The laws behind accessibility in 0001.e are only one of several kinds of rule that apply to computing, and a good deal of confusion comes from mixing the kinds up. A legal factor is a requirement set by government, enforceable whether or not anyone agrees to it; licenses belong here too, because they are legally binding permissions that an owner grants. A policy is a rule an organization sets for its own members and resources. A technological measure, such as a filter or copy protection, makes something harder or easier to do, which is different from deciding whether it's permitted. An interpersonal factor is what people actually do with one another: asking for consent, teaching a student a safer way to share, reporting a flaw privately. CIPA, described below, shows all four together: a law requires a technological filter and a written policy, and it also requires educating students about how to behave online. For any rule in this section, ask three questions: who is bound by it, what triggers it, and what does it require? The section groups the rules by what they protect: student data, privacy more generally, creative work, computer systems, and finally a school's own resources.

Student data at school#

Four laws govern student data and online safety in New York schools, and they are easiest to tell apart by whom they bind. The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects education records at schools receiving U.S. Department of Education funds. Parents may inspect records and request corrections of inaccurate ones, and disclosure generally requires written consent.¹ There are several important exceptions. School officials with a legitimate educational interest may have access, although that doesn't open every record to every staff member. Directory information that a school has designated, such as names and photos in a yearbook, may be released if families had notice and a chance to opt out. A teacher's private notes kept in sole possession, and shared with no one, aren't education records at all. Rights transfer to the student at age 18 or on entering postsecondary education, so a parent asking for the file of a 19-year-old who is still in high school generally needs that student's consent.

FERPA binds schools, whereas the Children's Online Privacy Protection Act (COPPA) binds companies. It applies to commercial online services directed at children under 13, and to other services that knowingly collect those children's data, meaning that the operator has actual knowledge of a child under 13. It requires a clear privacy notice and verifiable parental consent before collecting personal data, and the Federal Trade Commission (FTC) enforces it. Schools enter the picture when they adopt such services, since a school may consent on families' behalf, but only for educational use of the data. The age line matters: COPPA's consent requirement doesn't cover a 14-year-old, though other laws and district policies may.

The third law is tied to money. The Children's Internet Protection Act (CIPA) requires schools and libraries receiving E-rate discounts, a federal program that reduces the cost of Internet service, to filter obscene or harmful images, monitor minors' online activity, and adopt an Internet safety policy covering safety, hacking, and education about online behavior, including cyberbullying. Because it attaches to E-rate discounts, a school that doesn't take them isn't bound by CIPA, though state or local rules may still apply. A filter alone isn't enough without monitoring and a policy. A library may also disable its filter for an adult's lawful purpose. And because CIPA targets categories of images, blocking all sexual health sites goes beyond what it requires, which makes such a block a local policy decision and not a federal mandate.

New York adds its own law, which reaches the outside vendors that schools rely on. New York Education Law 2-d protects personally identifiable student data, and certain teacher and principal data such as annual performance evaluations, held by educational agencies. It requires a parents' bill of rights, data security standards, and agreements with third-party contractors, who may not sell the data or use it for marketing. Contractors must promptly report exposure to the district, which has notification duties of its own. In practice, this means a teacher's enthusiasm for a new app can't settle the matter alone: the district has to confirm that a compliant agreement is in place.

Privacy beyond school#

Outside education, privacy law tends to turn on where the people whose data is held are located, more than on where a company is. The EU's General Data Protection Regulation (GDPR) gives people rights over personal data, such as access and erasure. It can reach organizations outside Europe that offer services to or monitor people in the EU, and it requires a lawful basis for processing, such as consent or a legitimate interest. New York's SHIELD Act requires reasonable safeguards and breach notifications for residents' private information, with notice going to affected residents and specified state authorities. It can reach businesses anywhere holding New York residents' data.

Creative work: copyright and fair use#

The rules so far protect information about people. A second family of rules protects what people create, and software falls under it. Copyright protects original creative works, including software, automatically once fixed in a tangible form. It needs no notice or registration to exist, so a diagram posted without a copyright symbol is still likely protected. The owner controls copying, distribution, and adaptation, and for work made for hire, meaning work an employee creates within the scope of a job, the owner is generally the employer. Ideas and facts aren't protected. Copyright covers the expression and not the idea or function, so a program's specific code is protected while what the program does isn't. The facts in a database aren't protected, although a compilation's original selection or arrangement may be. Inventions such as methods fall under a different system: patents protect them.

Copyright has a built-in limit. Fair use permits limited use without permission, judged on four factors: the purpose of the use, the nature of the work, the amount used, and the effect on the market. It has no fixed percentage, and weighing the factors is the whole exercise. Educational use weighs in favor but isn't automatically fair. A short clip used for nonprofit classroom commentary has purpose and amount on its side and little effect on any market, whereas posting a full chapter publicly or copying that could replace sales weighs against it, even with a credit to the source and an educational label. Parody can favor fair use because it transforms a work to comment on it, though it too depends on all the factors. When a use looks doubtful, linking to the material or licensing it avoids the question.

Permission in advance: licenses#

Fair use is an argument that you can make without permission, whereas a license gives you permission outright, so that nobody has to weigh factors. Creative Commons (CC) licenses let creators grant permissions in advance using combinable terms. Attribution (BY) requires credit, NonCommercial (NC) bars commercial gain whatever credit is given, ShareAlike (SA) requires adaptations to carry the same license, and NoDerivatives (ND) allows sharing the original but not adaptations. CC BY by itself asks only for credit, with a link to the license, and permits reuse, adaptation, and commercial use. So a teacher adapting a BY-SA worksheet credits the creator and shares the new version under the same license.

