David Bowman: [00:00:00] We’re talking about data security and responsible use, and the reality is, is my data’s not going to hackers anymore, it’s going to companies.
Rebecca Bultsma: That’s the thing. This is the type of surveillance that this is enabling and collecting, right? Uh, ob- obviously, it makes people feel uncomfortable. It changes behavior patterns.
Rebecca Bultsma: It, you know, it makes people self-conscious if, if they know it’s happening, and that’s part of the problem, right?
David Bowman: We spend a lot of time talking about school shootings and protecting physical safety, and the news likes to talk about this because, you know, if it bleeds, it leads. So in Utah, we’ve had a lot, a lot of extreme focus on the school shooting aspects and physical security and all of these different things over the last few years, but there’s been very to little no focus on resources to protect students’ data
Rebecca Bultsma: Welcome to the AmpED to 11 Podcast. For [00:01:00] those of you who are wondering if you’re at the right podcast, you are. You’re probably used to hearing Brett introduce our latest episode, and unfortunately, Brett is not here with us today, and so you are going to be stuck with me and someone who I’m pretty sure is about to become my new best friend, because I have with me today a guest I’ve really been looking forward to.
Rebecca Bultsma: I have David Bowman, who leads the cybersecurity program for one of the largest school districts in Utah. So basically, he’s personally responsible for defending over 100,000 devices, Chromebooks, servers, all the things, from the ultimate chaos agents thousands, almost 60,000 students, right, David? And 7,500 staff members.
Rebecca Bultsma: And we have invited David today to our podcast because we have so many interesting things to talk about, including, but not limited to, a recent breach that happened with Canvas, which is based very close to where I think you are, David. [00:02:00] And, uh, then news coming out about Anthropics Mythos, all of this cybersecurity-type news that I think will be very interesting to dive into with someone who is an expert and talks about these types of risks all over the world.
Rebecca Bultsma: David serves on the State of Utah Cyber Commission, chairs the Statewide IT Directors Council, and chairs the Statewide K-12 Cybersecurity Council, uh, which means he sits in a lot of meetings all day, every day, uh, talking about things probably people don’t want to hear. But before we kind of kick this off into what I think is going to be a fascinating discussion, I think we wanna hear the story about how you and Brett met.
Rebecca Bultsma: Because you told us before we started that, uh, you just went up and, and kind of gave him a hard time at a conference, and I love that for you. So tell us everything.
David Bowman: I– You know, we have pretty innovative conference that we have here in Utah that, um, it’s called UCET, but it’s focused on education technology and teachers.[00:03:00]
David Bowman: And so we do that every year, and there’s lots of different topics and professional development and training and all of those kinds of things. For many years, it’s been a lot more traditionally focused to an educator focus. And one of the things that the conference has tried to do is to get a little more adding roles of folks in technical aspects to do sessions and talk about them and kinda consider those technical aspects of things behind it.
David Bowman: Like, one of the main reasons I go is so I can walk around on the vendor floor and see what vendors are telling my teachers, like, “Hey, yeah, just tell your IT to flip on the roster button, and then this’ll work great.” So it’s kind of my annual spy out what teachers are about to ask me for. Um, plus that’s an opportunity for me to individually give stern lectures to each vendor about what the heck they’re doing with data privacy, and could we maybe have a product that doesn’t have the word [00:04:00] AI in it?
David Bowman: Like So, I mean, that’s the type of thing where I’ll end up doing that. But in this case, the way I ran across Brett is we were in a session that was talking about what’s the future of AI in education and the topics, and there happened to be a lot more technical people in the room than your traditional educator.
David Bowman: And so Brett kind of went into some of the normal stuff he talks about and the things he’s excited about. And then, um, because I am who I am, right? People call it David style. I just said, “You know what, Brett? I’m sure you’ve talked about this before. Could we talk about the fact that we’re talking about data security and responsible use, and the reality is, is my data’s not going to hackers anymore, it’s going to companies, and I wanna talk about that.”
David Bowman: And Brett was like, “Yeah, okay.” And so we talked about it for a few minutes, and then at one point he said something, and I just was like, “That’s [00:05:00] bull crap. That’s not true.” And then he’s like, “Okay, this is a whole separate podcast conversation that has to go on.” And that’s kind of how I ended up meeting Brett by just giving him a hard time.
David Bowman: So yeah.
Rebecca Bultsma: I love that. And you know, I– that wouldn’t have been the first time that Brett heard that. I, I bring that up a lot on our podcast, and it’s the very unsexy reality of ed tech that really bothers me. As someone who does research in the UK where the, uh, data privacy laws are much more intense, I think it just really bothers me, and I don’t think as many people are aware as should be that a lot of these companies make money by taking millions of dollars from schools but then make more money than, again, taking data and brokering it, or as they like to say, sharing it with partners.
Rebecca Bultsma: And I’m sure you’re seeing that- They’re
David Bowman: making more, they’re making more money off of our data than what they’re making [00:06:00] off of me to pay them for the service.
Rebecca Bultsma: Isn’t that insane?
David Bowman: And like that’s the piece that ethically, it’s like I don’t think people get it. Or like this is the problem in the classroom that we run into, is the teacher sees it as this great free tool-
Rebecca Bultsma: Personalized learning
David Bowman: Yeah. But if it’s free then, well, nothing’s free. If it’s free, you’re the product. But the individual teacher in the classroom doesn’t have to think at the level of there is 60,000 students’ data that I have to protect and be part of. They just see me as the, “Why did you say no to that cool AI robot?” I just, you know, and that’s, that’s the reality of what we’re dealing.
David Bowman: So it’s not just fighting the companies to behave the way they should. It’s not just defining the data. It’s being seen as the no department by our educators, which are the critical piece of why [00:07:00] we’re in business, right? I don’t want to say no to things, but I have to teach the responsibility aspects, and that is increasingly so big and different to understand for teachers that I’m the bad guy a lot, and that’s kind of a bummer.
Rebecca Bultsma: I, I feel like there’s a misconception about, like, data and what it is. There’s a whole, like, kind of thing happening with that, this generation, a younger generation that’s like, “Yeah, take my data. I don’t care. Take my data. I don’t care if you know what I watch or what I do and things like that.” And I just don’t think people understand, number one, the value of data, what’s being collected, why it’s so valuable, and what the risks are of this data.
Rebecca Bultsma: It’s just kind of a blanket term, like AI, data, right? It can mean so many different things, but why is it so valuable? What should people know about why that’s valuable and why it needs to be safeguarded?
David Bowman: So from a value perspective, you know, the speech I get from vendors a lot right now [00:08:00] is, “We have to have this data in order to make the product work for you.
David Bowman: So we can’t make the product better without recording every single thing you’re doing.” Utah is actually rather progressive in our student data privacy laws. Like, we have a dedicated office for it in the State Board of Education. So, you know, when I’ve been at conferences or other things, then people are like, “Oh, that guy’s from Utah?
David Bowman: Just be quiet. They know what they’re talking about,” right? Like, Utah has been a really great leader in what some of those things look like. But as part of those things that come up is people just don’t understand the, the crumbs that get put together. So you can easily go look me up on LinkedIn, and you can see everywhere I’ve ever worked.
David Bowman: You can see what cities I’ve lived in. That information is totally out there, and yeah, that’s fine. But when you make it more [00:09:00] real, that’s what helps people to understand a little bit better about what’s going on. Probably one of the ones that scares me the most or helps people attach to it, you know, Rebecca, if I said I was gonna send someone to just sit next to your desk and watch you use the internet for eight hours, how would that make you feel?
