The domino effect of human error on technology systems – including those used in elementary and secondary schools – showed its destructive power in July when global cybersecurity company CrowdStrike released a faulty software update.

The speed with which this bug brought down all manner of companies and organizations around the world that use Microsoft Windows systems was frightening. Airlines had to delay or cancel thousands of flights, hospital operations were at risk, hotel employees had to personally escort guests to their rooms because key cards didn’t work, and emergency call systems were down in some places.

It was the perfect storm of technological chaos that drew comparisons to the year 2000.the techie acronym for predictions that chaos would break out at the turn of the century because computers would have trouble migrating from “1999” to “2000.” Those predictions didn’t come true. But a Time magazine headline shortly after the CrowdStrike/Microsoft tech meltdown reignited those fears: “Y2K sent a warning. The CrowdStrike outage shows we didn’t heed it..”

This time, schools were lucky. Aside from a few summer programs, most schools were closed. But what would happen if something similar happened in the middle of a regular school week? That’s the question school districts are grappling with at a time when virtually every part of school operations and teaching is connected to their online networks.

The CrowdStrike technology outage “is a reminder of how important technology has become to both instruction and the business operations of the school system, and how the loss of technology can now jeopardize school operations,” said Steven Langford, chief information officer for Beaverton Public Schools in Oregon, which has 38,000 students. “This becomes a tremendous challenge because technology provides access to security features and is so closely tied to student learning.”

Let’s look at just a small selection of all the things that are used in schools with internet access:

• Student and teacher laptops,
• electronic hall passes,
• Learning management systems,
• Student information systems,
• Security cameras and door access controls,
• Payments for catering services,
• Temperature controls for buildings and
• in some cases even vending machines.

In Langford County, the school system’s connection to the Internet is now 8,000 times greater than it was just over a decade ago.

Even districts like Langford’s that don’t use CrowdStrike could be impacted by the effects of such a tech breakdown, especially if they use the services of a vendor — say, a learning management system provider — that uses the cybersecurity service. This logic also applies to other major technology providers and services used by schools, such as Amazon Web Services, Google for Education and Microsoft Azure.

CrowdStrike crash prompts school district technology leaders to prepare

“Mistakes can happen. They don’t get the attention that cybersecurity gets because it has a malicious component, but change management and awareness of the impact of potential failed changes” are very important, said Amy McLaughlin, project manager for cybersecurity and network and systems design initiatives at the Consortium of School Networking (CoSN).

CrowdStrike declined to disclose how many K-12 schools or districts use its services, but a company spokesperson said in an emailed statement to Education Week that the company “proudly protects a significant number of K-12 schools, colleges, and universities across the country. We have taken a number of steps to prevent this incident from happening again.” The spokesperson said those steps are outlined on the company’s Guidance Hub..

But the assurances of the technology companies will hardly be able to prevent the next global collapse of the technology industry.

Don Ringelestein, director of technology for Yorkville Community School District 115 in Illinois, knows this only too well.

His 7,200-student school district was affected by the July CrowdStrike bug because it uses a lot of Windows computers. Fortunately, he said, regular school operations were suspended, so IT staff were able to get almost everything back up and running within two days. But if this had happened during the school year, it would have disrupted teaching and learning schedules and disrupted the school district’s attendance and human resources management systems. Plus, IT staff would have been under much more pressure to get everything back online as quickly as possible.

Still, Ringelestein emphasizes that “teaching and learning existed long before every student had a Chromebook. So teachers usually have a Plan B to fall back on if their technology fails.”

The switch to analog systems is the exact opposite of what teachers did in March 2020 when the pandemic closed school buildings. In the event of a technology breakdown, schools would have to take attendance with pencil and paper and hand in those lists in person to the main office. Classes that use online curricula would have to be replaced with printed materials or perhaps an impromptu class discussion. Adaptive online testing in math would have to be deferred in favor of skill-building exercises using pencil and paper or other low-tech approaches, and computer science classes would have to rely on physical props to teach computer programming concepts.

