More details emerge on FCC’s cyber program for schools, libraries

2023 was on track to be a record-breaking year for ransomware attacks against education institutions. During the first half of 2023, Comparitech recorded 85 ransomware attacks on schools and colleges and universities across the globe. In the same period of 2022, the research technology site noted just 45.

Indeed, school districts from Prince George’s County, Maryland, to Minneapolis to Chula Vista, California, fell victim to cyberattacks in 2023. It is a trend that the Federal Communications Commission is hoping to flip with a pilot program it announced in November to provide schools and libraries with better cybersecurity protections.

Two weeks ago, the Federal Communications Commission posted a notice in the Federal Register providing more details and seeking comments from state, local and tribal governments as well as nonprofits on the three-year, $200 million pilot.

The FCC wants to gather data “about which cybersecurity and advanced firewall services will have the greatest impact in helping K-12 schools and libraries protect their broadband networks and data,” according to a press release. The pilot would also help defray the costs of such services for eligible K-12 schools and libraries in rural and low-income communities.

According to new details in the notice, K-12 schools and libraries interested in the pilot have to apply and detail their proposed cybersecurity and firewall projects, and how they would use the funds. Applicants would also be required to detail any unauthorized access to their systems within the previous year, how it would use funding from the pilot program to improve its ability to address cyber concerns and track its progress.

Once selected, schools and libraries would be required to outline their current cybersecurity posture, including how they mitigate and manage cyber risks, and submit an advanced cybersecurity action plan.

The FCC said in the notice that the pilot program would be similar to one that it ran to promote and support connected care services. The agency provided up to $100 million over three years to cover broadband expenses, network equipment and IT services to support telehealth, remote patient monitoring and other connected care services for low-income and veteran patients.

The agency wants feedback on the proposed pilot. It has put forward three overarching goals that it is seeking comment on: how to determine which schools and libraries are eligible, how to ascertain the program’s effectiveness, and how to leverage existing federal K-12 cybersecurity tools and resources.

Measuring the cost associated with cybersecurity and firewall protections is key, the FCC said, especially as it considers rolling out this program to every school and library with networks funded by the agency’s E-Rate program, which helps schools and libraries obtain affordable broadband. 

The FCC said this pilot can help governmental agencies at all levels “gather additional data on the types of new services and equipment that applicants will purchase to address network and data security concerns, and the associated cost and effectiveness of Pilot-funded services and equipment.”

But agency officials said there is a lot to work out when it comes to measuring the cost. That could include requiring pilot participants to submit data on intrusion attempts, successful attacks, the time it takes to detect and respond to attacks, and the estimated cost of each attack, the FCC said. 

But it could also measure other metrics, like the use of multi-factor authentication among students and staff, how often cyber training sessions are held and the level of participation. And the FCC asked respondents whether participants should be required to use available guidance from the Cybersecurity and Infrastructure Security Agency and others to assess their readiness.

The final goal of the pilot is to evaluate how to leverage existing federal K-12 cybersecurity tools and resources to help schools and libraries address their cybersecurity needs. The FCC wants feedback on how to leverage existing tools from CISA, the Department of Education and others, especially as many of those federal tools are free.

FCC Chairwoman Jessica Rosenworcel said in a previous statement the pilot will complement existing federal efforts, but that the threat of ransomware attacks is “too big and complex for one agency to handle alone.”

Improving security and protection for schools’ and libraries’ networks and data is crucial, the FCC said, given the threats that they face and the lack of existing assistance available to them. School districts large and small have suffered cyberattacks in recent years, with researchers finding that ransomware is “arguably the biggest cyber risk facing education providers today.”

Comments on the FCC’s proposal are due on or before Jan. 29.