back to article Ransomware attack forces Brit high school to shut doors

A UK high school will have to close for at least two days, today and tomorrow, after becoming the latest public-sector victim of ransomware criminals. Blacon High School in the historic city of Chester, in north west England, said yesterday the attack hit on January 17, and didn't rule out having to shut its doors to students …

  1. cyberdemon Silver badge
    Headmaster

    Why should an IT outage necessitate shutting the school

    Can't they get their workbooks and pens out?

    1. Doctor Syntax Silver badge

      Re: Why should an IT outage necessitate shutting the school

      Quite. We didn't have computers at school at all, not even non-working ones.

      1. wolfetone Silver badge

        Re: Why should an IT outage necessitate shutting the school

        Everything is IT driven in schools.

        The register is online.

        Lesson delivery often includes online resources (i.e. Moodle)

        It can also be the fact that security, physical security, is ran through IT.

        It's not all chalk and slates as it were in your day.

        1. Blazde Silver badge

          Re: Why should an IT outage necessitate shutting the school

          If the teachers can't figure out how to take register without a computer then perhaps the first lesson they can't conduct without online resources can be rescheduled as some kind of emergency-survival problem-solving session where the students come up with madcap ideas for how to write down a list of names without modern technology?

          Does anybody have.. paper?

          We can use my shirt!

          Good! Does anyone have something to write with?

          We can use my blood.

          10/10 for effort, but too melodramatic.

          Can we get ink from a teabag..?

          etc.

          1. wolfetone Silver badge

            Re: Why should an IT outage necessitate shutting the school

            If it's so easy why aren't you a teacher? Or better yet - get in touch with the school yourself and offer your services to them?

            1. Anonymous Coward
              Anonymous Coward

              Re: Why should an IT outage necessitate shutting the school

              Because anyone with a brain knows that working with kids is a liability..

            2. Doctor Syntax Silver badge

              Re: Why should an IT outage necessitate shutting the school

              Back in the mists of time I was one of the part-time OU tutors, as was SWMBO who, incidentally, had been a school teacher before returning to University to do research. Th OU depended and very likely still does, on local colleges for premises for some tutorials. The OU year was very different from the traditional academic year and tutorials ran through the summer months when the colleges were normally closed.

              From time to time the caretaker would fail to turn up to unlock the building and couldn't be found. What to do? Cope. It's summer, the weather's fine. We channel the ancient Grecian Academy and hold tutorials outdoors. At least I did. If it happened to SWMBO she just cancelled the tutorial and came home. I still don't know why. Maybe its a teacher thing.

              1. Roger Kynaston

                OU tutorials

                In person tutorials are a rare thing for this OU student. They use Adobe Connect. I expect that little event from 2020-22 accelerated the move but it probably saves the beancounters in Milton Keynes a fortune even if Adobe do fleece them for the Connect license.

            3. Blazde Silver badge

              Re: Why should an IT outage necessitate shutting the school

              I'm not a teacher but I did on many occasions a) take register as a pupil myself because the teachers couldn't be arsed, and b) fail to be present in school when register was taken and suffer no adverse consequences. So I'm aware what a completely pointless tick-box joke the whole palaver is.

              To cancel an entire school day because you can't verify which pupils are not cancelling their own school day is the very definition of cutting off your own nose.

              1. hoola Silver badge

                Re: Why should an IT outage necessitate shutting the school

                If that register is online and linked to a pile of other stuff (most our now) then it is not so easy.

                Actually the register is only a small part of the issue and may not even be affected. If security systems are down then you simply don't have the staff to run the site.

                Anyone who is tried to get into s school as a legitimate visitor during normal school hours should understand that.

                1. Blazde Silver badge

                  Re: Why should an IT outage necessitate shutting the school

                  Exactly. It's nothing to do with the register. Most likely, because the phone lines and CCTV are down there's been some legally risk-averse decision that it's just easier to have kids schooled at home for a day or two. Maybe that's rational because online schooling is a decent fall-back these days, but let's not pretend it's somehow impossible for them to open up if they wanted to.

                  1. heyrick Silver badge

                    Re: Why should an IT outage necessitate shutting the school

                    And, yet, if a parent takes a child out of school for a day without medical reason or grovelling to the head beforehand, things get unpleasant in a hurry.

                    That school owes every parent £80.

                    Well, it's only fair isn't it?

                    1. Terry 6 Silver badge

                      Re: Why should an IT outage necessitate shutting the school

                      out of school for a day

                      These kids are not out of the school. They're out of the building. In a virtual classroom.Just like during COVID. And the school will be well prepared to teach like that.

                      1. Alumoi Silver badge

                        Re: Why should an IT outage necessitate shutting the school

                        Aha, with their IT system down, they will be have virtual classrooms left and right.

                    2. Lazlo Woodbine Silver badge

                      Re: Why should an IT outage necessitate shutting the school

                      You clearly missed the part about teachers setting work in Google Classroom, so the kids are still in school, but at home, just like during lockdown...

                      1. Terry 6 Silver badge

                        Re: Why should an IT outage necessitate shutting the school

                        I don't think they missed that- just ignored it. I already got down votes from (I assume) the same handful of dinosaurs when I made that point.

                        [More down votes incoming- whatever].*

                        *Already started within edit time.....