The key point, technology executives and tech experts say, is that no matter where you fall on the technology literacy scale—whether you consider yourself a Luddite or a tech-savvy teacher—you need a Plan B. And as technology consultant Melissa Tebbenkamp says, you need to be able to answer this question: “What will the classroom look like on day three if there’s still no internet?”

Tebbenkamp, ​​a former technology director for Raytown Public Schools near Kansas City, Missouri, who now works as a technology leadership consultant focusing on privacy and cybersecurity, said that when educators start thinking about these kinds of questions, “that’s when we start to prepare and understand that it’s not just an IT issue, it’s a challenge and a risk to the entire district that we need to mitigate as a leadership team. Can we use (what we know) to decide what we do if we don’t have internet on campus for a week?”

Kris Hagel, the public information officer for Peninsula Schools in Gig Harbor, Washington, which has 8,800 students, is starting to have such conversations with people in the school community. He, too, worries about human errors that could have global ramifications or cyberattacks that could take down a school district’s network. But what has worried him even more over the past two years are the wildfires that have been closing in on his community in the Seattle suburbs, including one that was just 10 minutes from his home.

Because of this threat, there is a possibility that the local power grid could be temporarily shut down to prevent wildfires from spreading. This, in turn, could mean that most of the school district’s technology-based operations will have to shut down. He has already spoken with a local fire chief about how the community is preparing for possible extended power outages.

“As climate change changes, we need to adapt and think about what the new realities will look like in the future,” he said.

Hagel’s story is representative of the growing concern among school district technology leaders across the country. The percentage of school district technology leaders who say they implement “incident response plans” for technology-related crises has increased from 34 percent in 2022 to 53 percent this year, according to a CoSN survey.

Schools can learn important lessons from healthcare and other industries

The good news is that businesses, governments and schools around the world are grappling with similar challenges. Many are currently busy planning elaborate scenarios to figure out how to keep their organizations running in the event of a technological breakdown caused by human error, a crippling cyberattack, a natural disaster such as a tornado, hurricane or wildfire, or intentional or accidental damage to the fiber optic cables used to connect the internet.

Peter Kennedy is a managing partner at Futures Strategy Group and specializes in scenario-based strategic planning. He has consulted for companies in the automotive, aerospace, healthcare, financial services, telecommunications, and consumer goods industries, as well as for government clients such as FEMA, NASA Aeronautics, the U.S. Coast Guard, and the U.S. Department of State.

Much of his recent work has focused on the healthcare industry, which, much like K-12 education, is a people-driven sector whose reliance on technology has grown exponentially. Scenario-based strategic planning is about building adaptability, he stresses — it’s not about having a specific answer to every scenario imaginable. He said many healthcare organizations, for example, are doing scenario-based planning with the possibility of another pandemic and how to respond. They now have some experience in that area to develop smarter plans.

Similar to health care and other human-powered organizations, Kennedy recommends that schools conduct a full “vulnerability inventory” that looks at key factors that put them at risk, such as student and teacher safety, disruption to normal instruction and learning, communication with parents, and even the morale of teachers, who can become frustrated and demoralized when a well-planned lesson is disrupted by a technical glitch. Then, schools should develop plans to address those vulnerabilities in the event of a crisis.

Kennedy, however, warns against clinging too tightly to a plan. “The paradox of emergency planning is that you should have a plan, but you should also be prepared to abandon the plan.There’s an old military saying: ‘The first casualty of war is the plan.’ And I think that’s very true here.”

Such lessons have not been lost on William Brackett, a former teacher who now works as director of IT services for Oak Park Elementary District 97, a 5,800-student school system near Chicago.

“I’m an advocate of always learning from everything,” Brackett said. “Even if (the CrowdStrike event) didn’t hurt us, the next one might hurt us. And if we throw that day away and say, ‘Oh, it didn’t bother us, we can just move on merrily,’ and don’t study it and learn from it, then I’m not being as thorough a technology leader as I could be.”