Jumping into the Cloud_ Privacy Security and Trust of Cloud-Base

Chapter 1 – Introduction

“When I think of the Cloud, I think of the high desert in eastern Oregon or Washington. Very rural,

there's nothing else there, there's very little industry, and it's just very cheap land. There's this huge

storage facility for people to, or that Google, or Apple, or whatever they use. They have [these] supercomputers

and are cooling them. They're affecting our environment. They are allowing people to access data that's

stored in those sites from different phones, or computers, or iPads, or Kindles, or whatever it is.”

(A Faculty member’s perception of the Cloud when asked “What is the Cloud?”)

Purpose of Study

The purpose of this study is to gain a deeper understanding of how public, K-12 faculty

view Cloud-based

computing, how they perceive issues of privacy, security, and trust (PST)

when using Cloud-based systems in schools, and what differences, if any, exist between their at-

home use of Cloud-based computer systems and their use of these and similar systems at work.

Before exploring the problem statement, research questions, and design, this study will provide a

brief introduction of Cloud-based computing, also commonly referred to as the Cloud,

to ensure

that this study begins with a firm foundation of understanding.

Introduction to Cloud-based Computing

Cloud-based computing is revolutionizing how we compute, communicate, collaborate,

and access information. In simple terms, the Cloud is “the use of common software, functionality

or business applications from a remote server that is accessed via the Internet" (Gupta, 2012, p.

325). The Cloud is a metaphor for an elastic computing

platform that includes, though not

Throughout this study, “Cloud-based services and applications” are defined in broader terms as a software

program. To assist with making this research easier to read, “Cloud-based services and applications” and “software”

are referenced as “Cloud programs,” “Cloud-based programs,” or simply as “programs.”

Throughout this study, "the Cloud" as well as "Cloud computing" and “Cloud-based” are terminology used

interchangeably to reference a Cloud, or virtually based computing infrastructure as defined by various

technologists, academics, and governmental agencies such as the National Institute of Standards and Technology

(NIST).

Elastic computing is a concept in Cloud computing in which processing power, storage, and bandwidth can be

scaled up and down by a service provider, on-demand. To the consumer, “the capabilities available for provisioning

often appear to be unlimited and can be appropriated in any quantity at any time” (Mell & Grance, 2011, p. 2).

limited to, servers, hosted applications, and services connected by the Internet, allowing

connectivity by various devices ranging from smartphones and tablets to laptops, stationary

computers, and Internet accessible devices.

A 2009 study by the global management consulting firm McKinsey found that there are

22 possible separate definitions of Cloud computing (Powell, 2009; Sultan, 2010). In fact, no

common standard or definition for Cloud computing seemed to exist (Grossman, 2009; Voas &

Zhang, 2009) until 2011, and although this definition has been accepted within the context of

Information and Communications Technologies (ICT) and general computing within U.S.

governmental agencies, it still remains an optional definition

open to interpretation and debate

outside these organizations. Nevertheless, millions of people access Cloud-based services and

applications daily for work, pleasure and personal productivity, checking email, collaborating

with colleagues, friends and family while social networking, video streaming, online banking

and shopping. In many cases, users do not even know that they are accessing the Cloud as it has

become such a ubiquitous and seamless facet of nearly every daily routine.

The Cloud’s growth continues well beyond forecasters’ expectations, accelerated by the

explosive growth of mobile technologies and users’ needs for digital content. An article in

Forbes Magazine details the Cloud’s profound growth, noting that, “cloud computing spending is

growing at 4.5 times the rate of IT spending since 2009 and is expected to grow at better than 6

times the rate of IT spending from 2015 through 2020” (Columbus, 2017, p. 2). The Center for

the Digital Future at University of Southern California has correlated the Cloud’s growth to the

amount of time users spend online, detailing that, “the average number of hours that users go

The U.S. Department of Commerce, Computer Security Division in September 2011 released the National Institute

of Standards and Technology (NIST) Special Publication 800-145 establishing a definition of Cloud computing.

However, as the authors note, “This guideline has been prepared for use by Federal agencies. It may be used by

nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired”

(Mell & Grance, 2011).

online has reached a new high- now 23.6 hours per week (page 6) [2016] – almost an entire day

per week and more than double the 9.4 hours reported in 2000 (a time when regular internet use

was already the norm)” (Cole et al., 2017, p. 143).

The Cloud’s integration goes far beyond what users can expect or even imagine. While

the Cloud is most commonly associated with online digital storage, productivity suites, social

media and streaming services, many users do not associate the Cloud with countless other

services and applications that go well beyond email, Facebook, Netflix, YouTube and Google

Docs. The Cloud plays a critical role in wide-ranging applications and services from browsing

the Internet to the Internet of Things

(IoT) including E-ZPass, Global Positioning Systems

(GPS), medical telemetry, big data analytics to earthquake and tsunami detection systems,

driverless cars and, not far in the future, the conversion of computer heat waste

into a viable

heating alternatives for homes, apartments and the workplace.

The Cloud has become such a significant part of 21st-century society that a major

provider

outage would grind daily activities and productivity to a halt, significantly impacting

one or more sectors of communications, transportation, manufacturing, banking, retail,

emergency services, and public utilities potentially escalating into civil unrest. Two massive

outages involving Amazon’s Web Services data centers, one in February 2017 and then in March

2018, disrupted services and applications for hundreds of thousands of clients including banking

The Internet of Things (IoT) is the extension of Internet connectivity beyond traditional computing and

communication devices to include items embedded with technology that allows connectivity to the Internet

(Osseiran, Elloumi, Song, & Monserrat, 2017; Paul & Saraswathi, 2017). The growth of IoT will generate an

unprecedented amount of data that will need to utilize scalable Cloud-based applications and services.

Data centers, also referred to as server farms, generate immense amounts of heat, byproducts of computers and vast

servers processing information. For more than a decade, data centers around the world have been recycling heat,

pumping it to nearby residential areas and offices as an alternative and viable energy source.

Some of largest Cloud service providers in 2017 include Microsoft, Amazon Web Services, Google, Oracle,

Salesforce and IBM according to Cloud analysts (Darrow, 2017; B. Evans, 2017).

giant Capital One, Zillow, Slack, GitHub and even rendering Amazon’s Alexa unable to answer

voice queries (Swearingen, 2018; Weise, 2017).

As crippling as a major outage would be, the Cloud is not without benefits. Our twenty-

first century information society is hungry for digital content and increasingly dependent on the

Cloud for the delivery of a wide range of digital content, applications and services. The Cloud

seamlessly delivers this content in a similar manner as public utilities such as electric, water, gas

and telephone, which has led many researchers to envision it as a fifth utility. A paper presented

at a 2009 Cloud computing conference, Cloud Computing and Emerging IT Platforms,

highlighted the importance of the Cloud for the continual growth of society and the workplace,

noting that this fifth utility is “like all other four existing utilities, [and] will provide the basic

level of computing service that is considered essential to meet the everyday needs of the general

community” (Buyya, Yeo, Venugopal, Broberg, & Brandic, 2009, p. 599).

While the Cloud has become a significant part of twenty-first century digital society, it

has also become a very “bad” metaphor for the Internet. This “bad” metaphor – using the Cloud

interchangeably with the Internet – evolved “around 2010, [when] casual Internet users were

introduced to the idea that the digital world around them could be understood in terms of the

“cloud” (Hsu, 2015, para. 2). Internet users were introduced to the notion that digital content was

somewhere in the ether, floating, contained in a virtual bubble, and easily accessible through a

wireless connection were introduced. This is not the case since the Internet is actually part of the

bundle of information and communication technologies (ICT) that makes up the Cloud. The

Internet

plays a significant role in ICT as the enabling infrastructure of the Cloud, a backbone –

serving as a crucial networking conduit by connecting data centers from around the world. These

The Internet can be “wireless,” which includes Wi-Fi, satellite, microwave and cellular conduits and “hard wired”

which is a physical wired network that can be modem based cable or Digital Subscriber Line (DSL). The Internet is

commonly a hybrid of wireless and wired networks.

data centers are far from being virtual bubbles somewhere in the ether. There are thousands of

brick and mortar data centers, former mines, bomb shelters and even floating barges

that house

massive servers, routers and network attached storage units along with numerous other

information and communication technologies that make up the Cloud. The Cloud itself is also a

misnomer, an inaccurate label for physical technologies and networked computing devices firmly

grounded on the Earth. However, the Cloud evokes imagery of soft and puffy shapes in the sky

that are continuously changing as part of weather fronts. The Cloud is also a wonderful

marketing oxymoron because it is a misnomer, branded as a naturally occurring object, yet man-

made, with each user interpreting it differently. When we talk about "the Cloud," we are not

talking about mist-like data hanging out in the ether, but massive computer servers, powered by

generators, cooled by air conditioners, and stored in warehouses (Rosen, 2011, p. 30).

The idea of using the figure of a cloud to represent information and communication

networks dates as far back as the 1920s. However, it was not until “the 1950s when AT&T

presented schematics of an ‘electronic “skyway”’ – a series of microwave relay stations in

conjunction with the first cross-country television network” (Hu, 2015; Teicher, 2015). By the

late 1970s, the figure of a cloud became commonly associated with communication networks,

spurred by developments in what eventually became the Internet. The figure of the cloud had

emerged to depict complex communication networks, especially ones – like the telephone or

Internet – where information traveled along unpredictable circuits (Hsu, 2015, para. 2). The

backbone of the Cloud is made of these “unpredictable circuits,” hybrid data conduits

Large remote mines, bomb shelters, and even missile silos are commonly used as data centers due to their seismic

stability, natural cool temperature control and security. See https://www.computerworld.com/article/2526002/it-

management/data-centers-go-underground.html. Floating barges and decommissioned vessels are also used as data

centers as water is easily accessible for cooling servers and hardware. See https://datacenterfrontier.com/nautilus-

data-barges-ahead-with-floating-data-center/ or https://www.computerworld.com/article/2485501/data-center/coast-

guard-spills-the-beans-on-google-s-mystery-barges.html.

transferring information between the Internet and computers, network-attached storage servers

and Internet-capable devices as shown in Figure 1.1.

Figure 1.1. Overview of the Cloud. Source: Erik Bennett

Background of the Study

Cloud-based computing significantly drives the digitalization of our twenty-first century

society. The Cloud has fostered a multitude of new business models – such as AirBnB and Uber

– that were mere conceptualizations less than two decades ago. Consumers and businesses alike

have made a ubiquitous and seamless transition to the Cloud, lured by digitally- native services

and applications ranging from Amazon to Zelle. Other businesses “moved to the Cloud out of

necessity as traditional business models have already migrated due to a need for data

centralization, network infrastructure scalability, and an overall reduction of ownership and

service costs while allowing for 24/7 accessibility” (González-Martínez, Bote-Lorenzo, Gómez-

Sánchez, & Cano-Parra, 2015; Vouk, 2008; Weber, 2013). Although Cloud computing does have

drawbacks, three important features continue to draw potential users to the Cloud: scalability,

remote accessibility and overall cost savings. As noted by Vouk (2008), “Cloud computing is the

next natural step in the evolution of on-demand information technology services and products”

(p. 235).

K-12 education and the cloud. Public K-12 schools also recognize the same benefits as

the private sector, namely that the Cloud offers significant cost savings, computing scalability,

and secured remote accessibility, as well as tremendous collaborative possibilities. As Gupta

(2012) noted, “educational institutions are under increasing pressure to deliver more for less, and

so they must find ways to offer rich, affordable services and tools” (p. 325). Budgetary

constraints, and the need for scalable computing environments, make the Cloud an optimal

solution for the education sector. Cash strapped school districts are looking for ways of lowering

operating expenses and migrating to the Cloud as it offers significant cost savings. The need to

cut state and district education budgets across the country forces school administrators to find

cheap, yet effective, ways to educate their students (G. Chen, 2010, para. 1). The Cloud offers

school districts a cost-effective and scalable solution over fixed, traditional “in-house”

computing infrastructures (G. Chen, 2010; DeNisco, 2015; Weber, 2013). Schools can then

significantly reduce costs by outsourcing physical servers and storage devices, as well as

software and technical support. This in turn reduces maintenance costs while providing enhanced

remote access, collaboration, and greater freedom for students and faculty.

K-12 education privacy, security, and trust. As school technology directors and

administrators increasingly embrace the Cloud, they are also growing more cautious toward

concerns about legalities not yet fully explored. Policymakers, educators, and legal analysts are

debating the role of the Children’s Online Privacy Protection Act (COPPA) enacted to protect

children from cybercrimes and the Family Educational Rights and Privacy Act (FERPA) enacted

to protect the privacy of the education records of students (Cascia, 2012; Gasser, Solow-

Niederman, & Nolan, 2013; Weber, 2013). Because the Cloud, by design, allows multiple parties

to store and share data among themselves, and in many cases outside of the originating state and

even federal jurisdictions, COPPA and FERPA are less meaningful. Although FERPA and

COPPA govern the privacy and security of student data, trust relations concerning how student

data are stored, maintained, and used by third parties is an area of growing concern, since

according to Cascia (2012), “notions of privacy are changing in today’s society and laws

covering relating to online privacy as it is in a state of flux. It is important that schools stay

current with the changes to laws to avoid litigation and loss of funding” (p. 2).

Cloud-based computing is also drawing concerns in the education sector due to the

privacy, security and trust (PST) of student data. Nearly all American public schools use one or

more Cloud-based services and/or applications for a broad range of tasks, from email to student

information management. The number of school districts that migrate to Cloud-based services

will continue to grow out of necessity as applications and services continue to move to the Cloud

to reduce operational costs, as well as streamline access and scalability. A 2016 ISTE

Conference presentation noted that K-12 IT solutions “delivered fully or partially via cloud was

at 42% in 2014 growing to 67% by 2016 and that in three years, IT pros expect this number to

reach 74%” (CDW-G, 2016). Cloud researchers and school technology directors assert that the

three greatest Cloud concerns for the education sector, according to McMahon (2016) includes,

“data breaches; insufficient due diligence when reviewing vendor/school contractual agreements;

and, failing to educate users on the risk of cloud applications” (para. 6). The last of the three

points, noted by McMahon (2016) “failing to educate users of the risk of cloud applications,” is

at the center of this study.

Statement of the Problem

Cloud computing has become the ICT infrastructure backbone of the education sector;

however, many users do not realize the potential pitfalls of the Cloud. As Ramnarine-Rieks,

McKnight, and Small (2011) observe, introducing, “any new generation of learning technology

brings new conceptual issues that learning technologists must untangle in order to unlock the

learning value of raw technological potential” (p. 2). The education sector exacerbates two

known issues of the Cloud, especially with consideration to student data, which are at the core of

this study and embedded in the research problem.

The first issue is the lack of a specific and coherent definition of Cloud computing within

the education sector. While a number of definitions of the Cloud have always existed in varying

forms and contexts, there has been a lack of a coherent universal definition of Cloud computing

until 2011. This has made it difficult for school administrators to formulate policies, guidelines

and professional development on Cloud-based computing, applications and services. The

ambiguous definition of Cloud computing also muddies users’ confidence and understanding of

the Cloud. For this research, the now universally recognized definition of Cloud-based

computing, defined by the National Institute of Standards and Technology (NIST) is “a model for

enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable

computing resources that can be rapidly provisioned and released with minimal management

effort or service provider interaction” (Mell & Grance, 2011, p. 2).

If users lack a clear understanding of the Cloud, how are they ever to understand its

drawbacks? When a school district implements a new generation of technology, such as the

Cloud, it is important that users, in this case faculty, have both an accurate understanding of the

system as well as a high level of confidence using that system. For many teachers, as Ertmer and

Otten breit-Leftwich (2010) note, “possessing the relevant knowledge, confidence, and beliefs is

enough to empower them to integrate technology into their classrooms in meaningful ways” (p.

264). Therefore, faculty need to understand the technology at hand (i.e., the Cloud), how it is

defined, what it is, and how using it provides all stakeholders with improved and effective

collaboration platforms as well as new instructional and curricular possibilities. Stakeholders

must comprehend the attributes of effective implementation of new technologies such as the

Cloud, including faculty members’ level of readiness for implementation as well as their fears,

preferences, teaching styles, and passions (Diaz, 2011; Marzilli et al., 2014).

This lack of a specific and coherent definition has led to the second issue: the perception

of PST with regard to the storing, transmission, and dissemination of student data between

second and third parties. PST concerns are already high for consumers adopting Cloud

computing (Aitenbichler et al., 2009; Svantesson & Clarke, 2010), and are significantly elevated

with regard to student data. Concerns are further heightened by how increasingly intertwined

social media and virtual learning environments have become with public and third-party Cloud

applications such as Facebook, Twitter, Google+, and privately hosted blogs on third-party-

hosted Cloud platforms. Of particular concern, as suggested by Weber (2013), is “the merging of

social media and virtual learning environments with personally identifiable data that are stored

on off-site computers” (p. 19).

While school districts urge faculty to integrate Cloud-based services and applications into

the classroom, many faculty sign up on their own for third-party applications and services.

Without proper knowledge of the Cloud, and how it seamlessly integrates with other applications

and services, faculty are putting student data at risk, sharing it with multiple parties and

compromising data integrity. In many instances, teachers introduce non-district purchased Cloud

applications to personalize lessons. In doing so, teachers are unknowingly allowing for possible

data breaches which can even circumvent federal privacy laws such as FERPA and COPPA

(McMahon, 2016; Singer, 2015). New York Times Technology reporter Natasha Singer (2015)

has written extensively about the Cloud in the education sector and discusses these dangers,

noting, “teachers are typically not equipped to vet the data-handling practices of free educational

apps that may collect details as diverse as students’ names, birth dates, profile photos, voice

recordings, homework assignments, quiz scores or grades” (Singer, 2015, para. 18).

The purpose of this study is to gain a deeper understanding of how faculty view Cloud-

based computing, how they perceive issues of privacy, security, and trust when using Cloud-

based systems in schools, and what differences, if any, exist between their at home use of Cloud-

based computer systems and their use of these and similar systems at work.

Research Question

To further the understanding of Cloud-based computing in the context of K-12 public

education, three research questions are asked:

1. How do school faculty and administrators understand the concept of Cloud computing

as used in K-12 public education?

2. How do faculty and administrators perceive the issues of privacy, security, and trust

(PST) as related to Cloud computing?

3. How may perceptions of PST differ when completing school related tasks as compared

to personal, non-work related tasks?

Research Design

This study utilizes a multiple case design to address these research questions. Three

districts located in Westchester County, New York, were chosen: the Pelham Union Free School

District, Tuckahoe Union Free School District, and the Hendrick Hudson Central School. These

districts were selected based on their willingness to participate. This is a critical and growing

issue in education research as many districts are hesitant to allow research by a second party.

There is the potential for liability, even with safeguards in place, such as those provided the

oversight of university institutional review boards. In this time of public accountability, it is

increasingly difficult to get school administrators to agree to have their districts used for external

research. Typically, intended research must be in specific alignment with the district’s goals, not

duplicative or unnecessarily burdensome to faculty and even formally submitted to the district

upwards to one year before the research is to take place.

Of particular importance for inclusion in this multiple case design is that all three districts

share the commonality of being G Suite school districts, and as G Suite schools, all three use the

Google Cloud platform as their primary productivity suite for teacher, student, and parent

collaboration and communication. The three districts also share a number of commonalities,

including the use of similar Cloud-based Learning Management Systems (LMS) and Student

Information Management Systems (SIMS) as well as other similar Cloud-based applications and

services. All three districts are relatively small in comparison with other Westchester County

districts while sharing similar faculty gender ratios and student racial and ethnic compositions.

Table 1.1 presents introductory demographic information for each district. Data collection used a

mixed methods that includes online surveys, semi-structured interviews, and non-participant

observations and document analyses.

Table 1.1. District Demographics

HHCSD

PUFSD

TUFSD

2015 – ‘16

2014 – ‘15

2015 – ‘16

Student Enrollment1

2366

2810

1099

Levels

KG–12

Faculty1

212

227

Student/Teacher Ratio1

11.59

12.8

13.8

Avg. Total Teacher FTE1

204.17

219.59

77.55

% w MA + 30 Hr or

Doctorate1

52%

62%

51%

Teacher Turnover Rate1

14%

% Gender (Faculty)2

(Male)

(Female)

27%

73%

27%

73%

16%

84%

%Race/ethnicity (Faculty)2*

(Black/African American)

(Asian)

(Hispanic/Latino)

(White)

96%

95%

90%

Median Salary (Faculty)2

(Not incl. part time)

$115,000

$119,092

$110,576

Locale2

Suburb

Large (21)

1 The Common Core of Data (CCD), Public school district data for the 2015-2016, 2016-2017 school years.

Retrieved from the National Center for Education Statistics; https://nces.ed.gov/.

2 Gender, Race, and Median Salaries retrieved from New York State Education Department, Information and

Reporting Services Personal Master File BED; http://www.p12.nysed.gov/irs/pmf/home.html.

* Use of data from 2016-2017 for Ethnicity.

Theoretical Framework

The theoretical framework for this study, as shown in Figure 1.2, utilizes an adaption of

F.D. Davis’s 1989 Technology Acceptance Model (TAM) which "is the most widely applied

model of users' acceptance and usage” (Venkatesh, 2000, p. 343). This extended version of TAM

places an emphasis on four variables that play a significant role in determining the faculty’s

understanding of the Cloud, its use, and concerns of PST. The first of these variables involve the

lack of a cohesive and uniformly recognized definition of the Cloud in public education—how

this possibly undermines an understanding of Cloud computing within the context of public

education. The next three are the symbiotic variables of PST that have a significant effect on a

district’s implementation and users' acceptance of the Cloud as a realistic option and a

progressive natural next step for the public education sector.

Figure 1.2. Extended version of TAM. Source: Erik Bennett

The first (external) variable is the definition of the Cloud, which has a direct influence on

determining the Perceived Usefulness (PU) and Perceived Ease of Use (PEoU) as well as the

Behavioral Intention to Use. The second variable is an amalgamation of three symbiotic

variables (e.g., privacy, security, and trust) which have more bearing on the PU determinant than

on the PEoU, and more directly on the Attitude Toward Using determinant, since lower

confidence levels will adversely affect districts’ and users’ attitudes towards implementing a

Cloud-based solution. This theoretical framework assists in revealing the interrelated

underpinnings that influence a user’s understanding of the Cloud and perceptions of PST.

Significance of the Study

This study’s data and findings add to the limited quantitative data on Cloud computing

within the public K-12 education sector, specifically addressing the ways faculty understand the

Cloud and perceive the issues of PST as related to student data and their own data when

accessing the Cloud at home. While much has been written on the Cloud in the last 20 years, it is

difficult to give a realistic account of papers, conference proceedings, and other formats of

research. However, overall interest and scholarly research on the Cloud continues to increase. A

search of Google Scholar,

using the search string “Cloud computing" AND “applications" OR

"security" yielded more than 49,000 results with a filtered date range of two years (January

2016-December, 2017). The same search over a two-year span (January 2018-December 2019)

yielded over 72,000 results. Academic publishers have also begun to publish journals specifically

targeting research on Cloud-based computing. Springer International has branded SpringerOpen

which, in 2012, launched the peer-reviewed Journal of Cloud Computing (JoCCASA), spanning

research on all aspects of Cloud computing with particular principles “focused on core elements,

including Cloud applications, Cloud systems and the advances that will lead to the Clouds of the

future” (SpringerOpen, 2012, para. 1). Additional open-access journals founded after 2010

include the International Journal of Cloud Computing (IJCC) and the International Journal of

Cloud Computing and Services Science (IJ-CLOSER), both of which, similar to JoCCASA,

focus on recent research on the Cloud and related technologies and advancements.

However, Cloud computing has been less studied within the public K-12 education

sector. Using Google Scholar, the search string “Cloud computing" AND “education" yielded

A Google Scholar search was conducted January 2, 2019, to show relative findings of the various search strings

noted. The findings are subjective and can change based on a number of variables including frequency of Google

queries and the relativity of terms to the search string as influenced by similar queries and includes the search of

only citations.

more than 23,000 results over a five-year range (January 2013-December 2017). Numerous

studies analyze the broader advantages and disadvantages of Cloud computing for schools, such

as the potential to reduce costs while fostering much needed scalability and user collaboration

possibilities (González-Martínez et al., 2015; Sultan, 2010; Weber, 2013; Wu & Huang, 2011),

but a relatively smaller number of studies have examined PST issues within the context of public

education. Cloud computing, as with any other technology, is dynamic and continuously

evolving as well as that of related technologies. This study will assist educational administrators

and technologists in understanding the benefits that the Cloud has to offer beyond cost and

scalability and, of greater importance, the Pandora’s Box that will be opened if the issues of PST

are not addressed.

Limitations of the Study

The focus of this study is to investigate how the Cloud is defined and understood within

the public education sector, with a further focus on educators’ perceived understandings of PST.

Caution is necessary when using this study to make generalizations since the Cloud is a scalable

technology continuously in flux. Consequently, a limitation of this study is educators’

understanding of the Cloud and their perceptions of PST. Knowledge and expectations of the

Cloud evolve alongside related technologies, and Cloud-based applications and services are

proliferating continuously. In other words, as articulated by Zhang, Cheng, and Boutaba (2010),

“despite the fact that cloud computing offers huge opportunities to the IT industry, the

development of cloud computing technology is currently at its infancy, with many issues still to

be addressed” (p. 7).

Further limitations include (a) The data collection was within a “regional” sample of

three districts within a 50-mile radius of each other located in the same county of Westchester,

New York. Because of the close proximity of the cases, findings are not generalizable on a larger

scale due to mitigating regional differences. (b) The accuracy of responses elicited through an

online survey are questionable because of the interchangeability of technology terminology.

Examples include, the Cloud and the Internet as well as the differentiation between what is

privacy or “private” and security and “secure” in terms of computing. (c) The possible lack of

truthfulness of participants due to the risk of embarrassment for lacking necessary knowledge.

(d) Accuracy of responses elicited during semi-structured interviews. An interviewee may

“exaggerate” knowledge of the technology being discussed to sound “technologically” current.

(e) Temporal validity considering the completion of the online questionnaire and interviews over

one academic year (2016-2017), while vendors have been increasingly marketing the Cloud on

television and the Internet, such as Microsoft Cloud and Amazon Web Services (“Build on

AWS”). (f) While all three districts use G-Suite, each district customizes the suite’s interfaces,

creating a unique “look and feel” which can influence functionality and end-users’ perceptions of

PST between districts.

Definitions of Terms

The researcher chose to define the following acronyms and terms that are not general

knowledge. This study’s preface includes acronyms not found below. The terms of privacy,

security, and trust are comprehensively defined in later chapters.

CIPA. The Children’s Internet Protection Act (2000) is a federal law enacted by Congress to

“address concerns about access to offensive content on the Internet viewed on school and

library devices” (Cascia, 2012, para. 12). Under CIPA, schools and libraries are required

to implement an Internet safety policy addressing: (a) access by minors to inappropriate

content on the Internet; (b) the safety and security of minors when using electronic mail,

chat rooms and other forms of direct electronic communications; (c) unauthorized access,

including so-called “hacking,” and other unlawful activities by minors online; (d)

unauthorized disclosure, use, and dissemination of personal information regarding

minors; and (e) measures restricting minors' access to materials harmful to them (FCC,

2015, p. 1).

COPPA. The Children’s Online Privacy Protection Act (1998) is intended to protect children

“from cybercrimes, including crimes by online predators, and to help parents shield their

children under the age of thirteen from material that is inappropriate” (Cascia, 2012, para.

9). COPPA applies to operators of both commercial websites and online services directed

at children under the age of 13 as well as general audience websites or online services

with actual knowledge that they are collecting, using, or disclosing personal information

from children under 13 (Federal Trade Commission, 1998). Most importantly, COPPA

requires that commercial operators of websites and online services obtain parental

consent before undertaking such activities. COPPA applies to educational Cloud

providers, as students under 13 years of age can access their products (e.g., websites and

digital media).

FERPA. The Family Educational Rights and Privacy Act (1974) protects the privacy of student

education records both written and in a digitized format. This student data is contained

within a range of written and electronic records—generally, anything that is “considered

‘personally identifiable information’ in an ‘education record,’ including emails and other

communications or documents created by students, teachers and administrators”

(Mutkoski, 2014, p. 519). FERPA applies to all schools that receive funding under any

program administered by the U.S. Department of Education.

PII. Personally identifiable information, is defined in FERPA as: “identifiable information that is

maintained in education records and includes direct identifiers, such as a student’s name

or identification number, indirect identifiers, such as a student’s date of birth, or other

information which can be used to distinguish or trace an individual’s identity either

directly or indirectly through linkages with other information” (USDOE, 2015, para. 1).

Summary

This chapter provides a brief overview of the Cloud to ensure a firm foundation of

understanding. This study then presents an overview of the researcher’s interest in understanding

how faculty may view Cloud-based computing, how they may perceive issues of privacy,

security, and trust when using Cloud-based systems in schools, and what differences may exist

between their at-home use of Cloud-based computer systems and their use of these and similar

systems at work. Chapter Two offers an overview of literature related to Cloud-based computing

and the issues of PST while also providing insights into the theoretical framework chosen to

rationalize the study. Chapter Three presents a detailed description of the research design,

including an annotation of the participating school districts (cases) and faculty. Chapter Three

also provides the background of the methodology, the methods of data collection and analysis,

and details in regard to the instrumentation used for this study. Chapter Four includes a more in

depth presentation of the results of the research discussed in Chapter Three. This will include a

detailed analysis of the data and an interpretation of the findings that will link to the research

questions. Chapter Five provides a summary of the research, its limitations, and implications for

further research. This study provides educational administrators and educators with a practical

examination of Cloud computing supported by theoretical underpinnings.

