Rebecca hosts solo this week for a timely conversation with David Bowman, cybersecurity director for one of Utah’s largest K-12 districts, a member of the State of Utah Cyber Commission, and chair of the Statewide K-12 Cybersecurity Council. David brings a clear, practical view of what student data privacy really means inside schools, beginning with a classroom exercise where he showed students just how much information about them could be gathered, connected, and exposed. From there, the episode moves into the recent Canvas breach, the third-party analytics tools quietly embedded in EdTech platforms, and the difficult questions district leaders need to ask before trusting vendors with student information.

At the heart of the conversation is David’s argument that the greatest threat to student data is not always the outside hacker. Often, it is the company already inside the district’s ecosystem, collecting more information than schools or families realise. Rebecca and David discuss how districts can create stronger privacy expectations, build data protection into procurement, communicate more clearly with parents, and hold vendors accountable when their practices do not match the responsibility of serving children. David also explains why privacy cannot sit separately from teaching, leadership, or purchasing decisions, and why schools need the confidence to “vote with your data” as well as with their budgets.

Tune in for a grounded, accessible conversation about cybersecurity, student privacy, vendor accountability, and the leadership choices that shape trust in K-12 education.

Rebecca Bultsma: That's the thing. This is the type of surveillance that this is enabling and collecting, right? Uh, ob- obviously, it makes people feel uncomfortable. It changes behavior patterns.

Rebecca Bultsma: It, you know, it makes people self-conscious if, if they know it's happening, and that's part of the problem, right?

David Bowman: We spend a lot of time talking about school shootings and protecting physical safety, and the news likes to talk about this because, you know, if it bleeds, it leads. So in Utah, we've had a lot, a lot of extreme focus on the school shooting aspects and physical security and all of these different things over the last few years, but there's been very to little no focus on resources to protect students' data

Rebecca Bultsma: I have David Bowman, who leads the cybersecurity program for one of the largest school districts in Utah. So basically, he's personally responsible for defending over 100,000 devices, Chromebooks, servers, all the things, from the ultimate chaos agents thousands, almost 60,000 students, right, David? And 7,500 staff members.

Rebecca Bultsma: David serves on the State of Utah Cyber Commission, chairs the Statewide IT Directors Council, and chairs the Statewide K-12 Cybersecurity Council, uh, which means he sits in a lot of meetings all day, every day, uh, talking about things probably people don't want to hear. But before we kind of kick this off into what I think is going to be a fascinating discussion, I think we wanna hear the story about how you and Brett met.

Rebecca Bultsma: Because you told us before we started that, uh, you just went up and, and kind of gave him a hard time at a conference, and I love that for you. So tell us everything.

David Bowman: And so we do that every year, and there's lots of different topics and professional development and training and all of those kinds of things. For many years, it's been a lot more traditionally focused to an educator focus. And one of the things that the conference has tried to do is to get a little more adding roles of folks in technical aspects to do sessions and talk about them and kinda consider those technical aspects of things behind it.

David Bowman: Like So, I mean, that's the type of thing where I'll end up doing that. But in this case, the way I ran across Brett is we were in a session that was talking about what's the future of AI in education and the topics, and there happened to be a lot more technical people in the room than your traditional educator.

David Bowman: And so Brett kind of went into some of the normal stuff he talks about and the things he's excited about. And then, um, because I am who I am, right? People call it David style. I just said, "You know what, Brett? I'm sure you've talked about this before. Could we talk about the fact that we're talking about data security and responsible use, and the reality is, is my data's not going to hackers anymore, it's going to companies, and I wanna talk about that."

David Bowman: So yeah.

Rebecca Bultsma: I love that. And you know, I-- that wouldn't have been the first time that Brett heard that. I, I bring that up a lot on our podcast, and it's the very unsexy reality of ed tech that really bothers me. As someone who does research in the UK where the, uh, data privacy laws are much more intense, I think it just really bothers me, and I don't think as many people are aware as should be that a lot of these companies make money by taking millions of dollars from schools but then make more money than, again, taking data and brokering it, or as they like to say, sharing it with partners.

Rebecca Bultsma: And I'm sure you're seeing that- They're

Rebecca Bultsma: Isn't that insane?

