“Maybe you should use your personal email for that?”

Hello Everyone!

As I have shared before, public schools continue to be a huge target for cyber-criminals. Despite numerous levels and layers of defense, sometimes attacks get through our defenses and show up in your email Inbox. If you’re not sure what to do or what to look for - here is a short refresher: Spam versus Phishing? You've got the power!

One thing that has been clear as we’ve been doing more and more to fight back against the criminals is that a certain amount of “human oversight” is unavoidable. This means that yes, there are times that I and/or my Technology Staff have to look at one or sometimes many of your emails to see if they are legitimate or possibly compromised “socially engineered” fakes designed to trick others into reading, clicking, or forwarding. To be fully transparent, what I am saying is that - yes, there are times that Technology Staff have to read your email or look at your Google Drive content - to validate whether it is part of a cyber attack or legitimate. [Note: these accounts are the property of New Haven USD and this is fully legal behavior.] We don’t like to do this, but we take this task very seriously and with the utmost of respect to your privacy and message confidentiality. We also have limits in place that restrict when and how and who can do this. 

That said, it is surprising to see how much obvious “personal use” is performed via many of our NHUSD email and Google Drive accounts. I know that there are many reasons why folks would think it is okay to use NHUSD work email to send or receive personal messages - but this is really not allowed. If you’re currently doing this, we STRONGLY recommend that you please stop. 

Your NHUSD email account is considered “district technology” and as such, one should “... use district technology primarily for purposes related to their employment consistent with board policies and administrative regulations.” This is from Board Policy 4040 “Employee Use of Technology”.

Your personal email should be used for personal use. 

Your NHUSD work email should be used for NHUSD business.

You should have a clear line between the two, and use them for these 2 distinct purposes. 

Some examples of email or Google Drive content that would be considered “personal” and should not be in your NHUSD Google email or NHUSD Drive: 

• Copies of your personal tax returns from current or previous years
• Your home PG&E or other bills
• Your car purchase paperwork
• Records of purchases from Amazon.com or other online retailers
• Your wedding pics
• Your kid’s or kids’ baby pics
• Retirement/Pension CalPERS or CalSTRS communications

Two other important reasons why you need to segregate your person and work email:

(1) California Public School districts frequently have to provide records to lawyers and external organizations when requested through the California Public Records Act. These Public Records Requests (PRRs) are usually guided searches of Google email and/or Google Drive content and the scope of the search can often include email records that could be private or personal if you are using your NHUSD email for private or personal content. Even if you have nothing to hide, it is in your best interest to keep your private or personal content out of these PRRs. The only way to do this is to keep your personal and NHUSD work emails separate from each other. 

(2) While we do hope that all of you have full, long careers with New Haven USD, at some point you may leave us, or ideally retire. New Haven does not provide access to your former NHUSD Gmail or Google Drive content after you leave. After your last day of employment, your former NHUSD accounts are suspended and locked and archived for 7 years. After that, depending on our storage limits, content may be deleted. Why are we taking a more serious approach to denying access to former staff’s Google accounts when people leave? This goes back to the very start of this blog post. Cyber-criminals are trying to access your Google accounts to capture student data. Student data is very valuable as it can be used for identity theft. We need to make sure that former staff do not (intentionally or unintentionally) copy student data from their former NHUSD accounts to their personal email or drive accounts. 

In closing, to recap:

NHUSD email and drive needs to be used only for NHUSD work related use. 

Personal email should be used for all your personal email needs. 

If you have a specific use that you’re not sure is work or personal - please ask your Technology Tech or me or anyone in the Technology Department. Thank you! 

– Frank DeLapo, your Technology Director