Chapter 2 – Literature Review

A cumulus Cloud filled with 0 and 1… Remote server that holds information online. You have access to this

information regardless of your location, so long as you can log into the site that serves as "the Cloud"

(Faculty member’s perception of the Cloud when asked “What is the Cloud?”)

Introduction

Current research on Cloud computing in K-12 education has focused primarily on the

Cloud’s architecture; issues of privacy, security, and trust (PST); and benefits of implementation

(cost, productivity, and scalability). Where research has fallen short, however, is in regard to

faculty perceptions of the issues of PST (Ercan, 2010; Keke & Saier, 2012; Zhang et al., 2010).

This literature review is divided into the following seven sections: (a) discussion of

methodological issues and literature search procedures; (b) the defining of the Cloud; (c) the

Cloud as a misunderstood technology; (d) discussion of literature regarding the Cloud’s adoption

by the education sector, and various governmental policy and vendor initiatives that have

influenced this adoption; (e) studies that provide a deeper understanding of PST concerns as

related to the Cloud, especially with dealing with student data; (f) discussion of recent literature

that defines PST perceptions and concepts; and (g) a concluding section reviewing the literature

on the Technology Acceptance Model (TAM) which provides the theoretical underpinnings for

this study.

Two issues became increasingly apparent while reviewing literature for this study: the

shortage of qualitative data on the ways educators define the Cloud, and how they perceive the

issues of PST when dealing with student and personal data. The literature review details various

aspects of the Cloud, including a universal, “one size fits all” definition; Cloud deployment and

service models; and research into the issues of PST. The literature on the Cloud is extensive and

is expanding as Cloud services and applications continue to grow, but specific research and

findings regarding faculty’s and administrators’ understanding of the Cloud and their perceptions

of PST in terms of K-12 education remain nascent, though they are growing steadily. A review

of the shared methodological issues of the Cloud, as discussed in this chapter may help to better

understand the Cloud in the education sector, while also furthering an understanding of

educators’ perceptions of the issues of PST. The intent of the researcher is that this literature

review, as well as the study in its entirety, will assist in shaping future inquiries specific to this

particular strand of research.

Literature Search Procedures

This chapter follows the methodological guidelines outlined by Kitchenham and Charters

(2007) for performing systematic literature reviews in software engineering. According to

Kitchenham and Charters, an effective research tactic is a systematic review of all research

available for a particular inquiry on a phenomenon of interest. Systematic reviews aim to present

a fair evaluation of a research topic by using a trustworthy, rigorous, and auditable methodology

(p. VI). A systematic review is one of the most effective and commonly implemented

methodologies available for software engineering and computer workflow mappings (Carvalho,

Neto, Garcia, Assad, & Durao, 2013; González-Martínez et al., 2015; Hashizume, Rosado,

Fernández-Medina, & Fernandez, 2013).

This literature review spans contributions through April 2018 using databases deemed

relevant for this study, including CUNY OneSearch online query, Google Scholar, EBSCOhost,

OCLC WorldCat, JSTOR, ACM Digital Library, IEEE Xplore Digital Library, and Springer

Link. Print editions of peer-reviewed academic journals, peer-reviewed book sections, and

conference proceedings are also included. Preliminary database queries using various broad

search strings, including [“Cloud computing” AND “education”], [“Cloud computing” AND

“security”], as well as [“technology in education” AND “faculty”] and other similar search

strings, yielded approximately 600 candidate studies for inclusion. There was an assessment of

each study using a series of “litmus test” methodologies, including a preliminary review of the

title for subject relevance and a review of the candidate study’s abstract. The final review of a

candidate study’s acceptance for the literature review included: (a) an assessment of the quality

of the contribution; (b) an assessment of the quality, clarity, and soundness of the writing; and (c)

breadth of knowledge of the field through a review of the number of citations that included the

authors.

This literature review presents the findings, which describe, summarize, and clarify

significant concepts related to the Cloud and issues of PST. The intention of this review is to

provide a theoretical basis for this study by outlining the background of significant concepts

related to the Cloud, while also presenting research on the Cloud in the education sector and on

enduser perceptions of privacy and security both in school and at home.

Background on Cloud Computing

A brief background of the Cloud’s origins, service models, and various types of Clouds

leads to a better understanding of the evolution of the Cloud and serves as an expansion of this

study’s introduction. The current section provides a brief overview of the Cloud rather than the

empirical findings discussed in detail following this section.

A 2006 BusinessWeek article announced the origins of Cloud computing, noting, “It is

conceivable that August 24, 2006, will go down as the birthday of Cloud computing, as it was on

this day that Amazon made public the test version of its Elastic Computing Cloud (EC2)” (Singh,

2012; Yadav, 2014). The term the Cloud grew in popularity following an October 2007

announcement by IBM and Google of their collaboration on an emerging paradigm of large-scale

distributed computing systems, the forefront of the present Cloud (International Business

Machines [IBM], 2007, 2009; Lohr, 2007). This collaboration between IBM and Google was

part of a larger one with six American universities, including Carnegie Mellon, Massachusetts

Institute of Technology, Stanford University, the University of California, Berkeley, the

University of Maryland, and the University of Washington to develop a scalable, web-based

technology that would later become known as the Cloud. These universities saw that such a

technology would facilitate the exchange of knowledge, data along with accessibility.

This collaboration between the universities and the corporate sector would significantly

increase search engine effectiveness and accuracy, especially for the tertiary education sector

which holds vast amount of digital resources and databases in need of effective indexing. This

would not only improve the collaboration of knowledge between the tertiary education sector

and the corporate sector, it will also set the stage for expansion in other areas as we see today. A

New York Times technology contributor, Lohr, noted the significance of this merger in 2007,

referring to Edward Lazowska, a computer science professor at the University of Washington,

who stressed the importance this development for the education sector, stating, “This is a huge

contribution because it allows for a type of education and research that we can’t do today,” (para.

12). Similarly, Eric Schmidt, CEO of Google, shared the same sentiments, noting, “In order to

most effectively serve the long-term interests of our users, it is imperative that students are

adequately equipped to harness the potential of modern computing systems and for researchers to

be able to innovate ways to address emerging problems” (International Business Machines

[IBM], 2007, p. 1). The current evolution of the Cloud has been somewhat propelled by the

needs of the education sector to organize information that is quickly, accurately, and easily

retrievable from multiple remote servers without respect to geographical borders.

The Cloud’s increasing integration among consumers and the private sector has led to

interchangeable terminology since, until recently, there has been no universal set of standards.

(Gang, 2009; Sultan, 2010; Vaquero, Rodero-Merino, Caceres, & Lindner, 2009). Though used

interchangeably, the Internet and the Cloud differ, as the Internet is the networking conduit for

the Cloud. Similarly, the Cloud in metaphorical terms represents bundled information and

communication technologies and not one “large Cloud.” Rather it is a number of smaller Clouds

that form what is most commonly refer to as the Cloud. In 2011, the National Institute of

Standards and Technology (NIST), an agency under the auspices of the U.S. Department of

Commerce, defined Cloud computing as “a model for enabling ubiquitous, convenient, on-

demand network access to a shared pool of configurable computing resources (e.g., networks,

servers, storage, applications, and services) that can be rapidly provisioned and released with

minimal management effort or service provider interaction” (Mell & Grance, 2011, p. 2). While

the 2011 NIST definition is not definitive or mandated, it has become the industry standard for

defining the Cloud while providing an overall framework of the Cloud’s architecture in that it

also characterizes “five essential characteristics, three service models, and four deployment

models” (Mell & Grance, 2011, p. 3), as discussed below.

Cloud characteristics. Many perspectives on Cloud computing have approached its

description from the viewpoint of “layers” (Mell & Grance, 2011; Naone, 2009; Powell, 2009) or

“service models,” as elaborated by the NIST (2011), as shown in Figure 2.1:

Figure 2.1. Universal overview of the Cloud. Licensed under CC by SA 3.0 via Wikimedia

Commons by S. Johnston 2009

The most commonly accessed layer of the Cloud, Software as a Service (SaaS), allows

“clients to access software services such as email, word processing, spreadsheets, etc. from the

Cloud instead of running these applications directly on their client computers” (Weber, 2011, p.

22). The middle layer, referred to as Platform as a Service (PaaS), is “a paradigm for delivering

operating systems and associated services over the Internet without downloads or installation”

(Johnson, 2009, p. 18). Common examples of PaaS include Facebook, Google (App Engine),

Microsoft (Windows Azure), Salesforce.com, and Rackspace Cloud Sites (Almajalid, 2017;

RightScale 2016 State of the Cloud Report, 2016; Sultan, 2010). The final layer of the Cloud,

Infrastructure as a Service (IaaS), includes “the remote delivery (through the Internet) of a full

computer infrastructure (e.g., virtual computers, servers, storage devices)” (Sultan, 2010, p. 110).

IaaS allows the end user to “scale up” or “scale down” services based on need at a particular

time. Weber (2011) discusses the importance of being able to “pay as you go” by scaling up or

down services, noting particular advantages as the users “only pay for the exact amount of

resources used, and resources available can be easily scaled to accommodate rapidly changing

needs. (p. 566). The IaaS layer provides a number of benefits which include “dynamic scaling,

Internet connectivity, automated administrative tasks, and platform virtualization, as well as

lower total ownership costs leading to lower capital” (Almajalid, 2017, p. 2).

Deployment models: types of clouds. In simplest terms, four Cloud deployment models

exist: the public Cloud, the private Cloud, the community Cloud, and the hybrid Cloud, also

referred to as “Cloud as a service.” Each deployment model has unique advantages and

disadvantages. The Public Cloud which is the most commonly accessed deployment model,

allows for simultaneous access by multiple users. (Asniar & Budiawan, 2016; Mell & Grance,

2011). In this type of cloud hosting, cloud services are provided through a network that is

accessible by the public (Almajalid, 2017, p. 3) as a shared multitenant environment and is

commonly subscribed to on a pay-as-you-go basis, making it the most affordable deployment

model. An end user subscribes to a public cloud service because of its affordability, since users

do not need to delegate resources or maintain servers and software; this also “removes the end

user from direct control over the systems that manage their data and applications” (Ren, Wang,

& Qian, 2012, p. 69). But as Jansen and Grance (2011) note: “Public cloud services offered by

providers have a serious underlying complication—client organizations typically share

components and resources with other consumers that are unknown to them” (p. 11). This

complication makes the public model the most vulnerable to attack, since it is a multitenant

environment that shares virtual machines and resources (Jansen & Grance, 2011; Ren et al.,

2012; Saxena & Chourey, 2014). Current examples of public Cloud models include Amazon

Web Services, Google App Engine (Google Apps), and Microsoft Azure, as well as Apple

(iCloud) and Dropbox (de Bruin & Floridi, 2017; Fox, Griffith, & Joseph, 2009).

A Private Cloud is operated exclusively by a single organization and may be owned,

managed, and operated by the subscribing organization, a third party, or some combination while

existing either on or off premises (Almajalid, 2017; Jansen & Grance, 2011; Saxena & Chourey,

2014). Appropriately, the private model offers what its name implies, “privacy,” which clients

seek since this model does not use shared or pooled resources such as the public Cloud, which is

a significant hindrance to an attack. Examples of private Cloud use include financial institutions,

the airline industry, the insurance industry, and organizations that must meet federally mandated

digital record protection specifications, including the medical records industry, which must meet

the Health Insurance Portability and Accountability Act (HIPAA) requirements.

The Community Cloud is a “mission specific” or “shared criteria specific” model where

subscribers contract for a Cloud solution based on sharing similar needs for applications,

services, or security with other subscribers, similar to a “cloud cooperative.” Mell and Grance

(2011) defined the Community Cloud as an infrastructure “provisioned for exclusive use by a

specific community of consumers from organizations that have shared concerns (e.g., mission,

security requirements, policy, and compliance considerations)” (p. 7). The community Cloud

offers significant security measures not met by the public Cloud, including the ability to tailor to

the needs of the community when it shares a need for common applications and services. The

banking and finance sector, the telecom industry, and government agencies, as well as the

education sector, where particular commonalities of SaaS, PaaS, and IaaS allow for shared

resources and database pooling, most commonly use the community Cloud.

The final model is the hybrid Cloud, which “is a composition of two or more distinct

Cloud infrastructures (private, community, or public) that remain unique entities, but are bound

together by standardized or proprietary technology that enables data and application portability

(e.g., cloud bursting for load balancing between clouds)” (Mell & Grance, 2011, p. 7). A hybrid

Cloud model provides the opportunity for high levels of security with the robustness and

versatility of the public Cloud, including much desired affordability, making it an optimal

solution for the tertiary education sector. Universities and similar higher education agencies

utilize the hybrid Cloud seamlessly, allowing them to share similar software applications as well

as student data securely and efficiently and at an affordable cost (Almajalid, 2017; Rindos et al.,

2010; Srinivasan, Quadir, & Vijayakumar, 2015).

To meet an organization’s particular needs, a deployment model is chosen, while also

considering matters of cost, security, and scalability in finalizing a decision. In particular, cost

and security resonate most profoundly in the public education sector, where budgets are limited,

and the security of student data is paramount (Asniar & Budiawan, 2016; González-Martínez et

al., 2015; Yadav, 2014). Figure 2.2 shows the relationship of Cloud vulnerability (security) to

cost, which determines the level of customizability of a Cloud solution.

While the public Cloud model is associated with the highest security risks and least

customization, it is the most affordable of the models portrayed in Figure 2.2. Conversely, the

private Cloud has the lowest risk of security breaches and greatest customization but has the

highest cost of all deployment models. Community and hybrid Cloud models are most

commonly used for both student information management systems (SIMS)

and learning

A SIMS is a Cloud-based platform that allows for the management of student data, including but not limited to:

student biographical details, grades, transcripts, attendance, and student testing, health records, Individualized

Education Plans (IEP), and similar student-centered data.

management systems (LMS)

within the public education sector because they offer many

features that are commonly shared by school districts at a reasonable cost (Rindos et al., 2010;

Srinivasan et al., 2015).

Figure 2.2. Cloud vulnerability versus cost and customizability. Source: Erik Bennett

The Cloud as a Misunderstood Technology

Cloud architecture is complex and well beyond the scope of this study. However, the

larger concepts of Cloud-based computing, which include Cloud services (SaaS, PaaS and Iaas),

deployment models (private, public, and hybrid), and the physical technologies that make up the

Cloud, are included in this study to show the sheer size and complexity of the Cloud. In practical

terms, it would be unexpected that general users would be familiar with many Cloud

components, especially service types and deployment models.

A LMS is a Cloud-based platform that assists with the planning, implementation, and assessment of specific

learning processes. Typically, a LMS, as discussed by (Rouse, 2014) provides an instructor with a way to create and

deliver content, monitor student participation, and assess student performance (para. 1). Examples of K-12 learning

management systems include Google Classroom, Blackboard, and Pearson SuccessNet.

Few Cloud users understand the complexity and the sheer breadth of the Cloud. It is not

one large computing facility or groupings of servers and storage devices connected by the

Internet as many users believe. The Cloud is a vast network of data centers, some having

upwards of 50,000 to 80,000 servers

delivering applications and services tailored for a

multitude of organizations with emphases on scalability, performance, cost and security. The

Cloud is not a “one size fits all” technology as users believe, but a complex ICT, woven

continuously into nearly every aspect of 21st century society.

Cloud-based computing continues to spread throughout society as noted by a number of

analysts such as Gartner, Inc., who, in a 2018 press release, stated that “worldwide public cloud

service revenue is projected to increase 50% from $153.5 Billion in 2017 to $302.5 Billion in

2021” (Moore & van der Meulen, 2018, Table 1). However, while the Cloud continues to grow

at an unprecedented rate, how to define it, what it is and the importance it plays in 21st-century

digital society remains unclear to many, and this contributes to the often-confusing nature of the

Cloud. A 2012 national survey of 1,000 adults conducted by the Wakefield Research Group and

presented by Forbes Media Group provides some basic yet poignant findings on Americans

understanding of the Cloud:

 “54 percent said they’ve never used cloud computing, but in reality 95 percent

actually do [use Cloud-based software],

Cloud Data Centers are massive state of the art and tightly guarded computing facilities with few details of exact

numbers of servers and related technologies being shared publically. The explosive growth of data needs due to the

growth of IoT and now, IoE (Internet of Everything) has created a new paradigm for data centers, namely,

Hyperscale Computing which requires tens of thousands of servers and related technologies. See

https://www.forbes.com/sites/johnsonpierr/2017/06/15/with-the-public-Clouds-of-amazon-microsoft-and-google-

big-data-is-the-proverbial-big-deal/#228f9ffe2ac3 for additional information.

 When asked what ‘the cloud’ is, a majority responded it’s either an actual cloud

(specifically a ‘fluffy white thing’), the sky or something related to weather (29

percent).

 16 percent almost got it right saying they think of it as a computer network to store,

access, and share data from Internet-connected devices.

 51 percent of respondents, including a majority of Millennials, believe stormy

weather can interfere with cloud computing,

 33 percent [of respondents] see the cloud as a thing of the future, even though 97

percent are already using cloud services through online shopping, banking, social

networking, and file sharing.

 32% had security concerns while 31% had privacy concerns.”

(Newtek, 2012, p. 1)

In a similar 2017 study by Clutch, a technology analyst firm, similar participant

responses resonated with the 2012 survey. Cloud analyst and Senior Content Developer Riley

Panko noted, “Our results show a significant lack of knowledge and confidence among consumer

cloud users, at a time when the Cloud is becoming only further ingrained in our daily lives”

(Panko, 2017, para. 3). The 2017 Consumer Cloud Security Survey

found that:

 “32% of respondents to our recent survey didn’t know that they were using the cloud.

 Over 30% of respondents believe they do not use the cloud, when they'd previously

noted they use at least one popular cloud-based application.

Clutch surveyed 1,000 respondents from across America in January 2017 using a third-party panel provider. All

respondents use at least one of the following apps on their phone or desktop: iCloud, Google Drive, Dropbox, Box,

Microsoft OneDrive, iDrive, or Amazon Cloud Drive. The screening question did not specify that these apps are

Cloud-based. See https://clutch.co/Cloud/storage/resources/consumer-security-survey-2017 for additional

information.

 55% of respondents are very or somewhat confident in their knowledge of the cloud.

 Over 50% of respondents who know they are using the cloud take additional steps

towards securing their data in the cloud.

 The largest percentage of respondents (42%) believe that responsibility for Cloud

security falls on the user and cloud provider equally.”

(Panko, 2017, pp. 1 - 2)

While these surveys reveal some interesting findings about the ways consumers

understand the Cloud, even inherent issues of security, since they are not academic in nature,

they are to be considered in general terms as their background is not thoroughly detailed. With

this noted, these findings show that after nearly a five-year period, 2012 to 2017, respondents

have an overall better understanding of the Cloud, but a significant learning curve still lies ahead.

It is interesting to note that the issues of security and trust of the Cloud is of concern in both

surveys as it continues to be today. Kim DeCarlis, vice president of Corporate Marketing at

Citrix, notes that the findings of the 2012 survey “clearly shows that the cloud phenomenon is

taking root in our mainstream culture, yet there is still a wide gap between the perceptions and

realities of cloud computing” (Newtek, 2012, p. 1) and that this gap is still apparent when

reviewing The 2017 Consumer Cloud Security Survey findings.

The cloud and internet of things (IoT). The Internet of Things (IoT) can be defined in

simple terms as “a network in which all physical objects are connected to the internet through

network devices or routers and exchange data” (A. Sharma, 2017, para. 2). A more detailed

definition of IoT is “a computing paradigm whereby everyday life objects are augmented with

computational and wireless communication capabilities, typically through the incorporation of

resource-constrained devices including sensors and actuators, which enable their connection to

the Internet” (Gomez, Chessa, Fleury, Roussos, & Preuveneers, 2019, p. 23). These IoT objects

includes billions of sensors that collect and share data while also automating processes with

minimal to no human intervention. IoT devices includes smartphones, home automation devices

(i.e., Amazon Echo Dot, Google’s Alexa, the Nest Thermostat, and the Ring Video Doorbell) to

devices such as smartwatches and smart glasses and smart cars. IoT devices deployed by the

industry and government sectors range from monitoring airplane and locomotive engines to

monitoring weather, atmospheric, seismic and oceanic conditions. A report published by Statista

in late 2019 notes that the “installed base of Internet of Things connected devices and things

stands at around 26 billion as of 2019 with forecasts suggesting that this number will nearly

double by 2023” (Liu, 2019, para. 2)

The rapid development and propagation of IoT would not have been possible without

recent developments and expansion of the Cloud. The Cloud provides both the networking

component for IoT and the platforms for the deployment of applications, services and data

aggregation. However, a report published in 2019 by Metova, a IoT application development

firm, notes that while “nearly 75% of 1,000 consumers interviewed about IoT reported that they

owned at least 1 IoT device” that their “awareness of IoT remains low with less than 1 in 4

people fully understanding the term” (Trends in IoT – 2018 vs 2019 Consumer Survey Results,

2019).

Recent research highlights mounting concerns about security and privacy of IoT devices.

The non-profit Internet Society in conjunction with Consumers International found that “63% of

people surveyed find connected devices ‘creepy’ in the way they collect data about people and

their behaviours” and furthermore, that “75% of people agree there is reason for concern about

their data being used by other organizations without their permission” (The Trust Opportunity:

Exploring Consumer Attitudes to the Internet of Things, 2019).

The cloud and internet as a fifth utility. As society becomes increasingly dependent on

the Cloud, the Cloud is increasingly perceived as a fifth utility similar to water, electric, gas, and

sewer. Users receive Cloud-based services and applications that are nearly ubiquitous on a “need

be” basis, increasingly similar to other delivered and pay-as-you-go services and utilities,

Computing is being transformed to a model consisting of services that are commoditized

and delivered in a manner similar to traditional utilities such as water, electricity, gas, and

telephony. In such a model, users access services based on their requirements without

regard to where the services are hosted or how they are delivered.

(Buyya et al., 2009, p. 1)

The delivery of Cloud-based services and applications is scalable and follows a pay-as-you-go

model made possible by the IaaS layer of the Cloud. The user pays for accessing the Cloud as

well as how much of the Cloud-based application or service is accessed at a given time, which is

very similar to the delivery of public utility commodities such as water and electric. The

regulation of Cloud providers is similar to utility providers, especially in regards to protecting

levels of privacy and security with the enactment of HIPPA, COPPA, and FERPA to name a

few. The most recent legislation includes the 2018 Clarifying Lawful Overseas Use of Data

(CLOUD) Act enacted “to speed access to electronic information held by U.S.-based global

providers that is critical to our foreign partners’ investigations of serious crime, ranging from

terrorism and violent crime to sexual exploitation of children and cybercrime” (DoJ, 2018, p. 2).

The Internet, also increasingly perceived as a utility, has gone from regulation by the

Federal Communications Commission (FCC) (similar to a public utility) to recent deregulation.

In 2005 the FCC adopted network neutrality principles "to preserve and promote the vibrant and

open character of the Internet" (FCC, 2005, p. 3). However, Internet service providers lobbied

successfully to overturn regulation with the belief that federal regulation stifles growth and

corporate profitability. Jeffrey Eisenach, the director of the Center for Internet, Communications

and Technology Policy at the American Enterprise Institute summarized the transition back to

deregulation, commenting that “The Internet has stood as a monument to the success of

American entrepreneurship and innovation, a testament to the power of free markets largely

unfettered by the dead hand of government regulation (Eisenach, 2016, para. 1). Consequently,

the Internet was deregulated in January 2018 with the FCC releasing the declaratory ruling,

“Restoring Internet Freedom Order” (FCC, 2018).

The Cloud in the Education Sector

The literature suggests that several factors have contributed to the migration of K-12

school districts to the Cloud. Educational institutions are under increasing pressure to deliver

more for less, and they also need to find ways to offer rich and affordable services and tools

(Gupta, 2012; Watters, 2010; Weber, 2013). Yet increasingly, districts are operating with

financial cutbacks and on significantly reduced budgets. Migrating to the Cloud, however, allows

districts to outsource many of the physical servers, systems maintenance, and hardware and

software, including manpower, thus significantly reducing overall technology operating costs.

The Cloud’s numerous incentives make it a practical solution for the education sector, as the

“value of the Cloud as a way to provide access to services and tools without the need to invest in

additional infrastructure makes it an attractive option for many schools” (L. Johnson, Smith,

Levine, & Haywood, 2010, p. 10). In migrating from fixed, in-house, traditional server

environments, school districts are “able to increase their overall capacity while at the same time

maintaining the required security level and limited infrastructural investment, hence ensuring

that the total cost of ownership (TCO) is low” (Almajalid, 2017, p. 1).

The literature shows that four significant factors continue to motivate K–12 schools to

implement Cloud-based solutions: the need to reduce costs; the scalability offered by the Cloud;

the need of state educational agencies (SEA) and local educational agencies (LEA) to share and

analyze student data in order to facilitate data-driven decision-making; and finally, the

realization that many students are already immersed in the technology (Almajalid, 2017; G.

Chen, 2010; Sultan, 2010). Additional monetary factors are increasingly advancing the Cloud in

the education sector as well, including state and federal funding initiatives for implementation, as

well as corporate initiatives to “fiscally” persuade SEAs and LEAs to contract with specific

vendors.

State and federal incentives. The 2009 State of Illinois’s Race to the Top funding

application is an early example of an SEA migration to the Cloud with the State noting that it

would be “a massive waste of resources and a missed opportunity to foster the development of

more than 350 separate LEA systems, all of which require their own data centers, hardware and

software, and equipment” (Koch & Ruiz, 2010, p. 76). Federal initiatives such as the No Child

Left Behind Act (NCLB) further asserted that “grants can be used for new or existing

technologies to improve academic achievement” (Learning Point Associates, 2007, p. 6). In early

2011, the Obama administration launched the new Advanced Research Projects Agency –

Education (ARPA-ED) within the Department of Education. This initiative would “fund the

development of new education technologies and promote their use in the classroom” (Mervis,

2011, para. 3). The potential of Cloud computing was noted in President Obama’s proposal brief,

Winning the Education Future: The Role of ARPA-ED, which several times cited the Cloud as a

medium that would promote online course delivery, education collaboration platforms, highly

personalized instruction, and “unprecedented data analytical capability” that “will let us make

sense of the massive flow of data to exponentially increase the pace of ‘learning about learning’”

(Winning the Education Future- The Role of ARPA- ED, 2011).

Cloud vendor initiatives. Reidenberg (2013), Sultan (2010), and Weber (2013) have

discussed the competition between vendors to contractually “lock-in” school districts to make it

too expensive to change vendors due to districts’ long-term, significant fixed profits. Yet in

many cases, contracts have been made with districts without addressing issues of parental notice

or consent or degrees of access to student data, which could be in violation of the Family

Educational Rights and Privacy Act (FERPA), the Protection of Pupil Rights Amendment

(PPRA), and the Children’s Online Privacy Protection Act (COPPA) (J. Reidenberg et al., 2013;

Sultan, 2010; Weber, 2013). Indeed, the competition to “lock-in” LEAs, and even SEAs, has

“escalated into a pitched battle between Google and Microsoft to sell Cloud software

applications” (Swift, 2011, para. 1), as the public school sector continues to be forced to move to

the Cloud out of financial and technological necessity. Google, Microsoft, Amazon, Apple, and

other multinational corporations are waging a fierce competition—the Battle of the Clouds—to

sell their Cloud, at the center of which lies a relatively untapped hybrid sector: American public

K–12 education (Kolowich, 2012; Petersen, 2011; Reisinger, 2017). As Swift (2011) observes,

“This intense rivalry between Google and Microsoft to sign up schools and nonprofit groups,

government agencies, and businesses has even spilled into the courts” (para. 9). With this fierce

competition driving the Cloud’s implementation into the educational sector, it is more imperative

now more than ever that faculty and staff have a thorough understanding of it.

The fierce competition between Microsoft and Google specifically for the SaaS platform

has been dubbed “The Cloud That’s Raining on Microsoft’s Parade” (Edwards, 2012). Similar

articles and journal titles reflect the competitive nature of corporations attempting to dominate

the education sector. Titles such as “Google, Microsoft battle for Cloud-computing customers”

(Swift, 2011), “Cloud Computing Ground War” (Kolowich, 2012), “Microsoft Live@edu vs.

Google Apps for Education- Technology’s New Rivalry” (Guerrero, 2012) and most recently,

“Apple Is Losing America's Classrooms to Google and Microsoft” (Reisinger, 2017) are more

commonplace as the corporate sector notices that technology in the classroom is no longer

optional or secondary; rather, it is embedded in the curriculum and instructional delivery:

“technology is not viewed as an extra, but as an embedded part of the culture.... We [school

administrators and educators] want students to use technology like it’s second nature.... It’s a tool

just like the pencil is a tool” (NYS School Boards Association, 2010, p. 9).

In an attempt to persuade K-12 districts to contractually “buy-in” to a particular Cloud

service provider, a number of vendors provide technologies for free, or at significantly reduced

cost, including laptops, tablets, and peripheral devices. Just as Apple dominated the K-12

classroom market with the introduction of personal workstations throughout the 1990s, Google

now dominates K-12 classrooms with a unique buy-in opportunity: no-cost Cloud provision

through the G Suite (formerly Google Apps for Education) and Chromebook laptops, which

retail for less than an estimated $200 a unit. Chromebook sales now account for more than half

of all devices sold for U.S. classrooms, up from less than 1% in 2012, according to a new report

from Futuresource Consulting (Singer, 2017a; Taylor, 2015). Google Chromebooks, most

effectively used in conjunction with other Google products such as Google Hangouts, Google

Heater (2017) references updated and similar projections as provided by Futuresource with “Google commanding

58 percent of U.S. K-12 schools. Windows is in second with around 22 percent and the combined impact of Mac OS

and iOS are close behind at 19 percent” (para. 2).