David Bowman: And like that's the piece that ethically, it's like I don't think people get it. Or like this is the problem in the classroom that we run into, is the teacher sees it as this great free tool-

Rebecca Bultsma: Personalized learning

David Bowman: Yeah. But if it's free then, well, nothing's free. If it's free, you're the product. But the individual teacher in the classroom doesn't have to think at the level of there is 60,000 students' data that I have to protect and be part of. They just see me as the, "Why did you say no to that cool AI robot?" I just, you know, and that's, that's the reality of what we're dealing.

Rebecca Bultsma: I, I feel like there's a misconception about, like, data and what it is. There's a whole, like, kind of thing happening with that, this generation, a younger generation that's like, "Yeah, take my data. I don't care. Take my data. I don't care if you know what I watch or what I do and things like that." And I just don't think people understand, number one, the value of data, what's being collected, why it's so valuable, and what the risks are of this data.

Rebecca Bultsma: It's just kind of a blanket term, like AI, data, right? It can mean so many different things, but why is it so valuable? What should people know about why that's valuable and why it needs to be safeguarded?

David Bowman: So we can't make the product better without recording every single thing you're doing." Utah is actually rather progressive in our student data privacy laws. Like, we have a dedicated office for it in the State Board of Education. So, you know, when I've been at conferences or other things, then people are like, "Oh, that guy's from Utah?

David Bowman: Just be quiet. They know what they're talking about," right? Like, Utah has been a really great leader in what some of those things look like. But as part of those things that come up is people just don't understand the, the crumbs that get put together. So you can easily go look me up on LinkedIn, and you can see everywhere I've ever worked.

Rebecca Bultsma: That's the thing. This is the type of surveillance that this is enabling and collecting, right? Uh, ob- obviously, it makes people feel uncomfortable. It changes behavior patterns. It, you know, it makes people self-conscious if, if they know it's happening, and that's part of the problem, right?

David Bowman: Well, and It's not just that they get disconnected from what it is, but the piece that's really hard to understand is that sometimes you need that data in order to perform the required service.

David Bowman: I literally am watching every single thing they do and they, they do and say. But in order to provide content filtering, I don't have a choice to do that. But traditionally, in the past, it was, it would use a little bit of its own data, and program developers or product developers did have jobs before AI, so products could be developed without AI.

David Bowman: Well, you don't have to have all of my data and aggregate it in order to make your product better. Matter of fact, if you need that to make your product better, make a better product.

Rebecca Bultsma: Uh-huh. And I think the part that most people aren't putting together is how this connects to AI and this AI era, right?

David Bowman: Yeah. And the argument I get into with providers, and this is a piece where I think people misunderstand. So one thing to know is that most school districts and people that manage data, they have what's called a data privacy agreement with the vendor that says, "This is the data you're gonna get. This is what you're allowed to do with the data or not do with the data.

David Bowman: And we're like, "What? What is this thing?" And we go to the website, and if you read the website, it's all about, "Track your customers and know everything where they do it," and, you know, da, da, da, da, da, da, da. And we're like, "Okay, this looks really sus," right? And so we start kind of looking into it, and it took us a little bit to narrow down exactly what application or thing was doing it, um, because it turns out four of them were doing it.

David Bowman: You're collecting who's logged in. You're collecting their device's IP address, so this is a way to extrapolate their location. You're collecting their grade, so now you know roughly how old they are. Then you're tracking things like a student got mad and rage-clicked on a question, and you're tracking that.

David Bowman: And, you know, the teacher explains the student what time it is, and they said, "Okay, let us go look at the recording, and we can figure out what the issue was." So then that became a challenge point with the CEO of saying, 'cause they were based in Utah, so we were able to track them down and say, "Look, man, you're saying that it's anonymized and you can't tie it back to anybody, but the network traffic is not going to you, it's going to this Fullstory AI company, and then it's going to you."

David Bowman: So it was kind of like a, a threat game of I can't-- it won't work if you block that. Well, guess what? We blocked it, and guess what? It still works, and they're still developing the program. They're just not getting that extra AI data. And that extra AI data and full recordings, that's a win in aspects of somebody that was paying really close attention, noticed it, caught it, called the vendor out on the mat, and made it stop.

David Bowman: So it's an extremely powerful statute that somebody's gonna have to test and push it against, and It'll probably be me at some point. But that's-- I mean, we at least have legislative level paying attention and going, "This is a scary problem." And the problem is, is now vendors are like, "Well, we're not gonna agree to that."

