unable to access virtual learning set up for the start of the school year, leading to disruption in education [104744]. 2. The district's computer networks were overwhelmed by multiple cyber attacks, including distributed denial of service attacks and software glitches, blocking access to servers and the virtual learning system [104744]. 3. More than 170,000 students and teachers were prevented from logging into the system during the fifth attack alone [104744]. 4. The district had to scramble to minimize disruption to students' learning, leading to the movement of students in grades 6-12 to different systems [104744]. 5. The attacks led to the consideration of axing the new online learning system altogether by the district superintendent [104744]. 6. The national outage of the virtual learning platform caused complaints from teachers and students about not being able to access classes [104744]. 7. The attacks resulted in the involvement of various law enforcement agencies such as the Miami Dade Schools Police Department, the FBI, the Secret Service, and the Florida Department of Law Enforcement in the investigation [104744].
Preventions 1. Implementing stronger cybersecurity measures to prevent unauthorized access and attacks [104744]. 2. Conducting regular security audits and vulnerability assessments to identify and address potential weaknesses in the system [104744]. 3. Providing cybersecurity training and awareness programs for students and staff to prevent malicious activities like cyber attacks [104744].
Fixes 1. Implementing stronger cybersecurity measures to prevent future cyber attacks [104744] 2. Conducting a thorough review and potential overhaul of the online learning system to address any vulnerabilities or glitches that were exploited during the attacks [104744] 3. Enhancing monitoring and detection capabilities to quickly identify and respond to any suspicious activities on the network [104744] 4. Collaborating with cybersecurity experts and agencies to improve the overall security posture of the school district's computer network [104744]
References 1. Miami-Dade County Public School district officials 2. District Superintendent Alberto Carvalho 3. MDSPD Chief Edwin Lopez 4. Florida Education Association 5. Dr. Steve Gallon, Vice Chair of the school board 6. Republican Senator Marco Rubio