Classroom, Google Docs, Gmail, and others, are part of G Suite. The Chromebook is a

significant and financially lucrative part of “buying-into” classrooms, opening the door for a

significantly discounted or no-cost Cloud solution that includes add-on physical devices and that

makes Google a one-shop solution for many public districts. G-Suite comes at a perfect time for

many school districts, considering district budgets and rapidly changing technology (Singer,

2017b; Taylor, 2015). Singer (2017b), a technology reporter covering digital learning for the

New York Times, recently noted the dramatic transition taking place in American schools,

“Today, more than half the nation’s primary- and secondary-school students—more than 30

million children—use Google education apps like Gmail and Docs, the company [Google] said”

(para. 6).

Privacy, Security, and Trust with School Data

Just as the scholarly literature on issues of Cloud-based PST in the education sector has

increased, so too has the literature regarding data protection and ownership, especially pertaining

to students’ personally identifiable information (PII) (Arpaci, Kilicer, & Bardakci, 2015;

Orehovavcki, Etinger, & Snjevzana, 2017). Until recently, most studies on PST-related issues of

Cloud computing focused on the architecture of Cloud platforms, such as how to design a Cloud

to foster scalability and collaboration while also protecting PST (D. Chen & Zhao, 2012; Habib,

Ries, & Muhlhauser, 2010). With the migration of schools to the Cloud, more student data is

maintained in the Cloud, and in combination with the merging of social media and learning

environments, areas of research opportunities are becoming more routinely explored.

As public K-12 schools rapidly migrate to Cloud-based platforms, however, the transfer

of student data to third-party providers has increased tremendously, making PST an even greater

area of contention. A Fordham Law School study by J. Reidenberg et al. (2013) noted that “95%

of [all] districts rely on cloud services for a diverse range of functions including data mining

related to student performance, support for classroom activities, student guidance, data hosting,

as well as special services such as cafeteria payments and transportation planning” (p. 5). The

sheer amount of student PII uploaded to the Cloud is vast and multifaceted, including, but not

necessarily limited to, students’ biographical and demographic attributes as well as “health and

physical condition, aptitude scores, achievement and psychological tests, comments by school

counselors and teachers, notes on interviews with parents and students, reports by social workers,

delinquency reports, samples of students’ work, and autobiographies” (House Research

Department, 2015, p. 2). Even with consideration of federal laws meant to protect student

privacy, such as FERPA, “Schools may [even] disclose the fact that a student has an individual

education plan if accused of committing a crime” (House Research Department, 2015, p. 13).

With the sheer quantity of PII, of particular concern is the misuse by third parties, both

intentionally as well as unintentionally. This includes the increased possibility of student PII

theft, as well as the chance that student data will be used for profiteering through targeted online

marketing and inclusion in data-driven decisions regarding commerce targeting without the full

consent of school administrators and/or parents (Bennett & Weber, 2015; González-Martínez et

al., 2015; Weber, 2013).

The literature shows three significant, overarching concerns with the current state of

public K-12 Cloud-based computing. The first is the challenge faced by schools in migrating to

the Cloud with respect to COPPA, FERPA, and in some cases HIPAA, specifically in confirming

compliance with a Cloud provider’s suite for the education sector (Bennett & Weber, 2015;

Cascia, 2012; Ravitch, 2013b; Singer, 2013). Cloud vendors that serve school districts must

ensure that the Cloud environment complies with the Federal Trade Commission’s (FTC)

regulations, including COPPA, FERPA, PPRA, and CIPA in addition to individual state laws. In

a number of cases, Cloud vendors have skirted state and federal legislation and successfully had

legal cases dismissed. One particular cause for dismissal is due to the fact that federal legislation

such as FERPA, enacted in 1974, is too antiquated to effectively address both the complex

privacy concerns raised by data mining and the issues of PST (Weber, 2016; Young, 2015).

G-Suite became the object of a number of state and federal lawsuits as early as 2014

owing to Google’s scanning and indexing of the contents of millions of email messages sent and

received through students’ G Suite accounts. Several articles, including a 2015 article in

Education Week, highlighted an acknowledgment by Google of data mining, noting, “A Google

spokeswoman confirmed to Education Week that the company ‘scans and indexes’ the emails of

all Apps for Education users for a variety of purposes, including potential advertising, via

automated processes that cannot be turned off—even for Apps for Education customers who

elect not to receive ads” (Herold, 2015, p. 1). On April 30, 2014, Bram Bout, Director of Google

for Education, announced on the Google Official Enterprise Blog that “we’ve permanently

removed all ads scanning in Gmail for Apps for Education, which means Google cannot collect

or use student data in Apps for Education services for advertising purposes” (Bout, 2014, para.

2).

The second concern, as noted by Ravitch (2013), Reidenberg et al. (2013), and Weber

(2013), is the increased intersection of public, private, and community Clouds that could

compromise student PST relationships. There is growing concerns, as noted by Weber (2013),

about the “merging of social media and virtual learning environments and personally identifiable

data that are stored on off-site computers” (p. 9). Initially, there was “resistance to the use of

Google Apps in some educational communities because student and teacher data including all

email is located on a server outside the domain of the school district” (Nevin, 2009, p. 4).

Although this concern is still mirrored by school administrators and parents, larger concerns have

evolved regarding the fact that “cloud computing services are operated by third-party vendors,

and these vendors have a range of business models and practices with respect to the collection,

use and disclosure of data” (DelNero, 2013, para.2). Although FERPA and COPPA govern the

privacy and security of student data, trust relations concerning the storage, maintenance, and use

of student data by Cloud vendors are an area of growing concern since the “notions of privacy

are changing in today’s society. Laws covering online privacy are in a state of flux” (Cascia,

2012, p. 2).

A Washington Post article by Strauss (2013) examines the changes in regulations

whereas the U.S. Department of Education, in 2011, amended FERPA to allow “the release to

third parties of student information for nonacademic purposes while also broadening the

exceptions under which schools can release student records to nongovernmental organizations

without first obtaining written consent from parents” (para. 3). A number of education advocates

such as Diane Ravitch were outspoken about the change in FERPA legislation (see Appendix A).

Ravitch (2013b), in her blog, “What You Need to Know About Your Child’s Privacy Rights,”

documented in detail the underlying consequences of the change in federal regulations (see

Appendix B), stating that the change allowed “the release of student records for nonacademic

purposes and undermine parental consent provisions” (para. 7).

The third concern regarding PST with respect to school data, as discussed by Weber

(2013) and de Bruin and Floridi (2017), is the loss of data control and intellectual property rights.

The loss of intellectual property resulting from contractual agreements set forth in the terms of

service (TOS), especially in conjunction with vendors who offer “free” cloud applications, poses

potential issues down the road with the personal ownership of data (de Bruin & Floridi, 2017;

Jaeger, Lin, & Grimes, 2008; Sultan, 2010). Additionally, as noted by Weber (2013), “the loss of

management control or intellectual property rights over materials uploaded to ‘free’ cloud

services is a potential barrier for creators of learning objects” (p. 1). The way contracts are

written for the education sector and other consumers, though beneficial to Google, is the problem

the education sector faces, especially with PST. In his study on Google’s 2012 privacy policy

revision, Weis (2012), notes that “privacy rights afforded to educational institutions through

existing contracts are often hard to distinguish from the terms and conditions offered to regular

consumers” (para. 6).

End User Perceptions of Privacy, Security, and Trust

It is evident from the literature that despite the Cloud’s enormous growth, issues of PST

remain areas of concern and uncertainty that must be better understood in order to mitigate

potential risk (Pearson, 2013; Ritvo, 2016; Weber, 2016). The concept of privacy is complex and

subjective. As Fraser (2015) observes, “it is common to think of it as interchangeable with

security” (p.231). Yet, as Prater (2014) notes “each of these concepts has a different fundamental

meaning and unique role” (para. 1) that differentiates them while also helping to solidify the

concept of trust. This section briefly introduces the literature on privacy and security by

discussing them as unique concepts, and then closes with a discussion of the literature on the

overarching and all-encompassing concept of trust as related to the Cloud.

Privacy. Current literature provides extensive background on the concept of privacy in

general, and in more specific terms, privacy as associated with the Cloud. The term privacy has

evolved, as expected, alongside the increasing complexity of society. The notion of Privacy in

Public is in a state of transformation with consideration of the technological advancements

brought on by ICT, and in particular, the Cloud and the Internet. While these technologies

facilitate the accessibility of information, they also degrade and even compromise privacy,

especially as it pertains to the public domain. Joel Reidenberg of the Fordham Law School

discusses in great detail the confusion over Privacy in Public, stating that “In a world of 24/7

data tracking, warehousing, and mining, technology has transformed obscurity, accessibility,

and transparency of personal information in ways that subvert the utility of the ‘reasonable

expectation of privacy’ constitutional standard” (J. R. Reidenberg, 2014, p. 142)

A late nineteenth-century entry in the Harvard Review (1890) defined privacy simply as

“the right to be let alone” (Warren & Brandeis, 1890, p. 193), while in a more modern context

and in terms of ICT, it also constitutes the “ability to control information and knowledge about

ourselves” (Hildebrandt & de Vries, 2013, p. 83). Privacy with respect to data collection and

retention policies can be defined as “the rights and obligations of individuals and organizations

with respect to the collection, use, retention, and disclosure of personal information” (D. Chen &

Zhao, 2012, p. 649). In this study, privacy is defined as “entail[ing] the protection and

appropriate use of the personal information of customers and the meeting of expectations of

customers about its use” (Pearson, 2013, p. 9). Numerous studies have shown that among the

most important reasons organizations procrastinate, or simply do not migrate to the Cloud, are:

(a) the complex problem of privacy, which extends beyond mere compliance with data protection

laws that differ from state to state and (b), the fact that the Cloud is still in its infancy and

evolving, making it difficult to pin down further, thereby complicating data protection laws and

legislation (D. Chen & Zhao, 2012; Pearson, 2013; J. Reidenberg et al., 2013; Svantesson &

Clarke, 2010).

Privacy concerns are numerous, including the issues of data collection, dissemination,

and storage; appropriate use of data and retention policies; the circumstances under which data

are accessed and by whom; uncertainty of data ownership and control; and even whether data

subjects are sufficiently and appropriately informed about these matters (D. Chen & Zhao, 2012;

Pearson, 2013; Svantesson & Clarke, 2010; Weber, 2014). Studies on privacy agree that the

discussion must begin with the realization that the Cloud takes multiple forms; and because it is

still in its infancy and continues to evolve, the Cloud remains poorly understood. As the Cloud

evolves, so too does the understanding of privacy as more and different types of personal data

makes its way into the Cloud. (J. Reidenberg et al., 2013; Svantesson & Clarke, 2010; Takabi,

Joshi, & Ahn, 2010). In broad and poignant terms, Cloud users perceive a lower threat to privacy

if public data are shared, transmitted, and stored, and therefore in less need of confidentiality,

while conversely, users perceive a higher threat if confidential data are shared, transmitted, and

stored, since those data are at greater risk of being compromised.

Security. Numerous studies have also detailed the concept of security following its

definition by the joint technical committee of the International Organization for Standardization

and the International Electrotechnical Commission (IOS/IEO). The IOS/IEO define security in

ISO/IEC 27002: Code of Practice for Information Security Management as “the preservation of

the confidentiality, integrity and availability of information” (ISO/IEC, 2005; Shariati &

Ahmadzadegan, 2015; von Solms & van Niekerk, 2013). For the purpose of this study, security

means “information security” as it relates to data within the context of Cloud-based computing.

Whitman and Mattford’s (2012) definition of information security expanded on

ISO/IEC’s 2005 definition by adding physical devices, or “hardware,” referring to “the

protection of information and its critical elements, including the systems and hardware that use,

store, and transmit that information” (Whitman & Mattord, 2012, p. 8). Whitman and Mattford

also identified several critical characteristics that give information value in organizations as

discussed by von Solms and van Niekerk (2013) which includes “the confidentiality, integrity,

and availability of information, as mentioned in the ISO/IEC definition, but are not limited to

these three characteristics only” (p. 98). In everyday terms, the security of information relates to

how PII and non-PII data are entrusted to be maintained with confidentially and integrity so that

they are accessible only to authorized individuals, organizations, and other confidants (D. Chen

& Zhao, 2012; Shariati & Ahmadzadegan, 2015; Zissis & Lekkas, 2012).

Trust. Studies by Ko et al. (2011), Pearson (2013), Weber (2013) and Weber (2016)

indicate that the relationship between privacy, security, and trust is both delicate and intricate.

Trust, especially in terms of the Cloud, is a complex concept for which no universally accepted

scholarly definition exists. The literature suggests that the concept as associated with ICT, and in

particular with Cloud-based computing, is difficult to define since it is a psychological state

uniquely constructed by the user based on preconceived notions of privacy, security, and

confidentiality (Hong, 2015; McKnight & Chervany, 2001; Pearson, 2013). Several studies

(Mukherjee & Nath, 2007; Pearson & Benameur, 2010; Urban, Amyx, & Lorenzon, 2009) on e-

commerce and online user behavior refer to Rousseau, Sitkin, Burt, and Camerer (1998) who

defined trust as “a psychological state comprising the intention to accept vulnerability based

upon positive expectations of the intentions or behaviour of another” (p. 394).

This definition implies that the user is aware that the Cloud involves risks or

vulnerabilities, but if the Cloud provider has proactively taken safeguards to mitigate these

issues, then trust is developed to a level that allows the user to access Cloud-based applications

and services since they expect that safeguards have been put in place. Yet, even with the

definition provided by Rousseau et al. (1998), Pearson (2013) notes that “trust is still a complex

concept for which there is no universally accepted scholarly definition” (p.13). Another widely

noted, though simplified, definition within both the domains of psychology and ICT defines trust

as a “measure or level of confidence in something or someone” (Bilecki & Fiorese, 2016;

Simpson, 2007); this allows it to be studied qualitatively using standard Likert-scale attitudinal

survey questions to predict trustworthiness (A. M. Evans & Revelle, 2008; Glaeser, Laibson,

Scheinkman, & Soutter, 2000).

Pearson (2013), in her study on PST, makes an interesting note that “trust is a broader

notion than security as it includes subjective criteria and experience” (p. 13). Such subjective

criteria include “hard” trust, which involves security systems in place within the Cloud to assure

authenticity and encryption, while “soft” trust involves human psychology, brand loyalty, and

reputation, as well as user friendliness. The Target and Equifax incidents in 2013 and 2017,

respectively are examples of “hard” trust failures that allowed intruders access to the companies’

databases and significant loss in brand loyalty and reputation, considering that, in the Equifax

case, “highly sensitive personal and financial information for around 143 million U.S. consumers

was compromised” (White, 2017, para. 1). At no time has accountability and auditability played

a greater role in trust relations as it does currently, especially with considerations of recent large-

scale data breaches.

Theoretical Framework (Model)

Extensive literature exists on competing theoretical frameworks that model users’

attitudes toward, and perceived usefulness of, a particular technology. Studies show a number of

commonly used theories to ground research on users’ technology acceptance. The three most

commonly applied theories are the theory of reasonable action (TRA) (Fishbein & Ajzen, 1975),

the theory of planned behavior (TPB) (Ajzen, 1985, 1991), and the technology acceptance model

(TAM), which currently has a number of variations

The literature reviewed on user attitudes toward Cloud-based platforms, as well as its

perceived usefulness, including e-commerce, e-payments, banking, and online gaming/gambling,

refers to one or more variations of TAM as the most commonly applied theoretical framework.

Hence, the number of citations

retrieved using Google Scholar and the keywords [“TAM”

AND “Davis” AND “(1989)”] comes to over 20,000 to date, which is significant for a journal

entry in an applied field. More importantly, prominent researchers on technology acceptance—

including but not limited to R. P. Bagozzi, F. D. Davis, P. R. Warshaw, and V. Venkatesh—

agree that users’ acceptance and perceived usefulness of ICT, and in this case the Cloud, can be

best studied when attitudes toward usage and intentions can be modeled using two technology

acceptance measures, namely, ease of use (PEoU) and usefulness (PU) (Davis, Bagozzi, &

Warshaw, 1989; Venkatesh & Davis, 2000).

TAM is one of the most “influential research models in studies of the determinants of

information systems and information technology acceptance to predict intention to use and

acceptance of information systems and information technology by individuals” (S. C. Chen,

Shing-Han, & Chien-Yi, 2011, p. 124). While TAM has been widely used for a broad range of

studies on Cloud computing and Internet adoption and acceptance (S. C. Chen et al., 2011;

Hemlata, Hema, & R, 2015; Moon & Kim, 2001; S. B. Stern, Royne, Stafford, & Bienstock,

The Technology Acceptance Model (TAM) has metaphorically “branched” into four variations, the root being the

original TAM (Davis, Bogozzi, & Warshaw, 1989). Variations of TAM include (a) the final version by Venkatesh

and Davis (1996) known as TAM2 (Venkatesh & Davis, 2000); (b) the Unified Theory of Acceptance and Use of

Technology (UTAUT) (Venkatesh, Morris, Davis, & Davis, 2003); and (c) TAM3 (Venkatesh & Bala, 2008). For

further discussion, see (Lai, 2017) and (R. Sharma & Mishra, 2014).

https://scholar.google.com/scholar?hl=en&as_sdt=0%2C31&q=TAM+Davis+et+al.+%281989%29&btnG

2008), recent literature does not suggest that TAM has been used specifically for studies of

Cloud computing and the issues of PST within the public K-12 education sector.

The below TAM model (Figure 2.3) has been theorized specifically “to explain computer

usage behavior… [as] an adaptation of Fishbein and Azjen’s (1975) Theory of Reasoned Action

(TRA)” (Godoe & Johansen, 2012, p. 38) which is shown in Figure 2.4. TAM uses technology

acceptance measures included in TRA, in addition to attitude measures and subjective norms.

Fishbein and Ajzen’s (1975) extensively cited TRA as commonly used to study communication,

especially when associated with consumer and health behavior (Malhotra & Galletta, 1999; Yi &

Hwang, 2003). The original TAM framework, TAM [1] (Davis, 1989) is grounded in four

principals within the context of social psychology: an external stimulus influences a cognitive

user response, which then elicits an affective response, which determines the overall behavioral

response of the user, as shown in Figure 2.3.

Figure 2.3. Technology Acceptance Model (TAM) [1]. Adapted from “User acceptance of

information technology: Systems,” by F. D. Davis, International Journal of Man-Machine

Studies, 38 (1993): 475–487.

The original version, TAM [1] (Davis, 1989), “has been adapted and extended in many

ways” (Chuttur, 2009, p. 13), allowing for the evolution of a TAM [2] adaption; this in turn has

gained wide acceptance, incorporating “additional theoretical constructs spanning social influence

processes (subjective norm, voluntariness, and image) and cognitive instrumental processes (job

relevance, output quality, result demonstrability, and perceived ease of use)” (Venkatesh & Davis,

2000, p. 187). An adaption of TAM [2] as shown in Figure 2.5 is used in this study since it is more

robust and scalable than TAM [1].

Figure 2.4. Theory of Reasonable Action (TRA). Adapted from Belief, attitude, intention, and

behavior: An introduction to theory and research, by M. Fishbein and I. Ajzen, 1975, Reading,

MA: Addison-Wesley.

Figure 2.5. Technology Acceptance Model (TAM) [2]. Adapted from “Determinants of

perceived ease of use: Integrating control, intrinsic motivation, and emotion into the technology

acceptance model,” by V. Venkatesh, 2000, Information Systems Research, 11(4), 342–365.

Summary

This chapter provides an overview of previous research into the Cloud, the concepts of

PST, the Cloud in the education sector and regulatory policy and mandates concluding with

discussion of the chosen theoretical framework meant to guide this research. The chapter also

provides background on particular aspects of the Cloud not normally introduced in a literature

review to define Cloud types and architecture. The author has chosen to add this background to

assist the reader with understanding that the Cloud is not necessarily a singular technology but a

“bundled” platform that can be difficult to understand without some degree of technological

introduction. Chapter Three introduces the three cases for the study and the applied research

methodology while Chapter Four details analysis and presentation of data. Chapter Five

concludes with the researcher’s findings, recommendations, implications and conclusion.

Chapter 3 – Research Methodology

Introduction

The purpose of this study is to gain a deeper understanding of how faculty view Cloud-

based computing, how they perceive issues of privacy, security, and trust when using Cloud-

based systems in schools, and what differences, if any, exist between their at home use of Cloud-

based computer systems and their use of these and similar systems at work. This study looks first

at how the faculty of three Westchester County school districts located in New York State

understand and define the Cloud. The study then examines faculty perceptions of the issues of

PST and addresses differences, if any, when faculty access the Cloud for school/student related

“work” as compared to personal use, as detailed in Table 3.1.

Table 3.1. Work and Home related Cloud-based Activities

Work related Cloud-based activities

Personal Cloud-based activities

 Curriculum and instructional delivery

 Student, faculty and parent

communication and collaboration

 Student reporting, grading and

attendance

 Student information management

systems access

 Professional development

 LEA and SEA longitudinal record access

 Human Resources related records and

resources (faculty sign-in, sick day

accrual, personal days and HR Policies)

 Communication and social networking

 Entertainment (gaming, video and music

streaming)

 Online banking and e-commerce

 Productivity suites such as Google docs

and/or Microsoft/Office 365

 Digital storage (Dropbox, iCloud, and

similar)

 Online education and reference

 Integration with Cloud-based

applications and services for

synchronization with peripheral services

(home link, alarm, and similar)

This chapter presents the methods and procedures used to carry out the study, including the

rationale behind the research questions, an outline of the research design and discussion of the

three school districts chosen as case studies. Also presented are the instruments used in the study,

data collection methods, and rationale for the research design, along with a discussion of ethical

considerations and limitations of the study.

Restatement of Research Question and Rationale

The following three research questions assist in furthering the understanding of Cloud-

based computing in the context of K-12 public education:

1. How do school faculty and administrators understand the concept of Cloud computing

as used in K-12 public education?

2. How do faculty and administrators perceive the issues of privacy, security, and trust

(PST) as related to Cloud computing?

3. How may perceptions of PST differ when completing school related tasks as compared

to personal, non-work related tasks?

Two exploratory exercises designed to provide a better understanding of the phenomenon under

study were the basis for these three research questions. The first involved a preliminary review of

academic findings and anecdotal literature in regard to the Cloud and related PST concepts to

confirm the feasibility of the study. In other words, is this topic of interest to researchers in

general and would this study make a positive contribution to the field of Cloud computing,

especially within the education sector? The second research practice involved impromptu

questioning of fellow educators and an “unofficial” roundtable discussions of the Cloud and

PST. This assisted the researcher in developing a better understanding of how fellow educators

understand the Cloud, which could potentially explain why some embrace the Cloud while others

remain cautious and leery.

A set of broad guiding questions formulated during the impromptu sessions and then

expanded on during the “un-official” round table discussions with fellow educators helped to

support the exploration of this study’s research questions. This allowed for the honing and

finalization of the three principal research questions as posed above. Not only did these guiding

questions assist with the formulation of the research questions, but they also acted as navigation

guides for data collection and interpretation as discussed later in this study. Table 3.2 outlines the

broader guidance questions and researcher’s rationale for posing the questions.

Table 3.2. Guiding Questions for Inquiry and Rationale

Question

Rationale

How do you define the Cloud or,

simply, “What is the Cloud?”

To learn of the various understandings of the Cloud to

assist with developing a possible “Cloud knowledge” scale.

Where is the Cloud and do you

need the Internet to access it?

To determine if there are various understandings of the

Cloud as either a metaphor, or as a physical or virtual

technology.

Can you list some programs,

services, or applications that are

Cloud-based?

 To determine if the user can differentiate between Cloud-

based services and applications

In terms not related to

technology, what is PST?

 Set a baseline for how the user defines PST in general

“humanistic,” or tangible, terms

In terms of technology, what is

PST?

 Set a baseline for how a user defines PST in terms of

technology to learn if the user has different perceptions of

PST related to humans and technology.

Is there a difference of PST when

using the Cloud at work

compared to at home?

 To differentiate if the user perceives PST differently at

work than at home.

Research Design

This study utilized a multiple case design to address the three research questions. A

multiple case design allows for a better understanding of the Cloud and the problematic issues of

(a) the lack of a coherent definition of the Cloud in the education sector, (b) the exploration of

the perceptions of the issues of PST with regards to student data (in the workplace), and (c) the

possible difference in perception of PST when completing school related tasks and personal,

non-work related tasks.

This multiple case study seeks to answer “how” and “why” questions to cover

“contextual conditions believed to be relevant to the study” with “no clear boundaries between

the phenomenon and context” (Yin, 2009, p. 18). In addition to the above criteria, a multiple case

design must also meet additional characteristics that call for its use instead of a single case

design. The multiple case design includes the need for replication among the cases, which is

analogous to that used in a multiple experiment design. The current research design meets both

sets of criteria for multiple case study design.

This study also employed a homogeneous sampling strategy to gain an in-depth

understanding of each of the three district’s faculty and their understanding (perceived

definition) of the Cloud in the context of public education, as well as the faculty’s perceptions of

PST. All three districts share commonalities and similar characteristics, particularly their choice

of G Suite for Education (G Suite) as the dominant collaboration and productivity platform for

students, faculty, and parents allowing for literal case replications. The three districts also

implement similar if not the same additional Cloud-based applications and services such as

Infinite Campus, Blackboard, E-Chalk as well as use of student-issued Chromebooks.

Theoretical replication among the districts predict either “similar results (a literal replication) or

predict contrasting results but for anticipatable reasons” (Yin, 2009, p. 54). Because the Cloud,

by nature, is a dynamic technology experiencing strong growth due to rapidly changing

technologies, this multiple case study is flexible by design. Careful consideration taken to

maintain the original research design with a preference of changing the original theoretical

objectives in the event additional case studies were added.

This study is predominantly qualitative; however, the researcher also used quantitative

methods to analyze data. A mixed methods design over a singular approach allows for a more

comprehensive analysis of the data. Creswell and Creswell (2017) emphasize that “a mixed

methods design is useful when either the quantitative or qualitative approach by itself is

inadequate to best understand a research problem or the strengths of both quantitative and

qualitative research can provide the best understanding” (p. 18).

The online questionnaire, shown as Appendix C, employed 16 (59%) questions that

elicited closed-ended responses and 11 (41%) questions that elicited open-ended responses.

Designing nearly half the questionnaire’s responses to be open-ended provided a significant

amount of richness and the intricate nuances in the participant’s words. While Creswell and

Creswell (2017) noted that the “more open-ended the questioning, the better, as the researcher

listens carefully to what people say or do in their life settings” (p. 8) there is a limit as

researchers do not want to cause participant fatigue that will adversely affect the quality of

responses.

Research Site and Participants

Three Westchester County school districts agreed to take part in this multiple case study:

Hendrick Hudson Central School District (HHCSD), Pelham Union Free School District

(PUFSD), and the Tuckahoe Union Free School District (TUFSD). While the attempt was to

choose districts that shared “strong” and “distinctive” commonalities, recruitment became

increasingly difficult during the invitation period to find districts that were willing to participate.

Invitations to take part in this study were sent to 49 Westchester and Rockland County school

district Assistant Superintendents and Technology Directors (see Appendix D) only to learn that

districts were not interested in taking part for various reasons ranging from the district having

fulfilled its survey quota for the 2016–2017 academic year (7%) to district policy not allowing

for participation in external studies and research. Administrative policies and union mandates

limit the number of surveys planned for data collection and professional development by various

districts. The researcher approached districts with clear technology-based initiatives and a

convenience sample of three districts was chosen based on their willingness to participate (Table

3.3). In this period of public accountability, researchers face increasingly difficult to get school

administrators to agree to participate in studies.

All three districts use G Suite as their dominant learning platforms and share a number of

commonalities regarding the issues of PST as outlined on the districts’ public websites or in

publicly accessible technology plans included in Appendix E. All three school districts’

technology plans and strategic planning goals detail initiatives to integrate various technologies

into the classroom and administrative roles. The districts also provided professional development

and training on new and existing Cloud-based technologies. District related technology plans and

strategic plans that utilize Cloud-based applications and services (e.g., G Suite, LMS and SIMS),

which are discussed in detail in the Chapter 4, were also reviewed. Additionally, data on district

characteristics from a federal and publicly accessible longitudinal database from the National

Center for Educational Statistics

was obtained (see Table 3.3).

Of particular importance is that all three districts do share the commonality of using G

Suite. All three districts implement the Google Cloud platform as their primary productivity suite

for teacher, student, and parent collaboration and communication. While this allows for literal

case replications as discussed earlier in the Research Design, this also sets a baseline for all

participants in the study as they share a common computing environment. Table 3.3 provides

The National Center for Education Statistics (NCES), part of the U.S. Department of Education, collects and

analyzes data related to the U.S. education sector. (Visit https://nces.ed.gov/ for more.)

district overviews including enrollment, student compositions, faculty, and additional

information.

Table 3.3. District Overviews

HHCSD

PUFSD

TUFSD

(2015 – ’16)

(2014 – ’15)

(2015 – ’16)

Enrollment

2366

2810

1099

Student/Teacher Ratio*

11.59

12.8

13.8

Faculty

212

227

Avg. Total Teacher FTE

204.17

219.59

77.55

% w MA + 30 Hr or

Doctorate*

52%

62%

51%

Teacher Turnover Rate

14%

Levels

KG–12

Financials

Student Expenditure p/year

$17,097

$14,954

$14,131

# disadvantaged Stud

25.0%

10.0%

18.0%

% at or below Poverty

5.5%

3.9%

7.3%

Students w/ IEP*

343 (14%)

346 (12%)

161 (15%)

Student Body

Composition

White*

61%

68%

67%

Hispanic or Latino

25%

16%

13%

Black

11%

Median Home Prices (2014)

$419,500

$810,500

$680,000

Locale

Suburb*

Large (21)

Source: Collected from the CCD Public school district data for the 2015-2016, 2016-2017 school years. Retrieved

from the National Center for Education Statistics; https://nces.ed.gov/

Asterisk * denotes district similarities

The three school districts included in this research are relatively small when compared to

other nearby districts and New York City schools. The three school districts are geographically

near each other and also share similar demographics, including a lower than national student

poverty rate

of under 10% for each school. This research intends to address faculty’s

understanding of the Cloud and PST and not necessarily that of the students. Additionally, this

study serves as an introduction to topics that further explore the Cloud as used in public

education and issues of PST as perceived by K-12 faculty members.