Software has its own licensing tradition. Free and open-source software (FOSS) gives users the source code and the right to modify and redistribute it, including free copies. "Free" refers to users' freedoms and not to price, which is why FOSS can be sold, and Linux and Firefox are well-known examples. Its creators retain copyright and grant these rights through a license, so it may still carry license conditions that users must follow, and support isn't guaranteed. The practical benefit is independence: a district can inspect and modify code to meet local needs, and users can fix abandoned code themselves or hire help.

FOSS licenses divide into two families according to what they ask of people who build on the code. Copyleft licenses such as the GPL require distributed modified versions to carry the same terms, with source available, so a product that combines GPL code and is then distributed may have to be released on those terms. That source requirement is triggered by distribution, not internal use, so a company running a modified version only on its own machines generally needn't release its source. Permissive licenses such as MIT allow reuse in proprietary software with minimal conditions, chiefly keeping attribution, which in MIT's case means keeping its notice in copies.

Computer systems: authorization and copy protection#

Licenses say what you may do with a work, and a separate body of law says what you may do with someone else's computer. The Computer Fraud and Abuse Act (CFAA) is the main U.S. computer crime law. It prohibits accessing a computer without authorization or exceeding authorized access, even if no data are changed or harm results, and state laws address similar conduct. The distinction between technological and legal factors matters a great deal here, because technical access isn't permission: a working login doesn't amount to authorization after employment ends, even if nobody disabled the account. Exceeding authorized access is a harder question. After the Supreme Court's decision in Van Buren v. United States (2021), the phrase means entering parts of a computer, such as a restricted database or section, that one's access does not extend to, and not misusing data that one is entitled to reach. A clerk whose login opens only the billing section but who alters a web address to reach the payroll section has exceeded authorized access, whereas an employee who looks up a neighbor's data in a database the job legitimately allows has not done so under the CFAA, although that snooping may still clearly violate workplace policy and ethics. Testing a service without authorization carries legal risk even with good motives.

Which leads to the form of hacking that's legitimate. Ethical hacking, or penetration testing, is testing a system's security with the owner's explicit permission and within an agreed scope. Authorization, not good intentions, is what separates it legally from a crime. Ethical hackers rely on a written agreement specifying scope and rules, or on a bug bounty's published rules, which give permission to anyone who follows them. They stop at the agreed boundary, even if a partner's system is one step away, and they report flaws privately and allow time for a fix, a practice known as coordinated disclosure. Students can build these skills legally by practicing on intentionally vulnerable sites on isolated networks.

Copy protection brings the two families of rules together, with a technological measure backed by law. The Digital Millennium Copyright Act (DMCA) prohibits circumventing technical copy protections, and it creates a takedown process that shields online services from liability if they promptly remove infringing material after notice. If a work is removed wrongly, its creator can file a counter-notice. Breaking copy protection raises a separate question from fair use: a teacher who could fairly show a film clip may still face a problem by bypassing a DVD's protection to get it, though exemptions exist, including some for educational uses.

Local rules: acceptable use#

Laws and licenses apply from outside; a school's day-to-day rules are its own. An acceptable use policy (AUP) sets rules for using an organization's technology. A school AUP generally covers school-provided devices, accounts, and networks, including a personal device on the school's network, and it applies to school laptops wherever they go. It generally doesn't reach a student's own equipment and connection at home, although other school rules may come into play if conduct affects the school. AUPs work best with specific examples and consequences. When a student breaks one, say by sharing a login, enforcing the policy is only part of the job. A policy states what's expected, and it falls to the teacher to follow its process and show the student a better way to share a project. Rules can't anticipate everything, and even when a practice is legal and permitted, there remains the question of whether it's right, which is the subject of 0001.g.

• FERPA: federal law protecting education records at schools receiving U.S. Department of Education funds
• directory information: designated student information that may be released if families had notice and a chance to opt out
• COPPA: federal law requiring notice and verifiable parental consent for commercial collection of data from children under 13, enforced by the FTC
• CIPA: federal law requiring filtering, monitoring, and an Internet safety policy at schools and libraries receiving E-rate discounts
• New York Education Law 2-d: state law protecting student data, and certain teacher and principal data, held by educational agencies
• GDPR: EU regulation giving people rights over personal data, such as access and erasure
• SHIELD Act: New York law requiring reasonable safeguards and breach notifications for residents' private information
• copyright: automatic protection for original creative works once fixed in a tangible form
• work made for hire: work created within the scope of a job, generally owned by the employer
• patent: protection for inventions such as methods
• fair use: limited use without permission, judged on purpose, nature, amount, and market effect
• Creative Commons (CC): licenses granting permissions in advance, with the terms BY, NC, SA, and ND
• free and open-source software (FOSS): software whose users get the source code and the right to modify and redistribute it
• copyleft: licensing, such as the GPL, that requires distributed modified versions to carry the same terms
• permissive license: licensing, such as MIT, that allows reuse in proprietary software with minimal conditions
• CFAA: main U.S. computer crime law, prohibiting access without authorization or exceeding authorized access
• ethical hacking (penetration testing): security testing with the owner's explicit permission and within an agreed scope
• DMCA: federal law prohibiting circumvention of copy protections and creating a takedown process
• acceptable use policy (AUP): an organization's rules for using its technology

Practice: practice questions for 0001.f

1. MWC2, Banjo app: a teacher portal case study, including requirements, components, and FERPA. ↩