Rebecca Bultsma: And let's, let's stop here and give people context on what Canvas is, because this is a perfect example of what happens. Maybe you have an agreement with one company, maybe it's acquired by another company, and you don't know where that data flows, or maybe you're locked into some sort of ecosystem with your data for so long at such a scale that you don't necessarily even have any choice about switching, even if the data practices aren't great.

Rebecca Bultsma: So let's talk a little bit about that, David. I'm sure you have opinions.

David Bowman: But one of the, one of the things is you find vendors that are more responsible, and those are the ones that you wanna work with. So, for example, we told Canvas, "We don't like this, and we really think you should have given us notice." And they said, "No problem. We'll turn it off." And then about sixty days later, they came back to us and said, "Hey, we've reviewed this internally, and we would like to update our agreements to talk about this to make it more usable for everybody."

David Bowman: And so that was a really cool, responsible behavior.

Rebecca Bultsma: Is the reason they wanna use it, are they making money off of tracking that data? Is that the reason they wanna use it, or are they using it to improve internal AI systems? What's in it for them that they came back and they were like, "Hey, like, we really actually wanna do this"?

Rebecca Bultsma: How does that benefit them? What are they getting out of it?

David Bowman: So I mean, that is a thing. But the way it works with the big edtech vendor like that is what'll happen is, yeah, they're gonna use some of it for exactly what they said they're gonna use it for. But then they'll have a relationship with an advertising agency or a marketing company or a data processing company where they say, "Hey, give-- we'll give you a really good discount if we can use your data."

Rebecca Bultsma: I know that there was a class action lawsuit brought against Canvas in the last couple of years alleging, uh, that they show, they shared their student data with over 500 partners, which I thought was very, very interesting. Parents were upset to learn a- about that, and, uh, you know, fair, and but I think there's a lot of misunderstanding, it sounds like even kind of with us, about like why and what are you using it for?

Rebecca Bultsma: Which isn't great considering kids can't consent to how their data's used, and, and there's a lot of issues around that as well. So it's just interesting to point out that if you're sharing it with allegedly 500 partners, and we don't quite know why or how that data's being used, that's a, that's a whole other thing to be talking about.

David Bowman: That was over a year ago.

David Bowman: It kinda is what it is, 'cause they gave us the option to say we just don't want it that way, and that was fine. Making them give it to us in writing and get it approval was kind of like we changed it from the standard of, "Well, you have to notify us, and then you're fine." So we were able to push to change the standard of, "You have to notify us, and then we have to respond back and say it's okay."

David Bowman: So this recent Canvas breach is a really good example of where good behavior and not so great behavior was happening, and so it changed how it impacted different institutions. So-

Rebecca Bultsma: Why don't you tell the whole story? For anyone who hasn't been following this in the news or they just clocked it off to something they didn't understand, spin the tale.

Rebecca Bultsma: Tell us, tell us, uh, the story and what happened and, and give us the background.

David Bowman: So Canvas has a lot of data. In order for us to use Canvas as a school district, they-- I can't think of any other vendor except Google that runs our actual ecosystem that has that level of data, and frankly, Google doesn't even have that level of data.

David Bowman: Sometimes that's daily, hourly, sometimes it's every time. It just depends what it looks like. So it's natural that a vendor has that type of thing and it's automated. And this automation becomes very important in kind of understanding the timeline of where things became interesting. But on the 26th of April, their main data communication language setup went down for maintenance.

David Bowman: But then they make it to the 29th, which is a Friday, and they wait until Friday at 4.30 in the afternoon and send an email to the customers and say, hey, we're aware of a security incident. We're working on it. And it probably contains a few things. First name, last name, email address, course enrollment, direct message data.

Rebecca Bultsma: And I'm gonna pause you there because I ran school public relations for a long time, and just to point out the timing on this, April 29th, it's not just K-12s that use this, right?

Rebecca Bultsma: There's tons of universities and colleges that suddenly kids couldn't submit work before deadlines. The university- They couldn't submit

David Bowman: final exams.

Rebecca Bultsma: Exactly. They couldn't communicate with professors. This has all been centralized to such a place that this was paralyzing for many institutions, and nobody knew what was going on, and they had no way to get information.

Rebecca Bultsma: 'Cause as you mentioned, the doors were locked, and the phones were turned off, and this was all the message you had to go on.

