AI
K12 as a Soft Target: Data Is the Crown Jewel
School districts hold student PII that attackers value precisely because minors have no credit history. A participant described taking ERP system data, redirecting payroll deposits to thousands of bank accounts, and walking away clean. Another explained that a student’s social security number can be exploited for 16 years before the victim notices. In the current political climate, immigration status, ESL records, and free-and-reduced-lunch data add to the target profile. Schools are soft targets: not Google, not Amazon, and their most important asset is data.
Students as the Real Insider Threat
The concern for a K12 IT administrator isn’t nation-state actors. It’s the middle schooler with time on their hands, YouTube, Reddit, and ChatGPT access, angry about being blocked from Roblox. Attendees described students using W3Schools to execute arbitrary JavaScript through content filters, writing their own proxies and VPNs, and one student at a private school who used macOS accessibility APIs to pipe Google Docs content through the Gemini API, bypassing both a lockdown browser and College Board test controls.
IoT Devices and Shadow IT on School Networks
Schools deal with interactive panels, cameras, drones, personal devices, and cheap consumer hardware teachers buy without IT approval. Micro-segmentation is the standard response: put IoT devices on separate network segments. A purchasing policy that bars teachers from reimbursement for unapproved devices stops most of the problem before it starts. Wall jacks should stay inactive unless a district-owned device is plugged in. One student set up a personal hotspot and charged classmates for unfiltered internet, showing the threat extends beyond hardware to policy gaps.
App Vetting and Compliance Across Layered Regulations
Schools operate under FERPA, COPPA, HIPAA, and state laws including California’s COPPA equivalent and New York’s Education Law 2D. Every free app asking teachers to sign in with Google SSO potentially exposes student PII to third parties through API calls. Requiring teachers to do initial vetting before requests reach IT reduces demand by making the process costly in effort. Any software running on a school computer needs a formal review, and COSN, a national organization for school network professionals, publishes guidelines for building that process.
Phishing, Voice Clones, and Training That Undermines Itself
AI has removed the telltale grammar mistakes from phishing emails. Navaar Johnson ran a security awareness exercise using a voice clone built from a YouTube video of his superintendent, then played both recordings for staff and asked which was real. About 30% identified the AI voice as the genuine superintendent. The exercise also exposed a structural problem: administrators were sending legitimate emails asking staff to enter credentials on external cloud services, directly undermining the training. During a work-to-rule period, one district’s faculty refused to attend any security training at all.
Mentoring the Next Generation Before They Walk Into Trouble
Navaar Johnson’s student help desk has run for most of his 15-year tenure at the district. The session’s consensus: channel student curiosity before it turns into an incident. Security firms doing school assessments routinely recommend starting clubs for students interested in hacking. A Purdue attendee asked how to start a DEF CON group when students lack cars to reach Indianapolis; the answer was to just start without waiting for formal structure. Raffling old Cisco switches, running summer internships, and career day talks were cited as concrete ways to build a pipeline.
Q&A
How do you start a DEF CON group at a university when the nearest chapter is in another city and students lack transportation? Just start, find an accessible meeting spot on campus, and lean on student-to-student communication, without waiting for official recognition or a formal name. ▶ 46:29
Notable Quotes
I hate how much we are filtering. Navaar Johnson · ▶ 17:11
people got it wrong. They picked AI. Navaar Johnson · ▶ 41:49
Don’t go to jail. Sam Comini · ▶ 47:55
Key Takeaways
- Student PII is high-value: minors have no credit history and won’t notice identity theft for years.
- A gaming machine with dual Nvidia 5090s can brute-force the full 8-character NLM hash space in two hours.
- Micro-segment IoT devices and block teacher reimbursement for unapproved hardware to cut shadow IT risk.
- Every free app using Google SSO can expose student PII to third parties through vendor API calls.
- Security awareness training fails when administrators send phishing-style credential requests as legitimate emails.
- Channel student curiosity into clubs and help desks before it becomes a criminal incident.