Rebecca Bultsma: That’s the thing. This is the type of surveillance that this is enabling and collecting, right? Uh, ob- obviously, it makes people feel uncomfortable. It changes behavior patterns. It, you know, it makes people self-conscious if, if they know it’s happening, and that’s part of the problem, right?
David Bowman: Well, and It’s not just that they get disconnected from what it is, but the piece that’s really hard to understand is that sometimes you need that data in order to perform the required service.
David Bowman: Like, no one’s gonna say, “Yes, please have somebody come stand next to me and watch me use the internet.” [00:10:00] But parents do want me to stop children from looking at stuff on the internet that they’re not supposed to. So, in order to do that, I have a content filter tool that is on their device and literally watches every single website they go to all day long with everything that they do.
David Bowman: I literally am watching every single thing they do and they, they do and say. But in order to provide content filtering, I don’t have a choice to do that. But traditionally, in the past, it was, it would use a little bit of its own data, and program developers or product developers did have jobs before AI, so products could be developed without AI.
David Bowman: So, but what happens now is instead of content filter provider taking our data for Jordan School District and saying, “Okay, this is where the errors are,” or we report [00:11:00] issues, they throw it into this big pool that everybody’s in, and it’s, quote-unquote, anonymized. And then the argument is, well, if you want us to be able to content filter so kids can’t look at pornography, then you have to let us do this.
David Bowman: Well, you don’t have to have all of my data and aggregate it in order to make your product better. Matter of fact, if you need that to make your product better, make a better product.
Rebecca Bultsma: Uh-huh. And I think the part that most people aren’t putting together is how this connects to AI and this AI era, right?
Rebecca Bultsma: Because all of this data, maybe our social media, maybe our LinkedIn, all of these things were available, uh, before, right? In, in disconnected ways, but now we have these systems that can then put all those pieces back together and re-anonymize and, and collect all of these digital trace data that exist everywhere and, uh, use it to use AI to help [00:12:00] create pretty comprehensive pictures of individuals or systems or processes or how people think or interact, and that’s worth a lot of money to organizations and, and companies at, at all different level, which is why companies are collecting that data and then selling it to other companies, correct?
David Bowman: Yeah. And the argument I get into with providers, and this is a piece where I think people misunderstand. So one thing to know is that most school districts and people that manage data, they have what’s called a data privacy agreement with the vendor that says, “This is the data you’re gonna get. This is what you’re allowed to do with the data or not do with the data.
David Bowman: And if you’re gonna share it with third parties, this is how you can do it or can’t do it.” But we ran into an issue with a statewide provider actually that we were using for math curriculum that had some funding through the state, [00:13:00] and we’re watching network traffic, so we’re getting onto the geeky IT side here, and we notice across many of the schools, because we all start talking to each other, that there’s this new website called fullstory.ai, and all of a sudden we have a ton of network traffic going to that.
David Bowman: And we’re like, “What? What is this thing?” And we go to the website, and if you read the website, it’s all about, “Track your customers and know everything where they do it,” and, you know, da, da, da, da, da, da, da. And we’re like, “Okay, this looks really sus,” right? And so we start kind of looking into it, and it took us a little bit to narrow down exactly what application or thing was doing it, um, because it turns out four of them were doing it.
David Bowman: Um, but the biggest offender was this math program. And so we reach out to the [00:14:00] technical side of the math program guys and go, “Hey, what are you doing? Your agreement doesn’t say you can do that.” Like, and they’re like, “Well, it’s, it’s anonymized,” and da, da, da, da, da. And I’m like, “Well, listen. I extracted a packet, and here’s what I can see that you’re doing.
David Bowman: You’re collecting who’s logged in. You’re collecting their device’s IP address, so this is a way to extrapolate their location. You’re collecting their grade, so now you know roughly how old they are. Then you’re tracking things like a student got mad and rage-clicked on a question, and you’re tracking that.
David Bowman: And then you’re not only tracking that as data elements, but you literally have a recording of everything that was going on on the screen.” And I’m like, “Is that really what’s happening? ‘Cause it’s what I see.” And they’re like, “Well, no, we’re not recording everything that’s going on with the screen.” And I said, [00:15:00] “Okay, but I’m looking at a ticket here that one of my teachers submitted ’cause a kid had an issue with a math test, and I see your agent responding saying, ‘Okay, who is the student?’”
David Bowman: And, you know, the teacher explains the student what time it is, and they said, “Okay, let us go look at the recording, and we can figure out what the issue was.” So then that became a challenge point with the CEO of saying, ’cause they were based in Utah, so we were able to track them down and say, “Look, man, you’re saying that it’s anonymized and you can’t tie it back to anybody, but the network traffic is not going to you, it’s going to this Fullstory AI company, and then it’s going to you.”
David Bowman: So he’s giving all this trumped-up technical explanation about nobody can map the numbers back to each other and it’s appropriately identified, and then a couple of the districts just said, “Hey, look, man, we’re just [00:16:00] gonna block fullstory.ai, and we’re not gonna let any traffic go there.” And he’s like, “If you do that, it will break my software and it won’t work.”
David Bowman: So it was kind of like a, a threat game of I can’t– it won’t work if you block that. Well, guess what? We blocked it, and guess what? It still works, and they’re still developing the program. They’re just not getting that extra AI data. And that extra AI data and full recordings, that’s a win in aspects of somebody that was paying really close attention, noticed it, caught it, called the vendor out on the mat, and made it stop.
David Bowman: But that became a big enough example and conversation happening in the state that in the last legislative s-session we had in the spring, they passed a new state law that says if we identify a vendor doing something [00:17:00] with data that’s inappropriate, they get notification, and they have 30 days to fix it or their contract is automatically null and void and we’re not legally allowed to use them anymore.
David Bowman: So it’s an extremely powerful statute that somebody’s gonna have to test and push it against, and It’ll probably be me at some point. But that’s– I mean, we at least have legislative level paying attention and going, “This is a scary problem.” And the problem is, is now vendors are like, “Well, we’re not gonna agree to that.”
David Bowman: And so then we get into this situation of we’re trying to push it, we’re trying to establish these things, but there becomes this moment in time in the contractual negotiation or the data privacy agreement where they say, “Listen, we can’t agree to that,” or, “Our attorneys won’t let us agree to that.” And we have to be [00:18:00] bold enough as a school district to say, “Okay, then we won’t buy your software But, and a perfect example of how that becomes an issue, and that can even transition us to a conversation about the Canvas breach and what happened with that, is Canvas was one of the other providers that was sending traffic off to Fullstory AI.
Rebecca Bultsma: And let’s, let’s stop here and give people context on what Canvas is, because this is a perfect example of what happens. Maybe you have an agreement with one company, maybe it’s acquired by another company, and you don’t know where that data flows, or maybe you’re locked into some sort of ecosystem with your data for so long at such a scale that you don’t necessarily even have any choice about switching, even if the data practices aren’t great.
Rebecca Bultsma: So let’s talk a little bit about that, David. I’m sure you have opinions.
David Bowman: Yeah. So when [00:19:00] it’s a small application, like we could say, “Hey, look, we’re not using this math application,” then that’s a little easier. But other ones that we found that were offending sending off to these AI programs were big providers like Adobe or Canvas, which is our online– Like, this is, this is where the syllabus are, the assignments, the grading, the papers, all the content that the students need, attendance.