                    3. MachDiamond Silver badge

                      Re: Why should an IT outage necessitate shutting the school

                      "And, yet, if a parent takes a child out of school for a day without medical reason or grovelling to the head beforehand, things get unpleasant in a hurry."

                      That reminds me of a story where a mother with terminal cancer wanted to take her daughter out of school for a week or two so they could take a grand holiday together while the mother was still healthy enough to travel and the head said no. Bugger that. I wouldn't put up with that sort of thing anymore than If I were an employee and gave notice I'd be out for a day. It's not a request, it's an FYI.

                  2. Terry 6 Silver badge

                    Re: Why should an IT outage necessitate shutting the school

                    That, unlike some of the teacher bashing that preceded it, is a fair point. And I did wonder why these schools don't have an emergency plan B for such eventualities. But then post COVID it may simply be that remote teaching is a good plan B, because the systems are in place.

                    Schools these days are far more complex than they were when some of the previous commentators were breathing chalk dust. Timetabling takes place on 10 day cycles in many high schools, with room allocations varying according to whether it's week A or week B. And daily schedules are sometimes different for different year groups.

                    Lessons can't just be made up on the spot, as they often were when I was at school in the 70s but often rely on meeting various scheduled target points, there's also a tot of box ticking. F***cking OFSTED don't accept discontinuities. So arguably a couple of days of lessons pulled from the emergency box wouldn't be a valid lesson.plan.

              2. Lazlo Woodbine Silver badge

                Re: Why should an IT outage necessitate shutting the school

                You're not a teacher, so you have no frigging clue how schools work.

                The register is a legal requirement, we have to upload them nightly to the DfE.

                Without a usable register, and emergency like a fire alarm could be a disaster, we wouldn't know who is in school and who isn't

                Yeah, your teacher couldn't be arsed, and yeah, your teacher wouldn't be working now...

                1. MachDiamond Silver badge

                  Re: Why should an IT outage necessitate shutting the school

                  "The register is a legal requirement, we have to upload them nightly to the DfE."

                  And there's another block out of the Jenga tower.

                  There was an attendance record when I was in school and it was mainly kept on paper. It would have been one of things the office staff would have taken with them in an emergency. Sending them in nightly online is a waste of time and certainly shouldn't be uploaded to DfE by each teacher individually. Teachers take the role, submit that to the office and that's the end of that. The office should print that out, on paper locally and keep it on hand if the reason is to know who is on campus and who is not. If a student leaves for some reason before the end of the school day, they can be ticked out.

                  My aunt was a school teacher and towards the end of that she was increasingly frustrated by admins justifying their jobs by trying to force tech into everything they could, taking away time she could put into teaching.

                  1. Lazlo Woodbine Silver badge

                    Re: Why should an IT outage necessitate shutting the school

                    " certainly shouldn't be uploaded to DfE by each teacher individually"

                    What gave you the impression the teachers upload them?

                    They're uploaded from the MIS nightly.

                2. Blazde Silver badge

                  Re: Why should an IT outage necessitate shutting the school

                  The register is a legal requirement, we have to upload them nightly to the DfE.

                  Without a usable register, and emergency like a fire alarm could be a disaster, we wouldn't know who is in school and who isn't

                  No, it's guidance. It's DfE data-hoarding and if you have trouble gathering the data on one day because of an exceptional situation you can absolutely tell them to shove it. (The headteacher should ideally be the one to do that, their common sense and ability to stick up for the school is what they're paid for).

                  I've looked through a lot of fire safety guidance on schools and can't find any reference to register being even guidance. Can you provide more on that? As others have noted, the fact they're allowing pupils in to collect lunch doesn't jive with it being all that critical for anything.

                  Incidentally, closed for some year groups all week long (at least).

              3. MachDiamond Silver badge

                Re: Why should an IT outage necessitate shutting the school

                "To cancel an entire school day because you can't verify which pupils are not cancelling their own school day is the very definition of cutting off your own nose."

                That the phones were down as well seems to suggest that their VOIP phone system was also run through the one computer used for everything else (Holmes IV?). Without working phones, they may not be allowed to have students on the premises.

                It also seems like they haven't "connected" the cafeteria yet since students could stop by and get some free food. Why, is my question. It appears that feeding kids has become a responsibility that's been shifted to the schools from parents. During a normal school day, students can't leave to go get a cooked lunch so having that as an option is a good idea. It was an extra cost when I was growing up unless the family was on the dole and I nearly always took a packed lunch with me from home. In high school is was 'cool' to have a vintage lunch box. I think I still have my "Hong Kong Phooey" lunch box from decades ago. Yeah, I'm old now. The last two years of school I often had a job and would go across the street to the college for better options at lunch. I was attending there as well so it was not an issue.

        2. Doctor Syntax Silver badge

          Re: Why should an IT outage necessitate shutting the school

          "The register is online."

          So they can't check a register. They can't take a register with the children at home - or maybe elsewhere. No effective difference.

          "It can also be the fact that security, physical security, is ran through IT."

          TFA says the children are allowed in to collect lunches so access is obviously not a problem.

          Coping when the world lets you down is an essential human skill.

          1. katrinab Silver badge
            Meh

            Re: Why should an IT outage necessitate shutting the school

            The register is needed to check that everyone is out safely in the event of an emergency evacuation. As well as for monitoring attendance etc.