David Bowman: And not only that, but the groups that attacked them-- And so we went the weekend with no information from Canvas at all. They finally released a generic statement on their website on Saturday that was a repeat of the same nothing, uh, nothing burger.

David Bowman: And, you know, sometimes you have to take what the bad guys have to say with a grain of salt. But then Monday comes around, and we're still not seeing any good communication from Canvas, and the attackers, the Shiny Hunter guys, take this bold step of saying, "You know what? Canvas is not responding to us. We can tell that people are frustrated as customers.

David Bowman: The scope is all of those customers but that company. But the relationship with Canvas and the individual decision-makers and boards and all of these different ongoing management things made it so that it was potentially feasible to negotiate individually with the terrorists or the cyber terrorists.

David Bowman: And so that theoretically at some point was successful. But what got even more crazy is, and this is the funny part about the timeline, so I have a little-- and I'll have to get you the asset so you can throw it up on the podcast, but I have a little sign in my office now that's called Canvo De Mayo. Um, and the shiny hunters and, and all of this silly...

David Bowman: Because at this point, it's been going four or five days. Those of us who are really worried about it aren't sleeping real great and, you know, at some point you have to dink around with your AI to entertain yourself.

Rebecca Bultsma: And let me, let me pause you there. What worries you? What could-- what's the worst-case scenario here s- that could happen that is making you lose sleep?

Rebecca Bultsma: Sure. So

David Bowman: a list of like what? Yeah My first name, last name, email address, not that big of a deal. And actually, I really tried to sample this and track this because I'm an adjunct professor at night, so I teach adults, and this was going on, and I teach cybersecurity and cloud systems, and so this was a very relevant first week of class.

David Bowman: And I just said, "Hey, guys, do you care if your first name and last name is out there and your email address?" And they're like, "Well, no, not really." Like you mentioned, a lot of the adults do. Well, then as we talked more and more through the details, I said, "Well, let me connect those dots." So here's an... The trick here of what the risk is is the relational connections Versus just the, "Yeah, my name and email is out there, it's not a big deal."

David Bowman: Now, you just go to ChatGPT or Gemini and say, "Here's my data, do that." So you don't have to go to, you know, you don't have to write a proposal and go use the university supercomputer anymore. You just do it from, you just do it from the internet.

Rebecca Bultsma: Because AI excels at making connections and finding patterns and connecting dots, all the dots that might be there, right?

David Bowman: Fourteen-ish? Fourteen. Yeah. So with their first name and last name, I probably could easily infer this is what their gender is. I could infer their ethnicity. So Canvas collected that data if people pushed it, so if you told them what the student's gender and ethnicity was, then, then it's there. Some people were sharing that, some people were not.

David Bowman: So if I'm motivated and want to figure that stuff out, I know who the kid is I can target based on eth-ethnicity. I know this kid is potentially more susceptible to persuasion or hacking because they maybe have some type of del- developmental delay or some special education services needs. And then you could also, you know, when students log into Canvas, there's a little picture of them.

David Bowman: Well, now, okay, maybe I care. Now that like if you printed it out as a, as a dossier, like a hitman, right? Of this is I'm gonna go hack this person, that's a lot more disturbing. And so I actually did an interesting exercise with my college class, and they'd been like, "Yeah, we don't ma- you know, we don't care that much."

David Bowman: And so I took and I made a mock one of just the pieces of data that I knew we were giving Canvas, and luckily, we were giving Canvas the absolute bare minimum, so a lot of this stuff wasn't involved, at least at our institution, in terms of the amount of things that could've been there. And I printed it out like a dossier, and I handed it out to the class and said, "All right, guys, do you have different feelings now about this?"

Rebecca Bultsma: Well, and if you think about it, that kid's 17, doesn't know this data's out there, whatever. How easy is it to then start applying for credit cards or do identity theft that the kid doesn't recognize until they go eventually to do those things for themselves?

Rebecca Bultsma: And at scale, how many times does that happen to how many kids, and what kind of impact does that have for them down the road? Like, in the hands of which bad actors is that data the most useful and damaging for kids in the future, in your opinion?

David Bowman: So listen, credit card numbers and setting up identity theft, stuff like that, yeah, it's absolutely happening.

David Bowman: Well, now take that $10 and times it by my 57,000 students. So now if you were to hack my school district just for purposes of that data, that's at least half a million dollars easily resellable value. But here's the crazy part. Or I'm a marketing company that wants to develop an ed tech software, and I wanna understand more about how students use things and do it.

