When a student searched a keyword, looking for a school assignment on their Google Drive, an entirely different document appeared: a spreadsheet containing confidential information from the San Mateo Union High School District (SMUHSD).

The spreadsheet, according to the student who viewed it, appeared to detail aspects of the district’s address verification procedures, including what they described as surveillance tactics used to confirm whether students lived within district boundaries.

“Students had been classified under three different classes, and what I saw on the third tab [of the spreadsheet] was private investigators either following kids around or looking at specific cars, marking down the license plates and going to the address that the student had provided and verifying that address,” one student who viewed the document said.

Once the anonymous student discovered the document, they showed it to several of their classmates, and eventually their teacher, who informed the district office that the spreadsheet had been shared.

In response, the Burlingame High School administration began an internal investigation.

“We received a notification from the district office that students had accessed an area that is not meant for students to access, and we were asked to follow up and just determine whether or not those students had copied or kept any information that they had received from that site,” Interim Assistant Principal Barry Tyler said.

According to anonymous sources, the spreadsheet appeared to contain information about an identity and address verification process used by the district to investigate potential enrollment fraud — a practice in which families use false addresses to gain access to schools in more sought-after districts.

Enrollment fraud is an issue school systems across the country regularly confront. Some districts, including SMUHSD, hire “Enrollment Center Investigators” for the purpose of investigating potential enrollment fraud. Several districts record dozens of cases of enrollment fraud every year, such as the San Francisco Union High School District, which recorded 53 cases from 2017 to 2018. These investigations are usually implemented to ensure students attending schools actually live within the correct area to be zoned for that school.

“There could be a myriad of reasons for the district needing to know if a student and family’s address aligns with the information that’s being provided,” Tyler said. “Sometimes, it requires the district to do a little due diligence and research and find out if the information that’s being provided is accurate.”

During the course of the investigation, students who were interviewed by administrators said they had accessed the spreadsheet unintentionally. According to their accounts, the document appeared in their Google Drive search results and could be opened by anyone within the district.

“Anyone who finds the link can open this document, so it appeared that the link to the Google sheet was shared to the whole organization, which is why it would come up,” another anonymous source said. “[The student who first accessed the spreadsheet] showed it to me on [their] computer, and I typed in one keyword and it came up on my Google Drive as well.”

While in the office, students and a member of the administration reportedly also had a conversation with their parents regarding the incident, a process some students found upsetting.

“When [Tyler] spoke with my mom, he almost portrayed me as a kid who wasn’t up to any good,” the anonymous student said. “He was stating how I accessed a portal with a bunch of private student information, when in reality it was a document that the school had made public on their fault.”

Tyler said that calls to parents were meant to provide details about the incident, and were not considered “punitive corrective action.”

“The phone call home was to notify the parent of the nature of the concern, why the student had been brought in, why the student had been questioned, and why the student had their account suspended,” Tyler said.

The anonymous student said that they and some of their peers, who also gained access to the document, lost access to their Google accounts. According to Tyler, students had to speak with school technology staff in the student union to restore their access. During this time, students also reported that the document was removed from their Google accounts.

“After I left the office a second time, I had gone home and my Google account was completely locked,” the anonymous student said. “There are specific resources that I use to help me with my studying, like online textbooks or online resources that I could use for math which I was unable to access from my school account.”

The anonymous source eventually regained access to their account with the assistance of one of their teachers, but they said that for some of their peers, it took significantly longer to regain their account access.

“My fellow peers told me that they had been locked out of their accounts for three to four days,” the student said. “They’d gone to administration multiple times, and the administration had practically told them an excuse…they didn’t really get any support to get back into their Google accounts.”

Shortly after the incident, the district sent an email to all staff members emphasizing the importance of ensuring documents are only shared with authorized viewers. It contained instructions on how to check if documents are securely shared.

In order for documents to appear in the Google Drive search results, documents need to be set to “anyone in the San Mateo High School District can view” and “Can find in search results” in their share menu. As of March 27, several district spreadsheets containing personal teacher and student information remain accessible to any SMUHSD Google account.

Tyler said that the incident was accidental and doesn’t warrant any major policy changes.

“I don’t think this is a policy related issue. I think the policies that currently exist are still the same. I think this is an instance in which something that was meant to be secure, accidentally was left unsecure,” Tyler said. “There’s not any new policies to say we’re going to do dot, dot, dot. There’s just the policy that currently exists and the effort to make sure that folks are diligent about securing documents that are meant to be secured.”

The student who first accessed the spreadsheet expressed frustration with how the district handled the incident.

“It felt like they were really trying to find any simple reason to blame this matter on students rather than taking accountability,” the anonymous student said.

Although the document’s sharing settings had mistakenly allowed students to view information they were not authorized to see, Tyler reaffirmed that the school is committed to ensuring students’ privacy.

“At any time a misstep can happen, or at any time there can be a specific glitch, but the intent and the privacy and the focus to protect the privacy of a student is always of the utmost importance,” Tyler said.