            1. MachDiamond Silver badge

              Re: Why should an IT outage necessitate shutting the school

              "The register is needed to check that everyone is out safely in the event of an emergency evacuation. As well as for monitoring attendance etc."

              And how does that worked when it's uploaded to a cloud server nightly? It has to be done onsite first thing and a print out made and put someplace with other important papers that would need to be grabbed in the event of an emergency. The paper record is an easy and convenient place to track early departures, late arrivals, etc. Digital updates can be done after the last bell.

              An emergency serious enough to warrant getting everybody out is highly likely to have a power cut so physical copies are mandatory if the reason behind them is to check off everybody against a role. Monitoring attendance is less important for other reasons, but can be useful if the school isn't barred from telling parents their little darling is failing to show up.

        3. katrinab Silver badge

          Re: Why should an IT outage necessitate shutting the school

          Don't they have a paper copy?

          What happens if there is some sort of emergency that requires them to evacuate the building, and that emergency also causes the computers to stop working, eg due to a power failure? How do they check that everyone is out safely?

          1. cyberdemon Silver badge
            Childcatcher

            Re: Why should an IT outage necessitate shutting the school

            It's probably a printout.. And if the computers aren't working in the morning, there is no procedure to go round with a clipboard.

            1. MachDiamond Silver badge

              Re: Why should an IT outage necessitate shutting the school

              "And if the computers aren't working in the morning, there is no procedure to go round with a clipboard."

              Which is strange since way back when I was in school, the teacher's had a printed list of students in each of their classes. Attendance was taken manually, but even today, it's not that hard for teachers to still have a nice crisp laser printed role on-hand. If technology has failed again, the normal backup would be to send somebody around to collect the roles. Easy. Once the computer is back up, somebody could input what's needing inputting.

          2. MachDiamond Silver badge

            Re: Why should an IT outage necessitate shutting the school

            "What happens if there is some sort of emergency that requires them to evacuate the building, and that emergency also causes the computers to stop working"

            The computers not working isn't even an issue to consider. If the fire bell rings, you grab only what's to hand and get out. Who would say that before that, policy is to make some printouts AND THEN clear the building?

            Tomorrow I'm going to pick up a new welder. I have a coupon and I put it right at eye level where I'll see it on the way out of the door to someplace else I need to visit before I get the welder. I can easily grab the coupon on the way out. A school could have one of those wall file pockets filled with the documents that should go with somebody in an evacuation.

        4. NoneSuch Silver badge
          Facepalm

          Re: Why should an IT outage necessitate shutting the school

          "It's not all chalk and slates as it were in your day."

          Clearly, the better option of the two is obvious.

    2. Mentat74
      Big Brother

      Re: Why should an IT outage necessitate shutting the school

      Because else Google won't be able to track everyone cradle to grave...

      You're not going to deny a billion-dollar company all of your kids private data now are you ?

    3. Anonymous Coward
      Anonymous Coward

      Re: Why should an IT outage necessitate shutting the school

      Things in schools likely to be controlled by computers in 2024:

      The "register" (information management system in modern parlance).

      Payments

      Food ordering system

      The secure fob/door system

      All the next of kin/emergency contact/parent contact details etc

      Pupil medical requirements/allergies/medication/etc

      Fire/safety/risk/etc documentation

      and so on...

      1. KayJ

        Re: Why should an IT outage necessitate shutting the school

        Quite. The most prominent are registration, catering (mostly biometric) and the facilities building-management-system (heating, potentially also water). With the best teaching will in the world it's a no-go if students are unaccounted for, cold, hungry and without toilets. ^^

        1. robinsonb5

          Re: Why should an IT outage necessitate shutting the school

          It's almost as though the systems controlling all those things should be air-gapped and not connected to the public internet.

          1. Terry 6 Silver badge

            Re: Why should an IT outage necessitate shutting the school

            Well that's a different and very good point. And one that applies in a lot of places. Schools simply do what everyone else does, with the systems available to them, often promoted by very persuasive sales types. If the school down the road and the LEA think the "Class DoJo" (shudders and takes a little lie down) is essential, then it is essential.

            1. An_Old_Dog Silver badge

              Just Doing What Everyone Else Does

              Is another way of saying, "failing to think."

              I don't want any potential kids of mine taught or regulated by a bunch of non-thinkers.

          2. Lazlo Woodbine Silver badge

            Re: Why should an IT outage necessitate shutting the school

            Until the DfE has a system where we can upload this data to them without touching the public internet, this is our only option.

            Back in the day, schools were linked to systems linked to JANET, but now most schools have switched to commercial fibre, as it's much cheaper than the university's networks.

            We moved to B4RN and have two 1 gig fibres for less than 1/3 of what we were paying for 500 meg from LUNS

            1. An_Old_Dog Silver badge

              "Our Only Option"

              @Lazlo Woodbine:

              Not so.

              Were I in charge at that school, I'd send hard copies of the relevant attendance and grade records over to DfE headquarters, and let them enter them by hand into the database.

              DfE might, or might not, take the point.

              1. MachDiamond Silver badge

                Re: "Our Only Option"

                "Were I in charge at that school, I'd send hard copies of the relevant attendance and grade records over to DfE headquarters, and let them enter them by hand into the database."