David Bowman: Like, there’s not traditional teachers take home papers to grade anymore or print out handouts. It’s all in the system. Now, to Canvas’s benefit and credit, we said, “Yo, we don’t like that.” And they said, “Oh, okay, cool. We’ll turn it off.” And so that was an appropriate response from a vendor. Now, one could argue that their contractual agreement should have required them to give us notice that they were gonna change to do that, and it didn’t [00:20:00] happen.
David Bowman: But one of the, one of the things is you find vendors that are more responsible, and those are the ones that you wanna work with. So, for example, we told Canvas, “We don’t like this, and we really think you should have given us notice.” And they said, “No problem. We’ll turn it off.” And then about sixty days later, they came back to us and said, “Hey, we’ve reviewed this internally, and we would like to update our agreements to talk about this to make it more usable for everybody.”
David Bowman: And so that was a really cool, responsible behavior.
Rebecca Bultsma: Is the reason they wanna use it, are they making money off of tracking that data? Is that the reason they wanna use it, or are they using it to improve internal AI systems? What’s in it for them that they came back and they were like, “Hey, like, we really actually wanna do this”?
Rebecca Bultsma: How does that benefit them? What are they getting out of it?
David Bowman: This would be one of those things where it’s hard to prove in a court of law, and then that’s why people look at people like you and I [00:21:00] are like, “Where’s the tinfoil hat,” right? Or is it, is it blurred in the background there? So the way this works, a- and so there are people like data brokers that literally take information, and it’s literally you go to their website and you buy it.
David Bowman: So I mean, that is a thing. But the way it works with the big edtech vendor like that is what’ll happen is, yeah, they’re gonna use some of it for exactly what they said they’re gonna use it for. But then they’ll have a relationship with an advertising agency or a marketing company or a data processing company where they say, “Hey, give– we’ll give you a really good discount if we can use your data.”
David Bowman: So they kinda get services in exchange, and that exchange becomes so great where it’s almost like they end up getting some of those things for free. And I, I, I– my tinfoil hat says it’s out there [00:22:00] somewhere, but in reality is it’s, there’s probably not a place where provider A says, “Okay, I have the student data and it’s for sale, and you write me a check for X amount.”
Rebecca Bultsma: I know that there was a class action lawsuit brought against Canvas in the last couple of years alleging, uh, that they show, they shared their student data with over 500 partners, which I thought was very, very interesting. Parents were upset to learn a- about that, and, uh, you know, fair, and but I think there’s a lot of misunderstanding, it sounds like even kind of with us, about like why and what are you using it for?
Rebecca Bultsma: Which isn’t great considering kids can’t consent to how their data’s used, and, and there’s a lot of issues around that as well. So it’s just interesting to point out that if you’re sharing it with allegedly 500 partners, and we don’t quite know why or how that data’s being used, that’s a, that’s a whole other thing to be talking about.
Rebecca Bultsma: But let’s continue down the Canvas [00:23:00] rabbit hole, and tell us a little bit, lead us in here. You had that agreement. They came back, and I don’t know how long ago that was, but I’m wondering if what’s happened over the last few months has changed some of those conversations you’ve been having with Canvas
David Bowman: That was over a year ago.
David Bowman: It kinda is what it is, ’cause they gave us the option to say we just don’t want it that way, and that was fine. Making them give it to us in writing and get it approval was kind of like we changed it from the standard of, “Well, you have to notify us, and then you’re fine.” So we were able to push to change the standard of, “You have to notify us, and then we have to respond back and say it’s okay.”
David Bowman: So not just de facto we have permission, and vendors really don’t like that, but Canvas did a good job with that, and they said, “Okay.” And so now it’s so much work for them to do it, they probably just do it with other districts or other people that aren’t as hawkish about their data. So, you know, one of the– ’cause for me, as much as [00:24:00] we talk about the challenges, I’m a big believer, and it’s super important that we also offer solutions in what we can do.
David Bowman: So this recent Canvas breach is a really good example of where good behavior and not so great behavior was happening, and so it changed how it impacted different institutions. So-
Rebecca Bultsma: Why don’t you tell the whole story? For anyone who hasn’t been following this in the news or they just clocked it off to something they didn’t understand, spin the tale.
Rebecca Bultsma: Tell us, tell us, uh, the story and what happened and, and give us the background.
David Bowman: So Canvas has a lot of data. In order for us to use Canvas as a school district, they– I can’t think of any other vendor except Google that runs our actual ecosystem that has that level of data, and frankly, Google doesn’t even have that level of data.
David Bowman: Like, Canvas is one of [00:25:00] my core data sharers. ‘Cause a big example is, is it knows information about students’ grades because teachers graded in Canvas, and then it automatically goes back to our student information system. So it knows every class that every kid’s in. It knows the grades, what assignments are completed.
David Bowman: They have to know all of those things in order to make the product work the way we want it to work. So when systems and bigger computer systems talk to each other, they have a technical tool that’s, it’s called an automated programming interface or an API. Basically, that just means, hey, Canvas’s system speaks this very specific language that is Canvas’s language, and my system speaks a very specific language that’s my system’s language, and there’s an agreed interface of this is how we will talk to each other [00:26:00] So when that conversation happens, there’s ongoing syncing.
David Bowman: Sometimes that’s daily, hourly, sometimes it’s every time. It just depends what it looks like. So it’s natural that a vendor has that type of thing and it’s automated. And this automation becomes very important in kind of understanding the timeline of where things became interesting. But on the 26th of April, their main data communication language setup went down for maintenance.
David Bowman: So if you went to their outage page, it just said, hey, we know there’s an issue. We’re working on it. We now know that that’s actually when they started to figure out that there was some hacking groups into their system. And so then on the 27th, [00:27:00] they indicated, yeah, it’s an ongoing outage still. We do know based on some of the after action stuff that they absolutely knew it was a cyber attack going on at that point.
David Bowman: But then they make it to the 29th, which is a Friday, and they wait until Friday at 4.30 in the afternoon and send an email to the customers and say, hey, we’re aware of a security incident. We’re working on it. And it probably contains a few things. First name, last name, email address, course enrollment, direct message data.
David Bowman: So if a student talks to a teacher and a private message, that was included. And it was like, well, wait a second. We need way more info than this. What happened? Are the bad guys gone? And it [00:28:00] This will be a case study for a very long time to come of how not to do public relations.
Rebecca Bultsma: And I’m gonna pause you there because I ran school public relations for a long time, and just to point out the timing on this, April 29th, it’s not just K-12s that use this, right?
Rebecca Bultsma: There’s tons of universities and colleges that suddenly kids couldn’t submit work before deadlines. The university- They couldn’t submit
David Bowman: final exams.
Rebecca Bultsma: Exactly. They couldn’t communicate with professors. This has all been centralized to such a place that this was paralyzing for many institutions, and nobody knew what was going on, and they had no way to get information.
Rebecca Bultsma: ‘Cause as you mentioned, the doors were locked, and the phones were turned off, and this was all the message you had to go on.
David Bowman: And not only that, but the groups that attacked them– And so we went the weekend with no information from Canvas at all. They finally released a generic statement on their website on Saturday that was a repeat of the same nothing, uh, nothing burger.
David Bowman: But the particular group that [00:29:00] attacked them is called Shiny Hunters. So they are a really big data-stealing, you know, data-stealing criminal gang, and they’re very sophisticated. But what’s really quite interesting is they have an extremely effective PR team. So Shiny Hunters starts posting all over the internet and the dark web and everything about, “Hey, we have this data, and we’ve attempted to engage with Canvas, and they aren’t talking to us.”
