UPDATE: New information released re: possible Fairbanks school district data breach
FAIRBANKS, Alaska (KTVF) - UPDATE: Fairbanks School District Superintendent Karen Gaborik sent an email to staff and families of students on Friday to share more information about the situation and clear up what they called misinformation surrounding the situation.
In the email the school district outlined the security process for computers that are sold.
"When it is determined district devices have reached the age where it is no longer economically feasible to maintain them, the district engages in the following surplus procedures:
- A work order may be created depending on device condition and type.
- Hard drives are removed, destroyed, or wiped clean.
- System entries such as Active Directory and FileWave are removed.
- District tags are removed.
- Shipping and Receiving collects the devices and bundles them for sale by a third party vendor.
- Auction agency conducts sale of auction items, collects payment, and provides receipt for collection of the awarded lot.
- Successful bidder presents receipt and takes possession of auctioned items."
The district says they are reviewing the process to prevent the release of future data.
The email also said that they do not admit there was date on the equipment or that it was not properly wiped. They said there has been no way to confirm the allegations because Bill Satterberg has not turned over the devices to be examined.
We spoke with Satterberg in an interview and he said the reason he has not released the computers is that he wanted to ensure the information was not deleted and swept under the rug. Satterberg claimed that he reached an agreement with the district to have them take the computers and look at them on the condition that no information was deleted or removed.
Satterberg also addressed concerns that his client, First Strike Asset LLC was only interested in money.
“We are not asking for any money damages, we are not asking for 5,000, we are not asking for 10,00, anything. The point is that the client filed a lawsuit because the public needs to know and he wanted court guidance and court assurance that this was taken care of without being swept under the rug,” Satterberg said.
We will continue to follow this story as it develops and will have more information regarding the story including interviews from Satterberg and his client as well as documents next week.
correction: Yesterday we reported that the Fairbanks North Star School District admitted to selling computers at a surplus auction that contained sensitive personal data of students and district personnel. That was not correct, the district did sell those computers at the surplus auction and according to the purchaser they contained sensitive data but the FNSB school district has not yet been allowed to examine the computers to confirm the data breach.
Original Story: According to a press release from the district that was emailed Wednesday afternoon, the district was contacted on August 10, 2020 by attorney William Satterberg who is representing 1st Strike Asset Management, LLC, the purchaser of the computers, and the plaintiff in a lawsuit against the district. Satterberg let the district know that his client purchased several computers at a School District auction back in June of 2019, and that the computers still contained sensitive information.
According to Wednesday’s email the district tried to get the computers back, but “the purchaser demanded $100,000 and refused to relinquish the property without payment.” In the court documentation provided by Satterberg there is no mention of any payment to the purchaser, other than requesting court and attorneys fees. The district email went on to say that an agreement was made to pay the purchaser $10,000 in return for the computers, but the “purchaser chose to continue to obstruct the School District’s access to the computers and filed suit naming 1st Strike Asset Management as the plaintiff.” The purchaser bought the computers for less than $100.
The court documents show there is a request that the court hold the computers until a thorough investigation is made against the district regarding who was affected by the data breach and how the computers were missed in the data wiping process.
“Because there is a dispute on what should be done with the data on the computers, Plaintiff is filing this action in interpleader and seeks the computers and the data contained on the computers be deposited with the Fairbanks court system for the safekeeping and a declaratory judgement by the court as to the correct disposition of the data and of the requirements to notify those parties with confidential data on the computers. Plaintiff is concerned that significant breaches of the community’s security may have occurred by the borough in allowing the computers to be surplused and made available for unlimited public inspection at auction, to include violations of HIPAA laws, social security confidentiality laws, personnel laws, and student confidentiality laws which need to be independently investigated and addressed to avoid future violations of this nature," the complaint said.
The School District email said there are “procedures in place for wiping devices before they are sold, and is again reviewing its policies and procedures in order to prevent future release of sensitive information and will continue to do so as further information is made available to it regarding this matter.”
We reached out for comment from the school district and were told that our questions have “been received and are being reviewed.” We will have more on this story as it develops.
Copyright 2020 KTVF. All rights reserved.