                I agree with the sentiment, but it would mean additional cost which comes straight out of the teaching budget (not the administrator's or supervisor's). It's likely a legal requirement as well.

                That doesn't mean that it should be required that it goes over a VPN link and the data is then whisked off to a system that is air-gapped with any work being done on the data happening off-line. The information is too sensitive for remote work. Access must be restricted to people needing to be at a location that is secure with a ban on taking printouts/thumbdrives off-premises without loads of approvals.

                1. An_Old_Dog Silver badge

                  Re: "Our Only Option"

                  Sorry for the ambiguity. The hard-copy records I'd send would only cover the length of the outage.

                  What sort of [insert pejorative(s) of your choice] devs would fail to include some sort of "store locally, phone home when connectivity is restored and transmit the stored records then" feature?

                  What sort of [insert pejorative(s) of your choice] people would select a system lacking that feature? ("This automobile is so slim, thin, and light, it doesn't even have space to carry a spare tire!")

            2. Terry 6 Silver badge

              Re: Why should an IT outage necessitate shutting the school

              And I should add that most schools and all primaries were excluded from that. Getting decent internet access to all schools was a monumental task. About 15 or 20 years ago I was at meetings with other school representatives and Virgin Media techies to discuss the planned roll out of fibre to schools in North London. An enormous task.

        2. Doctor Syntax Silver badge

          Re: Why should an IT outage necessitate shutting the school

          "catering"

          TFA says pupils were allowed to go to school to collect lunch.

          1. Lazlo Woodbine Silver badge

            Re: Why should an IT outage necessitate shutting the school

            These will be kids on Free School Meals, the school has a legal duty to provide them with lunch during term time, so they'll make up packed lunches

      2. nobody who matters Silver badge

        Re: Why should an IT outage necessitate shutting the school

        <<<<<<<......"Things in schools likely to be controlled by computers in 2024:

        The "register" (information management system in modern parlance).

        Payments

        Food ordering system

        The secure fob/door system

        All the next of kin/emergency contact/parent contact details etc

        Pupil medical requirements/allergies/medication/etc

        Fire/safety/risk/etc documentation"........>>>>>>>>

        I will politely, but firmly call bollocks on all of that!

        It says clearly that pupils "...can still visit the school to collect lunch". Those few words effectively mean that virtually <none> of the items on your list can be compromised because of a failed IT system, as all (apart from the Register perhaps) would need to be available if pupils are on the premises.

        1. AVR Bronze badge

          Re: Why should an IT outage necessitate shutting the school

          They probably expect to hand out lunches to a small number of pupils who will be shown the door right after, not allowed to hang around for hours. If half the school showed up this wouldn't work for them so well.

        2. Lazlo Woodbine Silver badge

          Re: Why should an IT outage necessitate shutting the school

          The school has a legal duty to provide meals during term time to pupils on the Free School Meals regsiter (the school will have a paper copy of this list in the kitchen).

          They will simply make up packed lunches for these kids to collect.

          This does not negate any of the list of things that are on computer...

      3. MachDiamond Silver badge

        Re: Why should an IT outage necessitate shutting the school

        "and so on..."

        Grades

        Elective courses

        club/team membership

        honors/discipline record

        Photos

        Child's phone number

        Parent's phone numbers

        Now that they have all of that, it gets much easier to derive a tremendous amount of estimates about them. If the child is on social media and has given their phone number and contact list (which they always beg that you do), they can look at the circle of friends. Perhaps they can't trade this information since the mark is under a certain age, but they'll have it stored for later.

        What's really scary is a lot of this can't be opted out of.

    4. Guy de Loimbard Silver badge

      Re: Why should an IT outage necessitate shutting the school

      So bang on the money it's shocking.

      It wasn't that long ago that there was no IT medium in school unless you were exploring computer science!

      IT outages are not an excuse for not delivering lessons.

    5. hoola Silver badge

      Re: Why should an IT outage necessitate shutting the school

      There are several issues.

      It depends what is broken:

      Is it related to safety such is ID & door entry systems or the register?

      Is it related to teaching material?

      On the first is security systems are down they will have no option but to close.

      In terms of teaching it all depends on what is available and working. By the sound of it the use Google Workspace and this is currently functioning. If there is sufficient material to run lessons on that platform and teacher's laptops they can function online until the first is fixed.

      1. Terry 6 Silver badge

        Re: Why should an IT outage necessitate shutting the school

        I'd hazard a guess that Google's offering was the chosen remote teaching system adopted for COVID and is now ready when needed.

    6. Lazlo Woodbine Silver badge

      Re: Why should an IT outage necessitate shutting the school

      Read today's Guardian, a shocking number of people can no longer write with a pen.

      Anyway, it's more about maintaining accurate attendance registers, which need to be uploaded to the DfE nightly.

      If you can't have an accurate register, there's also dangers with Fire Registers, you try taking a headcount of 1,000 kids in an emergency situation if you don't know who is in or out of school that day.

      I know what you're muttering under your breath 'we had to in my day', well it's no your day anymore, kids today have real problems following instructions, which is partly down to them having to fend for themselves during lockdown, something schools are still struggling to fix.

