AIP 230 · Educators & School Staff
School IT & Safety Technology
The defensive practices IT staff need: preserve evidence without viewing it, handle a suspect device or account correctly, balance filtering with privacy, vet vendors and AI tools, and support an incident.
What you will be able to do
- Configure logging and retention so an incident can be reconstructed without anyone viewing illegal material.
- Handle a device or cloud account with suspected illegal imagery: do not open, isolate, document, and hand off.
- Explain the tradeoffs between filtering, monitoring and student privacy and make a defensible choice.
- Vet a vendor or AI tool for student data risks with a practical checklist.
- Support the incident lead during an incident and run a practice drill.
- Write a one-page IT incident runbook for your school.
1 Module 1 of 5 · 35 min
Evidence-aware IT practice: logging, retention and preserving without viewing
- Explain why IT decisions can help or harm an investigation.
- Identify which logs and records matter and how long they should be kept.
- Describe how to preserve a record without opening or viewing illegal content.
In an exploitation incident, law enforcement will ask what happened, when, from which account and which device. The answers often live in logs and accounts that IT controls. Routine clean-up, such as auto-deleting old data, resetting a device or removing an account, can erase the trail.
| Record | Why it matters | Practice |
|---|---|---|
| Account sign-in logs | Shows who accessed an account, when, and from where | Keep long enough to support an investigation. Confirm retention with counsel |
| Email and chat metadata | Shows who contacted whom and when | Preserve metadata and message identifiers, not by reading content you do not need |
| Device inventory and assignment | Connects a device to a student or staff member | Keep accurate, current records |
| Filtering and alert logs | May show attempts and patterns | Restrict who can view and set clear access rules |
| Admin action logs | Shows what IT did and when | Keep and review. Your own actions are part of the record |
Preserve, don’t view
You can protect a record without opening it. Suspend deletion, lock the account, record identifiers and timestamps, and write down what you did. If the content is, or may be, sexual imagery of a minor, no one on staff opens, copies, forwards or screenshots it.
- Pause automatic deletion or retention clean-up on affected accounts when instructed by the incident lead or law enforcement.
- Record who asked, what you did, and the time, in a simple log.
- Limit access to the incident to those who need to know.
- Don’t search through an account to “see what is there.”
- Don’t delete content to “clean up” before law enforcement says so.
- Don’t forward screenshots of illegal content to colleagues or to the principal.
On Monday, a counselor tells you a student reported that a classmate shared an intimate image through the school’s email system last week. Your system automatically deletes messages in the deleted-items folder after 14 days, and a cleanup job runs tonight.
What do you do before the job runs?
Show the debrief
Tell the incident lead and ask permission to suspend deletion for the affected accounts, then do it and log the time and your action. Do not open the messages. Preserve identifiers and metadata and wait for law enforcement to direct collection. Note the 14-day rule in your log so investigators know about it.
Knowledge check
2 Module 2 of 5 · 40 min
Handling a device or cloud account with suspected illegal imagery
- Follow a safe sequence for a device or account that may hold illegal imagery.
- Maintain a simple chain of custody.
- Hand off to law enforcement correctly and avoid common mistakes.
A student’s phone, a school laptop, or a cloud account may hold sexual imagery of a minor. Staff may unknowingly commit a crime by viewing, copying or forwarding it, and may damage the evidence. The safe path is short: stop, secure, log, hand off.
- Stop. Do not open, browse, scroll or screenshot anything on the device or in the account.
- Tell the incident lead and the school’s law-enforcement contact. Follow their instructions.
- Secure the device. Do not unlock it, wipe it, reset it, update it or sign out of accounts. If it can be done without opening content, put it in airplane mode or power it off as law enforcement directs.
- Label the device and bag it with a note: what it is, who handed it over, who has held it, date and time.
- Store it in a locked place. Record every person who touches it and when. This is the chain of custody.
- For a cloud account: do not delete, download or share content. Restrict access, suspend deletion and wait for law enforcement to send a legal request to the provider.
- Report to the NCMEC CyberTipline (report.cybertip.org or 1-800-843-5678) as directed by the incident lead and law enforcement.
| Mistake | Why it is a problem |
|---|---|
| Opening the photo to “verify” | Possible crime, and it re-harms the child |
| Texting a screenshot to the principal | Spreads the image and creates a new copy |
| Factory-resetting the phone to “clean it up” | Destroys evidence |
| Letting the student sign out or delete the account | Evidence loss and possible tipping off |
| Leaving the device in a drawer with no record | Chain of custody gap |
- Don’t ask the student to unlock and “show me what you mean.”
