Miami-Dade Schools look at suing Comcast over cyberattacks
Miami-Dade Public Schools may sue Comcast alleging failure by the telecom to stop cyberattacks during the district’s failed rollout of a $15 million online learning system last year.
Comcast errors and denial that the district was under attack, schools staff said, led to a week of network crashes; frustrated students, families and teachers; and FBI and Secret Service investigations.
Comcast ultimately gave the district software to block the attacks, but Chief Auditor Maria Gonzalez said the company should have been providing those safeguards all along.
Problems began Aug. 31, the first day of the 2020-21 school year, when the district suspected widespread its system outages were caused by distributed denial-of-service (DDoS) attacks, which flood networks with internet traffic to disrupt information flows.
Comcast claimed the outages weren’t from DDoS because the telecom included protection against such attacks as part of its contract with the district. School staff then focused on issues with My School Online, the platform the administration got through a $15.3 million no-bid contract with for-profit education firm K12.
Many teachers reverted to Microsoft Teams and Zoom to continue classes.
“When the attacks had somewhat subsided and connectivity became relatively stable, staff found emails that indicated that the district was being attacked,” a report from Ms. Gonzalez said. “It wasn’t until the morning of Sept. 1 that Comcast determined that the district was, in fact, the victim of DDoS attacks and that the district was not configured by Comcast for automatic [protection] as contracted.”
Online outages lasted for a week until Comcast engineers and the district set up an “always on” system blocking DDoS attacks. A 16-year-old student was later charged in the attacks.
The district, which filed a claim with its cybersecurity liability carrier due to the DDoS attack, “should consider seeking legal remedies” from Comcast, Ms. Gonzalez’s report said.
Suing Comcast could be a “long litigation practice,” school board member Maria Teresa Rojas said.
Under its cybersecurity insurance, School Board Attorney Walter Harvey said, the district must cover the first $200,000 in legal fees. It has already spent about $95,000.
While the district did not end up paying for My School Online – the K12 contract was never executed, Superintendent Alberto Carvalho said – the school board created new rules in September to prevent similar future deals without its approval.
Following pandemic shutdowns, Florida Education Commissioner Richard Corcoran last summer ordered districts to provide fully remote, fully in-person and mixed learning. Complying districts would be funded based on pre-pandemic enrollment projections rather than actual numbers.
Mr. Carvalho’s administration said it contracted state-approved K12 because it believed not doing so would jeopardize funding here. None of Florida’s seven other largest districts reached the same conclusion, Ms. Gonzalez wrote, adding that the two weeks teachers had to acquaint themselves with K12’s software wasn’t remotely sufficient.
“Based on our research and interviews of instructional and information technology staff of … school districts in Florida,” the report said, “the timeframe required to properly acquire and implement a large-scale instructional technology platform in an entity the size and complexity of [Miami-Dade’s is] six months to more than two years.”