David Bowman: And, you know, sometimes you have to take what the bad guys have to say with a grain of salt. But then Monday comes around, and we’re still not seeing any good communication from Canvas, and the attackers, the Shiny Hunter guys, take this bold step of saying, “You know what? Canvas is not responding to us. We can tell that people are frustrated as customers.
David Bowman: [00:30:00] So here’s the deal. Here’s a website you can go to, and it’s a list of every institution’s data that we have And you would be welcome to contact us and individually negotiate protecting your institution’s data. And so this is kind of a unique and interesting case study ’cause typically when you hack a company, you, you’re dealing with that company.
David Bowman: The scope is all of those customers but that company. But the relationship with Canvas and the individual decision-makers and boards and all of these different ongoing management things made it so that it was potentially feasible to negotiate individually with the terrorists or the cyber terrorists.
David Bowman: And we know that that happened. I think it was, don’t overquote me, I’d have to double-check the news, but I think it was a university in Pennsylvania where their student newspaper actually [00:31:00] wrote an article saying that the administration had told them they’d reached an arrangement with the attackers so their data wasn’t gonna be released.
David Bowman: And so that theoretically at some point was successful. But what got even more crazy is, and this is the funny part about the timeline, so I have a little– and I’ll have to get you the asset so you can throw it up on the podcast, but I have a little sign in my office now that’s called Canvo De Mayo. Um, and the shiny hunters and, and all of this silly…
David Bowman: Because at this point, it’s been going four or five days. Those of us who are really worried about it aren’t sleeping real great and, you know, at some point you have to dink around with your AI to entertain yourself.
Rebecca Bultsma: And let me, let me pause you there. What worries you? What could– what’s the worst-case scenario here s- that could happen that is making you lose sleep?
David Bowman: So that’s the funny part. A lot of [00:32:00] people don’t think it’s that big of a deal.
Rebecca Bultsma: Sure. So
David Bowman: a list of like what? Yeah My first name, last name, email address, not that big of a deal. And actually, I really tried to sample this and track this because I’m an adjunct professor at night, so I teach adults, and this was going on, and I teach cybersecurity and cloud systems, and so this was a very relevant first week of class.
David Bowman: And I just said, “Hey, guys, do you care if your first name and last name is out there and your email address?” And they’re like, “Well, no, not really.” Like you mentioned, a lot of the adults do. Well, then as we talked more and more through the details, I said, “Well, let me connect those dots.” So here’s an… The trick here of what the risk is is the relational connections Versus just the, “Yeah, my name and email is out there, it’s not a big deal.”
David Bowman: And when we talk about the AI aspect, the computing [00:33:00] power of the ability to stick all those things together really easily is what’s fundamentally changed from that. So it used to be like you could go to the big research university in your region and say, “We wanna use your supercomputer to do this data analysis and help us figure out these things.”
David Bowman: Now, you just go to ChatGPT or Gemini and say, “Here’s my data, do that.” So you don’t have to go to, you know, you don’t have to write a proposal and go use the university supercomputer anymore. You just do it from, you just do it from the internet.
Rebecca Bultsma: Because AI excels at making connections and finding patterns and connecting dots, all the dots that might be there, right?
David Bowman: And so it’s not going to, it’s not gonna replace me. It’s going to change how I work. But here’s a scenario where things get, and this is a little geeky, but I wanna give this example of how you connect it [00:34:00] together. So let’s say I have an eighth grader that’s in middle school. So what age is that?
David Bowman: Fourteen-ish? Fourteen. Yeah. So with their first name and last name, I probably could easily infer this is what their gender is. I could infer their ethnicity. So Canvas collected that data if people pushed it, so if you told them what the student’s gender and ethnicity was, then, then it’s there. Some people were sharing that, some people were not.
David Bowman: But then, you know, age. Well, you can also see here’s all the classes that people are signed up for. So when this 15-year-old student is signed up for special education services class, now I know this student has some type of disability. This is their ethnicity. This is their age [00:35:00] And this is the time of day that they interact with the systems and their courses.
David Bowman: So if I’m motivated and want to figure that stuff out, I know who the kid is I can target based on eth-ethnicity. I know this kid is potentially more susceptible to persuasion or hacking because they maybe have some type of del- developmental delay or some special education services needs. And then you could also, you know, when students log into Canvas, there’s a little picture of them.
David Bowman: It helps the teacher identify who they are. Well, now I can print out for you, if I were to go print out all the screens I have, your first name, last name, picture, email address, gender, special education status, ethnicity, sometimes parents’ first name and last name, your geography, and roughly a zip code because of your [00:36:00] school, and what type of student you are.
David Bowman: Well, now, okay, maybe I care. Now that like if you printed it out as a, as a dossier, like a hitman, right? Of this is I’m gonna go hack this person, that’s a lot more disturbing. And so I actually did an interesting exercise with my college class, and they’d been like, “Yeah, we don’t ma- you know, we don’t care that much.”
David Bowman: And so I took and I made a mock one of just the pieces of data that I knew we were giving Canvas, and luckily, we were giving Canvas the absolute bare minimum, so a lot of this stuff wasn’t involved, at least at our institution, in terms of the amount of things that could’ve been there. And I printed it out like a dossier, and I handed it out to the class and said, “All right, guys, do you have different feelings now about this?”
David Bowman: And then universally, it was like, “Whoa, whoa, whoa. I, I [00:37:00] all of a sudden care now, and I care a lot.”
Rebecca Bultsma: Well, and if you think about it, that kid’s 17, doesn’t know this data’s out there, whatever. How easy is it to then start applying for credit cards or do identity theft that the kid doesn’t recognize until they go eventually to do those things for themselves?
Rebecca Bultsma: And at scale, how many times does that happen to how many kids, and what kind of impact does that have for them down the road? Like, in the hands of which bad actors is that data the most useful and damaging for kids in the future, in your opinion?
David Bowman: So listen, credit card numbers and setting up identity theft, stuff like that, yeah, it’s absolutely happening.
David Bowman: It’s a financial motivator. Something I try to share with people that’s kind of interesting that they don’t realize. So if you go on the dark web to buy data for purposes of like identity theft or things like that, an adult is worth maybe a dollar or two, right? [00:38:00] A student or a minor is worth like $10 because it’s less monitored, because it’s somebody who maybe isn’t as sophisticated to know what it looks like.
David Bowman: Well, now take that $10 and times it by my 57,000 students. So now if you were to hack my school district just for purposes of that data, that’s at least half a million dollars easily resellable value. But here’s the crazy part. Or I’m a marketing company that wants to develop an ed tech software, and I wanna understand more about how students use things and do it.
David Bowman: So I go to a data broker, and I pay them $10,000 for that information on 57,000 students So as a good guy, it’s actually cheaper. Now, you don’t get exactly the same first name, last [00:39:00] name, birthdate, but you get the same aggregated data. And so people kind of brush it off and go, “Listen, you know, it’s just credit.
David Bowman: It’s just a little bit of money. Your identity gets stolen.” That’s not the part that really scares me. The part that scares me here is– Actually, it was g– I was on a webinar the other day where they were talking about it, so trying to hire people effectively and go through things is, is complex, but there’s a lot of data out there.
David Bowman: And so one of the services this product offers is, “Give us the name of your candidate, and we will just tell you everything we know about them.” And that was part of the service. And so when you do it that way, then now this student’s applying to a job, and they look at the student, they like them, they decide to run that background check or that deeper dive, and then they can see, oh, this is where that kid lived.
