Miami-Dade schools endured more cyberattacks ‘all fended off successfully’ on Friday

Cyberattacks continued to plague Miami-Dade County Public Schools on Friday, although unlike earlier attacks reported during the chaotic first week of virtual classes, these attacks were “fended off successfully,” school officials said.

Connectivity problems, however, still persisted with the district’s controversial new platform, My School Online, run by a for-profit company called K12.

Even after the district removed teachers in grades 6 through 12 from the platform until at least Sept. 11, by Friday more elementary school teachers moved their lessons to Microsoft Teams and Zoom, fed up with My School Online’s shortcomings.

Some parents on Friday reported not being able to log in. Teachers reported the district’s portal being down after lunch time, impacting Microsoft Teams and other Microsoft tools.

Schools Superintendent Alberto Carvalho broke the news of new cyberattacks on WLRN, 91.3, South Florida’s NPR affiliate, , in a pre-recorded interview that aired early Friday afternoon. Miami-Dade Schools owns the broadcasting license of WLRN.

Carvalho said a cyberattack occurred at 3:30 p.m. Thursday, at the end of a news conference detailing the arrest of a teenager accused of attacking district servers at least eight times. He said another attack occurred Friday morning.

The Herald obtained an unredacted arrest report for the 16-year-old, a student at South Miami Senior High. He allegedly orchestrated eight distributed denial of service, or DDoS attacks, using a Low Orbit Ion Cannon (LOIC), according to the report.

The Herald is not naming the student as he is a minor.

Not sophisticated software used in schools’ cyberattacks

Experts say this program is easy to download and not sophisticated software.

“It’s really easy to prevent,” said Mark Rasch, a cybersecurity expert and former federal cyber crimes prosecutor. “The school must be really out of date on their router configuration.”

School Board members reacted strongly to that revelation when reached by the Herald.

“The issue of software could have certainly been prevented and is an ongoing investigation,” said board chair Perla Tabares Hantman in a text. “I’ve been told by the administration that today was a better day in our schools for student learning.”

Vice chair Steve Gallon, whose 7-year-old daughter’s teacher is now using Zoom, said the Herald’s reporting raises “serious questions about the district’s overall preparedness for future attacks and capacity to protect our infrastructure.”

He compared the situation to “an NFL Super Bowl team being taken down by a Little League player.”

“The mere thought, let alone harsh reality, that a 16-year-old student took down the nation’s 4th largest district using antiquated, unsophisticated means is not only concerning but embarrassing,” Gallon wrote in a text. “I still have questions and even a little doubt about the actual impact of this attempt on the persistent problems we’ve had since Monday.”

Board member Mari Tere Rojas visited schools all week and has expressed concerns over connectivity problems. She said teachers have come to her in tears complaining that the platform was “confusing, cumbersome, not engaging enough or conducive.”

Two issues: K12 and cybersecurity

She said the district has two separate issues: The K12 platform and cybersecurity concerns.

Rojas said she was “flabbergasted” at the revelation that a student’s simple attack wreaked havoc, calling it “disturbing.”

“To me, our district needs to be able to withstand attacks of this nature,” she said. “Our servers should’ve been able to detect this without any question.”

In 2018, Rojas successfully passed a proposal to enhance the district’s cybersecurity measures. The report she received noted that “48 major DDoS attacks ... were mitigated” in the 2017-18 school year.

“Regardless of that, separate of that,” she continued, “we have a very serious concern about the failure (of the K12 platform). In this district, we have failed these teachers and these students.”

Unlike the past two dozen cyberattacks that district officials say were partially to blame for a disastrous first week of virtual classes that left parents aggravated and educators downtrodden, Carvalho told WLRN on Friday that the new attacks were “all fended off successfully” using mitigation strategies used by school districts around the nation. He did not specify.

Nothing has been announced on the district’s social media pages or to the media about the most recent attacks, nor has the district provided information on them.

The district has also not acknowledged interview requests with either the district’s head of information technology or Chief Academic Officer Marie Izquierdo, who oversees IT.

School Board officials and the general public have been increasingly skeptical over the narrative and timing of the district’s recent woes.

Teachers: K12 training was lacking

Concerns began mounting about the district’s new online platform obtained over the summer from K12 in a $15 million no-bid contract. Educators felt the training did not provide enough hands-on learning, and teachers worked over the weekend to train each other ahead of a wildcard first day of school.

Carvalho seemed to acknowledge the issue. On Sunday, teachers received an email offering $100 for every teacher who scheduled Class Connect, or video chat classroom sessions, with their students by Sunday night, before Monday’s first day of virtual school. The funding came from a K12 donation and is being distributed by the Foundation for New Education Initiatives, a nonprofit founded and chaired by Carvalho.

Tabares Hantman, the School Board’s chair, is the vice chair of that foundation. She said she had no idea about the K12 donation.

During remote learning in the spring, teachers used whatever learning platform they were comfortable with, creating headaches for parents who had to navigate among the platforms their children used.

If any teaching and learning was done over the first week of school, it was thanks to teachers and students who found workarounds.

At a sullen press conference Monday, Carvalho announced that a software glitch was to blame and said third-party vendor Cisco was at fault. The district later said that the software glitch cast a shadow, making it hard to spot the cyberattacks.

Tuesday saw relentless crashes. Carvalho announced that afternoon that the district had been cyberattacked, putting the blame on Comcast for lack of notification.

Asked why the $15 million no-bid contract with K12 had not been made available to School Board members or the general public, Carvalho said, “There was no mystery to the contract.”

The district’s chief financial officer Ron Steiger dropped a bombshell Wednesday that the contract had not been fully executed, missing Carvalho’s signature. Carvalho had not said that before Wednesday.

In the early morning hours of Thursday, police arrested the teenager at his Flagami home. He has been charged with a felony and misdemeanor in connection with some of the cyberattacks.

The Miami-Dade Schools Police Department regularly fends off DDoS attacks, some from students. Sen. Marco Rubio, R-Florida, and Rep. Debbie Mucarsel-Powell, D-Kendall, have requested briefings with federal authorities over the cyberattacks.

The district is assessing whether to keep My School Online, considering a contract was never executed and K12 was never paid.

This story was originally published September 4, 2020 at 7:20 PM.