David Bowman: It's just a little bit of money. Your identity gets stolen." That's not the part that really scares me. The part that scares me here is-- Actually, it was g-- I was on a webinar the other day where they were talking about it, so trying to hire people effectively and go through things is, is complex, but there's a lot of data out there.

David Bowman: And so one of the services this product offers is, "Give us the name of your candidate, and we will just tell you everything we know about them." And that was part of the service. And so when you do it that way, then now this student's applying to a job, and they look at the student, they like them, they decide to run that background check or that deeper dive, and then they can see, oh, this is where that kid lived.

David Bowman: When I narrow it down to the two or three people I'm most interested in, I start Googling them. I'm looking at their social media. I'm looking at if they're on gamer forums. I'm looking at all those kinds of things. And I had experience recently where I had a candidate that I really liked and thought that candidate would be a good candidate, and then I came across a social media profile where all the person did was complain and moan about their work all day.

David Bowman: But there's been very to little no focus on resources to protect students' data. Here's the reality. If a kid gets injured or shot or they're in a school, they go to the hospital, they get treatment, it changes their life for sure, but it becomes an event that they can move on from If their data and all their identity gets stolen, it haunts them forever.

David Bowman: You have to be a steward of people's data and treat it like it was your own and you would care

Rebecca Bultsma: That's ex- that's exactly it, and that's what I love about your level of care and awareness here, 'cause I don't think we're, we're seeing that everywhere. To go back to Canvas for a minute, they gave, ShinyHunters gave Canvas a deadline, and from what I understand, they eventually paid up or came to some sort of agreement.

Rebecca Bultsma: Uh, what do you know about that?

David Bowman: And so it's not like we weren't all, like, yelling at Canvas, like, "What the heck are you doing?" But now media, institutions, everybody is banging on Canvas's door saying, "Guys, like, you have to talk to us about what's going on." We weren't demanding they paid. We weren't-- We were just saying, "You gotta talk to us about what's going on."

David Bowman: Well, there were some deadlines, and then they would move it out, and that's, that's somewhat natural attacker behavior. If they think with a little bit more time, they might get some money, they'll have a tendency to play that game. So we get into the weekend of that week, and all of a sudden everybody's paying attention now.

David Bowman: So the gut reaction from a large number of vendors and school districts was, we talked about that special communication tool that's automatic. We just cut it off. We just said, "We're done And so, you know, the big interruption for that is, you know, teachers, if they were putting in grades and things and determining graduation eligibility, those were not going back to, going back to the system that's the source of truth to decide those things.

David Bowman: I think I br- I had a LinkedIn post going for a while of like, "Give me an alternative to abundance of caution," and I think, I think my favorite one was, "Out of a total lack of faith that people will not click the link, we're going to da, da, da." Well, there's this technology principle that's called DDoSing or distributed denial of service.

David Bowman: What that means is, is everybody-- If you imagine like a grocery store and there's a hurricane coming or whatever, everybody goes to the grocery store and it's just completely overwhelmed and all of those things. Well, that can happen on the technology side of the house where everybody's sending an email to something or everybody going to a website and it just breaks.

David Bowman: I can't even word it. Okay, so this is what it said. "Due to the significant amount of press inquiries we are receiving every hour from all around the world, we are making a public statement. We are not commenting and have no further comment to make regarding this global incident." Yes, ShinyHunters posted that.

David Bowman: Canvas paid, and Canvas did on the Monday or the Tuesday, so that was like seventh, eighth, ninth, around the tenth now. Canvas said, "Hey, we've reached an arrangement with the attacker," and yada, blah, blah. Well, it's like, "So did you pay the ransom?" And they're like, "We reached an arrangement." And I'm like, "What lawyer is sitting there telling you not to say we paid the ransom?

David Bowman: At that point, clearly, Canvas hired an actual PR firm. We got an email from the CEO of Canvas apologizing for the disruption, and he felt really bad. So the good news is the CEO, man, the CEO of Canvas is gonna come after me, right? But the CEO of Canvas was all very sorry, you know. And so that, that was great.

David Bowman: So the good news is, is we're sorry that mass data shooting occurred. Our bad. Sorry. Right? I need to find the right word to describe that 'cause we talk about mass school shooting, but we should find a relational term to the exfiltration of data. I gotta think on that more.