- Don’t search other students’ devices without clear authority and a trained, documented process.
- Don’t discuss details of the content in email, chat or hallways.
A vice principal hands you a student’s phone after a teacher confiscated it. A student reported that it contains an intimate image of a classmate. The vice principal says, “You’re the tech person. Can you unlock it and just confirm what’s on it so we know what we’re dealing with?”
How do you respond?
Show the debrief
Decline respectfully. Explain that opening or viewing the content is a legal and evidentiary risk and not part of the role. Record the handoff and time, bag and label the phone, put it in airplane mode if you can without opening anything or follow law enforcement’s instructions, store it securely and call the school’s law-enforcement contact. Write the chain-of-custody entries as you go.
Knowledge check
3 Module 3 of 5 · 35 min
Filtering, monitoring and student privacy tradeoffs
- Explain what filtering and monitoring can and cannot do for child safety.
- Identify privacy risks of monitoring tools and how to reduce them.
- Apply a simple decision test for new safety technology.
Filters block categories of content. Monitoring tools scan student activity and raise alerts. Both can help, and both can harm if they collect too much, flag too often, or are used without clear rules. Technology supports adults. It does not replace trusting relationships.
| Tool | Helps with | Watch out for |
|---|---|---|
| Web filtering | Blocks known harmful sites on school networks | Doesn’t cover home networks or personal phones. Over-blocking can block help resources |
| Activity monitoring and alerts | Flags possible self-harm or contact from adults | False alerts, alert fatigue, student privacy, sensitive data about identity or health |
| Device management | Updates, lock-down, location of lost devices | Overreach into student private life on a take-home device |
| Reporting tools for students | Gives students a safe way to tell an adult | Only works if students trust it and adults respond |
A decision test for any safety technology:
- What specific harm does it address, and is there evidence it helps?
- What data does it collect, who can see it, and how long is it kept?
- Who responds to alerts, how fast, and with what training?
- How will students and families be told, in plain words?
- Is there a way to correct mistakes and appeal?
- What is the least invasive option that meets the need?
Tools do not talk to kids
A flagged message only helps if a trained adult responds with care. Plan the human response before turning on the alert.
- Don’t give broad access to alerts and logs. Limit it to named, trained roles.
- Don’t collect more student data than you need.
- Don’t use safety data for discipline unrelated to the safety purpose without clear policy.
Your district enables a new monitoring tool. In the first week it sends 400 alerts, mostly false, to one counselor’s inbox. A real alert about a student mentioning self-harm sits unread for two days.
What went wrong, and what do you change?
Show the debrief
The tool was turned on before the human response was planned. Fix the process: tune the rules to reduce false alerts, assign a named, trained team with backup and response-time targets, set an escalation path for high-risk alerts (including 988 and 911), document it, and tell students and families what the tool does. Review the volume and response times regularly.
Knowledge check
4 Module 4 of 5 · 35 min
Vendor and AI tool vetting for student data
- Use a practical checklist to review a vendor or AI tool before it touches student data.
- Recognize red flags in privacy policies and contracts.
- Explain why student data should not go into general-purpose AI tools without approval.
Every app and AI tool a teacher installs is a new place student data can go. Federal and state privacy rules, such as FERPA and COPPA, apply to many of them. Rules vary by tool and by district, so confirm specifics with your district counsel or privacy officer.
Vendor vetting checklist:
- What student data does it collect? Is it only what it needs?
- Where is the data stored, who can access it, and for how long?
- Does the vendor sell or share data, or use it to train models or for advertising?
- Can the district delete the data, and is that in the contract?
- Does it require a student account? What are the sign-in and age requirements?
- How does the vendor handle a breach, and how fast will it tell the district?
- Is there a signed data-privacy agreement that meets district and Nevada requirements?
| Red flag | Why it matters |
|---|---|
| “We may share data with partners for any purpose” | Student data may be sold or reused |
| No way to delete data | Records persist after the student leaves |
| Trains AI models on student inputs | Student writing and details may be retained or exposed |
| Free tool with no contract | No enforceable protections |
| Asks for photos, location or contacts | Unneeded sensitive data |
AI tools and students
Do not paste student names, records, images or counseling or incident details into a general-purpose AI tool. Use only tools your district has reviewed and approved. AI image tools can also be used to make fake sexual images of students. Your policy should say what is prohibited and who to tell.