      1. Terry 6 Silver badge

        Re: Why should an IT outage necessitate shutting the school

        I wouldn't blame lockdown for all of that. Add in kids with crap language and listening skills, then take note of how many parents you will see walking along with their kids in a buggy completely ignored while the "responsible" parent is glued to the bloody phone. Or kids who are stuck in front of a TV screen by parents who can't be bothered to interact with them- let alone take them to libraries and such like.

        There's al ot of anxiety at the moment about how much kids are stuck to screens - but in reality that's probably the best source of language and communication they're exposed to, because their parents are stuck on screens and aren't talking with the kids.

  2. An_Old_Dog Silver badge
    FAIL

    Failure to Plan and Test for Computer Failure is ... Failure

    No business continuity plan other than, "Kids stay home"?!! No way to manually record attendance and grades, and enter them into the system after recovery or re-initialisation?

    1. Guy de Loimbard Silver badge

      Re: Failure to Plan and Test for Computer Failure is ... Failure

      This is something I often lecture/consult on.

      Reversionary Method of Operation.

      It works, it takes a bit of work and planning, but if done right, is a great tool in your back up arsenal.

      Not for everyone I know, but if you can't operate your business, it's going to impact customers and if you're regulated, guess who's coming next?

      1. neilg

        Re: Failure to Plan and Test for Computer Failure is ... Failure

        "Not for everyone I know, but if you can't operate your business"

        Mate: can I point out the bleeding obvious, it's not a business it's a sodding school. Children are not "customers"

        1. Doctor Syntax Silver badge

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          And you think that's an excuse?

    2. Anonymous Coward
      Anonymous Coward

      Re: Failure to Plan and Test for Computer Failure is ... Failure

      Posting A/C for 2 main reasons here:

      1) I'm a school governor

      2) I work for a cyber security vendor

      For both of those reasons, I speak to a shedload of schools about cyber incidents. A modern school will probably have pretty much everything computerised from the register, the lunch payment system, the phone, fire alarms, CCTV, access control, building management systems etc on their LAN. Older schools - well, they're lucky if they are in a building that isn't falling down around their ears because it's that old and has had no money spent on it by any government since it was built in 1895.

      Most of them don't have much in the way of a cyber incident plan, because most schools don't believe an attack will ever happen to them, as they have nothing a cyber criminal would want, and it's incredibly difficult to persuade them otherwise - even with my own LA, where I'm volunteering my own time to talk to people, it's seen simply as an exhortation to buy stuff/services they don't need....

      When I speak at conferences, every school has a physical response plan to somebody coming in with a weapon or trying to take a child, because the children are the school's focus. Not their data.

      Until school leaders get this message loud and clear, schools will keep having incidents. Oh, that and having the money to properly fund and resource those plans, that might help as well.

      1. graemep
        Unhappy

        Re: Failure to Plan and Test for Computer Failure is ... Failure

        Should all this be computerised, given the risks? If it should be computerised should some of it not be air-gapped?

        > When I speak at conferences, every school has a physical response plan to somebody coming in with a weapon or trying to take a child, because the children are the school's focus.

        Are schools actually able to stop someone coming in with a weapon, or taking a child? Do they have armed guards, for example? How often does this happen? Is it the case they have plans for something very unusual they cannot stop, but not for something higher risk that they can do something about.

        I wonder whether it is just suspicion that they are being sold something they do not need, rather than a more general fear. I find a lot of people seem to regard cyber security, and reliability (even simple things like good backups) as a can of worms they do not want to open. Much easier to just hope it never happens.

        1. AndrewB57

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          Schools SHOULD have an Emergency Plan which deals with intruders and other pyhsical threats

          I have seen suich plans in action, though more for

          a) dangerous dogs in the playing fields

          b) hoax gun and bomb wanings

          1. MachDiamond Silver badge

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            "Schools SHOULD have an Emergency Plan which deals with intruders and other pyhsical threats"

            Plenty do, but it can be a lot like airport security. There have been demands that something be done, so it was even if it's rather meaningless.

            A fire evacuation is not that hard to work out and practice since it's going to be very much the same no matter what. The changes would be to muster the kids in one of two places depending on what area is more safe with one being the default location. A bad guy on campus is going to be very fluid so I suppose it could be "lock the classroom door, turn out the lights ,be quiet and keep out of sight" being the default. A bomb warning would be similar to a fire evacuation. A hoax gun (or real weapon) is fluid thing. Dangerous dog? How often does that happen? Most schools are gated and fenced.

            I was the safety officer when I worked on rockets and worked with the engineering manager to develop our safety manual. There's a point where the probability gets absurdly small and it has to be a given that something might have to be made up on site with just some general principals laid out. The 45th space wing at Cape Canaveral and the FAA didn't have any problems with there being a catch-all category for unusual circumstances. There's some hope that rocket engineers aren't too stupid that they run towards the burning rocket.

        2. hoola Silver badge

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          With so much now delivered as SaaS because it is cheaper (in theory) there is simply not the resources or technical know how to air gap stuff.

          In schools now it is very rare to have anything that is a traditional system running in the building. Now add in that the very limited number of IT staff are under paid, and therefore do not have the skills and over worked.

          1. Terry 6 Silver badge

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            Not to mention PFI schools where every item is a charge on a spreadsheet that has to be supplied by the landlords at whatever cost and charges they see fit to impose, and with refresh schedules that they choose.