Participant inclusion. Participation in this study was voluntary and open to faculty,

administrative staff, and school personnel involved in direct instruction, supervision, curriculum

implementation, or development. Examples of participants include teaching faculty, student

supervisory faculty, guidance counselors, speech and occupational therapists, school

technologists (instructional and curriculum development), and administrators (principals, vice

principals and department heads) of grades K through 12 at each school district. Custodians,

security officers, clerical staff, and cafeteria personnel were not eligible to participate.

Table 3.4. Questionnaire and Interview Data

District

Questionnaires1

completed

Questionnaires started and

not completed

Interview2

participants

HHCSD

PUFSD

TUFSD

Total (N=72)

1 Questionnaire sample size 9 to 12 per case or study total of 60 to 75 questionnaires.

2 Semi-structured interview sample size of 3 to 4 per case or study total of 9 to 12 semi-structured interviews.

The anticipated questionnaire sample size was 60 to 75, with an estimated combination of

full and part-time staff of N = 528. Since this study used a homogeneous sampling strategy, there

was a sub-sample of 9 to 12 faculty and administrators anticipated to volunteer and take part in

The National Center for Education Statistics (NCES) notes a national poverty rate for children under the age 18 at

18% in 2017. For more information, visit https://nces.ed.gov/programs/coe/indicator_cce.asp

the follow-up semi-structured interviews. The final number of 72 completed questionnaires

across 3 cases, and a sub-sample of 11 completed semi-structured interviews (Table 3.4),

provided a good sample size relative to the universal sample pool of 528 staff. While there are no

specific rules in qualitative research to determine the optimal sample size, it must be adequate to

meet a data saturation point. As noted by Creswell (2013), it is important “to gather enough

information to fully develop (or saturate) the model [and] may involve 20 to 60 interviews” (p.

89). All participants’ identities remained confidential and data was only presented in aggregate

form. The research instrument section addresses the validity of the survey instruments used for

the study. Specific demographic information about the faculty is found in Chapter 4.

Table 3.5. Study Announcement and Questionnaire Details

District

Domain Name

(website address)

Announcement

(Open – Closed)

Liaison

HHCSD

hendrickhudsonCloudstudy.com

March 13-27, 2017

Executive Director of

Educational Support

Services

PUFSD

pelhamCloudstudy.com

March 13-27, 2017

Assistant Superintendent

TUFSD

tuckahoeCloudstudy.com

March 6-20, 2017

Director of Technology

Study announcement. Each school district received a study announcement (Appendix F)

which included a background of the study, eligibility requirements, benefits of the study,

possible compensation in the form of inclusion in a raffle, and a link to the questionnaire

website. There were three unique domain names acquired for the study and configured to include

the school district’s name, allowing for each district to maintain confidentiality so that districts

were unaware of each other’s participation (see Table 3.5). For a step by step outline of the study

deployment at each district see Table 3.6.

Table 3.6. Study Announcement Protocol and Questionnaire Deployment

Step 1

Agreement by each district superintendent to take part in the study and a contact

person assigned as a liaison by each superintendent. The liaison was either an assistant

superintendent or the Director of Technology depending on the school district.

Step 2

Detailed discussion of the study by phone and/or email with liaison and presentation

of study announcement by email. A copy of the finalized IRB presented to each

liaison, see Appendix G.

Step 3

All faculty and school personnel received a district-wide study announcement by the

superintendent’s appointed liaison using the district-issued email system (Appendix

H). The email included a brief discussion of the study, a link to the pre-screening

section to determine eligibility (see Appendix I), the online questionnaire, and the

incentive (inclusion in a raffle) intended to generate interest in participation. The

liaisons sent the email announcements on a Monday, two weeks before the winter

break, or the Monday after each district’s winter break to maximize participation

possibilities.

Step 4

Each liaison sent a district-wide email reminder on Thursday of the same week of the

initial announcement. A final follow up reminder was sent the following Thursday

noting the study, link, possible compensation and a closing date of the following

Monday.

Step 5

The online questionnaire (SurveyMonkey) was available until two weeks after initial

announcement of the study. All response data exported from the questionnaire and

coded.

Step 6

Participants who noted an interest in taking part in the semi-structured interviews were

able to confirm their interest and a time and location to hold the interview via email.

Step 7

Raffle winners of two $50.00 Target gift certificates at each school district were

selected and notified by email.

Research Instruments and Data Collection

The online survey of 29 to 34 questions, presented in its entirety in Appendix C.

employed a mixture of Likert scale and open-ended questions employing “skip logic,” or

“conditional branching” to allow for response granularity. The objectives of the questionnaire

were to elicit responses regarding differences, if any, in the issue of PST by faculty while using

the Cloud for school and student related “work” as compared to personal productivity and leisure

activities. Chapter Four provides detailed findings and analysis of data collected from the

questionnaire.

The researcher then invited participants who completed the online questionnaire to take

part in an optional semi-structured follow-up interview. These interviews consisted of four

introductory questions meant to open the sessions to further dialogue about the Cloud, how

respondents defined it, and how they perceived PST. An additional five to six questions were

employed depending on the answers elicited during the introductory questioning. This

questioning technique was meant to collect detailed responses while allowing for an opportunity

to elaborate on any areas not fielded by the online questionnaire. This open-ended and inductive

approach fostered “open discussion” which combed out detail-rich qualitative responses not

possible through the use of an online survey.

The researcher digitally recorded each semi-structured interview after receiving

participant consent. While a professional transcription service such as Rev.com would have

reduced time spent preparing the data for analysis, the researcher chose to transcribe all digitally

recorded data to become fully immersed in each interview. This allowed the researcher to take

into consideration the intricate contextual variations and subtle intonations that reveal deeper

meaning in oral interviews, which a professional or automated transcription service would

potentially not capture. The researcher did use the Atlas.Ti 7.5 program to assist with the

analysis of the transcriptions. As detailed later in this chapter, this process led to the

identification of coded themes across each individual case and then across all three cases.

The identities of interview participants remained confidential, as explained to participants

in the semi-structured interview consent form (Appendix J). The researcher also verbally

reminded participants before being interviewed that their responses, as well as the voice

recordings, would be maintained in the most confidential manner as outlined by the CUNY

Internal Review Board (IRB) process. This reassurance of confidentiality also fostered a level of

comfort for participants. See Appendix K for the semi-structured interview questions, and Table

3.4 provides background on the number of completed interviews by case. Chapter 4 also

provides detailed findings and analysis resulting from the semi-structured interviews.

Document collection. A predominantly qualitative multiple case study can yield a

tremendous amount of data that is systematically organized for proper analysis. This is true for

this study, which spanned three cases and included an online questionnaire, a number of semi-

structured interviews, and a significant amount of primary and secondary documents for analysis.

Creswell and Clark (2007) emphasize that “the approach taken to data collection involves

systematically gathering information and recording it in such a way that it can be preserved and

analyzed by a single researcher or a team of researchers” (p. 115). The researcher took all

reasonable measures during this study to systematically collect and preserve data to maintain

integrity to allow an effective analysis. Table 3.7 outlines data collection methods, tools, and

rationale for the use of a particular tool.

To complement the interview and questionnaire responses, the researcher analyzed

district technology plans, implementation policies, technology overviews, and professional

development documents as presented by each case study. Part of the document collection also

included white papers and marketing literature provided by Cloud vendors to better understand

Table 3.7. Data Collection Tools and Rationale for use

Method of

Inquiry

Tool

Rationale for use of Tool

Conversion

Format

Online

Questionnaire

Survey

Monkey

-Ease of design and use by participant and

researcher

-Secured accessibility by participant and

researcher

-Assured anonymity by disabling IP

Address tracking

-Skip logic functionality

Excel export to

Atlas.Ti

(Qualitative)

and Excel

Export to SPSS

Semi-structured

Interview

Digital

Voice

Recorder

-Allows researcher to focus on questions

and answers/discussion rather than note

taking

-Reduces weariness of respondents as the

researcher is able to take less notes

-Allows researcher to in-depth review

interview session for accurate transcription

Manual

transcription*

to MS Word

and import to

Atlas.Ti

Documents

(Primary and

Secondary)

Qiqqa

-Enhanced search functionality

-Keyword and tagging functionality

-Relevancy search capabilities

-BibTeX integration

MS Word

conversion to

PDF format

Interviews with

District

Technology

Director

Field note

taking

-Allows for an understanding of the

phenomenon from an administrator’s unique

perspective and experiences

-Allows for specific questioning about the

phenomenon not gathered from the

questionnaire or semi-structured interview

Manual

transcription to

research notes

for input to

Qiqqa

* The researcher chose manual transcription instead of a paid transcription service or automated transcription. While

this process is time consuming, it assisted the researcher by furthering the understanding and context of interviewees

as it allowed him to take into consideration intricate contextual variations that were potentially useful for coding

analysis.

existing and future marketing strategies and how they may have an impact on PST. The

researcher also kept a reflective journal to record reactions, assumptions, expectations, and

biases as these provide additional data for analysis.

Data Analysis

Data collected for this study was analyzed using a two part process. The first involved

coding and then categorizing the data-segments into separate salient themes identified as primary

themes. The second involved a cross-case analysis of these primary themes across the three

school districts. This two part process was completed with the assistance of Atlas.Ti, a

qualitative data analysis and research program.

Throughout the data analysis procedures, sub-themes (i.e., emergent codes) developed by

grouping data segments that were similar in concept, issues, and phenomenon respective of their

primary themes. As a result, the researcher then linked each sub-theme to a specific theme. This

process was complete after multiple iterative reviews – often two to three reviews – of the data

segments categorized under each primary theme.

Figure 3.1. Data Collection and Analysis. Source: Erik Bennett.

Thematic analysis allowed the researcher to treat each school as an individual case with

shared salient themes (see Figure 3.1). According to Yin (2009), “[this] technique does not differ

from other research syntheses- aggregating findings across a series of individual studies” (p.

156). Specifically, this thematic approach allowed for the separation of data into organizational,

substantive, and theoretical categories (Maxwell, 2005, p. 98) for a more effective method of

categorizing and analyzing the data (see Figure 3.2). This approach also helped to facilitate an

effective cross-case analysis of the three school districts, allowing the researcher to make

generalizations about the cases collectively.

Figure 3.2. Thematic Analysis across Cases. Source: Erik Bennett.

Uncovering Emerging Themes. The qualitative data for this research was collected from

the semi-structured interviews, the open-ended questions from the online questionnaire, and

various artifacts (i.e., school district and vendor documents). All interview data was transcribed

and then analyzed alongside data from open-ended questions and artifacts and then uploaded to

Atlas.ti for coding, analysis, and interpretation, as shown in Figure 3.1 and Figure 3.2.

The first set of data coded included the semi-structured interviews, which consisted of

nine guiding questions, each with a set of sub-questions authored to elicit detailed follow-up

responses (see Appendix K). At times, the researcher deviated from these questions to allow

respondents to elaborate on key details, thoughts, or interests related to cloud-based computing

as understood by educators. This strategy strengthens the researcher’s understanding of the

phenomenon, as the most recent question being asked is formulated based on the response of the

previous question. This is discussed in detail by Creswell (2013) who noted, “My questions will

change and become more defined during the process of research to reflect an increased

understanding of the problem” (Creswell, 2013, p. 52), which further allows for the collection of

rich details not afforded when employing structured interviews.

The questioning technique in this study allowed the researcher to hone in on various

details and interpretations of the Cloud and PST not included in the original question bank. The

use of lead-in questions provided a treasure trove of additional rich detailed data resulting in a

dynamic and unique set of responses. The following set of data uploaded to Atlas.ti for coding

included 72 response sets from the 11 open-ended questions from the online questionnaire along

with a final set of data uploaded for coding which included participating school district

documents, policies, and vendor documentation and marketing materials.

Once all data had been uploaded to Atlas.ti, the researcher performed an exploratory

review to better familiarize himself with the data. While coding did not take place during this

exploratory review, memos and brainstorming maps were created to assist with the finalization

of a set of 8 primary themes that were salient across the three cases. This was achieved by using

a thematic approach commonly referred to as template analysis. As discussed by King (2004),

“The essence of template analysis is that the researcher produces a list of codes (‘template’)

representing themes identified in their textual data” (Cassell & Symon, 2004, p. 256). Initial

reviews of the documents were performed, assigning primary themes to data segments, including

excerpts of text in the form of phrases, sentences, and paragraphs and serving as examples of the

presence of a particular theme.

Additional reviews of the uploaded documents were then performed by reading through

the data to allow for the emergence of sub-themes representative of reoccurring concepts, issues,

phenomenon, and the many intricate details that were fleshed out during the coding cycle. This

coding methodology seemed practical and more in line with the qualitative intentions of the

study, especially considering the complexity and richness of data collected from the semi-

structured interviews and the open-ended questions on the online questionnaires. After a number

of reviews, 18 sub-themes were identified and organized under each primary theme for

substantiation, while also fostering a better understanding of the overall data. These themes and

sub-themes were then organized into a template-based table outlining themes related to each of

the three research questions. As discussed by King (2004), “The template is organized in a way

which represents the relationships between themes, as defined by the researcher, most commonly

involving a hierarchical structure” (Cassell & Symon, 2004, p. 256). There were also a number

of themes and sub-themes grounded in the data that did not specifically address the research

questions in this study; however, their emergence is important to the overall study, and for this

reason, these themes and sub-themes are presented towards the end of this chapter.

Use of Atlas.ti and Qiqqa. The researcher chose Atlas.ti over NVivo to assist with the

analysis of data due to its user friendliness and nearly intuitive interfaces that greatly facilitated

the analysis process. This data analysis tool is not meant or designed to replace human analysis

and interpretation but to facilitate the process of coding and finding relationships and themes. In

performing the analysis for this study, the researcher used Atlas.Ti as an assistive technology,

because it cannot, by itself, perform the humanistic side of analyzing data, which includes

imaginative thinking and the conceptualization of codes.

Qiqqa is a reference management tool similar to Zotero and Mendeley which also allows

for citation management, PDF markup, and keyword relevancy searching and annotations. Qiqqa

also functions as a brainstorming platform for cognitive mapping of processes and causal

networks to explore cause and effect relationships. In Chapter 4, questionnaire and semi-

structured interview coding using Atlas.Ti is discussed in further detail. Additionally, Table 3.8

provides a brief presentation of all tools used in this study to assist with analyzing collected data.

Table 3.8. Programs used for Data Analysis

Tool

Rationale

Atlas.Ti 7.5

Enhances interpretation of data by assisting with the extraction,

categorization, and interlinking of data segments for thematic coding.

SPSS V.22

Primarily used for the analysis of quantitative data; can be used to a limited

extent for qualitative data employing the SPSS Text Analytics Module.

Qiqqa

Assists with document archiving, indexing, and coding. Qiqqa allows for

the researcher to upload documents to a Cloud-based archive and then

define keywords, attributes and themes.

Researcher Positionality

Research is a continual process where the researcher acquires data and knowledge, in this

case, in regards to faculty’s understanding of cloud-based computing and their perceptions of

PST. The researcher engaged himself in the research process by first designing qualitative tools,

including an online survey and semi-structured interview question, and then through face to face

meetings with the interviewees. How does my positionality,

my identity, background, and

experiences shape this research process? Through recognition of our biases, we presume to gain

insight into how we might approach a research setting and members of particular groups, as well

as how we might seek to engage participants (Bourke, 2014, para. 2)

It is impossible while conducting a study to completely disregard ones’ cultural

background, biases, socio-economic status, and educational background during the data

collection process, especially when conducting semi-structured interviews. While preparing the

Positionality is the practice of a researcher delineating his or her own position in relation to the study, with the

implication that this position may influence aspect of the study, such as the data collected or the way in which it is

interpreted (Qin, 2016).

data for analysis, I performed a reflective “background check” by posing four questions and

reflecting on them as I continued through the research process.

 What role did my positionality as a technologist at an independent school with

considerable resources play, especially when inquiring about technology in the public

education sector where resources may be limited?

 What steps can I take to mitigate or lessen my positionality during the semi-structured

interview process?

 When analyzing data, how can I attempt to prevent my positionality from influencing

findings?

Ethical Considerations

This study’s methodology aligns with the required CUNY IRB standards to assure

participant confidentiality and minimalize any discomfort from taking part in the study.

Measures taken by the researcher also assured the confidentiality of participants. While there was

no foreseeable significant risk to the participants of the study, there existed the potential for

discomfort from revealing particular knowledge, or lack thereof, while completing the interview

and survey. The researcher digitally recorded interviews to facilitate with thematic coding. An

interview consent form, shown in Appendix J, provided each participant pertinent information

about the interview, including that the researcher would record the interview and that he would

follow all safeguards as required by the IRB.

Table 3.9. Raffle Details

Case

Questionnaire*

Semi-Structured Interviews*

Opted to

participate in raffle

Opted to not

participate

Opted to

participate

Opted to not

participate

HHCSD

PUFSD

TUFSD

Total†

†Totals do not include incomplete questionnaires or semi-structured interviews.

*Send and reply email exchanges acknowledging a “Raffle Winner” delivered from the email address:

Cloudcomputingwinner@computingny.com.

Two raffles served as incentives for participation. Participants who completed the online

questionnaire could take part in a raffle for one of two $50.00 Target gift card purchased by the

researcher for each participating district. Participants who completed the semi-structured

interview had another opportunity to take part in a secondary raffle for one $50.00 Target gift

card raffled purchased for each district. The researcher randomly selected the winners using an

online random lottery generator, Random Picker (www.randompicker.com) as detailed in Table

3.9. Winners were notified by email and provided with an online Target gift certificate and asked

to confirm receipt. There was critical consideration by the researcher with using a raffle as an

incentive to take part in the study. While the researcher felt that the use of monetary incentives

might have an impact on potential subjects’ choices to take part in the study, the financial

incentive of $50.00 was not considered excessive as the participants are employed adults with an

average salary

of $92,550. Thus, the researcher determined that the raffle incentive was

appropriate in relation to participation and time utilized for completing the questionnaire or

interview.

According to a 2016 article in LoHud, part of the USA Today News Service and a leading Lower Hudson Valley

newspaper, “Westchester County school districts pay educators an average of $92,550 a year, more than any other

county in New York, and the county is home to one of the highest-paid administrators in the state in 2015-16,

records show” (Spector & Wilson, 2016).

Summary

The researcher described the methods and procedures employed for the study within this

chapter. Also included in the chapter were the problem, research design, case sites, participants,

and instruments used in the study. The data collection process and tools implemented to analyze

the data were also present, in addition to a rationale for the use of an incentive lottery and

precautions taken to preserve confidentiality. The presentation of data collected from the

questionnaire, semi-structured interviews, and supporting documents in Chapter 4 will address

the research questions. Chapter 5 concludes with the researcher’s findings, recommendations,

implications, and conclusion.

Chapter 4 - Data Analysis and Findings

When asking “What is your definition of the Cloud?”

“I see a Cloud but I think servers underground in Nevada…… “

“A bunch of computers in a warehouse in a desert ……”

“An internet based website that hosts information with unlimited storage ……”

“The Cloud is a virtual data network within which the user has access to files, apps, and other digital

media via a range of platforms and devices ……”

(Participant responses collected from the online questionnaire)

What is Data Analysis?

In the purest sense, intelligence is the end product of an analytic process that evaluates information collected

from diverse sources; integrates the relevant information into a logical package; and produces a conclusion … by

using the scientific approach to problem solving (that is, analysis).(Carter, 2009, p. 9)

This chapter presents the study’s observations and key findings. The purpose of this study

is to gain a deeper understanding of how faculty view Cloud-based computing, how they

perceive issues of privacy, security, and trust (PST) when using Cloud-based systems in schools,

and what differences, if any, exist between their at-home use of Cloud-based applications and

services and their use of these and similar systems at work. Quantitative and qualitative data

analyzed and discussed in this chapter assist with answering the three research questions:

1. How do faculty and administrators understand the concept of Cloud computing as used

in K-12 public education?

2. How do faculty and administrators perceive the issues of privacy, security, and trust

(PST) as related to Cloud computing?

3. How may perceptions of PST differ when completing school related tasks as compared

to personal, non-work related tasks?

Following the study’s mixed method approach using concurrent sampling, two sections

of this chapter present qualitative and quantitative findings separately. The first section presents

quantitative data as descriptive statistics, providing the background of the cases beyond the

introductory demographics presented in Chapter 3. The descriptive statistics presented in this

chapter look at the frequency, means, and other measures of respondents’ understanding of the

Cloud and of Privacy, Security, and Trust (PST). The variables considered include respondents’

age, gender, work experience, and the frequency of access of cloud-based services and

applications for work and home related tasks, among others.

The second section and bulk of this chapter presents qualitative data and analysis. This

two-part process allowed the researcher to synthesize themes and then formulate generalizations

and observations to cultivate answers as findings. Chapter 5, as part of the conclusion and

implications of this study, presents in further detail the emergent themes, observations, and

findings discussed in this chapter.

Quantitative Analysis - Participating School Districts

This section presents descriptive data of the three school districts: Hendrick Hudson

(HHCSD), Pelham (PUFSD), and Tuckahoe (TUFSD). This section also provides detailed data

on respondents’ understanding of the Cloud, use of Cloud-based applications and services, and

perceptions of PST.

In all, 72 faculty and administrators, accounting for 14% of all those employed across the

three districts, completed the online questionnaire (see Table 4.1). Rates of participation across

the three districts were similar, with 12% of PUFSD, 14% of HHCSD, and 17% of TUFSD

faculty and administrators participating in the study. Of the 72 respondents, 15% (11) agreed to

participate in the semi-structured, follow-up interviews. Thirty potential respondents across the

three cases, which accounts for nearly 6% of the 528 educators invited to partake in this study,

began the questionnaire only to exit within the first three minutes. The questionnaire required an

average of 22 minutes to complete in its entirety. The researcher believes that the length of the

questionnaire was not a contributing factor for the 6% non-completion rate. One factor which

may contribute to the non-completion rate could be that the respondents had to complete the

survey in one sitting as it could not be re-opened once a would-be respondent exited by closing

the Internet browser.

Table 4.1. District Participation- Questionnaire

Faculty

Questionnaires

Interviews

District

Completed

(%)

Incomplete (%)

Ave. Time to

Complete*

Participants (%)

HHCSD

(2015 – ’16)

212

30 (14.1)

16 (7.5)

22 min.

3 (10.0)

PUFSD

(2014 – ’15)

227

27 (11.9)

11 (4.8)

22 min.

4 (14.8)

TUFSD

(2015 – ’16)

15 (16.9)

3 (16.8)

23 min.

4 (26.7)

Total (N)

528

72 (13.6)

30 (5.6)

22 min.

11 (15.3)

*There are 15 respondents not included in the calculation of the Average Time for questionnaire completion as

each of these respondents’ time to complete exceeded 1 hour, with two respondents spending 15 and 16 hours

to complete. These outliers possibly maintained an active session over an extended period of time and returned

later to complete the questionnaire.

The general demographic descriptors collected using the questionnaire included gender,

age, and years of work experience. This data is useful for exploring correlations between

variables, such as (a) age and participants’ understanding of the Cloud, and (b) Cloud-based

services or applications and participant’s perceptions of PST. The researcher categorized age of

participants across three 15-year age brackets. These brackets showed a normal distribution with

42% of responses collected from participants of Age Group 2 (36 to 49 years); followed by Age

Group 1 (20 to 35 years), who accounted for 31% of respondents; and Age Group 3 (50 years or

older), who accounted for 28% of responses (see Table 4.2). While the researcher did not

consider the gender of respondents an integral part of this study, it is interesting to note that 81%

of the respondents were female, while 19% were male (see Table 4.2). This gender gap is

somewhat in alignment with the national breakdown of faculty gender as researched by the

National Center for Education Statistics (NCES), noting that “about 77 percent of public school

teachers were female and 23% were male in 2015–16” (NCES, 2018, para. 2).

Table 4.2. Respondent’s Age and Gender

(N=72)

Table 4.3. Years Teaching and Participant Faculty Type

Teaching Experience in Years?

Faculty Type

District

1 to 5

Years

6 to 10

Years

11 to 20

Years

More than

20 Years

Teaching

Faculty

Depart. Head /

Guidance /

Administrator

HHCSD

PUFSD

TUFSD

Total

6 (9.0)

13 (20.0)

25 (39.0)

20 (31.0)

64 (89.0)

8 (11.0)

(N=72)

Across the three cases, the number of years teachers have taught, either full or part-time,

ranged from 1 year to more than 20 years, with an average of 15 years (M=15, SD = 6.48 years).

Teachers and other instructional faculty accounted for 89% of respondents, while principals, vice

principals, guidance counselors, department heads, and other administrators, all who did not hold

instructional responsibilities, accounted for 11% of responses (as shown in Table 4.3).

Age Categories

Gender

District

20-35 (%)

36-49 (%)

50+ (%)

Male (%)

Female (%)

HHCSD

6 (20.0)

14 (46.7)

10 (33.3)

4 (13.3)

26 (86.7)

PUFSD

8 (29.6)

14 (51.9)

5 (18.5)

9 (33.3)

18 (66.7)

TUFSD

8 (53.3)

2 (13.3)

5 (33.3)

1 (6.6)

14 (93.3)

Total

22 (30.6)

30 (41.7)

20 (30.6)

14 (9.4)

58 (80.6)

Descriptive summary of research question 1. How do school faculty and administrators

understand the concept of Cloud computing as used in K-12 public education? This question is at

the core of the study, and the following descriptive data provides a number of basic findings and

discussion of respondents’ understanding and knowledge of the Cloud. These findings and

discussion provide an outline for further descriptive inquiry while also providing a springboard

for the in-depth follow-up in the qualitative analysis section of this chapter. Data collected from

the questionnaire is presented across the three cases to provide a general overview as shown in

Table 4.4.

Table 4.4. Describe your "Cloud Knowledge" – Across the Three Cases

Frequency (%)

Cumulative %*

Very Knowledgeable

10 (13.8)

Somewhat Knowledgeable

39 (54.1)

68.1

Not Very Knowledgeable

22 (30.5)

No Idea

1 (1.4)

31.9

Total

72 (100)

100

*Cumulative % is the sum of the two knowledgeable responses sets, “Very Knowledgeable” or “Somewhat

Knowledgeable” and a separate sum of not knowledgeable response sets, selecting “Not Very Knowledgeable” or

having “No Idea.”

Item 4 of the questionnaire asked respondents “Which sentence best describes how much

you know about the Cloud?” Respondents chose from a 5-point Likert-scale ranging from Very

Knowledgeable to No Idea. Responses collected from this item provided a descriptive baseline

used to further gauge respondents’ actual understanding of the Cloud which was especially

useful for analyzing open-ended questions later expanded on in the qualitative potion of this

chapter.

Across the three cases, 68% of respondents chose Very Knowledgeable to Somewhat

Knowledgeable while nearly 32% choose Not Very Knowledgeable or that they had No Idea, as

shown below in Table 4.4. In simpler terms, nearly two thirds of all respondents felt that they

were Somewhat to Very knowledgeable of Cloud-based computing, while nearly one third felt

that they were Not so Knowledgeable or had No Idea what the Cloud was. These findings are

somewhat higher than those noted in a 2017 Consumer Cloud Security Survey that found, among

other things, that “55% of respondents are very or somewhat confident in their knowledge of the

cloud” (Panko, 2017, p. 1).

Exploring the same question on a case-by-case basis, 57% of respondents from HHCSD

noted that they were Somewhat Knowledgeable or Very Knowledgeable, while 60% of TUFSD

respondents also said that they were either Somewhat Knowledgeable or Very Knowledgeable,

and nearly 75% of respondents at PUFSD expressed similar sentiments (see Table 4.5). The

overall mean for the three sites was 64%, which translates to nearly two-thirds of respondents

who felt they were Somewhat Knowledgeable or Very Knowledgeable when asked how much

they know about the Cloud. Similarly, 26% of PUFSD stated that they were either Not Very

Knowledgeable or had No Idea about the Cloud, with 33% of respondents from HHCSD and

40% from TUFSD stating the same.

The overall mean for the three sites was 64%, which translates to nearly two-thirds of

respondents who felt they were Somewhat Knowledgeable or Very Knowledgeable when asked

how much they know about the Cloud. Similarly, 26% of PUFSD stated that they were either Not

Very Knowledgeable or had No Idea about the Cloud, with 33% of respondents from HHCSD

and 40% from TUFSD stating the same.

Table 4.5. Describe your Cloud Knowledge- Case by Case

District

HHCSD (%)

Cum. %*

PUFSD (%)

Cum. %*

TUFSD (%)

Cum. %*

Total N

Total %

Very

Knowledgeable

5 (16.7)

4 (14.8)

1 (6.7)

Somewhat

Knowledgeable

15 (50.0)

56.7

16 (70.0)

74.8

8 (53.3)

60.0

68.1

Not Very

Knowledgeable

10 (33.3)

6 (22.2)

6 (40)

No Idea

33.3

1 (3.7)

25.9

40.0

31.9

Total Respond./

Case

30 (41.6)

27 (37.5)

15 (20.8)

100

*Cum. %, or Cumulative %, is the sum of the two responses sets, “Very Knowledgeable” or “Somewhat

Knowledgeable” and a separate sum of response sets, who selected “Not Very Knowledgeable” or having “No

Idea.”