A teacher asks you to approve a free AI app that “writes comments on student essays.” It asks the teacher to sign in with a personal account and to upload student work with names.
What is your answer, and what do you offer?
Show the debrief
Do not approve it as is. Explain that student data can’t go to unreviewed tools. Ask for the vendor’s privacy terms and data practices and run the checklist. Offer an approved alternative or a pilot with no student names and a signed agreement. Thank the teacher for asking. That is how the process is supposed to work.
Knowledge check
5 Module 5 of 5 · 40 min
Incident support for IT staff and a practice drill
- Describe the IT lead role inside the school’s incident response team.
- Carry out a first-hour IT checklist.
- Run a short practice drill and record what to fix.
In a school incident, IT is a support role. The incident lead decides, law enforcement investigates and IT helps preserve and secure. Knowing your role in advance lets you act quickly and stay in your lane.
| Time | IT action |
|---|---|
| First 15 minutes | Take direction from the incident lead. Do not view content. Note the time. Suspend deletion on named accounts |
| 15 to 60 minutes | Secure and label any device. Start the custody log. Restrict access to relevant accounts. Capture identifiers and timestamps |
| Same day | Support takedown requests when directed (for example, reporting to platforms), and keep logs of what you did |
| Next days | Review access to the incident record. Hold an after-action review |
First-hour IT checklist:
- Confirm who the incident lead and the law-enforcement contact are.
- Write down the time, your name and who gave each instruction.
- Suspend automated deletion for named accounts.
- Lock named accounts and devices without wiping or resetting.
- Label, bag and log any device. Start the chain of custody.
- Record identifiers (account names, device IDs, timestamps), not content.
- Do not discuss details by email or chat. Use the channel the incident lead names.
Saying no to a request you should not fulfill
“I can’t open or copy that content. It would put you and the school at legal risk. I will secure and log it and hand it to law enforcement.”
The principal calls: a student reports that classmates are passing around a fake explicit image of her made with an AI app. It may be on a school Chromebook and in a school Google account. The principal says, “Can you pull everything off those accounts so we can see it?”
Walk through your first hour.
Show the debrief
Do not pull or view content. Confirm the incident lead and law-enforcement contact. Suspend deletion on the named accounts and log the time. Lock the accounts and secure and label the Chromebook without wiping. Record identifiers and timestamps. Explain why you will not view or copy it. Hand over to law enforcement and support takedown steps as directed. Afterward, hold a short after-action review: what slowed you down and what do you fix?
Knowledge check
★ Capstone
One-page IT incident runbook for your school
The capstone is how you show you can do the work, not just answer questions. It produces something real that you keep.
- Write a one-page runbook for the first hour of an exploitation incident in your school, with named roles (incident lead, law-enforcement contact, IT lead, backup).
- List the systems and accounts where deletion can be suspended, who can do it, and how to do it.
- Include the device handling steps (stop, secure, label, custody log, hand off) and a sample custody log table.
- Add a section of what IT will not do (no viewing, copying, forwarding, wiping or searching), with a short script for saying no.
- Run a 20-minute drill using the Friday 3:10 pm scenario and record three things to fix.
How it is reviewed
- The runbook says clearly that no one views, copies, forwards or screenshots illegal imagery.
- Roles and contact steps are specific enough for a substitute to follow.
- Deletion suspension and a custody log appear with named owners.
- Law enforcement and NCMEC reporting steps are included and match the school’s policy.
- The drill record lists three concrete fixes with owners and dates.
- The runbook fits on one page and uses plain language.
Pass every module check at 80% or better, finish the capstone, then follow the steps on the credentials page to request your certificate.
Counts toward
Companion playbooks
- Intimate image or sextortion on campus: the school incident playbook
- Preserving evidence: a guide for families
- Incident communications: parent, staff, student and media templates
- Run a 45-minute tabletop exercise for your school
- Blameless after-action review
AIP Academy courses are awareness and skills training. They are not legal, medical or clinical advice, and an AIP certificate is not a license, state or professional accreditation, CLE credit, or a promise of employment. In an emergency call 911.
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.