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: - The Miami-Dade County Public School (MDCPS) computer network was hit by at least 14 attacks, including distributed denial of service attacks and software glitches, which overwhelmed the district's servers and blocked access to the virtual learning system [104744]. - The district superintendent mentioned that they had experienced cyber attacks previously, but this incident was particularly severe, leading to considerations of scrapping the online learning system altogether [104744]. (b) The software failure incident having happened again at multiple_organization: - The article does not provide specific information about similar incidents happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in Article 104744 can be attributed to the design phase. The incident was caused by a wave of cyber attacks on the Miami-Dade County Public School (MDCPS) computer network, which left students and teachers unable to access virtual learning set up for the start of the school year. The attacks overwhelmed the district's computer networks, including the virtual learning system My School Online, due to a software glitch that blocked access to the district's servers [104744]. (b) The software failure incident in Article 104744 can also be linked to the operation phase. The attacks completely overwhelmed the systems, disrupting the virtual learning system and preventing more than 170,000 students and teachers from logging in. District officials scrambled to minimize disruption to students' learning, and students in grades 6-12 were moved to different systems to address the operational challenges caused by the cyber attacks [104744].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident involving cyber attacks on the Miami-Dade County Public School (MDCPS) computer network was primarily caused by factors originating from within the system. The attacks were carried out by a 16-year-old student using an online application to overwhelm the district's computer networks [104744]. The attacks led to a software glitch that blocked access to the district's servers, affecting the virtual learning system My School Online [104744]. Additionally, the district superintendent mentioned considering axing the new online learning system altogether following the attacks [104744]. (b) outside_system: The software failure incident also involved contributing factors originating from outside the system. The attacks on the MDCPS computer network were not limited to local sources, as some attacks came from outside of the US [104744]. This external factor added complexity to the incident and required involvement from various law enforcement agencies, including the FBI, Secret Service, and the Florida Department of Law Enforcement [104744].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions. The incident involved a wave of cyber attacks on the Miami-Dade County Public School (MDCPS) computer network, which left students and teachers unable to access virtual learning. The attacks were carried out by using an online application to overwhelm the district's computer networks, leading to distributed denial of service attacks and a software glitch that blocked access to the district's servers [104744]. (b) However, human actions were also involved in this software failure incident. The attacks were orchestrated by a 16-year-old high school junior, David Oliveros, who confessed to being behind the cyber attacks on the school's computer network. Oliveros was arrested and charged with computer use in an attempt to defraud and interference with an educational institution. The district superintendent expressed disappointment that a student was behind the attacks and mentioned considering scrapping the online learning system following the incident [104744].
Dimension (Hardware/Software) software (a) The software failure incident reported in Article 104744 was primarily due to software-related factors. The incident involved a wave of cyber attacks on the Miami-Dade County Public School (MDCPS) computer network, which left students and teachers unable to access virtual learning. The attacks were carried out using an online application by a high school junior, resulting in distributed denial of service attacks and a software glitch that blocked access to the district's servers [104744]. The district's virtual learning platform, My School Online, was overwhelmed by the attacks, preventing thousands of students and teachers from logging in [104744]. (b) The software failure incident was not attributed to hardware-related factors but rather to software-related issues. The attacks were carried out through software applications, causing disruptions to the virtual learning system and blocking access to the district's servers. The incident involved cyber attacks and software glitches that affected the functionality of the educational software used by the Miami-Dade County Public School [104744].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case was malicious, as it was caused by a 16-year-old high school junior who confessed to carrying out cyber attacks on the Miami-Dade County Public School computer network with the intent to disrupt the virtual learning system set up for the start of the school year [104744]. The attacks overwhelmed the district's computer networks, leading to multiple disruptions and preventing students and teachers from accessing the online learning platform. The student responsible for the attacks was arrested and charged with computer use in an attempt to defraud and interference with an educational institution. Additionally, law enforcement officials mentioned that they believe other attackers are still at large and are actively pursuing them to bring them to justice.
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was not due to poor decisions but rather intentional malicious actions. The incident involved a 16-year-old high school junior who confessed to carrying out cyber attacks on the Miami-Dade County Public School computer network using an online application [104744]. The attacks were deliberate and aimed at disrupting the district's virtual learning system, affecting students and teachers' ability to access online classes at the start of the school year. The student behind the attacks was charged with computer use in an attempt to defraud and interference with an educational institution, indicating a deliberate intent to disrupt the system [104744].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Article 104744 was not due to development incompetence but rather was a result of a deliberate cyber attack carried out by a 16-year-old high school junior. The student confessed to using an online application to launch multiple attacks on the Miami-Dade County Public School computer network, causing disruptions to virtual learning [104744]. (b) The software failure incident in Article 104744 was accidental. It was a result of cyber attacks orchestrated by the student, which overwhelmed the district's computer networks and led to disruptions in accessing the virtual learning system. The attacks were not accidental but were intentionally carried out by the student [104744].
Duration temporary The software failure incident reported in Article 104744 was temporary. The incident involved a wave of cyber attacks on the Miami-Dade County Public School (MDCPS) computer network, which left students and teachers unable to access virtual learning at the start of the school year. The attacks overwhelmed the district's computer networks, leading to distributed denial of service attacks and a software glitch that blocked access to the district's servers. The attacks completely overwhelmed the systems, including the virtual learning system My School Online, preventing more than 170,000 students and teachers from logging in. However, the district officials scrambled to minimize disruption, and students in grades 6-12 were moved to different systems to continue their learning [104744].
Behaviour crash, omission, value, other (a) crash: The software failure incident in Article 104744 can be categorized as a crash. The incident involved a series of cyber attacks on the Miami-Dade County Public School computer network, which resulted in the system being overwhelmed and unable to function properly. This led to students and teachers being unable to access the virtual learning system set up for the start of the school year [104744]. (b) omission: The incident can also be categorized as an omission. The attacks on the school district's computer network resulted in the system omitting to perform its intended functions, specifically blocking access to the district's servers and preventing students and teachers from logging into the virtual learning system [104744]. (d) value: Additionally, the software failure incident can be categorized as a value failure. The attacks caused the system to perform its intended functions incorrectly, as it failed to provide the necessary access to the virtual learning platform for over 170,000 students and teachers [104744]. (f) other: The incident can also be described as a denial of service attack, where the system was overwhelmed by the volume of malicious traffic, leading to a disruption in services and preventing legitimate users from accessing the system [104744].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay, non-human, theoretical_consequence, other (a) unknown (b) unknown (c) unknown (d) Property: The software failure incident impacted people's access to the virtual learning system, My School Online, which left more than 170,000 students and teachers unable to log in, disrupting their education [104744]. (e) Delay: The software failure incident caused disruption to students' learning as they had to be moved to different systems, and the district was considering scrapping the online learning system altogether [104744]. (f) Non-human: The software failure incident affected the Miami-Dade County Public School computer network, leading to multiple distributed denial of service attacks that overwhelmed the district's servers and blocked access to the system [104744]. (g) unknown (h) unknown (i) Other: The software failure incident resulted in the district superintendent considering axing the new online learning system, and there were discussions about potential cybersecurity implications for school districts, prompting a request for a briefing with the Department of Homeland Security on cybersecurity [104744].
Domain knowledge (a) The failed system was intended to support the education industry. The incident involved cyber attacks on the Miami-Dade County Public School (MDCPS) computer network, which disrupted virtual learning set up for the start of the school year due to the coronavirus pandemic [104744]. The district was using a virtual learning platform called My School Online (MSO) run by education tech giant K12 for conducting classes virtually [104744]. The attacks affected over 170,000 students and teachers, preventing them from logging into the system [104744]. District officials scrambled to minimize disruption to students' learning, and students in grades 6-12 were moved to different systems to continue their education [104744]. The incident led to discussions about potentially scrapping the online learning system following the attacks [104744]. Dr. Steve Gallon, Vice Chair of the school board, described the attacks as 'an utter fail' in terms of the system's implementation and functionality [104744].

Sources

Back to List