            1. Richard 12 Silver badge
              Boffin

              Re: Failure to Plan and Test for Computer Failure is ... Failure

              This particular school is a specialist sports college, run by the local authority (foundation school), with a fairly new building.

              And yes, it is a PFI.

              In 2021/2022 they spent £600k on their premises (4th highest of 15 comparable schools), and had a deficit of just under £300k (down by £120k on the previous year).

              It's been "undergoing a period of austerity" for the last few years.

              I didn't look for last year's data as Word on a phone is awful.

              1. MachDiamond Silver badge

                Re: Failure to Plan and Test for Computer Failure is ... Failure

                "I didn't look for last year's data as Word on a phone is awful."

                That you could access data via your phone is a problem.

        3. Anonymous Coward
          Anonymous Coward

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          This is a school in the UK, we don't need to check our kids have got their bulletproof backpack and an upgrade to date funeral plan.

          1. Terry 6 Silver badge

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            Hmm. There's some schools who'd disagree. The ones faced by racist gangs.

            But mostly it's violent, drug addled thugs wandering in off the street. And see my own story on this matter a few posts previous.

        4. JamesTGrant Bronze badge

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          Actually, folk under the influence and mentally unwell people seem to try to wonder into schools more often than you might think. A sturdy door with lock and a call to the police is required. It’s a small but avoidable risk. Imagine your systems were taken down - you don’t know if the attacker is trying to get you to roll over and expose a soft belly (ie - stay open with no IT). You’d probably not even know if the fire systems were compromised.

          Teaching online, remotely, is a very sensible back up.

          There’s a lot of ‘old man shouts at clouds’ (pun intended) going on in the comments. Back in my day we were lucky to have heating in the classroom, etc etc

          1. Terry 6 Silver badge
            Thumb Up

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            Spot on

        5. Terry 6 Silver badge

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          Armed? Not impossible. Violent certainly.

          Some years ago, long before schools were made secure, I was in a primary school doing one of my regular weekly visits when an adult came in demanding to see a certain young female teacher who'd dared tell off his child, and threatening violence, while swearing loudly. I was near the school entrance and intervened to block his way. I was somewhat tougher looking ( in those days I worked out a lot) than the 22 year old teacher he was threatening. But I was still shit scared. I just didn't let the bastard see it.

          1. MachDiamond Silver badge

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            "I was in a primary school doing one of my regular weekly visits when an adult came in demanding to see a certain young female teacher who'd dared tell off his child, and threatening violence, while swearing loudly."

            That should trigger somebody to push the button to summon police and possibly a couple of the larger teachers on campus. The result should be a serious charge since that sort of behavior at a school cannot be tolerated. I can see in some areas that the situation might not be as improbable as one might think. Certain cultures would be very upset if a female teacher was telling off their male child.

            1. Terry 6 Silver badge

              Re: Failure to Plan and Test for Computer Failure is ... Failure

              What kind of world do you live in. A small primary school is unlikely to have either a button to summon police, (m)any large heavy teachers or indeed a "campus".

      2. AndrewB57

        Re: Failure to Plan and Test for Computer Failure is ... Failure

        Thank you for this post. Far better informed than much up-thread.

        Folk don't seem to understand how a 21st C high school runs.

        The main MIS integrates student, staff and room timetables, attendance (registration), year groups, pastoral groups, subjects, finance, salaries, assessment, qualifications

        Schemes of work and lesson plans will all be computerised. Many, probably most, resources will be held virtually

        Catering, trips, cleaning and caretaking will all be managed on computers.

        In this case I would guess the main MIS is penetrated and that there is, therefore, evidence that all systems could be at risk as the MIS has least external contact.

        Yes, I agree, many schools do not have adequate disaster recovery plans and as a fellow school Governor you will be aware of the debate - every pound spent on x is a pound that cannot be spend on education, but I am wondering what is happening here.

        Has the school taken the view that keeping children learning off-site (as with the pandemic) is worth it for a few days. Perhaps the MIS cannot be accessed and registers printed until the vulnerability is identified.

        1. nobody who matters Silver badge

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          <......."Folk don't seem to understand how a 21st C high school runs."......>

          Sounds to me as though they are being badly run tbh!

        2. heyrick Silver badge

          Re: Failure to Plan and Test for Computer Failure is ... Failure

          "Has the school taken the view that keeping children learning off-site"

          OMFG, did nobody read the article?!? It said the children can go to school to collect lunch. Which means having kids on site. Check 'em off a written list, or are all those ancillary systems not affected, hmm? So if they can enter the premises to eat, why can't they enter to, you know, stare at the wall and pretend to be interested?

          1. Richard 12 Silver badge

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            To collect food.

            There is a big difference between turning up to collect some food in a single, specific location and leaving afterwards, and staying all day wandering around the campus to various lessons and break times.

            Also, only some of them will turn up.

            342 of the 723 kids at this school get "free school meals". For some of those, it may well be the only decent meal they get in the day.

            So probably 200-250 of the kids will turn up for it - not worth the travel for most.

          2. hoola Silver badge

            Re: Failure to Plan and Test for Computer Failure is ... Failure

            Mostly because you have no understanding of education, teaching or what has actually happened.

            On the last nobody on this forum does, it is all speculation which based on many of the comments shows a level of understanding that it probably far lower than the people you are slagging off....