The question, “Which sentence best describes how much you know about the Cloud?” is

a Likert-scaled item that asks respondents to provide an opinion of their level of understanding

of the Cloud while also providing a descriptive baseline that can be used to further gauge

respondents’ actual understanding of the Cloud. This is especially useful when analyzing the

open-ended question responses, which the qualitative potion of this chapter later expands on.

Table 4.6. Do you need the Internet to access the Cloud?

District

Yes (%)

No (%)

I don’t Know/ Not

Sure (%)

Total (%)

HHCSD

29 (96.6)

1 (3.0)

30 (41.7)

PUFSD

23 (85.0)

2 (7.4)

27 (37.5)

TUFSD

14 (93.3)

1 (6.6)

15 (20.8)

Total

66 (91.7)

2 (2.8)

4 (5.5)

72 (100)

(N = 72)

The next question that assists in gauging respondents’ understanding of the Cloud is Item

14, “Do you need the Internet to access the Cloud?” Nearly 92% of respondents across all cases

saw Internet connectivity as a requirement of Cloud access, while only 3% responded that the

Internet was not needed while nearly 6% of respondents were unsure (Table 4.6).

Respondents’ understanding of Cloud-based services and applications varied

considerably. Item 14 asks, “Which of the following programs/applications do you consider to be

Cloud based?” Six subset questions provided to respondents asked if a particular service or

application was Cloud-based and to choose either Yes or No or the opt-out “I prefer not to

answer” choice. A subset of three questions asked if “Microsoft Office,” “MP3 music stored on

your phone,” and “Documents and Files on your personal phone/laptop” were Cloud-based.

While the one application, Microsoft Office, is installed locally and the two file formats are

noted as being “on your personal phone/laptop,” they are not Cloud-based. Across the cases,

92% responded that iTunes & Google Drive are Cloud-based. Similarly, 76% responded that

email is Cloud-based, while 71% responded that social media such as Facebook and Instagram

are Cloud-based (see Table 4.7).

Table 4.7. Do you need the Cloud to access Applications/Services?

Which of the following programs/applications do you consider to be Cloud based?

District

iTunes / Google

Drive

Social

Media

Google

Suite /

MS 365

Netflix /

Hulu

Online

Shop

& Bank

MP3

Music on

Phone

Docs &

Files on

Laptop

Office

HHCSD

28 (93.3)

21 (70.0)

20 (66.7)

17 (56.7)

14 (46.7)

12 (40.0)

6 (20.0)

5 (16.7)

3 (10.0)

PUFSD

24 (88.9)

22 (81.4)

21 (77.8)

20 (74.0)

13 (48.1)

6 (22.2)

5 (18.5)

4 (15.8)

TUFSD

14 (93.3)

12 (80.0)

10 (66.7)

7 (49.7)

6 (40.0)

2 (13.3)

Total

66 (92.0)

55 (76.0)

51 (71.0)

47 (66.0)

34 (47.0)

31 (43.0)

14 (19.0)

12 (17.0)

9 (13.0)

(N = 72)

The subset of three baseline questions asking if “Microsoft Office,” “MP3 music stored

on your phone,” and “Documents and Files on your personal phone/laptop” are Cloud-based

elicited the fewest positive responses. Nearly 19% of all survey completers responded that “MP3

music stored on your phone” is Cloud-based, 17% responded that “Documents and Files on your

personal phone/laptop” are Cloud-based, and 13% believed that Microsoft Office installed on

your laptop is Cloud-based.

Two observations included participants not understanding that video streaming and

online shopping and banking are Cloud-based

. Nearly half of all participants, or 47%, agreed

that video streaming is a Cloud-based service, while 43% believed that online shopping and

banking are Cloud-based services (Table 4.7). Between 47% and 48% of respondents agreed that

video streaming is Cloud-based, and between 40% and 48% of respondents agreed that online

shopping and banking are Cloud-based.

Two question banks added near the beginning of the survey aimed to gauge participants’

understanding of the Cloud regarding personal tasks compared to work-related tasks. Participants

responded to whether the Cloud outside of work allowed them access to email, social media, and

online banking, as well as their ability to share documents, images, and music. Participants then

responded to similar questions Cloud use for work-related tasks including access to district

email, collaborating with faculty, sharing files with colleagues and similar. Would there be any

differences in how participants thought of the Cloud for personal use as compared to work? Item

12, “Using the Cloud outside of work allows me to…” asked respondents to select all applicable

tasks and applications that could be completed when using the Cloud. Item 13, “Using the Cloud

for work-related tasks as an educator allows me to…” asked respondents to select all applicable

tasks and applications that could be completed when accessing the Cloud for personal use.

Video streaming, online shopping and banking extensively utilizes the Cloud. All three examples require Cloud-

based services (SaaS and PaaS) and a hybrid of Cloud deployment models (Public, Private, and Hybrid) for effective

delivery and accessibility. The researcher did not expect respondents to have a thorough knowledge of the Cloud-

for example, knowing about Cloud services or deployment models.

Item 12.1 of the questionnaire asked participants if using the Cloud outside of work

allowed them to share documents, images and files while Item 13.1 asks a similar question about

using the Cloud for work-related tasks such as collaborating with other faculty members by

sharing files such as Word Documents and spreadsheets. Across the cases, 79% of respondents

agreed that using the Cloud outside of work allowed them to share documents, images and files

while nearly 88% of respondents agreed to the same for work related tasks (Table 4.8).

Table 4.8. Using the Cloud to share Documents

Q. 12.1

Q. 13.1

District

Share & Collaborate not for work (%)

Collaborate for Work (%)

HHCSD

22 (73.3)

25 (83.3)

PUFSD

22 (81.5)

24 (88.9)

TUFSD

13 (86.7)

14 (93.3)

Total

57 (79.2)

63 (87.5)

(N=72)

Item 12.5 asked respondents if using the Cloud outside of work (for personal use)

allowed them access to email and social media while Items 13.2 and 13.4 asked the similar

question but for work-related communication with faculty, parents and students as shown in

Table 4.9. Nearly 74% of respondents of Item 12.5 believed that the Cloud allowed them access

to personal, non-work related email and social media, such as Facebook and Instagram while

64% of respondents of Item 13.2 agreed that the Cloud allowed them access to their district

issued email account. Item 13.4 posed a similar question asking if using the Cloud for work

allowed them to “communicate electronically with parents.” This question, is a variation of Item

13.2 and presented in a broader context to include email and other communication and

collaboration platforms. Nearly 54% of respondents agreed that the Cloud did allow for them to

electronically communicate with parents which is a lower response rate than reported for Item

13.2 which asks the same question but worded differently.

Table 4.9. Using the Cloud for Electronic Communication

District

Q. 12.5

Access Email &

Social Media (%)

Q. 13.2

Use District

Email (%)

Q. 13.4

Communicate Electronically

with Parents (%)

HHCSD

22 (73.3)

19 (63.3)

16 (53.3)

PUFSD

19 70.4)

19 (70.4)

17 (63.0)

TUFSD

12 (80.0)

7 (46.7)

6 (40.0)

Total

53 (73.6)

45 (63.5)

39 (54.2)

(N=72)

A final set of descriptive statistics that provides further discussion of Research Question

1 involves how many times a week respondents accessed the Cloud for personal reasons (Item

15) and then for work related reasons (Item 16). These items’ questioning strategy is rather broad

in concept as access the Cloud for “personal reasons” or access the Cloud for “work related

reasons” could be interpreted as accessing any application or service that is thought by the

respondent to be Cloud-based. Accessing the Cloud for “personal reasons” could be for email,

video streaming, Dropbox or accessing music in iCloud. Similarly, accessing the Cloud for

“work related reasons” can include reviewing student’s work, reporting attendance, checking

school email or collaborating with other faculty while logged into Microsoft 365. Item 15 askes

respondents how many times a week do they access the Cloud for personal, non-work related

tasks while Item 16 asks how many times a week do respondents access the Cloud for work

related tasks. Across the cases, nearly 76% of respondents noted that they access the Cloud one

or more times a day for personal, non-work reasons while 82% of the respondents noted that they

accessed the Cloud one or more times a day for work related reasons. These findings show that

respondents access the Cloud at nearly the same frequency at home (76%) as at work (82%).

Across the cases, 15% of the respondents noted that they “almost never” access the Cloud or

“occasionally” at 2 to 3 times a week for personal, non-work related reasons. Similarly, 14% of

respondents noted that they “almost never” access the Cloud or “occasionally,” 2 to 3 times a

week for work related reasons. Nearly 77% of respondents stated that they access the Cloud for

personal, non-work related tasks “once to multiple times a day” while for work related tasks,

respondents noted a slightly higher frequency of 82% for accessing the Cloud for work-related

tasks (Table 4.10).

Table 4.10. Frequency of Respondents Access of the Cloud

Q 15.

Q 16.

District

Once a day

to Multiple

Times (%)

Once a

week (%)

Almost

Never to

3 Wk. (%)

Prefer

not to

Ans. (%)

Once a day

to Multiple

Times (%)

Once a Week

(%)

Almost

Never to

3 Wk. (%)

Prefer not

to Ans.

(%)

HHCSD

22 (73.3)

1 (3.3)

6 (20.0)

1 (3.3)

24 (80.0)

1 (3.3)

3 (10.0)

2 (6.7)

PUFSD

21 (77.8)

3 (11.3)

2 (7.4)

1 (3.7)

23 (85.2)

0 (0)

4 (14.8)

0 (0)

TUFSD

12 (80.0)

0 (0)

3 (20)

0 (0)

12 (80.0)

0 (0)

3 (20.0)

0 (0)

Total

55 (76.4)

4 (5.6)

11 (15.3)

2 (2.8)

59 (81.9)

1 (1.4)

10 (13.9)

2 (2.8)

(N=72)

The frequency of “Cloud access” by respondents was of interest, considering the absence

of a particular application or service for either item. It is also possible that respondents may have

been using “the Cloud” interchangeably with “the Internet” and then answering these items

thinking of accessing “the Cloud” as a metaphor for “the Internet.”

In preliminary terms, the majority of respondents do show a fairly grounded

understanding of the Cloud. A fairly large number of respondents knew that the Internet was

needed to access the Cloud and that a number of the most commonly accessed services and

applications are Cloud based such as iTunes, Google Drive, email, streaming services and work

related G-Suite. A fairly large number of respondents also noted that they access a Cloud-based

application or service “once to multiple times a day.” and that they access Cloud-based

applications for work more frequently than for personal reasons.

Descriptive summary of research question 2. How do faculty and administrators

perceive the issues of privacy, security, and trust (PST) related to Cloud-based computing?

Having provided a descriptive background on participants understanding of the Cloud, a logical

next step is to provide a descriptive background on participant’s perceptions of PST. The most

practical way to explore this question is to first look at participant’s perceptions of PST in a

broad context related to daily routines, interactions and relationships and then in the context

related to Cloud-based computing.

Privacy. Items 21.1 and 21.2 asks respondents about their perceptions of privacy in

general and broad terms not directed towards technology or in particular, the Cloud. Item 21.1 of

the questionnaire asked respondents to choose a level of agreement with the statement: “Privacy

is the ability to choose what I share.” Across the cases, 93% of respondents Agreed or Strongly

Agreed with this statement while nearly 7% Disagreed or Strongly Disagreed. Item 21.2 asked

respondents to choose their level of agreement with the statement- “Privacy is the ability to keep

information within a specific “circle of confidants” such as family or close friends.” Across the

cases, nearly 92% of respondents Agreed or Strongly Agreed while just over 8% were either

Neutral, Disagreed or Strongly Disagreed (Table 4.11).

Table 4.11. Perceptions of Privacy in General Terms

Q 21.1.

Q 21.2.

District

Strongly Agree

to Agree

Disagree to

Strongly Disagree

Strongly Agree

to Agree

Disagree to

Strongly Disagree

HHCSD

28 (93.3)

2 (6.7)

27 (90.0)

3 (10.0)

PUFSD

25 (92.6)

2 (7.4)

26 (96.3)

0 (0)

TUFSD

14 (93.3)

1 (6.7)

13 (86.7)

2 (13.3)

Total

67 (93.1)

5 (6.9)

66 (91.7)

5 (6.9)

(N=72)

A gradual decrease in the frequency of respondent’s agreement emerged when asking

respondents of their level of agreement for similar statements in regards to the issue of privacy in

terms of the Cloud. Item 21.6 asked respondents to choose their level of agreement with the

statement- “Privacy is knowing that information I upload to the Cloud is kept to myself and

shared only with who I have allowed the information to be shared with.” While 86% of

respondents either Agreed or Strongly Agreed with this statement, 8% were neutral, Neither

Agreeing or Disagreeing and nearly 6% either Disagreed or Strongly Disagreed (Table 4.12).

Item 21.9 also shown in Table 4.12 asks for respondent’s level of agreement of the statement-

“Information, data and documents that I upload to the Cloud are “private” if they are shared only

with people and businesses who I have chosen to share them with.” This Item had a lower

positive response rate of 58% who Agreed or Strongly Agreed and 19% of respondents who were

neutral and just over 23% respondents either in Disagreement or Strong Disagreement with the

statement (Table 4.12).

Table 4.12. Perceptions of Privacy with Regards to the Cloud

Q. 21.6.

Q. 21.9.

District

Strongly

Agree to

Agree (%)

Neither

Agree or

Disagree (%)

Disagree to

Strongly

Disagree (%)

Strongly

Agree to

Agree (%)

Neither

Agree or

Disagree (%)

Disagree to

Strongly

Disagree (%)

HHCSD

28 (93.3)

1 (3.3)

15 (55.6)

7 (25.9)

5 (18.5)

PUFSD

21 (77.8)

4 (14.8)

2 (7.4)

14 (51.9)

6 (22.2)

7 (25.9)

TUFSD

13 (86.7)

1 (6.7)

11 (73.3)

0 (0)

4 (26.7)

Total

62 (86.1)

6 (8.3)

4 (5.6)

40 (58.0)

13 (18.8)

16 (23.2)

(N=72)

The findings of Table 4.11 and Table 4.12 show that respondents do perceive the issue of

privacy differently when discussed in general terms and then when discussed in terms of the

Cloud. Respondents may possibly perceive that they have less control over privacy when related

to the Cloud.

Table 4.13. Perceptions of Security in General Terms

Q. 24.1

Q. 24.3

District

Strongly

Agree to

Agree (%)

Neither

Agree or

Dis. (%)

Dis. to

Strongly

Dis. (%)

Strongly Agree

to Agree (%)

Neither Agree

or Dis. (%)

Dis. to

Strongly

Dis. (%)

HHCSD

12 (40.0)

5 (16.7)

13 (43.3)

30 (100.0)

0 (0.0)

PUFSD

13 (48.1)

4 (14.8)

10 (37.0)

24 (88.9)

2 (7.4)

1 (3.7)

TUFSD

6 (40.0)

2 (13.3)

7 (46.7)

11 (73.3)

1 (6.7)

3 (20.0)

Total

31 (43.1)

11 (15.3)

30 (41.7)

65 (90.3)

3 (4.2)

4 (5.6)

(N=72)

Security. For the purpose of this study, security refers to “information security” firstly as

related to the exchange of information through daily routines, interactions and communications

then secondly, “information security” related to Cloud-based computing. Item 24.1 shown in

Table 4.13 asked respondents to choose their level of agreement with the statement-

“Information is ‘secure’ when I am able to share it with others, and I am confident they will not

then share that information with others.” The aim of Item 24.1 was to learn how respondents

perceived the issue of security as related to general interactions, daily routines and

communications not related to technology or Cloud-based computing. Just over 43% of

respondents Agreed or Strongly Agreed with this statement while 15% were neutral and nearly

42% Disagreed or Strongly Disagreed as shown in Table 4.13. Item 24.3 asked respondents of

their level of agreement with the statement– “Security” is when I am confident that other people

cannot access my “things” or property without my consent.” This statement had the greatest

response rate of 90% of respondents Agreeing or Strongly Agreeing with slightly over 4% of

neutral responses and 6% Disagreed or Strongly Disagreed as also shown in Table 4.13.

Item 24.4 and Item 24.5 (Table 4.14) focused on the issue of security in terms of Cloud-

based computing. Item 24.4 asked respondents their level of agreement with the statement:

“‘Security’ in terms of the Cloud is knowing that there are safeguards in place that protects

information and data from being accessed by unauthorized persons.” Item 24.5 asked about their

level of agreement with the following statement: “The Cloud has a number of layers of security

that protects my information and data from unauthorized persons and/or businesses.” Nearly

89% of respondents Agreed or Strongly Agreed with this Item 24.4, while 8% of responses were

neutral, and just under 3% of respondents Disagreed or Strongly Disagreed. The findings for

Item 24.5 were different from those for Item 24.4, with a larger number of respondents selecting

Neither Agree or Disagree; one interpretation of these results is that respondents are taking a

neutral stance. While the majority of respondents (68%) did either Strongly Agree or Agree that

the Cloud provided mechanisms of security to protect data (i.e., Item 24.5), there was a much

larger number of respondents who Neither Agree or Disagree (25%) with this statement, and

nearly 7% who either Disagreed or Strongly Disagreed, as shown in Table 4.14.

Table 4.14. Perceptions of Security in Terms of the Cloud

Q. 24.4

Q. 24.5

District

Strongly

Agree to

Agree

Neither

Agree or

Disagree

Disagree to

Strongly

Disagree

Strongly

Agree to

Agree

Neither

Agree or

Disagree

Disagree to

Strongly

Disagree

HHCSD

26 (86.7)

4 (13.3)

0 (0)

20 (66.7)

8 (26.7)

2 (6.7)

PUFSD

25 (92.6)

1 (3.7)

20 (74.1)

6 (22.2)

1 (3.7)

TUFSD

13 (86.7)

1 (6.7)

9 (60.0)

4 (26.7)

2 (13.3)

Total

64 (88.9)

6 (8.3)

2 (2.8)

49 (68.1)

18 (25.0)

5 (6.9)

When comparing the findings presented in Table 4.13 and Table 4.14, it can be observed

that respondents perceptions of security, in general terms, which are not related specifically to

the Cloud, were somewhat mixed with nearly half (43%) agreeing that information is secure

when the respondent is confident that safeguards to protect the information is in place (Item

24.1). However, when viewing security (Item 24.3) as a “gate” or even a metaphoric physical

barrier that prevents access to “property” without consent, just over 90% of respondents agreed

that information or “things could not be accessed without consent while almost 10% were neutral

or Neither Agreed or Disagreed as shown in Table 4.13.

When discussing security in terms of the Cloud, nearly 90% of respondents agreed that

security is knowing that safeguards are in place to protect information (Item 24.4). This is also

similar to respondents’ perceptions of security when viewed in metaphorical terms of a “gate” or

physical barrier as findings for Item 24.3 show as being very similar. This could suggest that

respondents have a greater level of confidence level of security when discussed in

metaphorically “physical” means, which can include non-human safeguards possibly

implemented as in the Cloud. These safeguards include “layers of security” built into a Cloud

model as noted in the statement for Item 24.5 as shown in Table 4.14.

Trust. For the purpose of this study, trust is defined as “a measure or level of confidence

in something or someone” (Bilecki & Fiorese, 2016; Simpson, 2007). Item 27.1 asked

respondents to choose their level of agreement with the statement- “I ‘trust’ someone when I

know they are honest and that we have the same understanding of what it means to be truthful”.

Nearly 96% of respondents Agreed or Strongly Agreed while 4% either Disagreed or Strongly

Disagreed with this statement. Similarly, Item 27.3- “’Trust’ is the ability to share very private

information, documents and secrets with people who promise to keep the information to

themselves.” Nearly 85% of respondents Agreed or Strongly Agreed, while 8% of respondents

were neutral and nearly 7% Disagreeing or Strongly Disagreeing with the statement. The

purpose of Items 27.1 and 27.3, which are shown in Table 4.15, was to learn how respondents

perceived the issue of trust when outside of the realm of technology and the use of the Cloud.

Table 4.15. Perceptions of Trust in General Terms

Q. 27.1

Q. 27.3

District

Strongly

Agree to

Agree (%)

Neither

Agree or

Disagree (%)

Disagree to

Strongly

Disagree (%)

Strongly

Agree to

Agree (%)

Neither

Agree or

Disagree (%)

Disagree to

Strongly

Disagree (%)

HHCSD

28 (93.3)

2 (6.7)

27 (90.0)

2 9(6.7)

1 (3.3)

PUFSD

26 (96.3)

1 (3.7)

21 (77.8)

3 (11.1)

TUFSD

15 (100.0)

13 (86.7)

1 (6.7)

Total

69 (95.8)

3 (4.2)

61 (84.7)

6 (8.3)

5 (6.9)

Respondents showed a relatively high regard for interpersonal trust, especially with

others who share the same or similar understanding of integrity and truthfulness as reported by

the findings for Items 27.1 and 27.3. Item 27.4 with 83% of responses either Agreed or Strongly

Agreed that “Trust is having confidence that people who you share private matters with have the

same mutual understanding of trust as you do. Would findings for similarly worded items on

perceptions of trust when related to the Cloud be similar?

Preconceived notions of privacy, security, and confidentiality as well as ease of use of

Cloud-based applications and services, user familiarity, and understanding of the benefits of

technology can possibly influence respondents’ trust in Cloud-based computing. Item 27.5 and

Item 27.6, shown in Table 4.16, asked of respondents’ levels of agreement with the issue of trust

when using the Cloud. Item 27.5 asked respondents of their level of agreement with- “’Trust’ as

related to the Cloud can be gauged by the security measures that they [Cloud providers]

provide.” Seventy-five percent of respondents Agreed or Strongly Agreed with this statement

while nearly 14% of responses were neutral and 11% who Disagreed or Strongly Disagreed.

Similarly, just over 86% of respondents Agreed or Strongly Agreed with the statement, “’Trust’

in terms of the Cloud is knowing that information and data that you upload is protected and

secured as so only people who you have granted access and/or authorized can access the

information and data” (Item 27.6).

Table 4.16. Perceptions of Trust in Terms of the Cloud

Q. 27.5

Q. 27.6

District

Strongly

Agree to

Agree

Neither

Agree or

Disagree

Disagree to

Strongly

Disagree

Strongly

Agree to

Agree

Neither

Agree or

Disagree

Disagree to

Strongly

Disagree

HHCSD

26 (86.7)

3 (10.0)

1 (3.3)

27 (90.0)

2 (6.7)

1 (3.3)

PUFSD

17 (63.0)

5 (18.5)

22 (81.5)

4 (14.8)

1 (3.7)

TUFSD

11 (73.3)

2 (13.3)

13 (86.7)

1 (6.7)

Total

54 (75.0)

10 (13.9)

8 (11.1)

62 (86.1)

7 (9.7)

3 (4.2)

Table 4.17. Trust in General Terms and Associated with the Cloud.

Q. 27

27.1

27.2

27.3

27.4

27.5

27.6

27.7

27.9

District

Strongly

Agree to

Agree

Strongly

Agree to

Agree

Strongly

Agree to

Agree

Strongly

Agree to

Agree

Strongly

Agree to

Agree

Strongly

Agree to

Agree

Strongly

Agree to

Agree

Strongly

Agree to

Agree

HHCSD

28 (93.3)

26 (86.7)

27 (90.0)

26 (86.7

27 (90.0)

8 (26.7)

19 (63.3)

PUFSD

26 9 (96.3)

19 (70.4)

21 (77.8)

22 (81.4

17 (63.0)

22 (81.5)

5 (18.5)

19 (70.4)

TUFSD

15 (100.0)

12 (80.0)

13 (86.7)

11 (73.3

13 (86.7)

8 (53.3)

12 (80)

Total

69 (95.8)

57 (79.2)

61 (84.7)

60 (83.3)

54 (75.0)

62 (86.1)

21 (29.2)

50 (69.5)

These findings showed that respondent’s trust of the Cloud varies with the security

measures and safeguards put in place by the Cloud providers. The more proactive a Cloud

provider is with taking measures to protect data, the more trust respondents had in using the

Cloud as seen with the findings for Item 27.5. As seen with the findings for Item 27.6,

respondents have a greater trust of the Cloud when they know their data is secure and can be

accessed only those with proper authorization. Findings in regards to trust when referring to

interpersonal interactions (Items 27.1 through 27.4) had a greater level of agreement the findings

for trust when associated with Cloud-based computing (Items 27.5, 27.6, 27.7 and 27.9) showed

less frequency of agreement as shown in Table 4.17.

Descriptive summary of research question 3. How may perceptions of PST differ when

completing school related tasks as compared to personal, non-work related tasks? This is a

difficult research question to descriptively measure due to limitations related to the working of

particular items on the questionnaire. However, it is possible to make general observations by

reviewing the descriptive summaries of particular items within two sets of questions asked on the

survey. The first set of questions includes items from Question 12 – “Using the Cloud outside of

work allows me to…” and items from Question 13 – “Using the Cloud for work-related tasks…”

The second set of questions includes items from Questions 21 (Privacy), Question 24 (Security),

and Question 27 (Trust). While Questions 21, 24, and 27 discuss perceptions of PST, they do not

differentiate between work and non-work related tasks. Only a general view of PST derives from

these items irrespective of task type. The same is true for items in Questions 12 and 13, which

discuss using the Cloud outside of work (for personal use) as well as for work-related tasks.

Once again, perceptions of PST with respect to task type cannot be differentiated in Questions 12

and 13. Items in Question 12 – “Using the Cloud outside of work allows me to…” asks

respondents about using the Cloud to share documents, images and files, email, social media, and

for accessing productivity suites. Items in Question 13 – “Using the Cloud for work-related

tasks…” asks respondents about using the Cloud to share documents, collaborate, and

communicate with faculty, students, and parents while accessing student related applications for

attendance, grading, and assignments. Both questions have a similar structure, with 6 items and

one “opt out” item and an “Other” fill in the blank item, as shown in Table 4.18.

Table 4.18. Using the Cloud for Non-Work and Work Tasks

Q. 12

Q. 13

District

12.1

Files

(%)

12.2

Access

to Files

(%)

12.3

Use

Prod.

Suites

(%)

12.4

Access

Images

and

Music

(%)

12.5

Social

Media

(%)

12.6

Online

Bank

Shop

(%)

13.1

Coll.

(%)

13.2

(%)

13.3

Stud.

Data-

bases

(%)

13.4

Par.

Com.

(%)

13.5

Rev.

Stu.

(%)

13.6

Store

Student

Data

(%)

HHCSD

(30.6)

(37.5)

(23.6)

(34.7)

(30.6)

(18.1)

(34.7)

(26.4)

(16.7)

(22.2)

(23.6)

(22.2)

PUFSD

(30.6)

(20.8)

(33.3)

(26.4)

(20.8)

(33.3)

(26.4)

(19.4)

(23.6)

(25.0)

(30.6)

TUFSD

(18.1)

(19.4)

(9.7)

(18.1)

(16.7)

(6.9)

(19.4)

(9.7)

(11.1)

(8.3)

(11.1)

(9.7)

Total

(79.2)

(87.5)

(54.2)

(86.1)

(73.6)

(45.8)

(87.5)

(62.5)

(47.2)

(54.2)

(59.7)

(62.5)

Response rates for items in Questions 12 and 13 were overall positive, having a fairly

good level of agreement among respondents. The findings shown in Table 4.18 for items from

Question 12 have a respondent agreement range of 46% to 88% with an average of 71% of

respondents agreeing that using the Cloud outside of work allowed them access to a number of

services and applications. Similarly, items in Question 13 have nearly the same range from 47%

to 88% of agreement, but with a much lower average of 63% of respondents agreeing that the

Cloud was needed to access a number of work related applications and services. The findings for

the items in Questions 12 and 13 show that while respondents understood that using the Cloud

both “outside of work” (for personal use) and “for work” allowed them access to a number of

services and applications. However, a greater number of respondents believed that the Cloud as

used outside of work allowed greater access to applications and services than for using the Cloud

to access applications and services for work as the average response rate for Question 12 was

71% compared to that of 63% for Question 13.

Items of Questions 21, 24 and 27 ask about respondents’ levels of agreement of the

notions of privacy, security and trust in general terms and then in terms specific to Cloud-based

computing. These questions do not differentiate between using the Cloud “outside of work” (for

personal use) or “work-related” tasks. However, particular items from these three questions do

provide descriptive findings that extend across both the “outside of work” and “for work-related”

task groupings. Items 21.4 (Privacy), 24.4 (Security), and 27.6 (Trust) provide a relatively good

sense of respondents’ levels of agreement in regards to perceptions of PST in terms of the Cloud

and across the two task groups.

Respondents showed relatively high regard for the practice of ensuring effective

management and safeguarding of information and data uploaded to the Cloud (see Table 4.19).

Nearly 96% of respondents Agreed or Strongly Agreed that information and data is private when

maintained in a manner whereas only intended parties as delegated by the user can access it.

Similarly, nearly 89% of respondents Agreed or Strongly Agreed that effective security of

information and data is in place when unauthorized persons lack access. A nearly similar

response rate of 86% Agreed or Strongly Agreed with the notion of trust – that it is possible to

establish a level of trust when there is confidence that only originally intended parties have

access to information and data. While the items discussed above do not differentiate between

“outside of work” and “for work-related” tasks, they do provide a general understanding of

respondent’s perceptions of PST in terms of the Cloud.