David Bowman: This is how old [00:40:00] they are. This is what their grades were like. This is what types of classes they took. Well, these are all things that are illegal to discriminate based on, but we’re giving them that information easily so that conscious or unconscious bias-wise, that’s what happens. But I do the same thing as a technology professional that hires people, especially in the IT space.
David Bowman: When I narrow it down to the two or three people I’m most interested in, I start Googling them. I’m looking at their social media. I’m looking at if they’re on gamer forums. I’m looking at all those kinds of things. And I had experience recently where I had a candidate that I really liked and thought that candidate would be a good candidate, and then I came across a social media profile where all the person did was complain and moan about their work all day.
David Bowman: And that was like, maybe that’s not such a great fit. But those are– [00:41:00] And this is gonna be, call this controversial, but you know, we spend a lot of time talking about school shootings and protecting physical safety. And the news likes to talk about this because, you know, if it bleeds, it leads. So in Utah, we’ve had a lot, a lot of extreme focus on the school shooting aspects and physical security and all of these different things over the last few years.
David Bowman: But there’s been very to little no focus on resources to protect students’ data. Here’s the reality. If a kid gets injured or shot or they’re in a school, they go to the hospital, they get treatment, it changes their life for sure, but it becomes an event that they can move on from If their data and all their identity gets stolen, it haunts them forever.
David Bowman: It haunts them in jobs, it haunts them in ability to get credit, it haunts them [00:42:00] in how they’re targeted politically. And so instead of it being a limited window event, it’s an ongoing life event. And that’s why I get a little bent out of shape when people are like, “Eh, hmm.” Um, but the word that I really like to use is stewardship.
David Bowman: You have to be a steward of people’s data and treat it like it was your own and you would care
Rebecca Bultsma: That’s ex- that’s exactly it, and that’s what I love about your level of care and awareness here, ’cause I don’t think we’re, we’re seeing that everywhere. To go back to Canvas for a minute, they gave, ShinyHunters gave Canvas a deadline, and from what I understand, they eventually paid up or came to some sort of agreement.
Rebecca Bultsma: Uh, what do you know about that?
David Bowman: Um, so the interesting part about this is nobody really was noticing this was going on until May [00:43:00] 4th or May 5th. And the reason that this happened was because ShinyHunters was still in the system, unbeknownst to Canvas, and they had told everybody it was good. And then in the afternoon one day, all of a sudden, about 900 Canvas customers, the screen popped up with a message that all, anybody logged into it and said, that said, “Hey, we’re ShinyHunters.
David Bowman: Uh, Canvas patched, and they thought they had us out, but we still have control. So we’re the boss. We’re not gone yet. You need to pay us.” Right? So at that point, mm, speculation/things are heard/how you interpret things are said. Canvas had not engaged with them and had zero intention to engage with them. But the ShinyHunters PR people figured out that [00:44:00] we really care.
David Bowman: And so it’s not like we weren’t all, like, yelling at Canvas, like, “What the heck are you doing?” But now media, institutions, everybody is banging on Canvas’s door saying, “Guys, like, you have to talk to us about what’s going on.” We weren’t demanding they paid. We weren’t– We were just saying, “You gotta talk to us about what’s going on.”
David Bowman: Well, there were some deadlines, and then they would move it out, and that’s, that’s somewhat natural attacker behavior. If they think with a little bit more time, they might get some money, they’ll have a tendency to play that game. So we get into the weekend of that week, and all of a sudden everybody’s paying attention now.
David Bowman: Because when people, normal users saw that on the screen, people were taking pictures, and now the entire news is picking it up. Federal levels are, you know, they’re, they all of a sudden everybody knows about the thing that I’ve been losing sleep [00:45:00] over for a week, right? And that was a moment where that was kind of an oh crap moment because all right, they are still in there, so we really can’t trust them anymore.
David Bowman: So the gut reaction from a large number of vendors and school districts was, we talked about that special communication tool that’s automatic. We just cut it off. We just said, “We’re done And so, you know, the big interruption for that is, you know, teachers, if they were putting in grades and things and determining graduation eligibility, those were not going back to, going back to the system that’s the source of truth to decide those things.
David Bowman: And when major vendors started doing it, their services were essentially inaccessible because it was accessed through Canvas. We turned it off out of my– I’m really tired of abundance of caution, right? Like, we [00:46:00] did it because we don’t trust those freakers, right? Like, but you did PR, right? Abundance of caution is everybody’s favorite word.
David Bowman: I think I br- I had a LinkedIn post going for a while of like, “Give me an alternative to abundance of caution,” and I think, I think my favorite one was, “Out of a total lack of faith that people will not click the link, we’re going to da, da, da.” Well, there’s this technology principle that’s called DDoSing or distributed denial of service.
David Bowman: What that means is, is everybody– If you imagine like a grocery store and there’s a hurricane coming or whatever, everybody goes to the grocery store and it’s just completely overwhelmed and all of those things. Well, that can happen on the technology side of the house where everybody’s sending an email to something or everybody going to a website and it just breaks.
David Bowman: Well, here’s the crazy part about what happens. On the Friday Yeah. On the [00:47:00] Friday In the afternoon, the ShinyHunters guys take down from their website any mention of anything about Canvas or Instructure or the data or anything. And actually, give me just a second. I’m gonna find the actual screenshot ’cause I wanna read it because it was just so hilariously written and so, so real about what it was like.
David Bowman: I can’t even word it. Okay, so this is what it said. “Due to the significant amount of press inquiries we are receiving every hour from all around the world, we are making a public statement. We are not commenting and have no further comment to make regarding this global incident.” Yes, ShinyHunters posted that.
David Bowman: So ShinyHunters [00:48:00] essentially got DDoSed through their own attempt of every media outlet, every customer, everybody, where they’re like, “We don’t know what you’re talking about. We’re not commenting on this.” Like they broke their own infrastructure to respond to things. That’s one theory about it. Now, we do know, and so speculation then happens on the Friday, okay, somebody paid, right?
David Bowman: Canvas paid, and Canvas did on the Monday or the Tuesday, so that was like seventh, eighth, ninth, around the tenth now. Canvas said, “Hey, we’ve reached an arrangement with the attacker,” and yada, blah, blah. Well, it’s like, “So did you pay the ransom?” And they’re like, “We reached an arrangement.” And I’m like, “What lawyer is sitting there telling you not to say we paid the ransom?
David Bowman: We all know that’s what you did.” But then it’s like, okay, can we trust that? What happens with that data? Where did it go? [00:49:00] And the answer is no, you can’t trust it. You just– Now, whether or not to pay them is a whole separate conversation, but you still have to behave and act on what you’re gonna do with it.
David Bowman: At that point, clearly, Canvas hired an actual PR firm. We got an email from the CEO of Canvas apologizing for the disruption, and he felt really bad. So the good news is the CEO, man, the CEO of Canvas is gonna come after me, right? But the CEO of Canvas was all very sorry, you know. And so that, that was great.
David Bowman: So the good news is, is we’re sorry that mass data shooting occurred. Our bad. Sorry. Right? I need to find the right word to describe that ’cause we talk about mass school shooting, but we should find a relational term to the exfiltration of data. I gotta think on that more.
Rebecca Bultsma: And you think about, you know, you take the other side for a [00:50:00] second, what that must have been like for Canvas this too.
Rebecca Bultsma: What a gong show, right? I’m, I’m torn because part of me looks at what happened with PowerSchool. So like, something’s happened before. Like you, you own like a storage locker where you store people’s stuff, and you know what? Somebody broke in recently to your neighbor’s, and it was a massive nightmare. And so you kind of already know maybe like this could happen to you.
