When Riley Stratton was called into the principal’s office, school officials didn’t search her backpack or her cellphone — they searched her Facebook account.
A parent had complained to the school that her son and Stratton, who was in sixth grade at the time, had talked about sex on Facebook. In response, school officials questioned Stratton about the conversation and demanded she turn over her username and password; they searched her account, including Facebook messages and quizzes she’d taken on the social-networking site.
While school officials often say such searches are necessary to combat cyberbullying and other illegal activity, several lawmakers and free speech advocates argue efforts to regulate off-campus speech are an invasion of students’ privacy.
The American Civil Liberties Union of Minnesota filed a lawsuit in 2012 against Minnewaska School District on behalf of Stratton. The lawsuit was settled in March and, in addition to paying $70,000 in damages, the school agreed to change its policy regarding student privacy, according to documents filed with the U.S. District Court in Minnesota.
While technology and the way students communicate can change quickly, the law hasn’t always changed at the same pace, said Oamie Amarasingham, public policy counsel at the American Civil Liberties Union of Maine.
“Social media and other personal internet accounts are in a gray area,” Amarasingham said. “People have an expectation of privacy in the same way they would with their diaries or regular mail, but the law is not so clear.”
Currently, 12 states have laws that say school officials cannot require students to provide access to social media accounts, and in some cases email accounts and other forms of electronic communication. Louisiana and Wisconsin were the latest states to enact password-protection laws for students, both establishing their own versions in 2014.
Similar legislation has been proposed in 11 other states, but was unsuccessful. Nineteen states have laws that prohibit employers from requiring passwords from employees and job applicants.
Issue finds state-level support
In 2011, former Maryland corrections officer Robert Collins tried to obtain recertification for his job after taking a leave of absence. In the process, his boss asked for his Facebook username and password during a recertification interview.
Collins approached the American Civil Liberties Union of Maryland after the incident, and nearly a year later, Maryland became the first state to prohibit employers from requiring that their employees hand over social-media account information and passwords.
Following a burst of media coverage about the issue, social media privacy laws began to take off, said Jay Stanley, a senior policy analyst at the ACLU.
Sen. Ronald Young, a Democrat from Maryland, also tried to pass legislation that would have extended the law to students and schools, but the bill never made it to a vote.
However, Collins’ story and the new law in Maryland, along with multiple stories of student athletes having to turn over account information, sparked a slew of similar bills in state legislatures nationwide, said Ed Yohnka, Director of Communications and Public Policy at the ACLU of Illinois.
“The genesis of these laws came in a couple of things that coalesced together,” Yohnka said.
In Illinois, a password protection law for employees followed media coverage of the issue and constituents raising concerns to Rep. La Shawn Ford, a Democrat. It was his bill that inspired a similar bill protecting students, Yohnka said.
“When the employee bill was being debated, in the classic legislative process the topic of students was brought up,” Yohnka said. “As an advocate, it’s what you like to see because legislators involved themselves in the issue, they found other areas that they could legislate.”
Rep. Zachary Dorholt, a member of Minnesota’s Democratic-Farmer-Labor Party, sponsored a student password-protection bill in his state this year, but it never made it to a vote. But, Dorholt said he plans to pursue the bill again next session.
Dorholt said school administrators aren’t the only ones looking to access students’ social media accounts. In some instances, he said, teachers require students’ passwords as part of a school project or assignment. Regardless of the reason, however, it still disrespects the students’ privacy, Dorholt said.
“The student-professor relationship needs to have privacy,” Dorholt said. “Social media accounts are one way for a school staff member to gain access to unnecessary information.”
Rep. Ted James, a Democrat from Louisiana, said his bill, which became law last year, was a response to password-protection laws in other states, he said.
“I heard about the case in Michigan and I started to see what some other state legislatures were doing,” James said. “I had conversations with high school students in my state and the issue came up. We didn’t have a widespread problem in our state, but I wanted to be on the front end of this issue.”
Privacy, safety at center of debate
It is difficult to determine how often school administrators demand students’ social-media passwords, Amarasingham said, “because there is no legal recourse.”