Table 4.19. Levels of Agreement for PST

21.4

Privacy

Q. 24.4

Security

Q. 27.6

Trust

District

Agree or Strongly

Agree (%)

Agree or Strongly

Agree (%)

Agree or Strongly

Agree (%)

HHCSD

30 (100.0)

26 (86.7)

27 (90.0)

PUFSD

24 (88.9)

25 (92.6)

22 (81.5)

TUFSD

15 (100.0)

13 (86.7)

Total

69 (95.8)

64 (88.9)

62 (86.1)

While this final research question aimed to understand how perceptions of PST among

participants may have differed across work and non-work related tasks, the quantitative data

collected for the descriptive summaries only provides a general view of participant sentiments

regarding PST across each of these task types. The quantitative portion of this study provides a

foundation for participant sentiments regarding PST and work versus non-work related tasks, and

the qualitative portion further helps answer the third research question as to how perceptions may

differ across these task types. To fully answer the third research question, the following presents

a discussion of both quantitative as well as the qualitative data gathered from the interviews as

part of this mixed method approach.

Qualitative Analysis - Participating School Districts

This section presents and analyzes qualitative data collected from the semi-structured

interviews, the questionnaire and various case related documents. The researcher used a two-step

process to complete this data analysis. The first step involves the coding and categorizing of the

data into meaningful and salient themes (Figure 3.1) and the second step involves the cross-case

analysis of these themes among the three school districts (Figure 3.2). Chapter 4 discusses

emergent themes, observations, and overall findings of the qualitative portion of this study

alongside findings deriving from the quantitative survey data. The primary findings are presented

in Chapter 5 as part of the conclusion and implications of this study.

Qualitative Summary of Research Question 1

Two themes helped answer the first research question: How do school faculty and

administration understand the concept of Cloud computing as used in K-12 public education?

These themes covered the ways in which respondents described the Cloud, the advantages and

disadvantages of Cloud computing. The following sections discuss each of these two themes

along with their related sub-themes (see Table 4.20).

To assist with the fluidity of Chapter 4 and 5, the researcher used gender-neutral

pseudonyms to reference exemplary quotes instead of the semi-structured interview codes or

online questionnaire IDs. Quotes taken from participant respondents of the semi-structured

interviews are denoted using the surname initial of “S,” while quotes taken from respondents of

the online questionnaires have been denoted using the surname initial of “Q.” Minor grammatical

corrections have also been made to assist with the fluidity of the quotes for easier reading.

Table 4.20. Research Question 1 Themes and Sub-Themes

Research Question 1

Theme

Sub-Theme

Theme 1:

Describing the Cloud

 Respondent Definitions

 Metaphors of “the Cloud”

 The role of the Internet

 Respondents Self-Rating of Knowledge

Theme 2:

Advantages and Disadvantages of Cloud

Computing

 Overall Convenience

 Cloud-based storage

 Remote Accessibility

 Cloud Reliability

Theme 1: Describing the Cloud. Respondents’ description of the Cloud aided in

answering how school faculty and administration understood Cloud computing as used in K-12

public education. Specifically, when describing the Cloud, respondents often focused on one or

more of the four sub-themes (see Table 4.20). These sub-themes included participant’s

definitions of the Cloud, their use of metaphors to describe the Cloud, their tendency to describe

the Cloud in terms of the Internet, and respondents self-rating of their knowledge of the Cloud.

Sub-theme: Respondent definitions. Respondents provided a broad range of definitions

and descriptions of the Cloud. Jackie S. provided a vague and yet succinct description of the

Cloud as “saving your data on an external drive in the sky,” which used both concrete

terminology, “data on an external drive,” and a metaphorical descriptor, “external drive in the

sky.” Another respondent, Remi S. provided a succinct and detailed definition of the Cloud as

being “remote based computing where any individual can have access to files and information

from another remote based location.” A more comprehensive response collected from the online

questionnaire described the Cloud as:

A non-tangible entity, comprised of internet-hosted non-physical servers, that can

temporarily 'loan' processing power and resources on-demand to the individual machines

within the network of individuals who choose to 'buy in' and have access to the Cloud.

[Corey Q.]

These last two descriptions of the Cloud closely align with the 2011 National Institute of

Standards and Technology (NIST) definition of the Cloud. In light of their detailed descriptions,

it is of interest to note that neither Jackie S. nor Corey Q. teach technology or described

themselves as technologists or IT administrators. Jackie S. is an elementary grade level teacher,

while Corey Q. is a science and math teacher.

Use of Cloud-based terminology. A number of respondents used similar terms and

descriptions commonly associated with Cloud-based computing. The most commonly used

terminology included the Internet, remote storage and accessibility, remote computing and

memory, data accessibility, upload(ed), storage, and server. Jesse S. described the Cloud as

“remote storage where information is stored on the server, somewhere else, and can be accessed

by different channels.” Similarly, Jesse S. used terminology commonly associated with the

Cloud, including remote storage, accessibility and “somewhere else,” referring to data being

located remotely; this respondent also used the phrase “accessed by different channels,” which

refers to accessibility across multiple Internet ready devices. Another respondent described the

Cloud as not only accessible from various computing devices, but also from a smartphone. In

discussing the Cloud, this respondent explained it as,

A large system that you can upload documents or different things… from different

computers and different systems depending on where you are… I know it’s on my

phone… [and it is] always asking me to upload things to the Cloud to save room on my

[smart] phone or to save room on my laptop. [Casey S.]

100

While the description given by Casey S. uses conceptual wording, such as “large system” and

“different things, different computers and different systems,” this respondent also used

terminology directly related to the Cloud. Casey S. noted “remote accessibility from various

devices” and “remote storage,” demonstrating knowledge that by uploading to the Cloud, not

only are you using remote storage but also freeing up local storage on the computing device.

While the majority of respondents used terminology related to the Cloud such as remote storage,

accessibility and server, a few described the Cloud in broad terms without using Cloud-related

terminology. A small number of respondents used terminology not necessarily used by non-

technical, everyday users such as a virtual platform, scalability and system redundancy which

demonstrates a higher level of understanding of the Cloud, its characteristics, and features as

outlined in Mell and Grance’s 2011 NIST definition of the Cloud.

The Cloud in terms of productivity and as a fifth utility. A number of respondents

described the Cloud as a fifth utility, as a necessity, because of its seamless and ubiquitous

integration into nearly every facet of daily routines. Jesse S. described the Cloud as a fifth utility,

similar to public utilities such as electric, water, gas and sewer, envisioning greater dependence

on the Cloud as it continues to evolve. According to Jesse S.,

More and more [data and work tasks] are going to be moved to the Cloud as more

and more people want smaller and smaller devices, for instance where local

storage is no longer an option so to save space and also to free up speed and such.

It's going to be almost a necessity to have information stored in remote locations.

[Jesse S.]

Three other respondents shared similar sentiments when describing the Cloud, noting that

the Cloud is still in its infancy, and as dependence on Cloud-based applications continues

101

to grow, it will increasingly become a necessity, similar to a fifth public utility as

discussed earlier.

The location of the Cloud. Defining the Cloud also includes describing its location

in both physical and virtual terms. However, many people have not come to the

realization that despite uploading their data to the Cloud, that physical storage in a Cloud

datacenter is still needed. When asked, “Where is the Cloud located?” respondents

occasionally provided a virtual location such as “in the ether,” “cyberspace,” or “in the

sky.” Respondents occasionally also provided a physical “terrestrial” location, usually in

the western United States or stated that they envisioned a rural and remote area similar to

a desert or underground storage facility.

Respondents who described a virtual location included Sasha Q. who noted “an

actual Cloud in the sky where all of the world’s technological data is stored,” while

Micky Q. stated that the location was “literally… [in] a Cloud.” Other respondents such

as Blaine Q. discussed the location as being “out there in space,” while Mackenzie Q.

stated “data is saved in an alternate location.” Frequently, respondents who discussed the

Cloud in virtual terms did so because they were unclear of the storage location of their

data, once in the Cloud. Various marketing strategies that use a figure of the Cloud to

depict Cloud-based computing have reinforced this notion. Cloud computing researcher

Hu (2015) notes that the figure of the Cloud used today was first developed by AT&T

engineers in the 1970s who “used the symbol of a cloud to represent any unspecifiable or

unpredictable network, whether telephone network or Internet” (p. X) as a way to depict

complex communication networks where information traveled along unpredictable

circuits.

102

Respondents who described the Cloud as being at a physical and terrestrial

location frequently chose a western state of the United States, a dessert, or described the

Cloud being in a rural and remote location. When asked, “Where do you think the

information [data] goes?” Jesse S. replied, “To a server farm somewhere in America…

[maybe] California.” Another respondent, Dylan S. stated, “I think of the high desert in

eastern Oregon or Washington [state]… Very rural, there's nothing else there, there's very

little industry, and it's just very cheap land.” Later in the interview, Dylan S. stated that

this location in the eastern Oregon region would have to be large enough to accommodate

“a large database somewhere that stores a whole lot of information… from [all parts] of

the world… I mean, for redundancy purposes, but I'm not exactly sure.” This respondent

emphasized one of the five significant characteristics of Cloud-based computing: system

redundancy. Responses collected from the online questionnaire made similar references

to a dessert or a particular western state, including a response from Quinn Q. who

described the Cloud as “a bunch of computers in a warehouse in a desert,” and Micky Q.

who stated, “I see a Cloud, but I think [of] servers underground in Nevada.”

Sub-theme: Metaphors of “the Cloud.” Many respondents described the Cloud in

metaphorical terms as “a virtual file cabinet,” “virtual storage,” “an invisible place,” and even “a

non-tangible place [or] space.” Drew Q. used the metaphor of an “online USB [that] you can

access anywhere" when discussing remote storage and accessibility, while Addison Q., unsure

how to describe, stated it is “a cumulus Cloud filled with zeros and ones.” The use of metaphors

to describe complex technologies such as the Cloud is most common when a person is unfamiliar

with the specifics of the technology or when describing concepts that are vague or difficult to

understand. Unfamiliar and vague concepts are often described “in terms of more concrete

103

concepts, which are more clearly delineated in our experience” (Lakoff & Johnson, 2003, p.

113).

The most frequently used metaphor by respondents for “the Cloud” was found to be “the

Internet.” In many instances, “the Internet” was used as a metaphor for “the Cloud” that

respondents used it synonymously as an interchangeable term for “the Cloud.” Reilly Q.

discussed the Cloud in terms of the Internet as “a space where data is stored... [as] in the infinite

world of the Internet,” while Robin Q. responded that the Cloud and the Internet are the same

technology, both “allow[ing] people to conduct business, store data and run applications.”

Sidney Q. equated the Internet to the Cloud stating that the Cloud is “the Internet, where

information is stored,” while Austen Q. described the Internet interchangeably with the Cloud as

“Internet storage of files and other computer data that is housed on unknown servers.”

Respondents who were unsure how to describe the Cloud more frequently used metaphors to

describe it and most frequently used “the Internet” interchangeably with “the Cloud” when

discussing the its features and characteristics.

Sub-theme: The role of the Internet. An important part of understanding respondents’

knowledge of Cloud-based computing includes how they describe the role of the Internet. This is

especially important as the Internet provides the crucial connection between the user and the

Cloud as a networking technology. While there were four respondents who equated “the Cloud”

to “the Internet” by using the terminology interchangeably, seven of the 11 respondents who

took part in the semi-structured interviews correctly identified the role of the Internet as the

network connection between the user, the Cloud, and Cloud-related technologies such as the

Internet of Things (IoT). Responses presented for this sub-theme provides insight of respondents

understanding of the role of that the Internet plays in Cloud-based computing.

104

Respondents most frequently discussed the Internet as the networking component of the

Cloud and the importance of Internet connectivity to access the Cloud. Harley S. stressed the

importance of the Internet in Cloud-based computing, stating that “basically almost everything I

do… I think is through the Internet which goes to some form of the Cloud,” while Dylan Q.

stated, “I can access personal files and keep them in sync on any device I am using… as long as I

can connect to the internet.” Other respondents discussed the Cloud as being Internet-based

storage, or an Internet based external hard drive, and as noted by Harley Q., as “Internet based

computing where data is stored on a remote server owned by a large organization.” One

particular response from Jesse Q. stressed the importance of the Internet as the networking

conduit for the Cloud within the education sector. Jesse Q. explained, “As an educator, I rely

heavily on the internet and many of the [Cloud-based] Google apps and platforms to provide

instruction, assignments, and feedback.”

Sub-theme: Respondents self-rating of cloud knowledge. Respondents commented

during the semi-structured interviews on how much they believed they knew about the Cloud.

Respondents frequently stated that they believed that they were not very knowledgeable about

the Cloud. Jesse S. stated that “My experience is fairly limited with this Cloud computing.”

However, when Jesse S. was asked at the beginning of the semi-structured interview to define

the Cloud, this respondent provided a succinct and well thought out description of the Cloud,

stating that the Cloud “refers to remote storage where information is stored on the server,

somewhere else, and can be accessed by different channels.” Similarly, Ryley S. explained, “I

don’t honestly know that much about Cloud computing… so in my head... when I hear [of]

Cloud computing, I think of any program that stores lots of information in some remote

location.” While Ryley S. admitted “I don’t honestly know that much” about the Cloud, this

105

respondent had referenced two of the five most essential characteristics of Cloud-based

computing: remote data storage and remote accessibility.

Two respondents inferred a limited understanding of the Cloud, and that they would like

to better understand the Cloud, especially as it pertains to the workplace. Skyler S. stated,

“I'm not as proficient in it [Cloud-based computing] as I would like to be, and I

think… it’s [because of my] temperament… if I was a little bit more patient and

had a little bit more time vested in becoming more proficient, maybe I would

want to access it a little bit more, but due to the lack of me not being so proficient

in it, it takes a little more time and time is not what I have…” [Skyler S.]

In this excerpt, Skyler S. eludes to becoming frustrated with the Cloud due to limited patience

and the need to invest more time in learning the technology.

When asked to describe the Cloud earlier in the interview, Skyler S. defined the Cloud in

terms of remote storage with the ability to be accessed from various devices and locations.

Remote storage and accessibility are fundamental characteristics of Cloud-based computing

which makes this individual’s description of the Cloud fairly accurate and in alignment with the

2011 NIST definition of the Cloud.

Another respondent, Remi S., discussed Cloud computing as “one of the many services

offered by Apple” that allowed for the uploading of images and documents to iCloud, which the

respondent references as “the Apple Cloud.” Remi S. also discussed the ability to access

uploaded images and documents remotely and from various devices; however, when asked,

“How much do you believe you know about the Cloud?” similar to other respondents, Remi S.

described having a limited understanding of the Cloud, stating “I know Apple [but] I don’t

106

necessarily understand the Apple Cloud and I don’t necessarily understand the Apple Cloud and

how my pictures are stored.”

Frequently, respondents referred to their knowledge of the Cloud as limited, even though

they were regular users and demonstrated a relatively fair understanding of the Cloud.

Respondents believed that their understanding of the Cloud was somewhat limited, and in some

instances, non-existent. However, all eleven respondents who took part in the semi-structured

interviews could provide an example of at least one characteristic that defined the Cloud, with

nearly half of the respondents referencing two to three examples of characteristics that define

Cloud-based computing. Respondents’ discrepancy between what they believed they knew about

the Cloud and their actual knowledge of the Cloud may be potentially linked to their

misunderstanding of Cloud terminology or a lack of awareness of the many programs,

applications, and services commonly accessed through the Cloud.

Theme 2: Advantages and disadvantages of the Cloud. Respondents’ descriptions of

advantages and disadvantages of Cloud-based computing aided in answering how school faculty

and administration understood Cloud computing as used in K-12 public education. Specifically,

when describing advantages and disadvantages of using the Cloud, respondents often focused on

one or more of four sub-themes. These subthemes included overall convenience that Cloud-based

computing offers, the advantages of Cloud-based storage and remote accessibility which are

fundamental features of the Cloud, and reliability that Cloud-based applications and services are

easily and securely accessible.

The overall convenience that the Cloud offers was the most frequently discussed

advantage of Cloud-based computing. The second most frequent advantages of using the Cloud

at home and for school related work were Cloud-based storage and remote accessibility. These

107

three advantages of Cloud-based computing were logical choices for discussion by respondents,

considering that the marketing of the Cloud rests around these features, which also makes it

attractive to consumers, schools, and organizations. Respondents least frequently discussed the

reliability of Cloud-based applications and services. However, when respondents discussed

Cloud reliability, it was in terms of not being able to access data, applications, and services due

to a Cloud-outage or the loss of Internet connectivity. Respondents’ discussion of Cloud

reliability in terms of providing a secured environment and the possibility of data compromise

and nefarious acts is part of the third theme.

Sub-theme: Overall convenience of Cloud-based computing. When asked, “What do

you like the most about the Cloud?” respondents most frequently provided statements such as,

“convenience, convenience, and overall convenience.” Other respondents, summarizing the

Cloud, stated “it is so convenient” and “it is very convenient as it allows me to complete tasks

for home or work.” Speaking to the idea of convenience, respondents also made remarks like “it

is so useful,” with one respondent describing the Cloud as “efficient, as it helps me store my files

and keep all my music in one place.” There were more than 47 references made of the term

convenience, or of phrasing that described conveniences of Cloud-based computing, in both the

semi-structured interviews and when completing the open-ended questions of the online

questionnaire. For this reason, the researcher assigned the code Overall Convenience to wording,

phrasing, and contexts of responses that referenced the various conveniences that Cloud-based

computing offers.

Just over three quarters of responses collected from the semi-structured interviews

referenced convenience in one or more context as the most important characteristic of Cloud-

based computing. Robin S. expressed especially using the Cloud for online shopping “because of

108

the convenience [it offers]… It saves me a lot of time… a lot of gas… [and] I like the

convenience of it [purchases] coming to my door.” Sidney S. discussed the convenience the

Cloud has to offer for accessing both personal and school related documents and data, explaining

that “with the Cloud, you can then access [data, files and] information anywhere, at any time…

again because of its convenience.”

Respondents also described the convenience that Cloud-based computing offers as the

primary reason for the Cloud’s continual expansion, our growing dependence on it to complete

daily routines, and for productivity at home and at school. Remi S. stated that “the convenience

factor [of the Cloud] is far too great and I foresee this becoming ingrained in our lives.” During

the semi-structured interview, Jesse S. explained that “it seems like society likes all of these

convenience factors, so I would say that this is the reason why it [the Cloud] will continue to

grow and develop in ways that I can't even imagine.” It is evident from the responses of Remi S.

and Jesse S. that they understand how essential the Cloud is presently. Also evident is their

understanding of our growing dependence on the Cloud due to the continual expansion of Cloud-

based applications and services as society increasingly becomes dependent on the Cloud for

everyday needs.

Respondents frequently discussed sacrificing privacy, security, trust, and even

knowledge, in exchange for the conveniences that the Cloud offers. Two respondents agreed that

they regularly access their Cloud-based (online) bank accounts because convenience outweighs

potential security concerns. Ryley S. stated that “sometimes convenience outweighs security for

me…. I don't know if online banking is considered ‘Cloud use’ but certainly I use online banking

because it is so much easier than going to the bank.” Jackie S. described societies growing

dependence on the Cloud, describing the Cloud as “necessary evils,” stating that one has “no

109

choice” in many instances because of the convenience the Cloud has to offer. Jackie S. further

explained,

Because of the convenience... I use many applications, including [online] banking...

That’s really the bottom line, because I am typically working... 12 to 15 hour days during

the school year, that convenience is just one of those necessary evils. [Jackie S.]

Jackie S. infers that the convenience that the Cloud offers is as a necessary evil since while it

makes tasks and routines easier, it also makes us more dependent on the technology.

One respondent discussed Cloud-based computing as a “double-edged sword,” explaining

that the Cloud offers so much convenience that it could potentially be detrimental to society in

the long run. While the Cloud greatly facilitates information retrieval and productivity at home

and in the workplace, it could hamper critical thinking and problem solving skills, as Robin S.

explains:

As technology advances, such as the Cloud, it's kind of a double-edged sword

because for all of the conveniences and all of the ways it's supposed to make our

lives simpler, we aren't using our critical thinking skills as much and our ability to

get ourselves out of certain situations or to protect ourselves or to even think in

terms of ‘What do I need to do in order to take care of this?’ without using

technology. We're losing those skills… [Robin S.]

Technology is the driver of convenience, and this is no more evident than with the

continual expansion of Cloud-based computing across all fabrics of modern society. Respondents

asked to further discuss the convenience that the Cloud has to offer provided responses that lead

to two important features of Cloud-based computing. These two features, which included (a) the

ability to remotely upload and store vast amounts of data and (b) the ability to access this data

110

along with applications, services, and programs remotely, frequently became the center points of

discussion. The sections that follow provide a discussion of both of these features.

Sub-theme: Cloud-based storage. Respondents quickly referenced “Cloud-based data

storage” when asked, “What do you like most about using the Cloud?” The most frequently

discussed responses referenced how the Cloud conveniently allowed respondents to easily

upload and store large files, such as music, images, video, and object streaming content not

easily stored locally on personal devices such as smart phones, tablets, and laptops. The ability to

remotely store data using Cloud-based services was the most frequently referenced convenience

discussed by respondents. All 11 semi-structured interview respondents discussed Cloud-based

storage in one form or another, affirming that it is the greatest convenience of Cloud-based

computing. Similarly, more than 56 responses collected from the online questionnaire’s open-

ended questions also referenced Cloud-based storage as the greatest convenience of Cloud-based

computing. Ryley S. described the Cloud in terms of remote storage, stating, “I would only think

of it as a storage solution…. I would not think of it as anything else.” Similarly, Skyler S. stated,

“I think it's storage of [data]… [in] an area where you can store information; pictures or extra

memory somewhere.”

Respondents referenced Cloud-based storage more frequently when discussing their

personal needs to upload images, music, and other large file types than when discussing Cloud-

based storage in the context of work and school related data, such as student records,

assignments, and documents. Skyler S. stated, “I think it's storage of data... It's an area where you

can store information, pictures and music,” while Ryley S. discussed using the Cloud “just for

my photos and videos... [as] it seems that [the Cloud] is unlimited data storage… So you can put

whatever there for however long.”

111

While respondents less frequently associated Cloud-based storage with school related

data, there was some discussion of how Cloud-based storage has become a necessity for schools.

Ryley S. discussed the sheer volume of digital lesson plans and curriculum that has to be stored

and shared when saying,

I actually remember when we [the school district] were not on the Cloud a couple

of years ago [and] a major issue was running out of storage space and the more

you add on those drives, the more student information you have from years and

years... all the lesson plans and Smart Board files… videos, there is so much data,

just how do you store it if you don't use a Cloud? [Riley S.]

Two respondents discussed the need for additional Cloud-based storage in the future due

to the continual growth of Cloud dependent devices, applications, and services. The significant

growth of digital content will first drive the need for additional Cloud-based storage, followed by

the need of users to access data across multiple devices. Jesse S. envisioned that “local storage

will no longer be an option, so to save space… It's going to be almost a necessity to have

information stored in remote locations,” while Casey Q. stressed the need for additional Cloud-

based storage in the future, this being due to users accessing multiple devices that share data

nearly simultaneously.

Cloud-based data being accessed without necessarily downloading and saving the data

locally was an understanding found across nearly half of the responses collected. Jesse S. stated

that “When you're accessing information from a remote location, you're not [necessarily] saving

it or downloading it, you [are] simply accessing it.” Jesse S. similarly discussed accessing data

from Cloud-based storage, noting that “Again, the information is stored somewhere else and

you're just accessing it... in the moment and you are not downloading it from the Cloud.”

112

Sub-theme: Remote accessibility. Respondents referenced the convenience of “remote

accessibility” just as frequently as they referenced the convenience of Cloud-based storage which

is one of the five characteristics of Cloud-based computing as defined by Mell and Grance

(2011) in their NIST definition of the Cloud as “road network access.”

The ability to access data remotely at any time, from any location, and from any Internet

ready device was a frequently referenced as advantages of Cloud-based computing. Robin S.

stressed the convenience of remote accessibility stating “I can access things [data] from

anywhere... If I need to pull something off the Cloud and I'm not at home on my personal

computer, I can sign into and get what I need.” Remi S. explained that the Cloud “allows you to

access files remotely whereas this information is stored on a server somewhere or multiple

servers.” The response provided by Remi S. not only emphasizes remote accessibility, but also

“system redundancy” in referencing the use of “multiple servers.” System redundancy is one of

the five significant characteristics of the Cloud as defined in Mell and Grance’s 2011 NIST

definition as “resource pooling.”

Of particular interest was a response collected when asked “As an educator, what are

some benefits for using the Cloud?” Skyler Q. responded that the Cloud allowed for the

“accessibility to work from any location with internet [and] Wi-Fi and student accessibility to

work between school [and] home and their [students] ability to share work with me remotely.”

The response provided by Skyler Q. not only details the convenience of remote accessibility by

providing the ability to work remotely from home and access student work, but also another

important characteristic of Cloud-based computing: the ability to collaborate with students in real

time.

113

Respondents referenced “remote accessibility” nearly as equally as “Cloud-based

storage.” However, when respondents referenced “remote accessibility,” they more frequently

referenced “remote accessibility” as it pertained to the workplace, student data, files, and

assignments than when discussing “remote accessibility” in terms of accessing their personal

data, files and documents. This was especially prominent when analyzing responses collected

from the open-ended questions of the online questionnaire. Frankie Q. discussed the advantages

of remote accessibility in particular for the students explaining,

My students love having access to their assignments and documents wherever they are.

Students are able to log into their Cloud and send, receive and share documents more

readily then when they used their school drive for their primary location for saving

information. [Frankie Q.]

Sub-theme: Cloud reliability. The reliability of Cloud-based applications and services

was the least frequently discussed advantage or disadvantage of using the Cloud. Of the 11

respondents interviewed, only four referenced Cloud reliability; while of the 73 responses

collected from the open-ended questions of the online questionnaire, only five responses

referenced Cloud reliability.

Data access was the most frequently discussed topic in regards to Cloud reliability. Remi

S. stated that a Cloud outage or loss of internet connectivity, “…could compromise my ability to

get information [as I am] assuming that I am not able to access services or a data connection to

the Internet,” while Casey S. stated that “…reliability of the Cloud are important, being able to

rely [on it] and have it consistently working for you is important.”

Three responses collected from the open-ended questions of the online questionnaire

provided a much more in-depth understanding of the issue of Cloud reliability. These three

114

responses detailed a different perspective of Cloud reliability; that the Cloud is more reliable

than other computing and storage platforms. In particular, one response from Corey Q. detailed

the Cloud as being the most reliable computing and storage platform currently available, even

with considerations of Cloud outages and privacy and security concerns. Corey Q. explained,

The Cloud is, first of all, an immeasurably more reliable method of storage than locally

hosting one’s own data. A personal device is very prone to bugs, glitches, malware, data

corruption, accidental formatting of the hard disc, and of course, physical maltreatment of

the machine, leading to a damaged hard disc and subsequent lost data. Furthermore, an

unbelievably high proportion of end users of technology do not realize the dire necessity

of backing up… and users can be confident that the Cloud is a much more reliable way to

store their data. Personally, I view this to be, by far, the most significant advantage to

Cloud-based data storage. [Corey Q.]

While Corey Q. is a math and science teacher with 5 or fewer years of teaching experience, it is

evident that this respondent has an in-depth knowledge of the Cloud that is beyond that of the

common user.

Another respondent shared similar sentiments on the reliability of the Cloud, stating that

the Cloud was a far better option than standalone computing and storage solutions. This

respondent, Jackie Q., “personally experienced” the loss of years of personal data due to a hard-

drive failure, and as assumed by this researcher, had no backup of the data for restoration.

According to Jackie Q.,

Having lost a hard-drive in the past, I have personally experienced the loss of my entire

media library accumulated over four years. I was easily able to get back all of my Cloud-

stored information such as downloaded music through my iTunes and Google platforms;

115

however, I lost my entire collection of photographs and research conducted during three

years of college. The frustration of not being able to access four years of material has led

me to both backing up everything on a second hard-drive and storing personally

meaningful files in a Cloud drive. In a nutshell, the advantages of storing information in

the Cloud is that you do not have to worry about physical damage to your own hard-

drive. [Jackie Q.]

Qualitative Summary of Research Question 2

Three themes helped answer the second research question: How do faculty and

administrators perceive the issues of privacy, security, and trust (PST) as related to Cloud

computing? These themes covered the ways in which respondents understood PST in terms of

the Cloud, respondents’ concerns about PST, and how respondents understood of the issues of

data ownership. The following section discusses each of these three themes along with their

related sub-themes (see Table 4.21).

Table 4.21. Research Question 2 Themes and Sub-Themes

Research Question 2

Theme

Sub-Theme

Theme 1:

Understanding of PST

 Privacy (Personal/Cloud)

 Security (Personal/Cloud)

 Trust (Personal/Cloud)

Theme 2:

Underlying Concerns of PST

 Morality

 Nefarious Acts (Hacking, Big Brother &

Data Compromised)

Theme 1: Respondents understanding of PST. Respondents described what privacy,

security, and trust (PST) meant to them in general terms, when dealing with human interactions

and then in the context of Cloud-based computing. Data analysis led to the categorization of

116

responses across one of the three sub-themes of PST: describing privacy, describing security, and

describing trust.

Sub-theme: Describing privacy. In general terms, two respondents described privacy

succinctly as information “for my eyes and use only” and “not shared or accessible by others.”

Most frequently, respondents provided more detailed meanings of privacy, as detailed by Sydney

Q. who stated, “Privacy is the right to keep certain information about yourself, or to exist within

a space that is out of the public eye.”

Responses collected from the open-ended questions of the online questionnaire resonated

with differing understandings of privacy both in general terms, as with human interactions and in

the context of the Cloud. Dylan Q. discussed privacy in general terms as “…the right to keep

information and actions that you don’t want known by anyone else from being known or shared

with others.” This same respondent later discussed privacy in the context of the Cloud, stating

that it “…should be the same as when viewed in human terms, but it’s not… as information

[that] belongs to you should not be shared, viewed or accessed by anyone other than you without

[your] permission or a high legal threshold.” Similarly, Sasha Q. discussed privacy in general

terms as “Having the choice to disclose information as you see fit and being respected for your

choices.” Sasha Q. later discussed privacy in the context of the Cloud as “Having your private

information or information that you have placed in the Cloud only accessible to you and the

other parties which you allowed to have access.”