            Teachers and the school management.

      3. MachDiamond Silver badge

        Re: Failure to Plan and Test for Computer Failure is ... Failure

        "A modern school will probably have pretty much everything computerised from the register, the lunch payment system, the phone, fire alarms, CCTV, access control, building management systems etc on their LAN. "

        The giant issue is that ONE computer is connected to the internet. Obviously, a VOIP phone system must be connected, but there's a place where dedicated hardware is important. Lunch payments? Dedicated hardware that's updated every so often since it doesn't need to have real time I/O.

        I've got loads of computers that are dedicated to certain things. I'm typing on an iMac that's not to greedy for leccy. My media production machine is a beast so only firing it up when I need it saves me money. PC's are not allowed online except one that has an OS and Chrome for two very vertical purposes. What that gets infected, I'll burn the drive down and reinstall the OS and Chrome again rather than having to rebuild my CAD PC since loading that software with all of the anti-piracy "features" takes ages. Cheap computers (often free) do the easy stuff and a couple of boxes with that manly smell to them do the heavy lifting when needed. Having a super-duty computer to do everything all at the same time is more expensive and harder to maintain. I have an old Mac Mini for my accounting. It is also set up as a back up for email if I ever need that but it's worth next to nothing to sell and I've had no need to update my accounting software for ages so when I do accounting stuff, I fire up that computer that's strapped to the bottom of the desk out of the way and I pull out the wireless KB and mouse that goes to it. Easy to back up, my accounting stuff isn't online and if I need to restore from backup, it's fast and easy.

    3. hoola Silver badge

      Re: Failure to Plan and Test for Computer Failure is ... Failure

      There clearly is something, maybe not a full blown plan because they are switching to online teaching where possible.

      "Students have not been given the day off, however. Teachers set work for them to complete on Google Classroom over the two days, although they can still visit the school to collect lunch."

      It is the second sentence.

      1. Terry 6 Silver badge

        Re: Failure to Plan and Test for Computer Failure is ... Failure

        And note the word "collect". Not sit down to eat hot school dinner. Get a lunch - which some of those kids rely on - usually a sarnie and a bit of fruit. The well-heeled kids probably get lunch at KFC and not bother to collect this.

    4. MachDiamond Silver badge

      Re: Failure to Plan and Test for Computer Failure is ... Failure

      " No business continuity plan other than, "Kids stay home"?!!"

      When I was in school, in later years we had the lesson plan at least a week in advance and other than pop-quizs, we knew when there were tests. If I were ill, I'd certainly be given some extra time to turn things in, but I would know what would be covered while I was out. I was expected to carry on as best as I could. In an age where a single point of failure computer can shut an entire school for days, this sort of knowing seems more important. It would also be simple to run off copies of a lesson plan/study guide for the next week that could be collected at the school if there was no way to send it electronically.

  3. Anonymous Coward
    Anonymous Coward

    surely only a coincidence

    But we didn't get (M)any ransomware attacks before absolutely everything was internet and cloud connected to further the subscription model profits of all pervading mega corps.

  4. Tron Silver badge

    Just because everything is computer based....

    ...doesn't mean that they cannot rough it for a few days giving lessons the way they have been given for a hundred years before our basic services depended on giving money to US computer companies.

    Armed gangs of terrorists are not going to descend on the school because the automatic locking is working on manual with a KEY. Kids play happily on the park near where I live outside school hours with no tech-based safeguarding system in place. They survive. They walk to and from school without assistance from GAFA. They survive.

    Biometrics just to buy lunch and locks on the door. These places must be like prisons.

    1. JamesTGrant Bronze badge

      Re: Just because everything is computer based....

      Yes, they are. But it’s to keep people out, rather than in. The schools round my way have scary looking security but all the decor and the staff and teachers are kind, professional, teachers. The kids are well taught, well supported, and have every opportunity to play ‘dangerous’ games outside in the playgrounds. They also have other things that we didn’t have - kitchen gardens, they can help out (learn) in the school kitchen, there’s loads of clubs and other things that kids can get involved in.

      ‘In my day, after school , we had to amuse ourselves with drugs and matches until the parents got home from t’pits’ etc etc.

      1. Terry 6 Silver badge

        Re: Just because everything is computer based....

        "drugs and matches"

        In my day we had to hit ourselves on the head with rocks.............

        1. MachDiamond Silver badge

          Re: Just because everything is computer based....

          "In my day we had to hit ourselves on the head with rocks............."

          Growing up a dwarf has many challenges.

      2. An_Old_Dog Silver badge

        Prisons' Critical Systems

        Modern prisons have computerised door locks and access controls, yet I've never heard of one having had their computer systems attacked from outside and the prisoners gone running free.

        Perhaps their critical systems are airgapped, and not running in a remote cloud, which is an idea which can be applied to other sectors and businesses to good effect.

        1. David Hicklin Silver badge

          Re: Prisons' Critical Systems

          > Modern prisons have computerised door locks and access controls, yet I've never heard of one having had their computer systems attacked from outside and the prisoners gone running free.

          That's because their prime directive is to keep the prisoners locked up, a school on the other hand does not need that level of security.

          Also at schools these days the blackboard and chalk are history, instead they have computerised smart boards - lose them and no classroom teaching

          1. Terry 6 Silver badge

            Re: Prisons' Critical Systems

            Chalk has been history for decades. Replaced with white boards and markers,.