“Since there wasn’t a law on the books,” Amarasingham said, “schools weren’t technically in violation of the law if they did it.”
But the issue became clear when school administrators expressed opposition to the law in Maine, she said. School officials argued the bill raised safety concerns.
During a committee hearing, Elaine Tomaszewski, associate executive director of the Maine School Management Association, said the bill would prevent schools from asking students or teachers for access to their social media or email accounts “when we believe a student is at risk of harm, or when a tragedy, like a school shooting, has occurred.”
While officials with the Wisconsin Association of School Boards didn’t oppose a law safeguarding job applicants’ social media accounts, the restrictions on access to students’ accounts brought some worry, said WASB Spokesman Dan Rossmiller.
“We did have a strong concern in the competing interests between privacy and protecting children,” Rossmiller said, adding that the law “could hamper schools’ ability to investigate student misconducts such as cyberbullying.”
Tomaszewski made a similar argument in her testimony, arguing that the legislation would make cyberbullying investigations very one-sided.
Rossmiller said that he didn’t see any reason school officials should be barred from asking for passwords in situations where there would be no penalty for the student providing access, or in other words, asking the victims of cyberbullying for access.
“It would be a different thing if we were asking the perpetrators of the misconduct,” Rossmiller said.
However, Amarasingham said that that giving administrators the right to access students’ social media accounts not only compromises that student’s privacy, but also the privacy of anyone they communicated with.
“To give schools carte-blanche power to say, ‘someone accused you of something, we need to see your account,’ compromises every aspect of that student’s privacy,” Amarasingham said.
Stanley, the ACLU policy analyst, said people have an expectation of privacy when it comes to their personal internet account passwords.
“I think there is a belief that it would be beyond the pale,” Stanley said. “If administrators shouldn’t be allowed to ask to read diaries or listen into private conversations of students to all of their friends, they shouldn’t be allowed to do the electronic equivalent of that.”
While many of the laws prohibit officials from asking or requiring access to accounts, they don’t prohibit students from printing out copies of messages or posts they’ve received, or willingly showing them to official.
Password-protection laws shouldn’t be viewed solely as a way to take away power from schools, said Bradley Shear, a Maryland-based attorney who specializes in social media law and helped write the Maryland law. While they do protect students from having to turn over passwords, they also take some of the burden off schools that feel they have to monitor everything.
“The goal of this legislation was to protect students and employees but it was also to protect schools and employers,” Shear said. “If schools don’t have the legal duty to scan this stuff, then they can’t get in trouble for not doing it. It works as a legal liability shield. My whole idea was to create legislation that was a win-win for both sides.”
Shear said that ultimately, the way to improve students’ behavior on the internet is through education, not monitoring their accounts.
“You have new technologies where educators and school districts can’t control them,” Shear said. “When you don’t know about something, you try to control it.”
Vermont’s password-protection bill failed after being proposed in 2012, but the issue will probably rise again in the coming years, said Dan Barrett, staff attorney at the ACLU of Vermont.
Barrett said that as schools battle cyberbullying, there is an overall concern that school administrators try to be online police. While educators need to address concerns of cyberbullying, they shouldn’t be overstepping their bounds, Amarasingham said.
“It doesn’t make sense for schools to have access to things that the police would need a warrant for,” Amarasingham said.
High-schoolers not protected
While password protection laws are a step in the right direction, not all of them protect every student, Yohnka said.
Currently, more than half of student password-protection laws only protect college students, leaving younger students vulnerable.
“I find it troubling that we are not extending these same protections to high school students,” Yohkna said. The feeling of “being watched or controlled” in high school, he said, “is not good for society as a whole.”
Yohnka said that if state legislators in Illinois proposed legislation protecting younger students, it probably wouldn’t garner the same level of support that the other bill, which provided protection for college students.
“Too often there is this idea from parents that we have to rein in students,” Yohnka said.
But allowing the persistence of policies that violate students’ privacy can send the wrong message, Barrett said.
“When you subject young people, our future voters to situations of pervasive surveillance, you habituate them to the idea that their expression is going to be constantly monitored,” Barrett said, “That gives them the message that Americans don’t question their government.”