Apparent data hack provides student ranks, GPAs

    A website that enables Paly students to view their class rank is circling about Paly community this morning. Administration has been notified of the apparent security breach and is responding. “It makes me really sad to hear that this tool is out here and people are curious," Principal Kim Diorio said. "This is exactly what we wanted to prevent when we took a hard stand [against weighted GPA.]" Photo: Maya Reuven

    A website that enables Palo Alto High School students to view their grade point averages and class rank is circling around the student community this morning, and suggests a breach of the Infinite Campus system. “It makes me really sad to hear that this tool is out here and people are curious,” Principal Kim Diorio said. “This is exactly what we wanted to prevent when we took a hard stand [against weighted GPA.]” Photo: Maya Reuven

    Editor’s note: Palo Alto High School Administration is urging anyone with information on today’s data breach to call 650-833-4243, email [email protected], or provide anonymous input via a website feedback form.

    Principal Kim Diorio and her team are responding this morning to an apparent hack of student data manifesting in a website that allows students to calculate their class rank.

    By entering their student ID as well as their “person ID”, which can be found through Infinite Campus, students can find their class rank, percentile, and weighted GPA to four decimal places. In addition, the site provides information on overall class size, mean weighted GPA, and standard deviation. However, students can only view their own information, not that of other students.

    While the accuracy of the website has yet to be officially confirmed, members of the Class of 2018 and 2019 on The Paly Voice Staff have verified that the information is consistent with the GPA provided on their transcripts.

    The website, which the Voice first encountered Wednesday night — and sought comment from the administration Thursday morning during the first half of 2nd Period — was created using an anonymous domain, according to the domain registration website ICANN.

    Diorio responded by immediately contacting Interim Supt. Karen Hendricks — in her first week on the job — and other district and Paly staff. PAUSD Chief Technology Officer Derek Moore arrived in her office by 9:45 a.m. to answer questions from The Paly Voice.

    The incident is reminiscent of one in 2003 in which a Palo Alto Weekly reporter was able to wirelessly access highly sensitive PAUSD computer files containing student information on its network. “Unauthorized users could copy many of those sensitive files, as well as upload their own files onto one of the district’s servers,” The Palo Alto Weekly stated.

    Following the mishap, the district made wireless connectivity to its office unavailable temporarily due to the security breach.

    Responding to the news of the apparent hack today, Moore emphasized the urgency of the potential breach, and is looking into identifying the problem as soon as possible.

    “We as an organization take security very seriously,” Moore said. “If it is a hole [in the system], then we absolutely will have to close it [infinite campus], we have to deal with it immediately. We have to go back and do some research first.”

    If an issue is found in the Infinite Campus server, it is likely that public access to Infinite Campus will be shut down temporarily, according to Moore.

    Senior Paly robotics team captain Devin Ardeshna expressed concern about what other information may have been obtained by the hacker.

    “It’s reasonable to assume that with the ability to access this information someone could also access everything else stored in Infinite Campus, including disciplinary records and medical information,” Ardeshna said.

    Principal Kim Diorio worries that the website is a side effect of last year’s decision to include weighted GPAs on student transcripts, something her team fought adamantly against.

    “We were very upfront,” Diorio said. “We said to the board if you go to weighted GPAs you’re essentially going to de facto ranking, and that’s exactly what happened.”

    “It’s philosophical, and a lot of high performing schools don’t [rank students,]” Diorio said. “We think ranking especially in a highly competitive environment produces more stress, It’s one of the reason we weren’t in favor of reporting the weighted GPAs on transcripts. It feeds into the whole idea that you’re number, and that it’s a competition.”

    Guidance counselor for the Class of 2019 Susan Schultz echoes this sentiment.

    “I’ve been here, I think this is year 22,” Schultz said. “When I got here we did not rank students and we also did not rank grades. Being in this kind of very competitive environment those were two things I was super proud of. We haven’t ranked students for over 20 years, and I hope we never do.”

    Regardless of whether or not the rankings are accurate, Diorio stresses that students will not be able to include rank information on their college applications.

    “We put on our school profile that we don’t rank students, that’s really clear, so if a student is going to self report their rank, that could be detrimental,” Diorio said. “It would raise some questions, like how this student would get this information.”

    Diorio voiced her concern for the situation, and worries of the consequences the concept of ranking may bring to school climate.

    “The news that there’s now a way for students to get that information is really disturbing to me because this is really counterproductive to all that work we’ve been trying to do,” Diorio said. “I don’t want false information out there, I don’t want people’s privacy breached in any way, I don’t want [it] to contribute to the climate and culture of competition among peers, which is what ranking does.”

    Eli Zucker contributed reporting to this article. 

    Related Posts

    Admin springs to action, cautions students following data breach
    Cross Country students eager to participate in the Moonlight Run and Walk
    Closed board meeting today to evaluate Diorio McGee and Wade