            White boards and their felt tips markers have been removed from most schools for years - replaced with interactive whiteboards.

            Interactive whiteboards are starting to disappear now, too. Replaced with smartscreens. Effectively a large sophisticated PC screen with it's own software so that it can be used with or without a PC attached ( and I think networked too).

          2. MachDiamond Silver badge

            Re: Prisons' Critical Systems

            "That's because their prime directive is to keep the prisoners locked up, a school on the other hand does not need that level of security."

            And nobody gives FA about how bad losing the data is for the people affected. The media would also be all over the escape of the Shropshire Slasher for many more days than yet another data breech.

        2. cyberdemon Silver badge
          Devil

          Re: Prisons' Critical Systems

          Ah yes, that's what we need to do - switch the school's door lock latches from "fail unlocked" to "fail locked". It's a simple mechanical switch on most electric strikeplates.

          Sorry kids - can't leave the classroom until we get this IT back on - you're banged up.

        3. hoola Silver badge

          Re: Prisons' Critical Systems

          Simply answer: Cost

          Prisons are designed to keep people in, that is their sole purpose and large amounts of money is expended to do this

          With schools they are struggling for budgets and resources as it is. Every pound spent on DR for systems is a pound from stretched resources for teaching.

  5. Anonymous Coward
    Anonymous Coward

    How on earth did we survive?

    I went to a small school in the bush.

    Electricity was the only tech we ever saw.

    No heating, cooling or otherwise.

    The only time we went home early was during local bushfires. And we walked home unaided through the smoke.

  6. Anonymous Coward
    Anonymous Coward

    The author should use the correct term

    > revealing personally identifiable information (PII) belonging to council residents and staff.

    This is at least the 2nd recent article I've seen from Connor Jones where he incorrectly uses the term PII when describing an "event" relating to UK-based organisations and/or UK-based affected individuals rather than using the correct term "personal data" as used by both the UK GDPR and (EU) GDPR.

    "PII" tends to be a USA invented/specific term that represents a *subset* of the information that "personal data" covers.

  7. Mast1

    Undiscussed hidden costs

    The problem reported seems to be silo-ed into a discussion about the impact on the school and its reaction.

    As a society we all need to have resilience against this sort of attack.

    Sending kids home for a couple of days appears an easy solution compared to planning for failure mentioned above, but it has massive knock-on costs, and not just financial.

    My wife is a hospital doctor, and were I not able to work from home to supervise my children during such closures, her clinics would be cancelled: a further 15-20 people disappointed every day.

    What about those people being paid piece-rate having to stay at home and losing income ?

    Shoving our personal failure to plan as a cost onto everyone else turns out to be a cost back on us. We need to learn to work better to face these issues as a co-operative society.

    I leave how one does that as "an exericse for the student".

    1. MachDiamond Silver badge

      Re: Undiscussed hidden costs

      "Sending kids home for a couple of days appears an easy solution compared to planning for failure mentioned above, but it has massive knock-on costs, and not just financial."

      The issue is there doesn't seem to be anybody doing some "what-ifs". Scrambling to implement something at the last second for a problem that could have been planned out much earlier is a fail. It didn't have to be ransomware specifically. If that one computer ruling everything has a bad day, the same thing happens. If the software for the fire detection or VOIP phones goes off for any reason (subscription not renewed), it's the same thing. What do they do in that situation? Easy, pull out the three-ring binder and flip to the proper section for the pre-programmed (pun) solution. Any preparatory work needed to implement the plan should have already been put in place. The depressing thing is to see the same sort of problem time after time with different nuts sprinkled on top and still no plan.

  8. Efer Brick
    Joke

    Just send 'em to...

    TheRegister.com

    1. neilg
      Headmaster

      Re: Just send 'em to...

      .co.uk

      Should then have the correct spelling and terminology.

      apropos the above: What exactly is fiber in networking.?

      https://www.oed.com/search/dictionary/?scope=Entries&q=fiber

  9. abufrejoval

    Love those girls!

    I know it's most likely a standard shutterstock pic, but boy, did these girls go into giving everything to project boredom!

    They obviously came well prepared and groomed to their best but then just imagine their fun at trying look both the possible best (at looking good) and projecting the possible worst (boredome/frustration).

    I'd say they nailed it! Bravas! Da capo!

    And I guess a lot was also in the brain behind the lense: well done, the effort shows and really carries over to the viewer!

  10. Lazlo Woodbine Silver badge

    Lots of angry people here

    There seems to be a ridiculous number of down votes on posts that are only trying to explain why a school may feel the need to close.

    Let me tell you, schools do not close without very good reasons, because we know exactly how badly this affects parents.

    Where I work, outside of Government mandated lockdowns, we've closed 4 times in the last 12 years I've been working here.

    Twice because buses couldn't get to school due to flooding

    Once because of an area wide powercut, we tried to carry on teaching, but the powercut killed the heating, and classes were uncomffortably cold.

    The final time was due to far too many staff being off sick and we couldn't cover lessons safelly.

    On all but the powercut, we conducted lessons online for those that could access them.

    1. Terry 6 Silver badge
      Thumb Up

      Re: Lots of angry people here

      Yep.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like