Olathe School District CTO Josh Umphrey understands firsthand the challenge of aligning IT goals with classroom needs. Before taking the technology helm at Kansas’s second-largest school district, Umphrey was a history teacher, coach and assistant principal at Olathe West High School. That frontline experience informs how he approaches student privacy and network security.
InformationWeek recently caught up with the former assistant principal turned CTO to discuss how common IT challenges, particularly around AI and cybersecurity, play out differently in K-12 education. Umphrey explained that in the Olathe School District, technology is viewed as an “engagement tool to learning” that should serve as a “resource” but not a “crutch” to students.
The overarching challenge for Umphrey and the district’s IT team is managing the speed at which technology is deployed across the district. For example, it’s not always feasible for the IT team to deploy bleeding-edge technology as quickly as teachers would like.
As a former teacher, Umphrey fully understands that desire, but he also knows that school districts face privacy, compliance and security obligations that require a deliberate approach.
Navigating app overload and strict data compliance
Managing a massive software environment with a lean staff is a constant battle for the district, Umphrey said.
“We support around 2,400 different apps across the district and ensuring that all of them work is a near impossibility.”
Ensuring compliance with federal regulations — including the Child Online Protection Act (COPA), Family Educational Rights and Privacy Act (FERPA) and HIPAA laws — further complicates the effort to manage so many applications, he added.
Another challenge is that the Olathe District has a dedicated IT team of only about 35 individuals serving 51 schools.
“On top of that, we have about 30,000 kids in our district, all of whom are actively trying to bypass everything,” Umphrey said.
Establishing student privacy guardrails
Protecting student data and training teachers on the threat landscape are among the district’s top security priorities, Umphrey said. While a teacher might want to use a new AI technology right away, it’s critical to consider the protection of student information and meet district guidelines before deploying new technology, he said.
The district’s use of AI tools was “kind of open at the beginning, and then we dialed it back. Now we’re locked into just a few that we know have the right guardrails in place to not train anybody outside, and then we have very specific use cases,” Umphrey said. Among the Olathe District’s approved internal AI technologies are MagicSchool and CoPilot — a select group also have access to Gemini to determine whether the district should expand access to additional AI models.
“We want to get it right,” Umphrey said about the district’s approach to AI. Olathe School District is collaborating with partner school districts to deploy AI “effectively, protect kids, and make sure that we’re finding the right ways to train teachers.”
Umphrey explained that the district’s AI technologies run within the internal network to prevent private student information from being shared publicly. AI isn’t the only potential threat to distributing private student data; human error presents another privacy challenge. If a staff member attempts to share student information via their school’s email address, the security platform will stop it and the IT team will receive an alert, he added. “Five years ago I saw that happen a handful times, but now our training is really paying off, and we’re just not seeing it as much,” Umphrey said.
As a result of training and relationship-building, Umphrey said he is pleased that teachers are comfortable approaching him with questions about ethical AI usage, which will reduce the likelihood that student information is uploaded to external AI tools, for example.
For Umphrey, it’s important that teachers and staff know that they can approach him directly with technology questions or security concerns.
“It always starts with relationships. You have to be a face, not just a title on an email. You have to be someone that they know and trust. I work hard to make sure that the principals in every single building know who I am, and I have a relationship with them. I know that what matters to their school isn’t the same as what matters to another school,” Umphrey said.
Securing the network
Identity management — providing different levels of AI and other technology access based on whether a user is a teacher or student, for example — has also been key to Olathe’s security strategy, Umphrey said.
“We have everyone from a kindergartner to a 40-year veteran teacher. Being able to establish permissions within our environment is really important to us — ensuring that the kid that is in kindergarten is getting the right access based on who they are,” Umphrey said. Among the reasons for identity management is ensuring that students are only exposed to age-appropriate educational resources, he explained.
Another top cybersecurity concern for the district is phishing attempts that target both staff and students, “mainly through impersonators pretending to be the principal at the school,” he said.
That type of phishing is common partly because contact information for staff in leadership positions is available to the public, which includes bad actors.
“We spent a good amount of time over the last couple years training our staff [on phishing], and it’s been phenomenal to see what we used to do or what used to happen to us compared to what’s happening now,” Umphrey said. He added that staff have official tools to report phishing attempts, but he also receives emails and even texts from staff asking about potential phishing attempts.
In addition to securing the network, the Olathe District is prioritizing speed. The educational system is ” becoming more and more digital, and as a result, you know, we need that connectivity to be as reliable as possible,” Umphrey. Wi-Fi 7 will be deployed this summer to deliver faster, more reliable connectivity as academic testing software and data analytics demands increase across the district, Umphrey said.
“It’s getting installed right now — we’re going through each of our buildings, installing the switches … and replacing the [Wi-Fi] access points,” he said.
Supporting the district’s AI, cybersecurity, and network priorities is no small feat. Umphrey credits the IT team running these initiatives as “a small group of people who could probably go other places and make a lot more money than they make in a school district, but they really do care.”
He continued: “We’re not the biggest district in the nation, but 30,000 [students] is respectable and we all feel like we are part of something that matters.”
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.