Letter to Hon. Miguel Cardona, Secretary of Education - Matsui and Langevin Urge Biden Administration to Address Cybersecurity Threats in K-12 Schools

Letter

Dear Secretary Cardona:
Congratulations on your recent confirmation as Secretary of Education. As the U.S. continues to
battle the ongoing pandemic, the Department of Education will play a critical role in supporting
American families as they navigate the challenges of distance learning and prepare to reenter the
classroom safely. To help ensure schools are keeping pace with the demands of the modern
classroom, we urge you to issue guidance that will allow K-12 schools to make needed
investments in increased cybersecurity measures.
While the shift to online interaction has helped keep students engaged, it has also highlighted a
growing threat -- cyber-incidents targeting schools that are increasing in regularity and
sophistication. In December, the Federal Bureau of Investigation (FBI), the Cybersecurity and
Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis
Center (MS-ISAC) issued a Joint Cybersecurity Advisory warning that "cyber actors are
targeting K-12 educational institutions," and that "these issues will be particularly challenging
for K-12 schools that face resource limitations." Though this public health crisis has revealed
preexisting vulnerabilities, the underlying cyber threat facing K-12 schools will remain even
after we have crushed the coronavirus. In light of this well-documented threat, we believe that
the Department must be doing everything it can to support schools in protecting the
confidentiality of students' data and ensuring the availability of information technology systems
essential for learning.
The Coronavirus Aid, Relief, and Economic Security (CARES) Act and the Coronavirus
Response and Relief Supplemental Appropriations Act, 2021 (CRRSA) Act both included
funding streams to support school operations during the pandemic. Specifically, the Elementary
and Secondary School Emergency Relief (ESSER) Fund and the Governor's Emergency
Education Relief (GEER) Fund allow for the purchase of "educational technology (including
hardware, software, and connectivity) for students." While schools can reasonably interpret this
text to indicate cybersecurity costs would be considered eligible expenses, written guidance from
the Department to that effect will ensure schools have the information they need to make
informed decisions about how to use these funds.
Many schools are already in the process of allocation decisions, and ongoing ambiguity about
cybersecurity as an allowable use will prevent them from expending these funds quickly as
Congress intended. As the FBI, CISA, and MS-ISAC have warned, cyber incidents targeting
schools are an urgent and growing threat that must be addressed. We encourage you to issue
immediate guidance to clarify that cybersecurity expenses are allowed under ESSER and GEER.
We appreciate your attention to this important issue and look forward to working with you to
improve K-12 cybersecurity moving forward.

Source