Rebecca Bultsma: What a gong show, right? I'm, I'm torn because part of me looks at what happened with PowerSchool. So like, something's happened before. Like you, you own like a storage locker where you store people's stuff, and you know what? Somebody broke in recently to your neighbor's, and it was a massive nightmare. And so you kind of already know maybe like this could happen to you.

Rebecca Bultsma: What are you gonna do to protect it? And then be shocked when something similar happens to you. I, I have a hard time not blaming them, but I also understand, uh, you know, groups, hackers are good and, you know, they're probably, it probably sent them into a tailspin, and what could they have done differently or better?

Rebecca Bultsma: C- could they have? And with the technology that's coming out now, is this gonna be an everybody problem soon? I have so many questions, you know?

David Bowman: I have that same issue in a school district. Should I buy this other security tool that will help us protect us, or should I pay two teachers? What is the core mission of what we're supposed to do in a school district? So that's a day-to-day reality. Here's the problem. When this type of thing happens to companies, they don't care.

David Bowman: The penalty isn't big enough. It's not a big enough deal. Like Canvas could-- Canvas is almost in too-big-to-fail territory just because of the size of their customers and how you don't just wake up one day and go, "Hey, we're gonna move to this competitor." Um, and you don't do it in a summer, right? I mean, this would've been the moment to go, "Hey, you know what?

David Bowman: Um, Europe is way out in front on this. They have-- They are getting stronger and stronger about it. The num-- The problem is, is that even in the consequences there, they're, they're mainly the baseline statutes are number-based, like X amount of dollars per instance or occurrence, which works for the small to medium, but then you see a judgment that says Google got fined a billion dollars.

David Bowman: Because when breaking the rules or stretching the rules costs more money than it does to do the right thing, then they'll do the right thing.

Rebecca Bultsma: And you are right into my territory now because this is such a big conversation happening with the big AI companies right now, and accountability, and the fact that there's very little legislation governing any of that, and sorry our chatbot told your kid this, but like there's no consequences or penalty or accountability at this point, and these companies are massive.

Rebecca Bultsma: And again, from a public relations standpoint, you know, I, I understand maybe some of the motivations behind them releasing that. They essentially said, "Hey-" The

David Bowman: best marketing ploy ever.

Rebecca Bultsma: Ever. Okay. Okay. Yeah.

David Bowman: Right? As my- It's so good it scares us. We

Rebecca Bultsma: can't tell you anymore, but it's so amazing.

David Bowman: Yeah.

Rebecca Bultsma: Right? But they came out and said, "We're worried that this is gonna hack every system in the world, right?

Rebecca Bultsma: You know, some of it, uh, some major, major organizations, especially government organizations, infrastructure even, based on some whistleblower reports I've seen, that are still operating on very old easy to hack software. Uh, and we start to wonder if these data breaches become more common, or we see them more often, and how are we ever supposed to protect ourselves or our children from this?

Rebecca Bultsma: Or is it just hype? David, what's your read?

David Bowman: My initial read was this either is what they say it is and the world's over, right? Right? Pick your religious statute, right? Or preference, but God's coming back. It's over, right? Or it's the most brilliant marketing scheme ever. So that's been my concept for a little while.

David Bowman: And so because it's better at automating that than typically you write a program that says, "Try this thing and go try this thing on everything we know about." That's traditionally what it looked like. Now what you're telling AI is, "Try this thing, but if this, this, this, or this happens, then shift to this."

David Bowman: You need to make it stop." And I'm like, "Okay, well, anytime this happens, we try to figure out what's going on and we stop it." Well, parent shows us the video, and it's like student goes to this, this approved app, then scrolls down to the bottom of the page, hits Contact Us, then goes up to the other top of that page and hits About this company, then goes to the bottom that says, "Here's your stock ticker for this company," that clicks take me to Google Stocks, and boom, now they're on Google search engine with no content filtering restriction, right?

David Bowman: And so what I think will happen is that Anthropic or Mythos or whatever you wanna call it, it will continue to find things, and it's gonna be a big deal, and we need to patch it, but it's not going to change the way the-- It's not going to change inventing this new way to hack people. It's just going to make the volume so large that we can't do anything about it.

David Bowman: Well, the basketball game is going on or the adult ed night school is going on. So then do I do it at ten o'clock at night? We're public government employees. Nobody wants to work at ten o'clock at night. So do I have a guy that his job is to just turn everything on and off every night and apply fixes?

