What’s especially worrisome about AI-driven cyberattacks for school district technology director Gary Lackey is that the better hackers get at using the technology to mimic real people, the more likely they are to succeed. And hackers are getting better, experts say.
“Some of these hacking teams are getting really smart,” said Lackey, the director of cybersecurity for the 24,000-student Goose Creek Consolidated Independent School District near Houston. “What they’re going to take advantage of is how they can utilize AI to make it sound like it’s someone else and then get us to give them access into our systems.”
AI-driven cybersecurity challenges are likely to become more frequent and sophisticated for schools across the country due to AI, many K-12 educators predict. A recent EdWeek Research Center survey of teachers, principals, and district leaders found that 51 percent believe the severity of cyberattacks against their schools will pick up due to artificial intelligence in the coming year. That prediction follows reports showing that schools were already a prime target for hackers because of all the personal data they collect and the money they manage.
In a recent conversation with Education Week, Lackey talked about how advances in AI are affecting cybersecurity, the impact of cyberattacks on schools, the risks cellphones bring, and cybersecurity strategies educators should use to help protect their schools.
This conversation has been edited for length and clarity.
How has the cyber threat environment changed?
Years ago, you would easily be able to recognize a phishing email because it was so obvious with the misspellings and everything. Attackers are using whatever tools they can to improve. AI is just another iteration of that.
AI can go research and figure out who all these different people are and what their jobs are in an [organization], who their connections are, what projects they’re working on. [For hackers], it’s been a continual improvement.
What is the impact when a school or district suffers an attack?
At a bare minimum, it’s an annoyance and a distraction from what we need to be focusing on. But worst case, you’re stopping everything. And what’s so scary is that it can easily go from one to the other very quickly. It’s going to move fast, and it’s going to take down the entire school, most likely, or the whole district.
What protection strategies should educators be using in the age of AI?
We want to do everything remotely. We [are not willing] to pick up the phone and call somebody [to verify something]. [But] pick up that phone and call and validate [before clicking on a link]. That’s becoming more and more important as we’re seeing more sophisticated attacks.
What are common hacker approaches that are becoming harder to detect due to AI?
Hackers have always known that if you can scare someone into thinking that their boss or their boss’s boss is trying to contact you, that you’re going to respond quickly.
That’s where we try to tell people if you think our superintendent is contacting you and you need to jump on that request, realize that that’s what the attacker wants you to do. You’d better double, triple check and go and confirm that before you do it. As a teacher, are you really expecting the superintendent to send you an email saying, “I need this report from you.”
What about the use of deepfake audio and video to impersonate school officials?
I can guarantee 100 percent that that is extremely possible. I’ve played around with some of the AI-generative stuff to see if we can utilize it for training. I found out that if you want good audio for that, well, guess what? Your superintendent, your other school leaders are doing a lot of public speaking, a lot of public announcements and videos. When they are doing these videos, they are talking very slowly, enunciating. So that type of audio is extremely easy to duplicate.
[A hacker] could take that and call someone and then that person responds and they could have AI set up to generate a response in the voice of the superintendent, the head of finance, or someone else.
And what about cellphones? What risks do they bring?
If hackers can get ahold of your phone number, then they’re going to use that to attack you.
What if I am attending a conference [and my phone number is on a conference list]. That becomes a tool if that list gets sold to somebody or released. That’s always going to be a problem.
Are there new tools that can help schools combat AI-driven cyberattacks?
Right now, there is a lot of confusion because a lot of companies are just trying to get on the bandwagon to sell their products. There definitely are tools out there that utilize AI and they’re starting to come out more and more. But I doubt schools are at the point where they’re utilizing them [on a large scale].
Any parting thoughts?
We really have to realize and take ownership that if I click on something, if I respond to something, I could compromise the whole district. We need to pay attention to that and make sure we’re doing our best to stop those [actions].
Data analysis for this article was provided by the EdWeek Research Center. Learn more about the center’s work.