Rebecca Bultsma: What are you gonna do to protect it? And then be shocked when something similar happens to you. I, I have a hard time not blaming them, but I also understand, uh, you know, groups, hackers are good and, you know, they’re probably, it probably sent them into a tailspin, and what could they have done differently or better?
Rebecca Bultsma: C- could they have? And with the technology that’s coming out now, is this gonna be an everybody problem soon? I have so many questions, you know?
David Bowman: So let’s talk about how you fix this, and talk [00:51:00] about the reality of why it goes this way. Security investments and security tools and how you take care of those things are expensive, right?
David Bowman: I have that same issue in a school district. Should I buy this other security tool that will help us protect us, or should I pay two teachers? What is the core mission of what we’re supposed to do in a school district? So that’s a day-to-day reality. Here’s the problem. When this type of thing happens to companies, they don’t care.
David Bowman: The penalty isn’t big enough. It’s not a big enough deal. Like Canvas could– Canvas is almost in too-big-to-fail territory just because of the size of their customers and how you don’t just wake up one day and go, “Hey, we’re gonna move to this competitor.” Um, and you don’t do it in a summer, right? I mean, this would’ve been the moment to go, “Hey, you know what?
David Bowman: We’re leaving. We’re, we’re getting off of [00:52:00] it.” And it’s just not something you can do that easily. So in the end, at some point, Canvas will probably pay some fines. They will pay, you know, they’ll maybe lose 10 to 15% of customers that are like, “Hey, we’re not doing this anymore.” Canvas, you know, learned their lesson, so they’ll actually– I mean, they’ve released guidelines about this is what we’re doing to prevent this in the future, which is basically the lowest level tier one security responsibilities that everybody should have been doing in the first place.
David Bowman: And so it’s like, but the, it didn’t hurt. So like this happens with like a Google or an Apple or they’re getting t- they’re– or PowerSchool. They’re getting fined or the consequences are single digit, single digit impacts to their revenue or their bottom line. Here’s how you fix it. You make it hurt If [00:53:00] screwing that up makes it expensive enough that your entire company could go down, that boardroom-level conversation about this is what’s gonna happen if this happens, yeah, we’re not gonna hire those two teachers because we, we can hire no teachers if that happens.
David Bowman: Um, Europe is way out in front on this. They have– They are getting stronger and stronger about it. The num– The problem is, is that even in the consequences there, they’re, they’re mainly the baseline statutes are number-based, like X amount of dollars per instance or occurrence, which works for the small to medium, but then you see a judgment that says Google got fined a billion dollars.
David Bowman: A billion dollars to Google is the equivalent of me stopping at my dirty soda shop on the way home, right, to my annual budget, right? It, it’s nothing. It, it’s smarter [00:54:00] from a business spreadsheet perspective to not make the investment. It doesn’t matter. And so one way to do things is to change it so that there is a percentage-based penalty of profit For those types of violations.
David Bowman: Because when breaking the rules or stretching the rules costs more money than it does to do the right thing, then they’ll do the right thing.
Rebecca Bultsma: And you are right into my territory now because this is such a big conversation happening with the big AI companies right now, and accountability, and the fact that there’s very little legislation governing any of that, and sorry our chatbot told your kid this, but like there’s no consequences or penalty or accountability at this point, and these companies are massive.
Rebecca Bultsma: And what does a good punishment or [00:55:00] penalty look like when there isn’t even any laws that are fast enough to keep up with all of this? These companies, the size of them is staggering and introducing a whole new layer of risk, and as we’ve mentioned. On that thread, Anthropic announced last month that they had built this AI system that scared them.
Rebecca Bultsma: And again, from a public relations standpoint, you know, I, I understand maybe some of the motivations behind them releasing that. They essentially said, “Hey-” The
David Bowman: best marketing ploy ever.
Rebecca Bultsma: Ever. Okay. Okay. Yeah.
David Bowman: Right? As my- It’s so good it scares us. We
Rebecca Bultsma: can’t tell you anymore, but it’s so amazing.
David Bowman: Yeah.
Rebecca Bultsma: Right? But they came out and said, “We’re worried that this is gonna hack every system in the world, right?
Rebecca Bultsma: And so we’re only gonna give it to the major companies so that they can use it to figure out where their systems are vulnerable and make those patches before this gets released.” So yes, great marketing. Probably a little bit true maybe [00:56:00] when you think about the amount of public infrastructure in North America that is still operating on like Windows 7.
Rebecca Bultsma: You know, some of it, uh, some major, major organizations, especially government organizations, infrastructure even, based on some whistleblower reports I’ve seen, that are still operating on very old easy to hack software. Uh, and we start to wonder if these data breaches become more common, or we see them more often, and how are we ever supposed to protect ourselves or our children from this?
Rebecca Bultsma: Or is it just hype? David, what’s your read?
David Bowman: My initial read was this either is what they say it is and the world’s over, right? Right? Pick your religious statute, right? Or preference, but God’s coming back. It’s over, right? Or it’s the most brilliant marketing scheme ever. So that’s been my concept for a little while.
David Bowman: Now, I am connected enough to the [00:57:00] security researcher environment and some of those things that I’ve been able to talk to people directly that have actually touched the Mythos stuff or seen what it can do. And it– Part of why it can be successful is back to that DDoS concept of just trying the same thing over and over and over and over again until it finally breaks.
David Bowman: And so because it’s better at automating that than typically you write a program that says, “Try this thing and go try this thing on everything we know about.” That’s traditionally what it looked like. Now what you’re telling AI is, “Try this thing, but if this, this, this, or this happens, then shift to this.”
David Bowman: And it really can find stuff that shouldn’t be there, but it’s not really inventing [00:58:00] new ways to do things. So like this is a perfect example of how it works. So yesterday I was dealing with an issue where we got a video sent to us from a parent that said, “Hey, our– my– our kid is looking at pornography on your Chromebook.
David Bowman: You need to make it stop.” And I’m like, “Okay, well, anytime this happens, we try to figure out what’s going on and we stop it.” Well, parent shows us the video, and it’s like student goes to this, this approved app, then scrolls down to the bottom of the page, hits Contact Us, then goes up to the other top of that page and hits About this company, then goes to the bottom that says, “Here’s your stock ticker for this company,” that clicks take me to Google Stocks, and boom, now they’re on Google search engine with no content filtering restriction, right?
David Bowman: So only a middle schooler’s brain is bored enough to figure out the seven [00:59:00] clicks it takes to figure out how to get there. No human being, even a properly trained cybersecurity person or somebody locked in a basement by their government hacking other people, has the patience for that. Well, what does have the patience for that is a computer.
David Bowman: And so what I think will happen is that Anthropic or Mythos or whatever you wanna call it, it will continue to find things, and it’s gonna be a big deal, and we need to patch it, but it’s not going to change the way the– It’s not going to change inventing this new way to hack people. It’s just going to make the volume so large that we can’t do anything about it.
David Bowman: And so it’s like, you know, every time that we have to fix something, we have to turn a system on or it off or whatever. A s– Let’s imagine a perfect world where the vendor finds out about it, and that same day I have a fix. Well, [01:00:00] do I reboot it in the middle of the day and take everything down in the middle of class, or do I wait until six o’clock because then teaching is done?
David Bowman: Well, the basketball game is going on or the adult ed night school is going on. So then do I do it at ten o’clock at night? We’re public government employees. Nobody wants to work at ten o’clock at night. So do I have a guy that his job is to just turn everything on and off every night and apply fixes?