David Bowman: That's the piece that's really gonna get into the issue where, where that's gonna be the piece that's really gonna change things And I'm not necessarily looking forward to being the incident response level person in that. I wanna do the more leadership of how we fix it level at this point. I used to kinda wanna be the guy that just sat in the basement by myself and with my dark hoodie and my just...

David Bowman: But now I'm like, "Ugh, that's exhausting."

Rebecca Bultsma: How do we exist in this world? Is it just as easy as the digital hygiene, digital footprints individually? It doesn't sound like it because it sounds like it is bigger than a lot of us, and more on the companies. Is the accountability piece the secret potion that we all need to exist here?

David Bowman: Yeah. Don't click on phishing emails, be overly aware, blah, blah, blah.

David Bowman: Why do we have to put that on every breach notification? If you don't know at this point to think before you click, it doesn't matter how many more ways I'm gonna say it.

Rebecca Bultsma: It's the same reason we put, "Don't drink the shampoo," on the shampoo bottle, right? Like, there's always people-

David Bowman: Yeah, or the coffee is hot at the McDonald's, whatever, right?

David Bowman: And I don't wanna say, like, you just kinda have to be resigned to it. A lot of those typical things that we talk about in the abundance of caution, doing those things will help you, will help you minimize your own exposure. And so it's good to do those things. But everything has a trade-off, and people decide how they wanna make it work.

David Bowman: So common sense would be David Bowman should not have a LinkedIn profile that literally says all these different things about me, where I've worked, to make it easy to associate that. I know that, but here's where the trade-off comes. I, because of where my experience sits, lots of companies wanna research how to sell to people like me.

David Bowman: So once or twice a year, I'll get a company that reaches out to me or a market research firm that says, "Hey, based on what we're seeing on your LinkedIn, if you'd be willing to talk to our client for an hour about this particular type of thing, we'll pay you three or four hundred dollars." And it's like, okay, right?

David Bowman: And I'm like, well, I kinda like that. And so I put it back. So, you know, I-- it was a particularly interesting research time, but, like, during the year that I did that, I got almost two thousand dollars in those free, in those little conversations with zero effort. They just called me and offered to pay. So I'm choosing to give up my privacy for two thousand bucks So I'm making that decision, and everybody has to realize that they're making that decision.

David Bowman: But I think the accountability is the biggest way to fix it, whether it's parents or class action lawsuits or fines of what's going on, and you gotta hold them accountable. Like with this Canvas thing where they weren't communicating, the Senate Education Committee s- had sent a letter and said, "You need to come talk to us about this.

David Bowman: So here's the message that we sent you, and here's the date we expect you to come testify." So it'll be really interesting to see what happens when they come testify. But what's the impact in the end? There was a really big hack where that happened a lot with a company called Change Healthcare, and they controlled prescriptions for like seventy-five percent of America.

David Bowman: And you can go watch those hearings and those things, and the funny part is to watch the legislators go, "You didn't have two FA turned on? Are you kidding me?" Well, guess what? When it's all said and done, how much did that cost Change Healthcare?

Rebecca Bultsma: It's like having your-

David Bowman: Go look it up ... password

Rebecca Bultsma: for everyone set as password one, two, three.

Rebecca Bultsma: Yeah. I mean, their

David Bowman: Well, when an institution gets behind it, then it's bigger. It's bigger numbers. So Jordan School District, this random school district in Utah, is suing Facebook and Instagram and Meta and all these big companies, and we are what they call a bellwether case. So what happens with a class action is they build all of these different people, but then they take a few of the biggest ones that have the best stories and the best data, and they use them to present that.

David Bowman: We have 65 schools. The payroll cost to have 65 qualified professionals that are properly licensed in every single school, and there's way more than just one per school when you get to bigger schools, that's a significant cost to the taxpayer. And this concept of we hold people accountable is something that we believe in as a district, and we believe in as a community.

David Bowman: Now, I'm not gonna go crazy on YouTube like the guy trying to fix the Lego problem that got stolen with the-- If you want a rack, oh, go watch the Bricks and Minifigs Lego theft. It, it's fascinating, right? I'm not gonna be a crazy YouTube personality of, like, doing all kinds of insane stuff, but I'm going to continue to demand that we get attention.