Responses collected from the semi-structured interviews shared similar sentiments. Casey

S. discussed privacy as centering on “Me being in control of any sort of information about me,

and who has access to it and when… that is privacy to me.” Similar to responses collected from

the open-ended questions of the online questionnaire, respondents frequently described privacy

117

in one context for general terms and then in another context for the Cloud. Remi S., discussing

privacy in general terms stated, “Privacy in my opinion would be limiting information to only the

people who are authorized to use it.” In the context of the Cloud, Remi S. stated, “Privacy would

be the ability to determine who has access to [my] information… assuming that at any given time

my information could be subject to a subpoena, or something to that regard.”

Respondents’ concepts of privacy. Upon the closer review of the data, the researcher

found that respondents frequently described privacy in one context when discussing in general

terms and then in another context as related to the Cloud. Also found, although less frequent, was

the use by respondents of mutually associated phrases and wording while discussing privacy in

both general terms and when related to the Cloud. Mutually used phrases and terminology

associated with privacy in general terms and in the context of the Cloud included “accessible to

others,” “my ownership of information,” and “what I choose to share,” as well as “the

dissemination of my information.”

After the careful review of responses that discussed privacy in general terms, such as

privacy related to human interactions, the researcher uncovered that nearly all responses fit into

one of four categories. These responses could be categorized as (a) the notion that individuals

can be selective of who information is shared with; (b) the notion that individuals can be

selective of what information to share; (c) the ability to maintain confidentiality of particular

information, and when that information is shared, the notion that others knowledgeable of it

should respect your thoughts related to privacy; and finally (d) the notion that an individual can

use physical determinants to maintain privacy, such as locking a door or using a safe to protect

personal documents, among similar actions.

118

Nearly all the responses analyzed in regards to privacy in the context of the Cloud fit into

one of four categories. These groups included (a) the notion that privacy is set by the end user,

who can adjust personal privacy settings, allowing for various levels of privacy as commonly

used in social media and on collaboration platforms; (b) the notion that the end users’

information, files, and data are private and cannot be accessed by others unless authorized by the

end user through the use of credentials provided to allow for access; (c) the notion that privacy in

terms of the Cloud is a tradeoff, as the end user relinquishes a certain amount of privacy for the

conveniences that the Cloud offers; and finally (d) the notion that files and data uploaded to the

Cloud are never private, no matter how much confidentiality and security is assured.

Two responses collected from the open-ended questions from the online questionnaire

summarize the differences in respondents’ understandings of privacy in general terms and in the

context of the Cloud. When discussing privacy in general terms, as related to human interactions,

Sasha Q. detailed the “human” elements of privacy, stating that privacy is “having a choice to

disclose information as you see fit and being respected for your choices.” Also discussing

privacy as related to the Cloud, Ryley Q. explained, “I am in control of content and data that is

mine and only accessible to others who are exclusively granted authorization by me to access it.”

These two respondents share similar notions of privacy in terms of having the ability to

determine what information can be shared. However, the description provided by Ryley Q.

details a more technical side of privacy, by using terminology associated with computing, and

more specifically to the Cloud, as seen when Ryley Q. mentions “control of content and data,”

“authorization,” and “access.”

Sub-theme: Describing security. In general terms, respondents described security

succinctly along the lines of “the feeling of being safe and comfortable” or “feeling that my life

119

and my property will not be hurt or damaged by others.” Frankie Q. described security as

“keeping myself and my family safe from outsiders who may try to breech our circle.” Another

respondent, Dylan Q., discussed security as “confidence that your person and possessions are

protected from harm.”

Responses collected from the open-ended questions of the online questionnaire resonated

with differing understandings of security related to everyday interactions and then in the context

of the Cloud. Sasha Q. discussed security in the context of everyday interactions as “Feeling safe

and comfortable.” However, in the context of the Cloud, this respondent went into greater depth,

describing security as “the ability to safely share and store information to the Cloud and feeling

comfortable that it will only be accessed by the people who I know and trust.” While describing

security in the context of everyday interactions, Harley Q. explained, “Generally, security is

confidence that you are safe from intrusions.” This respondent went into greater detail while

discussing security in the context of the Cloud by providing a more technical description. Harley

Q. explained that “security is made up of [different] systems employed to protect your data from

being accessed and compromised.” Sydney Q. also provided a technical description of security,

explaining that “Cloud security is the existence of protocols that ensure that confidential

information is kept safe and remains confidential.” A quick review of all security related

responses revealed that nearly every respondent went into greater detail when describing security

in the context of the Cloud than when describing security in terms related to everyday

interactions.

Responses collected from the semi-structured interviews shared similar sentiments.

Frequently, respondents discussed security as an assurance of physical protection and safety

from intruders or dangers. Respondents also described security in terms of protecting personal

120

and “sensitive” information from others who may have malicious intentions. Discussing security

in the context of the Cloud., Jackie S. explained, “The bottom line is that I think there is very

little… I can't say there is very little security, but there is very little... that can't be learned if

somebody wants to learn about it.” The response provided by Jackie S. offers a deeper

understanding of how the majority of respondents perceive security. Respondents described

security in general terms, as related to everyday interactions, as a process of measures taken to

maintain a safe and protective environment for individuals, family, and personal property.

While discussing security in the context of the Cloud, respondents showed greater

concern about what security entailed and the need to be vigilant to effectively protect their data.

The response by Jackie S. about security in the context of the Cloud echoes other respondents.

While Jackie S. believed in proactive measures taken to provide effective security of Cloud-

based data, “There is very little... that can't be learned” if an individual wants to obtain your

Cloud-based data and consequently, data is never 100% secure. Other respondents shared similar

sentiments. Regardless of measures taken to secure data as it pertains to the Cloud, if a nefarious

individual, a hacker, wants access to that data, they will find a way to circumvent even the most

effective security measures. Jesse S. expanded on this, explaining,

Personally, I believe that the fact that all the security systems are created by humans, it

can all be hacked and undermined by humans. So, I don't think that anything on the

internet or the Cloud is 100% secure, but I didn't think that anything was 100% secure

before the Cloud either. [Jesse S.]

Respondents also discussed measures and controls implemented to secure both personal

information and data as well as students’ information and data. These measures and controls,

according to respondents, are security features including data encryption, virus protection, and

121

system redundancy. Ryley S. described these measures and controls as “layers of security” which

ranged from password protection to encryption, stating that,

It depends on the measures that are put in place to keep the information secure, protected

and private… That is what I would say is Security… How many usernames and

passwords and levels do you need to go through? I don’t know anything about

programing but I know that people have more encrypted information and have programs

in place to safeguard from hackers and whatever so that to me is security. [Ryley S.]

Two respondents discussed in detail the notion that student information management

systems (SIMS), such as Infinite Campus, must implement the “highest levels” of security when

compared with other Cloud-based systems, like G Suite (formally known as GAFE), which all

three districts used. One respondent discussed the importance of maintaining student data with

the “highest levels” of security due to the confidential nature of student data and the tremendous

amount of student data centralized in one system. According to Harley S., student data includes

“…everything on the student, everything, from grades and standardized test scores [to] also

medical history, guidance records, family details, and even disciplinary records.” Harley S. and

another respondent agreed that while their districts do take “computer security” very seriously,

there is always the threat of a data breach. Later in the semi-structured interview, Harley S. again

discussed the importance of SIMS having the “highest level” of security, even comparing the

need for this “high level” of security to security levels of other Cloud-based systems in the

district. Harley S. stated that there is “very private information, based on every student, so I

would think that it [referring to SIMS] is more secure than the Google docs platform.”

The most commonly discussed threat by respondents was the theft of personally

identifiable information (PII) in the form of student data. Three respondents discussed the need

122

for “high level” security measures not only to protect student data from outside threats, but also

from the students themselves, who may want to alter grades, attendance records, and even

college recommendations. Sydney S. stated, “A student might want to go into it [the SIMS] just

purely to change grades or change data that'll make him look more positively if he was applying

to college or anything like that.” Casey S. echoed these sentiments when stating, “I think that if

students could find a way to go in and change grades [they would], or for their buddies to do it so

[they] can gain access to better colleges.”

Sub-theme: Describing trust. In general terms, related to human interactions,

respondents described trust along the lines of “feeling secure with the person you are interacting

with” or “knowing that a person or company [you are dealing with] has your best interests in

mind.” When discussing in the context of the Cloud, respondents described trust as “knowing my

information is secure and can't be accessed by others,” or knowing “that the business or company

running the Cloud will work hard toward keeping [my] information safe and secure.” A closer

review of the responses revealed that when respondents discussed trust in general terms, related

to human interactions, nearly all responses were brief in detail. However, when respondents

discussed trust as it relates to the Cloud, most responses were very detailed and discussed how

trust is related to security, privacy, and confidentiality. Also discussed in detail by respondents

were the expectations on part of Cloud vendors and hosts not to share data for personal gain or

with malicious intentions. A very few respondents extended this expectation to include student

data as well.

Responses resonated with differing understandings of trust, both in broad terms as well as

with human interactions. Sasha Q. discussed trust in broad terms as “knowing that a person or

company has your best interests in mind,” while Quinn Q. described trust as “confidence in

123

something or someone that they are as they present themselves.” Corey Q. provided the most

detailed and comprehensive description of trust in broad terms related to human interactions,

stating that “Trust, in my opinion, implies that there is an understanding of an individual or

group’s patterns of behavior and thought, and with that knowledge, that individual or group is

permitted access to greater levels of closeness.”

Respondents frequently used specific words and phrases when describing trust related to

human interactions. Commonly used words and phrases by respondents when discussing trust

included “faith,” “belief,” “reliability,” “truth,” “security,” and “having confidence in.” The use

of these words and phrases by respondents coincides with a number of formal definitions, which

define trust as “a firm belief in the reliability, truth, ability, or strength of someone or something”

("Oxford English Dictionary," 2019).

Respondents defined trust as related to the Cloud in a very different context than when

related to everyday human interactions. Respondents frequently described trust as a measure of

confidence in the Cloud and data maintained in a secured and protected manner. Adrian Q.

stated, “Trust in terms of the Cloud means that the business [or] company running the Cloud will

work hard toward keeping your information safe and secure.” Another respondent, Sasha Q.,

stated that trust means…

Having full confidence that the Cloud in which you are sharing confidential or other

personal information will uphold that information with utmost regard for the intentions in

which it was provided and not share or give access to unauthorized sources. [Shasha Q.]

Respondents also discussed trust in terms of Cloud vendors and subscribers (e.g., private

companies and school districts who use the Cloud) not allowing for the sale or use of data by

third parties for profit, personal gain, or malicious acts. Hudson Q. discussed trust in terms of

124

knowing “that the Cloud service will make an effort to keep my information safe and secure and

will not share it for profit or gain.” Dakota Q. stated that trust “is knowing that what I upload and

share isn't being sold to a third party.” A closer look at the responses collected made it evident

that respondents were concerned about the issue of trust of Cloud vendors and even school

districts.

Harley S. discussed his overall lack of trust in the Cloud, especially for personal use;

however, when discussing trust of the Cloud related to his school, and to student data in

particular, this respondent thought strongly to the contrary. Harley S. stated that the school

district is doing everything within their means to avoid the compromising of student data. Harley

S. further discussed security measures implemented to protect student data, stating,

I think the systems I use at work are more secured because it's a bigger database. There is

a bigger risk in losing the information because the school is in control of a lot of student

and faculty information and confidential documents, a lot of confidential information... I

think that it is going to be a lot more secure because of the people at risk, versus my own.

Because I think my own [data] would be easier to capture. Someone can hack my phone,

or when I’m home someone can drive by and just kind of hack through and get through.

[Harley S.]

Six respondents discussed trust in the context of the Cloud as being “non-existent” due to

potential threats of the compromising of data. Charlie Q. expanded on this when stating that

“Trust is non-existent... Companies may say your information is protected, but there have been

too many breeches for me to trust them. Example: Yahoo, Target, et cetera.” Another two

respondents discussed being cautious of trusting the Cloud, as it is susceptible not only to

hackers but also to governmental agencies who may use personally identifiable data for

125

surveillance. Sasha Q. stated that trust is “having faith that data is secured… and hoping [that]

the Cloud is protected from people and the government.” An overall review of responses shows

that respondents cautiously trust the Cloud, with their level of trust decided by how confident

they are in the security and maintenance of data in a confidential manner.

Theme 2: Underlying concerns of PST. The researcher asked respondents to discuss

any topics of concern related to PST in the context of the Cloud, providing them brief starter

questions to promote discussion during the semi-structured interviews. Starter questions included

“Do you think that Apple looks through your pictures uploaded to iCloud?” and “Do you think

that a company would have an interest in reviewing student data?” These starter questions varied

among respondents, depending on the interviews and timing, to segue to this new topic.

Sub-theme: Morality. Nearly half of respondents who took part in the semi-structured

interviews discussed their perceptions of the responsibility, or lack of responsibility, by Cloud

vendors and subscribers in maintaining data as outlined in vendor and application specific End

User License Agreements (EULA). One respondent discussed his “uneasiness” and discomfort of

uploading confidential information to the Cloud due to concerns of privacy and the possibility of

third parties gaining access to their data. Jackie S. believed that while Cloud vendors and

subscribers follow terms outlined in their contracts and EULAs, third parties still use PII without

full disclosure of use and owners’ consent. When asked about uneasiness uploading confidential

information, Jackie S. stated, “I don't think there is morality related to the Cloud.” This notion of

uneasiness resonates with many other respondents. Hence, the title of this subtheme, morality,

which addresses this area of contention frequently discussed by respondents concerned about the

use of PII by Cloud vendors and subscribers who circumvent contractual stipulations and scope

of EULAs for both corporate and personal gain and profit.

126

In this study, morality is understood as a system of explicit and implicit norms of

behavior or beliefs maintained by society, concerning acceptable and not acceptable uses of PII

and other private data by Cloud vendors and subscribers. Morality centers more on how Cloud

vendors and subscribers treat data and how they use data or allow others to utilize data through

contractual and EULA loopholes. Morality, as discussed in this section is related to the implicit

and explicit trust that they have in the Cloud, Cloud vendors, and subscribers.

Respondents frequently discussed a relationship between morality and personal gain,

mostly for profit on part of Cloud vendors and subscribers. Later in the semi-structured

interview, Jackie S. explained this relationship: “I think that most institutions try to do the right

thing… but they’re more interested in the bottom line, the financial gain… and in a capitalist

system, morality isn’t typically factored in.” Here, Jackie S. is inferring that while the vendor

and subscribers know that they are bound to their contractual agreements, the EULA, and more

importantly, federal acts such as Health Insurance Portability and Accountability Act (HIPAA)

and Family Educational Rights and Privacy Act (FERPA), vendors will circumvent requirements

if there is a profitable margin of return, even with consideration of possible legal or monetary

recourse. Remi S. discussed concerns of the possible use of PII by vendors outside of

contractually defined terms, explaining…

that these companies are definitely benefiting more than I am despite the fact that these

services have become so integral to how I conduct business of my own… So they are

certainly benefiting and they have access to basically my entire life whether they choose

to use it or not. [Remi S.]

Responses analyzed in regards to vendor and subscriber morality showed that the

majority of respondents overall trusted the Cloud when it came to their personal data, though to

127

varied extents. While a few respondents trusted vendors’ morality, the majority of respondents

believed that vender morality could sway depending on motivations for profit. Respondents

believed that if there was a possibility for a vendor or subscriber to profit from the sharing of

data with third parties without the need for disclosure, they would think twice about what data,

especially PII, to share from the Cloud. The response of Dylan S. represents overall sentiments

frequently discussed by respondents in regards to vendors and subscribers. Dylan S. explained,

I think it depends upon the corporation where the data is stored, [and who] is running the

Cloud. I think that it is probably reasonably secure against third parties, maybe hackers or

people who have some nefarious intents. However, there is an assumption that these

companies, like Google and Apple, are constantly doing research to secure their data in

their own sources. I just think that it's not secure against the companies [operating] the

Cloud in which I'm storing. I feel that it is not private as they have access to it and they

could share data with others. [Dylan S.]

Three respondents of the semi-structured interviews stressed the need to assure that the

Cloud vendor and even subscribers strictly maintain student data with the utmost confidentiality.

Jesse S. discussed personal concerns regarding Cloud vendor morality when addressing student

data, and more specifically PII, and the potential for exploitation of data for marketing purposes.

When asked if people other than the originally intended authorized users would desire student

PII, Jesse S. stated “Oh, absolutely. I think everything data wise, as far as they're concerned, is

valuable in terms of marketing. You know, they're looking at trends, they're looking at interests

and things of that nature.” When asked if a Cloud vendor would want to study student data for

data mining and marketing, both internally and externally to other companies, Remi S. provided

detailed insight, explaining,

128

Potentially, I feel that any original work by a student could technically be run through an

algorithm to look for a particular keyword of phrases to identify important components. I

mean take for example the algorithms that computers run to tell you the type of things

that you might be interested in buying next. If a teacher or for an example… an

assignment was “what did the student do over the summer,” this could be potentially be

used by a research firm to get ideas about trends, or to market. So yes, I feel that despite

the fact that I did not classify this information as necessarily sensitive it could definitely

be used and certainly interesting for somebody to look at. So regardless of what exactly

that material is, I am sure that it could be used for a purpose other than the original intent

of the author. [Remi S.]

Sub-theme: Nefarious acts. Practically every respondent emphasized their concerns of

the Cloud’s susceptibility to nefarious acts ranging from hacking and data theft, to data ransom

and large scale data breaches. While nearly every respondent agreed that the Cloud was not

100% secure, they did agree that their confidence has grown over the last few years and that

companies are taking more proactive measures to protect data. Jesse S. stated that while there are

many obstacles to providing 100% security, Cloud vendors are showing more accountability for

protecting data. Jesse S. explained,

I'm sure they’re not fool-proof, I’m sure they’re not bullet-proof either, I'm sure they

[security measures] can be circumvented, there’s probably holes and loopholes and ways

that people can get around in it as well, but I do think that they at least create a layer of

accountability that hadn’t been there previously. [Jesse S.]

While recent reports suggest that user’s confidence levels in regards to Cloud security

continues to grow, users may never be fully confident of data security. A survey report

129

completed by MIT Sloan Management Review and published by Google shows that over the last

two years, 74% of respondents have “increased confidence” in the security of cloud applications

and infrastructure, while 25% of respondents’ confidence stayed about the same” (Survey

Report: Behind the Growing Confidence in Cloud Security, 2017, p. 3). Nearly five of eleven

respondents who took part in the semi-structured interviews agreed that their confidence in

Cloud security had grown over the last few years; however, each respondent clearly noted that

they would continue to remain cautious of what they upload and share through Cloud-based

applications and services.

Respondents frequently discussed a correlation between the growth of Cloud-based data,

much of it of confidential and sensitive nature, and the increase in successful nefarious acts

ranging from the theft of data to data ransom and large scale data breaches. Respondents

discussed society’s growing dependence on the Cloud to complete everyday tasks ranging from

banking, shopping, and communication to using cashless tolls (E-ZPass) and even confirming

online dinner reservations. Society’s dependence on the Cloud equates to the uploading of

significantly more confidential and sensitive data to the Cloud, which increases the risk of

nefarious acts.

Respondents also discussed the growth in student data maintained by the Cloud, ranging

from homework assignments to student medical records. Nearly all respondents agreed in one

form or another that the Cloud has provided a new level of efficiency and convenience that was

unimaginable decades earlier. Dylan S. elaborated on this, explaining,

I think that this is the world in which we live… in order to operate efficiently, there's so

much data, there's so much information coming at us. There's so many different portals…

130

I bank at three different banks… The same with Apple or Amazon, my music,

whatever… you used to be able to go to a music store, but that's changing. [Dylan S.]

As more data, especially of the confidential and sensitive nature continues to move to the

Cloud, there is an increase in data theft carried out by a range of culprits from the lone

“basement” hacker to government supported teams dedicated to compromising data for profit

and personal, corporate and governmental gain. Jackie S. discussed the growing trends in data

theft

stating,

I've always looked at that [the idea of data being 100% secured from hackers] with an air

of skepticism because I've always seen the possibility for all sorts of problems, all the

hacking episodes that have to come to light about all these companies, you see that, but

that's just one of many ways ... people can get any information they want at a cost… to

you, to us. [Jackie S.]

Respondents also commonly discussed their growing concerns in regards to potential

theft of student data, in particular of PII. While the majority of respondents believed that their

school districts maintained student data in the most secured manner, slightly more than half, six

of the eleven respondents who took part in the semi-structured interviews discussed their

concerns about the potential theft of student PII. When asked “why do you think a hacker would

want student information,” Jesse S. explained,

I'm sure in ways I can't even imagine that hackers would want student information... I

don't know exactly all the information that is kept by the school, but for instance, the

student information system, I suspect there's a lot of sensitive information about students,

The number of high profile security breaches continues to grow as vast amounts of data moves to the Cloud

including the 2016 LinkedIn breach which compromised 167 million LinkedIn users email addresses and passwords

as well as the 2018 Marriott Hotels data breach which involved up to 500 million guests travel itineraries and other

confidential and sensitive records fuels respondents concerns of having their data compromised.

131

their backgrounds, independent history, grades, parents and things of that nature... names,

birthdays, that could be pulled… Student information can be good as gold to the right

people, money and more money for retail and marketing. [Jesse S.]

While respondents had varying levels of confidence in security measures meant to deter

nefarious acts, respondents most commonly demonstrated low confidence levels in the fact that

the Cloud currently provides a 100% secured environment and that they doubted the Cloud could

in the near future prove itself as 100% secured. One respondent’s quote speaks volumes, sharing

the same sentiments of others when discussing the current state of the Cloud and nefarious

actions taken to compromise Cloud integrity and the security of data. Jesse S. explained,

I believe that the fact that all the security systems are created by humans, they can all be

hacked and undermined by humans. So, I don't think that anything on the internet or in

the Cloud is 100% secure, however, I didn’t think that anything was 100% secure before

the Cloud, when people could go and read [your] garbage and get your personal

information from and things of that nature. [Jesse S.]

Qualitative Summary of Research Question 3

Two themes helped answer the third research question: How may perceptions of PST

differ when completing school related tasks as compared to personal, non-work related tasks?

These themes covered the ways in which respondents understood PST in terms of using the

Cloud at school, for educational and student related purposes, as well as they ways they used the

Cloud home, for non-work related tasks. The following section discusses each of these two

themes along with related sub-themes (see Table 4.22).

132

Table 4.22. Research Question 3 Themes and Sub-Themes

Research Question 3

Theme

Sub-Theme

Theme 1:

Understanding of PST as it

relates to school tasks

 Faculty and student use of the Cloud and

PST concerns

 Government legislation and

protection of student privacy

Theme 2:

Understanding of PST as it

relates to personal tasks

 Personal use of the Cloud and PST

concerns

 Convenience is the Enemy of PST

Theme 1: Understanding of PST as it relates to school tasks. Respondents discussed

their understanding of PST as it relates to both their use and students’ use of school centered

Cloud-based applications and services, leading to two subthemes. The fist subtheme was PST-

Faculty and student use of the Cloud. The second subtheme was government legislation and

protection of student privacy. The sections that follow provide a detailed account of each of these

subthemes.

Sub-theme: PST- Faculty and student use of the Cloud. Cloud programs discussed by

the respondents included G Suite, SIMS, LMS, and communication platforms from ClassDojo to

Edmodo, and even traditional email. Not only did the responses provide detailed insight of

faculty and student use of the Cloud, but more particularly, it let to the uncovering of faculty’s

understanding and concerns of the issues of PST as related to Cloud-based applications and

services. Jesse S. provided a succinct yet informative overview, sharing how,

We use a couple of them… We use a student information management system, I think

Infinite Campus for grades, progress reports, and attendance. We utilize Google for

student work… and that's it. There's also a learning management system [LMS] for

133

parents to use to see their kids’ progress [that] may be considered part of Cloud. [Jesse

S.]

G Suite was the most frequently discussed Cloud program. Respondents commonly

discussed how transformational G Suite has been for all constituents, from teachers and students

to administrators and parents. Responses detailed how G Suite has allowed for tremendous

collaborative possibilities for faculty, students, and parents, both remotely and securely.

Respondents frequently discussed the conveniences that G Suite offers, which include

district wide collaboration possibilities and the centralization of student documents, lesson plans,

curriculum, and other forms of data with the possibility of secure and remote access. Drew Q.

emphasized the collaboration and sharing possibilities offered by G Suite in the following

statement: “I can access my materials from any classroom when I have to bounce from room to

room while teaching… [and] easy to share documents with students, instead of keeping hard

copies of everything.” Other respondents, such as Dakota Q., discussed remote and secured

accessibility, explaining,

I co-teach, so Google would allow us to access shared documents easily and securely. We

don't have to physically be in the room together to work on documents… also, I can work

from home on things and access them in school. [Dakota, Q.]

Respondents also discussed the advantages that G Suite allows for students. Responses

mostly focused on how G Suite had improved student accountability for assignment deadlines

and overall learning outcomes. Many respondents’ discussions resonated with Hudson Q. who

stated, “I no longer have trouble receiving digital homework from students,” or Kai Q. who

noted, “Students cannot use excuses like ‘I did it but it is not on my computer’ or ‘I sent it but it

got lost in the Cloud’.” A small number of respondents detailed accounts of their students’

134

enjoyment using G Suite, as it facilitates assignment preparation and their ability to turn in their

work on time, remotely (from home), and securely. Frankie Q. shared this sentiment when

expressing that,

My students love having access to their assignments and documents wherever they are…

Students are able to log into their Cloud and send, receive, and share documents more

readily than when they used their school drives as their primary location for saving

information. [Frankie Q.]

Most respondents discussed security measures of school centered Cloud programs,

especially in terms of student PII. Two respondents went as far as to note that they believed that

student data, in particular PII maintained by the SIMS, was perhaps more securely maintained

than their own personal, non-work related data. When discussing the use of the Cloud for work

related tasks, especially when working with student PII, Harley S. stated,

Yeah, well, their level [the school] of security is a lot greater than mine, [my] personal

data… I feel a little bit more trusting of student data being secured, because the school

knows how important so much of that data is, they cannot [allow a] breach of that kind of

information based on their student base. [Harley S.]

Respondents commonly discussed the importance of maintaining student data in a highly secured

environment, mostly because of the sheer volume of data stored by each school district. Many

respondents foresaw that there was a greater likelihood of a data compromise or breach, as

explained by Harley S.,

I think the systems I use at work are more secure based because it's a bigger database.

Bigger risk in losing the information because the school is in control of a lot of student

and faculty information and confidential documents, a lot of confidential information.

135

[Harley S.]

Six of the eleven respondents who completed the semi-structured interviews expressed

concerns about the sharing of student data with third parties. While these respondents understood

the potential sharing of their personal data with third parties when uploaded to Facebook and

other social media platforms, they expressed concerns that they had limited knowledge of the

extent to which, if any, student data could be similarly shared with third parties. Dylan S.

discussed personal data, stating “I think that once you allow your images [and other] data to be

given to a private company, like for Facebook, [it] becomes their property… they can use it for

marketing and analyzing.” However, when asked about the sharing of student data with third

parties, Dylan S. stated that it could be possible and that this was concerning, as noted in the

following:

Maybe if they're [marketing companies] doing something [for] educational purposes, or

to see how students use [the Cloud]... I think that there's statistical information that would

be interesting, but I am not sure if it is allowed or not, but actually that concerns me, I

have kids and I don't want Google knowing about them.

Respondents seemingly agreed that vendors, subscribers (i.e., the school districts), and

state and federal education agencies must protect data and adhere to various policies and legal

frameworks. However, eight of the eleven respondents who discussed student data were not

always aware of how student data may or may not be shared, and if it is shared, what data

attributes are shared, for what reasons, and with who. While respondents agreed that student data

would be of great interest for corporate use, few thought that data was actually being shared or

had knowledge of recent high profile court proceedings as discussed in Chapter 2 of this

dissertation. Many respondents shared similar sentiments as Sydney S., who explained,

136

They might, actually they would, want that information… I mean, if they're looking for

information to use for marketing or targeted advertising. They might want to do that as

student data could be a jackpot, for learning about students for tutoring [companies] to

selling the latest video games, its powerful info.

Sub-theme: Government legislation and protection of student privacy. Nine of eleven

respondents who took part in the semi-structured interviews discussed the importance of

protecting student data and privacy. While these respondents discussed, to varying extents, what

their school districts go through to protect student data and privacy, only four of the nine

respondents were reasonably knowledgeable of government legislation, such as Family

Educational Rights and Privacy Act (FERPA), meant to safeguard student privacy. However,

when asked about Health Insurance Portability and Accountability Act (HIPAA), all nine

respondents were aware that HIPAA is a form of legislation enacted to safeguard medical

records.

Near the end of the semi-structured interviews, nine of the eleven respondents discussed

whether they knew of any legislation enacted to protect student privacy, in particular, laws such

as FERPA and COPPA enacted to protect student data. Responses ranged from Ryley S. who

simply stated, “Never heard of it,” to that of Dylan S. who stated, “Are those the ones that

protect your searches and for students using the Internet? Mmm, I think.” Two other respondents

also drew similarities to HIPAA when discussing legislation enacted to protect student privacy.

When Harley S. was asked of FERPA and COPPA, with a perplexed look he initially answered

“No.” The interviewer followed up, stating, “You're looking shocked [being asked], but it's not

like people commonly know of legislation that protects student privacy…” Harley S. then stated,

137

“You mean like HIPAA? Yes… that’s for medical, I would think that there are some [laws] for

student records.”