David Bowman: That’s the piece that’s really gonna get into the issue where, where that’s gonna be the piece that’s really gonna change things And I’m not necessarily looking forward to being the incident response level person in that. I wanna do the more leadership of how we fix it level at this point. I used to kinda wanna be the guy that just sat in the basement by myself and with my dark hoodie and my just…
David Bowman: But now I’m like, “Ugh, that’s exhausting.”
Rebecca Bultsma: So then how do we fix it? Where do we go from here? Knowing, you know, the parent who’s listening to [01:01:00] this or, you know, people who are freaked out about their data or what’s possible or, like me, tempted to just move back to the farm and get some bees and turn off all my technology sometimes, you know.
Rebecca Bultsma: How do we exist in this world? Is it just as easy as the digital hygiene, digital footprints individually? It doesn’t sound like it because it sounds like it is bigger than a lot of us, and more on the companies. Is the accountability piece the secret potion that we all need to exist here?
David Bowman: Yeah. Don’t click on phishing emails, be overly aware, blah, blah, blah.
David Bowman: Why do we have to put that on every breach notification? If you don’t know at this point to think before you click, it doesn’t matter how many more ways I’m gonna say it.
Rebecca Bultsma: It’s the same reason we put, “Don’t drink the shampoo,” on the shampoo bottle, right? Like, there’s always people-
David Bowman: Yeah, or the coffee is hot at the McDonald’s, whatever, right?
David Bowman: Like, so but you have, in the end, it has to be about accountability [01:02:00] You have to demand accountability as a parent, as a data steward, as a citizen, as a legislator, as a voter. Like, you have to make people pay, and you have to demand accountability. And until everybody forces them to do it, they’ll just keep doing it.
David Bowman: And I don’t wanna say, like, you just kinda have to be resigned to it. A lot of those typical things that we talk about in the abundance of caution, doing those things will help you, will help you minimize your own exposure. And so it’s good to do those things. But everything has a trade-off, and people decide how they wanna make it work.
David Bowman: A perfect example, I’m a cybersecurity professional. I have all kinds of access to things that would be highly valuable. So, like, David Bowman’s credit is [01:03:00] not particularly attractive. The username and password that David Bowman has that could access the data of that many people is extremely attractive, which makes me a very highly targeted individual.
David Bowman: So common sense would be David Bowman should not have a LinkedIn profile that literally says all these different things about me, where I’ve worked, to make it easy to associate that. I know that, but here’s where the trade-off comes. I, because of where my experience sits, lots of companies wanna research how to sell to people like me.
David Bowman: So once or twice a year, I’ll get a company that reaches out to me or a market research firm that says, “Hey, based on what we’re seeing on your LinkedIn, if you’d be willing to talk to our client for an hour about this particular type of thing, we’ll pay you three or four hundred dollars.” And it’s like, okay, right?
David Bowman: I mean, I’m doing this because I like to talk [01:04:00] about it. Somebody wants to pay me to, by the minute to talk, I’m in, right? So I go through this period of like, I just, I have to be more controlly and what– I update my whole LinkedIn profile to be way more generic, way less easy to do it, and those opportunities dry up.
David Bowman: And I’m like, well, I kinda like that. And so I put it back. So, you know, I– it was a particularly interesting research time, but, like, during the year that I did that, I got almost two thousand dollars in those free, in those little conversations with zero effort. They just called me and offered to pay. So I’m choosing to give up my privacy for two thousand bucks So I’m making that decision, and everybody has to realize that they’re making that decision.
David Bowman: Now, I refuse to use Facebook or X or like the ones that it’s– [01:05:00] the ones I think that are the most egregious. I, I vote with… It used to be vote with your dollar. Now I would say it’s vote with your data, right? What data you will or will not share. Um, and that’s a decision and things that I have to do about that, and everybody is doing that.
David Bowman: But I think the accountability is the biggest way to fix it, whether it’s parents or class action lawsuits or fines of what’s going on, and you gotta hold them accountable. Like with this Canvas thing where they weren’t communicating, the Senate Education Committee s- had sent a letter and said, “You need to come talk to us about this.
David Bowman: This impacts, like, a large portion of every student in the United States.” And Canvas didn’t answer the door or the phone call or the email. So then Senate Education Committee did the same thing that the bad guys did. They went to the media and [01:06:00] said, “Hey, we sent you a message. We’re trying to reach you about your extended car warranty, but you aren’t answering.
David Bowman: So here’s the message that we sent you, and here’s the date we expect you to come testify.” So it’ll be really interesting to see what happens when they come testify. But what’s the impact in the end? There was a really big hack where that happened a lot with a company called Change Healthcare, and they controlled prescriptions for like seventy-five percent of America.
David Bowman: And you can go watch those hearings and those things, and the funny part is to watch the legislators go, “You didn’t have two FA turned on? Are you kidding me?” Well, guess what? When it’s all said and done, how much did that cost Change Healthcare?
Rebecca Bultsma: It’s like having your-
David Bowman: Go look it up … password
Rebecca Bultsma: for everyone set as password one, two, three.
Rebecca Bultsma: Yeah. I mean, their
David Bowman: stock hasn’t gone down. They still have sufficient revenue. Like, it didn’t hurt enough. [01:07:00] Now, when I say you have to make it hurt, well, that’s an interesting target. What happens when I get hacked? ‘Cause I’m gonna get hacked as the school district. So do you sue your school district? Is that fair? I was doing my best, right?
David Bowman: It, it was a well-meaning teacher who posted the spreadsheet of every student and all their data on the internet on accident. They’re not a bad person. So who do you hold accountable for it? And how complicated is it to do that It gets very complicated. Like, and this is something I can comment on because it’s very public that Jordan School District is doing it, but there’s serious concerns about the impact of social media and mental health on children, and it’s really hard for individuals like, you know, a mom would have a really hard time suing Facebook because of stuff that happened on Facebook [01:08:00] that caused their child to kill themselves, as an example.
David Bowman: Well, when an institution gets behind it, then it’s bigger. It’s bigger numbers. So Jordan School District, this random school district in Utah, is suing Facebook and Instagram and Meta and all these big companies, and we are what they call a bellwether case. So what happens with a class action is they build all of these different people, but then they take a few of the biggest ones that have the best stories and the best data, and they use them to present that.
David Bowman: Well, our school district is proactively trying to hold people accountable for what they do And people are like, “Well, what does that have to do with the school district? Like, how did that impact you?” Well, we now have, which is actually super cool investment and proactive good thinking on our [01:09:00] board’s part, but we have a mental health professional in every single school.
David Bowman: We have 65 schools. The payroll cost to have 65 qualified professionals that are properly licensed in every single school, and there’s way more than just one per school when you get to bigger schools, that’s a significant cost to the taxpayer. And this concept of we hold people accountable is something that we believe in as a district, and we believe in as a community.
David Bowman: But I believe the same thing. That’s why I’ll go to a conference, or I’m willing to go on a podcast and say, “Canvas, you didn’t do it right.” Because we believe institutionally, and David believes institutionally, that you have to demand accountability. And if you’re not [01:10:00] gonna own it, I’m gonna bug you until you own it.
David Bowman: Now, I’m not gonna go crazy on YouTube like the guy trying to fix the Lego problem that got stolen with the– If you want a rack, oh, go watch the Bricks and Minifigs Lego theft. It, it’s fascinating, right? I’m not gonna be a crazy YouTube personality of, like, doing all kinds of insane stuff, but I’m going to continue to demand that we get attention.