David Bowman: And, and do I think that's gonna work or fix it? No. Do I think hopefully it helps to make some difference? Yeah, I really do. And I do have some beliefs that it will make some difference. But the influence I have, I will vote with my dollar, but not just my dollar, but with the taxpayer dollar budget that I control When I deal with a content filter company, if they're gonna feed the stuff to AI and not do it the way I want, then we're gonna say we're not gonna give you our taxpayer money.

David Bowman: And this is what I tell vendors and CEOs or different people that I come across. I said, "On your website, I don't wanna have to look for it. I wanna easily go on your website, and there's a button, and you need to call it Our Digital Data Pledge. And on there, you should define every imaginable thing under the sun you can think of to explain what you're doing with the data, how you're gonna use it, what you insist your customers do, what your security is.

David Bowman: We're approved by that thing. We're appro-- But if somebody sends me, "This is our data security manifesto," I... And we've even done this. I've researched it, and at least in Utah, this is appropriate in public purchasing policy. But when we define elements of what's evaluated for purchasing, you know, there's a lot of rules about you can evaluate references and features and cost.

David Bowman: But how do you get your local school district or your local person to care about that? There's not a, there's not a David at every school district. There's not a school board that's willing to go to bat and sue some of the world's largest companies, right? So it becomes that individual activism of the choices that you make about what you do.

David Bowman: And my experience is kinda cool because I get to live across both worlds. And like, I've actually been developing this semester, my students use AI to do my, one of my assignments. I, a lot of them, they can't because I know how to design it properly. But I want to use it as a benefit to help them. So I made an AI chatbot that runs on my computer, so it doesn't go anywhere.

David Bowman: It just has a little website on it. I've told it, "This is my rubric, this is the assignment prompts," and the students can go take their writing assignment, put it in there, and say, "Give me feedback in the same way that Mr. Bowman would give me feedback to help me improve it." The students think it's super cool.

David Bowman: That's not what they do anymore because that didn't make sense. AI could just spit it out. They weren't learning from that. Instead, they have to actually go on the cloud and make it, or they have to record a video showing me or talking to me about it, and that's how I innovatively change. But I mean, I've been all over the place now.

David Bowman: I've been talking too much here, but you-- Good luck to your editor. There's a lot to do here.

David Bowman: But yeah, I mean, that's kind of my thing, right? Of, you know, data privacy is real, and it's my data, not your data. You know, the old Wentworth commercials, "It's my money, and I want it now." It's my data, and I want it back.

Rebecca Bultsma: It's more important now than ever, right?

David Bowman: Hmm. Right? Think about being a parent to a teenager. You tell them to clear the table, they don't clear the table. Eventually, you're like, "Listen, if you don't clear the table, then I'm not a good teenager parent. I'm learning how to be a teenager parent. Example would be too extreme, right? But there's this point where when you child peop-- uh, parent people, there's a rubber meets the road moment, and if not, there's consequences.

David Bowman: And the rubber has to meet the road. They have to be standing out, they have to be standing outside Canvas's door in Cottonwood Heights, knocking on the door and saying, "We know you're in there. We can see you. Answer our questions or we're done." You know?

Rebecca Bultsma: And you know, I, you, you said it midway through and I think part of the problem is the too big to fail, uh, sometimes too, right?

Rebecca Bultsma: But that's the conversation for another podcast, I'm sure, and I'm sure we will definitely be having you back in the future 'cause this has been a great conversation about probably what I think is one of the most, probably the most important topic of the, of our time right now, just of how AI is changing w- the value of data and how it can be used for us, but really against us too in a lot of ways.

Rebecca Bultsma: So thank you for being here, David. If people wanna get in touch with you then is, is LinkedIn it? Is it not it? How do they find you? And if someone wants to hire you for a session, like where do they go? Do they find you on LinkedIn?

David Bowman: Um- Who

Rebecca Bultsma: do they tell the hackers? ...

David Bowman: LinkedIn is probably the place. Yeah.

David Bowman: It's the companies that you do business with every day that are the bigger threat, and I need your help To hold companies accountable to stop it. Yes, I need your help and your tax dollars to fight Russia and North Korea and Iran trying to hack our data, but I need to stop the legal sale of our data even more than the illegal transactions on our data.

Rebecca Bultsma: Sorry Brett couldn't be here, but I think he'll definitely be here on our, our next one, and we look forward to having you back in future conversations. Thank you.

David Bowman: Great. Thanks, guys.