David Bowman: And, and do I think that’s gonna work or fix it? No. Do I think hopefully it helps to make some difference? Yeah, I really do. And I do have some beliefs that it will make some difference. But the influence I have, I will vote with my dollar, but not just my dollar, but with the taxpayer dollar budget that I control When I deal with a content filter company, if they’re gonna feed the stuff to AI and not do it the way I want, then we’re gonna say we’re not gonna give you our taxpayer money.
David Bowman: That’s [01:11:00] what you have to do. And so, you know, there’s, there’s gonna be a corporate guy out here somewhere listening to this going, “Well, how do I do– I believe the same way. I’m ethical, and I’m responsible. How do I convince you or get to you to let you know that that’s the way that I am, and that’s why I’m different?”
David Bowman: And this is what I tell vendors and CEOs or different people that I come across. I said, “On your website, I don’t wanna have to look for it. I wanna easily go on your website, and there’s a button, and you need to call it Our Digital Data Pledge. And on there, you should define every imaginable thing under the sun you can think of to explain what you’re doing with the data, how you’re gonna use it, what you insist your customers do, what your security is.
David Bowman: Give yourself a public report card. And then once a year, pay a [01:12:00] professional firm to come in and test that everything you say you’re doing is actually happening, and be willing to put that on the internet and prove it.” Because everybody sends me a thing with a bunch of stamps. We’re approved by this thing.
David Bowman: We’re approved by that thing. We’re appro– But if somebody sends me, “This is our data security manifesto,” I… And we’ve even done this. I’ve researched it, and at least in Utah, this is appropriate in public purchasing policy. But when we define elements of what’s evaluated for purchasing, you know, there’s a lot of rules about you can evaluate references and features and cost.
David Bowman: We’ve added into our template of there’s an evaluative score based on privacy practices So then if one vendor might not be as good or is a little more expensive, but has the this is our digital data manifesto and the other one doesn’t, I can appropriately, [01:13:00] and I believe ethically that’s what I should be doing, award something to a vendor because they’re more aggressive about that.
David Bowman: But how do you get your local school district or your local person to care about that? There’s not a, there’s not a David at every school district. There’s not a school board that’s willing to go to bat and sue some of the world’s largest companies, right? So it becomes that individual activism of the choices that you make about what you do.
David Bowman: Be that crazy mom or that– I, I have a tendency to call myself a cybersecurity evangelist, right? Or a technology evangelist. Don’t overtake everything and replace it with technology But you also have to be intentional. I– It was actually really interesting. Uh, yesterday, [01:14:00] there was a, there was a Senate hearing where they were interviewing some people about being worried about AI in higher education.
David Bowman: And my experience is kinda cool because I get to live across both worlds. And like, I’ve actually been developing this semester, my students use AI to do my, one of my assignments. I, a lot of them, they can’t because I know how to design it properly. But I want to use it as a benefit to help them. So I made an AI chatbot that runs on my computer, so it doesn’t go anywhere.
David Bowman: It just has a little website on it. I’ve told it, “This is my rubric, this is the assignment prompts,” and the students can go take their writing assignment, put it in there, and say, “Give me feedback in the same way that Mr. Bowman would give me feedback to help me improve it.” The students think it’s super cool.
David Bowman: I think it’s super cool because [01:15:00] they learn how to make their assignment better. I can tell the AI, “Don’t do the homework for them.” And then I have it all locally on my thing, so the data doesn’t go anywhere. I would not be comfortable doing that with any large AI provider because I don’t know what they’re gonna do with it.
David Bowman: But there was this really cool conversation going on yesterday in the Senate hearing, and, um, the guy’s name is Michael Horn. So he’s an author, but he’s an adjunct professor at Harvard Graduate School. And he said this really interesting thing during that testimony that to me has been my mantra for almost two years now, and he said, “If AI can complete an assignment, perhaps the assignment itself is in need of change So my college course, it used to be you had to design a new company’s infrastructure, and they had to write a business plan [01:16:00] and all those different things.
David Bowman: That’s not what they do anymore because that didn’t make sense. AI could just spit it out. They weren’t learning from that. Instead, they have to actually go on the cloud and make it, or they have to record a video showing me or talking to me about it, and that’s how I innovatively change. But I mean, I’ve been all over the place now.
David Bowman: I’ve been talking too much here, but you– Good luck to your editor. There’s a lot to do here.
David Bowman: But yeah, I mean, that’s kind of my thing, right? Of, you know, data privacy is real, and it’s my data, not your data. You know, the old Wentworth commercials, “It’s my money, and I want it now.” It’s my data, and I want it back.
Rebecca Bultsma: It’s more important now than ever, right?
David Bowman: You’re not getting it back. That is– Sorry. It’s the, the right phrase is, “It’s my data, and I want it [01:17:00] regulated.”
David Bowman: Hmm. Right? Think about being a parent to a teenager. You tell them to clear the table, they don’t clear the table. Eventually, you’re like, “Listen, if you don’t clear the table, then I’m not a good teenager parent. I’m learning how to be a teenager parent. Example would be too extreme, right? But there’s this point where when you child peop– uh, parent people, there’s a rubber meets the road moment, and if not, there’s consequences.
David Bowman: And the rubber has to meet the road. They have to be standing out, they have to be standing outside Canvas’s door in Cottonwood Heights, knocking on the door and saying, “We know you’re in there. We can see you. Answer our questions or we’re done.” You know?
Rebecca Bultsma: And you know, I, you, you said it midway through and I think part of the problem is the too big to fail, uh, sometimes too, right?
Rebecca Bultsma: Like, because that’s a lot of what’s happened here because you’re ending, you end up without a lot of [01:18:00] options, right? Like even you, they’re too big that you don’t, can’t go necessarily to a competitor or they have too much of your data at one point and maybe there’s bigger problems around, you know, regulation around things like that that make them maybe e-easier to govern or easier to get out of because really you’re locked in at a certain point.
Rebecca Bultsma: But that’s the conversation for another podcast, I’m sure, and I’m sure we will definitely be having you back in the future ’cause this has been a great conversation about probably what I think is one of the most, probably the most important topic of the, of our time right now, just of how AI is changing w- the value of data and how it can be used for us, but really against us too in a lot of ways.
Rebecca Bultsma: So thank you for being here, David. If people wanna get in touch with you then is, is LinkedIn it? Is it not it? How do they find you? And if someone wants to hire you for a session, like where do they go? Do they find you on LinkedIn?
David Bowman: Um- Who
Rebecca Bultsma: do they tell the hackers? …
David Bowman: LinkedIn is probably the place. Yeah.
David Bowman: LinkedIn is probably the place. You know, if [01:19:00] I, if I had one wrapping up sentence or idea that I think I really want people to understand is everybody agrees that hackers are bad and they want me to protect their data from hackers. What I really need people to begin to understand is the hackers are the low-hanging fruit.
David Bowman: It’s the companies that you do business with every day that are the bigger threat, and I need your help To hold companies accountable to stop it. Yes, I need your help and your tax dollars to fight Russia and North Korea and Iran trying to hack our data, but I need to stop the legal sale of our data even more than the illegal transactions on our data.
Rebecca Bultsma: And I think that starts with people understanding exactly what you’ve told them, like why the pieces of data you don’t think matter, matter, and how when you collect them together and draw those [01:20:00] lines, why they’re valuable and why we need to be having these conversations. So thanks for being here, David.
Rebecca Bultsma: Sorry Brett couldn’t be here, but I think he’ll definitely be here on our, our next one, and we look forward to having you back in future conversations. Thank you.
David Bowman: Great. Thanks, guys.