Ryley S. elaborated on the notion that even with legislation there could be ways to

circumvent protections to privacy, and that legal wrangling, nefarious actions, and even potential

technical issues could undermine legislation and compromise data security. Ryley S. explained,

Yes, I think that they [legislation] probably can make a difference, but I think that there

are always going to be flaws and loopholes in any of those laws. There are computer

errors, human errors, and there are people who are out to get information and will find a

way to do it. [Ryley S.]

Another respondent discussed the importance of adaptive legislation to protect student

data and privacy because of the dynamic nature of the Cloud as a technology that is still

evolving. While Jesse S. did not specifically discuss FERPA or COPPA, this respondent

discussed the notion that the Cloud is still in its infancy and that “There's still applications for it

that haven't been imagined yet.” With the growth and increasing complexity of the Cloud and

Cloud-based programs, there is the need to review existing legislation on a regular basis to

confirm that it is still effective in safeguarding and protecting personal data irrespective of

changes in technology. Jesse S. stated, “I hope that policy and legislation measures are in place

and regularly amended to protect data and privacy, especially confidential, not only mine but

also for the students.”

Respondents least frequently discussed their school districts’ policies in regards to

student privacy as it pertains to Cloud programs. A review of each of the three district’s public

and non-public resources regarding technology use and student privacy yielded a number of

comprehensive policies enacted by each district that outline measures taken to safeguard student

138

and faculty privacy. Each school district makes numerous references to FERPA, and to a lesser

extent, to Children's Internet Protection Act (CIPA) and New York State Education Law § 2-c

and 2-d,

the latter of which details how districts should maintain student PII to ensure data

integrity. The Tuckahoe Union Free School District’s website includes a sub-section with

downloadable notifications, including the Parents Bill of Rights for Data Privacy and Security,

Rights Under the Protection of Pupil Rights Act, and two versions of the district’s advisement for

parents and students 18 years of age pursuant to FERPA. The Hendrick Hudson Central School

District website follows suite, publishing under “Legal Notices” similar downloadable

documents. Pelham Union Free School District also publishes on the district website similar

documents, including their Policy on Student Privacy and Policy on Access to Student Records.

Faculty and staff of the three districts take part in yearly professional development

workshops and sessions that address both acceptable technology use and measures followed to

ensure student and faculty data privacy and security. All three school districts require that faculty

and staff consent yearly that they have reviewed the acceptable technology usage policies and

other mandated materials that outline the maintaining of data to protect both student and faculty

privacy. It is a requirement that faculty and staff at Tuckahoe Union Free School District sign the

District Acceptable Use Policies which included an additional Computer Network for Education

Policy. This policy details steps that faculty and staff must take to maintain student and staff

confidentiality and privacy of data.

All three school districts’ technology policies and professional development documents

made numerous references to protective legislation, including FERPA, CIPA, and Children’s

Online Privacy Protection Act (COPPA), and how these enactments protect student data and

New York Consolidated Laws, Education Law - EDN § 2-c. Release of student information to certain entities.

New York Consolidated Laws, Education Law - EDN § 2-d. Unauthorized release of personally identifiable

information.

139

address measures to maintain both its privacy and confidentiality. The Tuckahoe Union Free

School District requires faculty and staff to acknowledge that they have reviewed the Internet

Safety Policy Regulation documents, which clarifies appropriate use of the Internet in accordance

with the CIPA. This policy notes, among a number of protective measures adopted, that “Staff

and students will be advised to not disclose, use and disseminate personal information

about students when accessing the Internet or engaging in authorized forms of direct electronic

communications” (Board Policy 4526.1 Internet Safety, 2005, p. 5). Hendrick Hudson Central

School District’s Strategic Instructional Technology Plan (2015) makes numerous references to

the appropriate use of student data to protect their privacy, especially as it relates to student’s PII.

As stated in the plan, “Staff may not post student last names, photos with first or last names,

personally identifying information of students, or any confidential student information, without

prior parental authorization” (HHCSD Strategic Instructional Technology Plan 2015, p. 25).

Theme 2: Understanding of PST as it relates to personal tasks. PST as it relates to

Cloud-based programs accessed at home for personal use was another topic respondents

discussed during interviewing. Respondents first discussed their most commonly used Cloud

programs and then their perceptions of PST as it relates to accessing these programs. Results led

to the finding of a number of commonalities, discussed further in the sections that follow. One in

particular is the notion of convenience being the enemy of PST. The other was the personal use

of the Cloud and PST concerns.

Sub-theme: Personal use of the Cloud and PST concerns. All 72 respondents who took

part in this research discussed their personal use of the Cloud, some in great detail and others to a

much lesser extent. Responses included a broad range of uses, from the mundane of posting to

social media, shopping online, and sharing pictures with family, to more specific and in-depth

140

tasks, including the completion of a mortgage application as well as the trading of stocks and

bonds in real time. Corey Q. even discussed “using ride-sharing apps, specifically Uber [which]

serves as great examples of modern iterations of real-time Cloud computing.”

Respondents most frequently discussed using Cloud-based programs to securely store and

share large formatted files, including pictures, videos, and music, with family and friends.

iCloud, Google Drive, Dropbox and OneDrive were the most commonly noted programs used by

respondents. Blair Q. shared sentiments that resonated with others, explaining “I use Cloud based

storage with my husband for sharing photos, music, and files,” while another respondent simply

stated “It’s best for accessing photos, music, movies, and sharing with friends.” Other

respondents discussed using the Cloud to securely store personal data as well as the benefit of

having remote access to this data from various devices. Morgan Q. explained that, “The Cloud

stores all of my phone and computer information, so if I purchase a new device, all of my

information can be downloaded to that device… It's great for saving pictures and videos.”

Respondents nearly as frequently discussed using the Cloud to access video and music

streaming services. Programs discussed included iTunes for accessing music, videos, and

podcasts, Amazon streaming services, as well as Netflix, Pandora, and Spotify. Jesse S. stated, “I

use streaming services like Pandora, Netflix, Amazon Prime, HBO Go, and things of that nature.

If those are in fact Cloud, which I think they are, then I use those.” Remi S. discussed there being

a number of advantages associated with streaming music instead of maintaining music on a

particular device, stating,

Pandora radio for example, I would assume is a Cloud type information where my

preferences are stored somewhere and anytime I want to listen to any particular type of

141

music, although I don’t have that music on my personal file I would be able to access it

and have it with me. [Remi S.]

While respondents frequently discussed Cloud-based productivity programs used for

work, such as G Suite and Microsoft 365, respondents much less frequently discussed using

productivity platforms for personal use at home. Only three respondents discussed using

particular applications such as Google Docs, Spreadsheets, and Drive, which are part of G Suite,

and Microsoft Docs, Excel, and OneDrive, which are part of the Microsoft 365 Suite. Casey S.

discussed using Google Docs for coaching at a local Police Athletics League (PAL), stating, “I

use Google Docs at home for writing up notes… It’s great as I can use it on my iPad or on my

laptop [and] then send it out as a memo for the next meet.” Another respondent discussed using

Microsoft 365, in particular Microsoft Docs, stating “I can be traveling on a train and creating

Word documents, or personal documents [then] I can share them easily among many people.”

Respondents more commonly spoke of using particular applications of productivity suites, such

as Google Docs or Microsoft Word, instead of noting G Suite or Microsoft 365 when discussing

the Cloud for at home and for personal use.

Respondents were then asked to discuss their concerns of PST as it relates to the Cloud

when accessed for personal, non-work related tasks. Respondents most commonly discussed

social media platforms as being the least trusted and least private Cloud-based programs. While

respondents agreed that social media played a significant role in connecting them to friends and

families, the general perception among respondents was to be cautious of what information they

share on social media and with who they share that information. Jackie S. explained,

142

My wife has Facebook, I see the benefits, she's connected with some old friends, so to

some degree I am freeloading there, but none of my information goes on there, because

it's all tracked, that’s what social media does, takes your privacy and sells it. [Jackie S.]

Respondents’ concerns in regards to PST as it relates to the use of iCloud, Google Drive,

Dropbox, and Microsoft’s OneDrive were considerably more positive than PST related to social

media use. In particular, respondents felt that when using services like iCloud, that their data and

information was more secure and protected against third parties. However, while respondents

were more confident that their PST was held to higher level of commitment, they were still

cautious of large corporations that may have vested interests in learning more about the owners

of data uploaded to their Cloud systems.

Respondents discussed being weary of vendors, especially large well established

corporations who could potentially mine data for particular information that could be monetized.

Skyler S. elaborated on this, explaining,

I just started to do iCloud, only because my phone’s storage was full. I like it as I can get

my pictures from any device and I am pretty sure it is secured. But it is Apple, and they

already have so much of my information. I think it is very secured from hackers but again

Apple has my information [and] if they wanted to know anything about me, it is there....

Basically, I am forced to use the iCloud if I want to keep all my pictures… [but, I am] not

comfortable with using the iCloud because they know so much. [Skyler S.]

Two respondents discussed online banking and shopping as providing the greatest levels

of privacy and security, making them, in the opinions of these respondents, the most trusted of

all Cloud-based programs and applications. These respondents believed that there were varying

levels of security that correlated with data sensitivity. Sydney S. explained,

143

I trust that banking and online shopping [would] have the greatest levels of security

because they are dealing with money… and do not want criminals to steal your money

because this would make them look bad and they would lose you as a customer as well as

the money. [Sydney S.]

Casey S. shared a similar sentiment when discussing the use of a particular banking corporation

solely based on the perceived measures of security in place to protect bank accounts. Casey S.

explained,

I use [XXX] bank because it offers a secure website and offers a secured app so anyone

who tries to hack in does not have the access to that very important information, so they

cannot transfer funds or steal money… Obviously that is a major thing for me. [Casey S.]

Sub-theme: Convenience is the enemy of PST. All 72 respondents discussed the

convenience of using Cloud-based programs to complete personal tasks outside of the

workplace. Respondents frequently discussed how using Cloud-based programs saved them time

and money, which allowed them to focus on other more important matters. The Cloud has

revolutionized nearly every aspect of daily life, from the way we communicate (e.g., email,

social media, and even online dating) to how we entertain ourselves, bringing 3D virtual reality

in to our living rooms. However, as discussed by respondents, while society increasingly

embraces the Cloud, there is a tradeoff of convenience increasingly becoming the enemy of PST.

While respondents enjoy the conveniences that the Cloud offers, they stressed a loss of PST

associated with these conveniences. In many cases, respondents discussed willingly sacrificing

PST as a compromise for the conveniences that the Cloud offers.

Responses commonly referenced a tug-of-war between the conveniences that the Cloud

offers and the degradation of PST as associated with using the Cloud. While all 72 respondents

144

applauded the conveniences that Cloud-based computing offers, there were a number of

respondents who voiced concerns of consequences that go hand-in-hand with these

conveniences. Responses collected from the semi-structured interviews were categorized into

three groups. These three groups included (a) the notion that convenience can outweigh concerns

of PST; (b) the notion that to be productive and able to complete daily routines, you must use the

Cloud; and (c) the notion that the Cloud is here to stay, like it or not.

Convenience outweighs concerns of PST. All 11 respondents who took part in the semi-

structured interviews discussed to varying extents the notion that the conveniences that the Cloud

offers can outweigh concerns of PST. Harley S. explained that regardless of your shopping

method, online or in a brick and mortar store, the possibility of being a victim of a crime exists.

Harley S. explained,

I do it [shopping] because of convenience. It saves me a lot of time, it saves me a lot of

gas, so I don't have to go to the store… I like the convenience of it coming to my door.

You know I can be targeted while walking out of the store at Christmas, it happens all the

time, there is no to little difference in risk. [Harley S.]

Respondents commonly attributed factors, including time and money, logistics, and even as one

respondent stated, “laziness,” as reasons why they have grown increasingly dependent on the

Cloud to complete daily routines.

Respondents also discussed knowingly sacrificing privacy and data security because of

the conveniences that the Cloud offers. While respondents discussed conveniences, which

included secured and remote accessibility and the ability to access information across multiple

devices, nearly half of the 11 who took part in the semi-structured interviews agreed with the

possibility of data being compromised internally. These respondents discussed the possibility

145

that the Cloud vendor or host could potentially mine data for particular information for the

purpose of internal marketing and that these vendors could even share your data with third

parties without proper consent, all for monetary gain. As Skyler S. explained,

I like it as I can get my pictures from any device and I am pretty sure it is secured, but it

is Apple and they already have so much of my information. I think it is very secured from

hackers, but again Apple has so much of my information that if they wanted to know

anything about me it is there… [Skyler S.]

Jackie S. added that as the conveniences that draw users and their confidential and

sensitive data to the Cloud increases, there is also an increased likelihood of nefarious actions

taken to compromise data for monetary gain. Jackie S. explained,

The pros are that it [the Cloud] gives you an enormous convenience and opportunity to

save materials, especially things that are, that use a lot of memory such as pictures and

large documents, however, anything that starts to move beyond your computer is a

greater possibility of hacking… The more we move to the Cloud, the more hackers are

going to try to get to it, but convenience will always win because it [the Cloud] simplifies

our lives. [Jackie S.]

To be productive, you must use the Cloud. The notion that using or accessing the Cloud

is necessary to be productive in today’s society and to manage daily routines furthered the idea

that convenience was the enemy of PST. Three respondents discussed the notion of “routine

efficiency,” or the idea that to minimize time and money spent on daily routines you need to

“engage with this new technological world” that Cloud-based programs offer. Dylan S. went into

great detail discussing two factors that encourage users to use the Cloud for self-sustainability.

These factors include (a) efficiency, as Cloud-based programs simplify a multitude of routines

146

tasks and errands; and (b) the vast amounts of information and data that crucially need to be

accessed but are only available through the Cloud. While many respondents take precautions to

protect their data, the need to be self-sustainable potentially overshadows users concerns about

PST. As Dylan S. explained,

I think in order to operate efficiently… I think that there's so much data, there's so much

information coming at us… I bank at three different banks, and my stocks are held at

three different places. I need to be able to have access to [all] that. I can't go to the

banks… and I think that to be efficient, you need to engage with it… I have things that

require engagement with this new technological world…. But to make it today you have

to sacrifice privacy to some extent. [Dylan S.]

Robin S. similarly discussed the notion of self-sustainability and of needing to use the

Cloud due to a lack of alternatives, as society as a whole is moving to the Cloud. Robin S.

elaborated on this when stating,

I don't really have a choice unless I want to switch banks, and even then, I would need to

use their banking app. I trust my bank app to some extent, but I also always know it can

be compromised at any given time, I think it's like: What am I willing to do, and what am

I not willing to do? I don't know. I guess we just make choices like that and hope for the

best… [Robin S.]

The Cloud is here to stay, like it or not. The final notion discussed by respondents when

addressing convenience as the enemy of PST is that society has grown so dependent on the

Cloud and the Cloud is so interwoven into daily life, that it is here to stay and will only continue

to evolve to one day become a much needed necessity, similar to a fifth public utility.

Respondents discussed that the conveniences that the Cloud has to offer are so great that society

147

will increasingly continue to embrace the Cloud until it is taken for granted in the near future,

similar to a public utility, such as electric or water. One respondent, Remi S. stated “I think the

convenience, while it is fantastic, it does put us in a potentially compromising situation… the

convenience factor is far too great and I foresee this becoming ingrained in our lives. Here to

stay like it or not.”

Other respondents shared similar sentiments of the Cloud being here to stay. This theme

often resulted from the idea that society has grown used to the Cloud, and in many cases, from

the idea that society accepts the conveniences that the Cloud offers as the new standard, leading

to a technologically dependent society. Jesse S. elaborated on this, explaining, “People… like the

freedom [to] access information… it seems that society likes all these convenience factors, so I

would say this is the reason why it will continue to grow and develop in ways that I can't even

imagine.”

148

Chapter 5 – Conclusions and Implications

When asking “Do you use the Cloud at work, for school related tasks?”

“I don’t use the Cloud for educational usage. I use google docs.”

When asked “Do you think that the conveniences that the Cloud offers have any side-effects?”

I think the convenience while it is fantastic, it does put us in potentially in a compromising

situation. With this being said, the convenience factor is far too great and I foresee this becoming ingrained

in our lives… [Remi S.]

(Participant responses collected from the online questionnaire)

Review of Study

This study explored how faculty understand the concepts of Cloud-based computing and

how they perceive issues of privacy, security, and trust (PST) when using Cloud-based

applications and services at-home and in schools. This study also looked at what differences, if

any, exist between faculty’s at-home use of Cloud-based applications and services and their use

of these and similar systems at work. The data collected in this study helped answer the

following three research questions:

1. How do school faculty and administrators understand the concept of Cloud computing

as used in K-12 public education?

2. How do faculty and administrators perceive the issues of privacy, security, and trust

(PST) as related to Cloud computing?

3. How may perceptions of PST differ when completing school related tasks as compared

to personal, non-work related tasks?

The Discussion of Findings section that follows is broken down by this study’s three

research questions. Each research question is then presented across those key findings that

helped answer that specific research question. This chapter then concludes with a statement of

149

the limitations of this study, implications for practice, recommendations for future research, and

a conclusion.

Discussion of Findings

Layering of the three research questions presented in this study ensures the collection of

as many details as possible from each respondent. Research Questions 2 and 3 built off of the

previous research question, respectively, and allowed for the development of interview questions

that were initially broad in nature and then became more specific as interviews progressed. This

layering approach allowed participants to describe particular aspects of the Cloud and issues of

PST without the researcher leading them. This approach also led to the initial fostering of broad

responses, later narrowed down by the researcher to provide more granular nuances of particular

aspects of Cloud-based computing. The following sections provide detailed findings on how

educators understand the Cloud and perceive PST as it relates to student data as well as their own

personal data.

Research question 1. How do school faculty and administrators understand the concept

of Cloud computing as used in K-12 public education? Overall, respondents demonstrated a

relatively good understanding of the Cloud. The majority of respondents were able to provide a

foundational definition of the Cloud, describe at least one or more characteristics of Cloud-based

computing, and discuss advantages and disadvantages of using the Cloud. An estimated 51 of 72

respondents (71%) who took part in the online questionnaire and six of the 11 who took part in

the semi-structured interviews were able to describe two or more characteristics of the Cloud. A

lesser number of respondents, including four who took part in the semi-structured interviews,

went beyond defining and discussing characteristics of the Cloud. These respondents provided

insight to implications for future expansion as well as society’s increasing dependence on the

150

Cloud, its applications, and the evolution of the Internet of Things (IoT). Respondents described

the Cloud most frequently in terms of convenience, discussing the advantages the Cloud offers,

which make it a sound and attractive solution for productivity, communication, collaboration,

and secured centralized data storage, with the possibility of remote access at any time and from

various Internet ready devices.

The description of a “relatively good understanding of the Cloud” is based on how

closely aligned respondents’ definitions and descriptions of the Cloud were with the 2011

National Institute of Standards and Technology (NIST) definition. While the 2011 NIST

definition is not definitive or mandated, it has become the industry standard for defining the

Cloud. The 2011 NIST defines the Cloud as “A model for enabling ubiquitous, convenient, on-

demand network access to a shared pool of configurable computing resources (e.g., networks,

servers, storage, applications, and services) that can be rapidly provisioned and released with

minimal management effort or service provider interaction” (Mell & Grance, 2011). This

definition also lists five essential characteristics of the Cloud as well as service and deployment

models. The five characteristics include (a) on-demand self-service, (b) broad network access,

Putting the 2011 NIST definition into simpler and practical terms, the Cloud can be defined as

“the use of common software, functionality or business applications from a remote server that is

accessed via the Internet" (Gupta, 2012, p. 325). The following is a discussion of the findings for

the first research question based on responses elicited from the semi-structured interviews and

supported by responses collected from the online questionnaire.

Describing the Cloud. Examining the responses elicited from the semi-structured

interviews, we see that all respondents were able to identify at least one of five essential

151

characteristics. Similarly, responses elicited from the open-ended questions of the online

questionnaire also referenced one or more of these five essential characteristics. Slightly over

half of the 11 respondents who took part in the semi-structured interviews identified two to three

of the five essential characteristics of the Cloud. Respondents most commonly identified one or

more of three essential characteristics, which included remote accessibility, the need for Internet

connectivity, and the ability to access the Cloud and related programs at any time. For example,

during one of the interviews, Casey S. mentioned “remote accessibility from various devices”

and “remote storage,” demonstrating the understanding that by uploading to the Cloud, not only

are you using remote storage but also freeing up local storage on the computing device. Jesse S.

also used terminology that described three of the five characteristics associated with the Cloud,

including remote storage, accessibility, and “somewhere else,” which refers to data being located

remotely. Furthermore, Jesse S. discussed data “accessed by different channels,” which refers to

accessing the Cloud across multiple Internet ready devices.

Characteristics of the Cloud. All respondents who took part in the semi-structured

interviews were able to describe one or more essential characteristics of the Cloud. Similarly,

respondents from the online questionnaire often provided one or more of these essential

characteristics, while also describing the Cloud in metaphorical terms. The use of metaphors to

describe complex technologies such as the Cloud is more common when a person is unfamiliar

with a technology or when describing concepts of the technology that are vague or difficult to

understand. Unfamiliar and vague concepts are often described “in terms of more concrete

concepts, which are more clearly delineated in our experience” (Lakoff & Johnson, 2003, p.

113). Respondents, such as Drew Q., described the Cloud as an “online USB [that] you can

access anywhere,” while Addison Q., unsure of how to describe the Cloud, stated it was “a

152

cumulus Cloud filled with zeros and ones.” These findings suggest that while a number of

respondents who defined the Cloud may not have possessed accurate Cloud terminology, these

respondents were able to demonstrate their knowledge of the Cloud using metaphorical concepts.

This was particularly noticeable with responses collected from the open-ended questions of the

online questionnaire.

The Internet as a synonym and metaphor. Findings suggest that while respondents

frequently used “the Internet” interchangeably with the Cloud and as a metaphor for the Cloud,

seven out of 11 interview respondents correctly identified the role that the Internet plays in

Cloud-based computing as the networking conduit, connecting users to the Cloud, Cloud-related

technologies, applications, services, and the IoT. Descriptive data from the online questionnaire

supported findings from the semi-structured interviews. Specifically, respondents agreed that

“the Internet” is not the same as “the Cloud.” Nearly 92% of all respondents who completed the

online questionnaire agreed that, “…Internet connectivity is required to access the Cloud,” while

the remaining 8% were either unsure or responded that “The Internet was not needed.” While

these descriptive findings do not address the metaphorical use of “the Internet” to describe “the

Cloud,” they do shed light on respondents’ understanding that the Internet is not the same as “the

Cloud.” These findings show the majority of respondents from both the online questionnaire and

semi-structured interviews identifying that the Internet, which is one of the five most essential

characteristics of the Cloud, is in fact needed for network connectivity. Additionally, most

respondents commonly understood that the Internet is the networking conduit of the Cloud.

Recognition and marketability. Respondents’ use of “the Internet” interchangeably and

as a metaphor for “the Cloud,” even though the majority of respondents understood that the

Internet is the networking conduit of the Cloud, may be explained by marketing strategies that

153

describe “the Cloud” as “the Internet” to assist consumers with understanding what the Cloud is.

Cloud marketing and introductory literature commonly references “the Cloud” as “the Internet,”

as exemplified in a 2016 PC Magazine article, which explained, “In the simplest terms, Cloud

computing means storing and accessing data and programs over the Internet instead of your

computer's hard drive. In simplest terms, “the Cloud is just a metaphor for the Internet” (Griffith,

2016, p. 1). Academic publications, which also suggest that “the Cloud” is a metaphor for “the

Internet,” include (a) The origin and construct of Cloud computing

and (b) Cloud computing:

Opportunities and challenges

among numerous other publications.

The marketing of Cloud-based computing in metaphorical terms, as a meteorological and

atmospheric Cloud, also plays a crucial role in users’ understanding of the Cloud and their

abilities to describe the Cloud and its essential characteristics. The very few questionnaire

respondents, estimated at less than 4 of 72, who could not describe one essential characteristic of

the Cloud in accordance with the 2011 NIST definition, referred to the Cloud in meteorological

and atmospheric terms. Sasha Q. spoke about “…an actual Cloud in the sky where all of the

world’s technological data is stored,” while Micky Q. stated that the location of the Cloud was

“literally… [in] a Cloud.”

Respondents who discussed the Cloud in virtual terms did so because they were unclear

as to the storage location of their data once in the Cloud. Various marketing strategies that use a

figure of a Cloud to depict Cloud-based computing have reinforced this notion. Examples

include Google Cloud Storage

and Comcast Business Solutions

websites as well as ZDNet’s

(Daylami, 2015)

(Sadiku, Musa, & Momoh, 2014)

https://cloud.google.com/storage/

https://business.comcast.com/Ethernet/data-center

154

online article

What’s the best Cloud storage for you? Cloud computing researcher Hu (2015)

noted that the iconic figure of a Cloud, which was first developed by AT&T engineers in the

1970s and which is used today to represent the Cloud, was originally “used… to represent any

unspecifiable or unpredictable network, whether telephone network or Internet” (p. X). In other

words, the initial intention of the figure of a Cloud was to depict complex communication

networks. However, since then, marketing strategists and Cloud venders have found this figure

or symbol to be a more effective way to present Cloud-based computing to consumers.

“Convenience, convenience, and overall convenience.” Findings suggest that

respondents most commonly associated the conveniences that the Cloud has to offer as its

biggest lure. Specifically, participants bought into the Cloud for its ability to provide remote and

secured accessibility to data at any time across various Internet ready devices. When asked,

“What do you like the most about the Cloud?” respondents most frequently provided statements

such as, “convenience, convenience, and overall convenience.” Other respondents, summarizing

the Cloud, stated “it is so convenient” and “it is very convenient as it allows me to complete

tasks for home or work.” Speaking to the idea of convenience, respondents also made remarks

like “it is so useful,” with one respondent describing the Cloud as “efficient, as it helps me store

my files and keep all my music in one place.” Respondents referenced the term convenience as

well as phrasing that described conveniences of Cloud-based computing more than 47 times in

both the semi-structured interviews and responses collected from the open-ended questions of the

online questionnaire. Just over three quarters of responses collected from the semi-structured

interviews referenced convenience in one or more contexts as the most important characteristic

of Cloud-based computing.

https://www.zdnet.com/article/whats-the-best-cloud-storage-for-you/

155

Recent literature suggests that millennials,

who have also grown up as Digital Natives,

have come to expect the conveniences that the Cloud has to offer as a “norm” of the highly

technological society that we live in. A 2013 Forbes article reports that millennials are changing

the workplace by focusing more than any other generation on collaborative efforts for

productivity, the ability to work from home, and the increased use “Facetime” technologies to

tele-communicate (Schawbel, 2013, p. 1), all of which require one or more essential Cloud-based

feature.

This trend of expecting the conveniences afforded by the Cloud as the “norm” will only

continue to increase over time. Nearly 40% of respondents

who took part in this study are of

the Millennial Generation. As time progresses, future educators in similar positions will either

come from this millennial group or share similar sentiments as millennials, especially

considering that Generation Z (those born in 1997 and onward) are also Digital Natives.

Furthermore, respondents in this study are educators in classrooms with students who are more

immersed as Digital Natives than ever before.

Overall convenience in the workplace or the school. Findings suggest that respondents

saw the conveniences the Cloud has to offer in the workplace or the school as a significant

advantage not afforded or even fathomable a little more than a decade earlier. Respondents

frequently emphasized the conveniences of school related Cloud-based programs, including

Researchers define Millennial Generation as the demographic cohort born between the early 1980s through the

mid to late 1990s. This study uses the Pew Research Institutes definition of Millennials as having a birth year range

of 1981 through 1996 (ages 23 to 38 in 2019). See https://www.pewresearch.org/fact-tank/2019/01/17/where-

millennials-end-and-generation-z-begins/ for further discourse.

Digital Natives “think and process information fundamentally differently” (Prensky, 2001, p. 1) having been

immersed in a rapidly evolving digital world while coming to age. Digital Natives have known the Internet,

computer games, cell phones and the Cloud as “the norm”- intertwined into nearly every facet of society since

nearly birth.

Of the 72 respondents who took part in this study, 29 or 40% self-indicated that they were of the Millennial

Generation ranging between 20 to 39 years of age (Online Questionnaire #31).

156

secure and remote access to work and student related documents outside the school. Jesse S.

discussed the benefits of the district moving to the Cloud, explaining, “We use Google to save

public documents that could be used by any and all faculty members… and they can be accessed

at multiple terminals by anyone, faculty... [and] students to save their work so that it's in one

place...” Respondents also discussed in detail how today’s Cloud-based capabilities afforded

them flexibility for reviewing assignments, writing reports, grading, and even collaborating with

students and parents, most of which was not afforded with older, more traditional computing

models.

Respondents further detailed how G Suite has allowed for both remote and secure

collaborative possibilities between faculty, students, and parents. Drew Q. emphasized the

collaboration and sharing possibilities offered by G Suite in the following statement: “I can

access my materials from any classroom when I have to bounce from room to room while

teaching… [and] easy to share documents with students, instead of keeping hard copies of

everything.” Another respondent, Dakota Q., commented on the remote accessibility the Cloud

offers as well as security stating,

I co-teach, so Google would allow us to access shared documents easily and securely...

We don't have to physically be in the room together to work on documents… also, I can

work from home on things and access them in school. [Dakota, Q.]

The Cloud’s numerous incentives make it a practical solution for the education sector as

respondents have described and research suggests. G Suite, as discussed by Awuah (2015), has

“…advantages that are perceived as transformational in the education system” (p. 16). Google

Sites and G Suite offers faculties and students both communication and collaboration capabilities

157

to achieve optimum productivity within both traditional brick-and-mortar and virtual learning

classroom environments (Awuah, 2015, p. 16).

Findings also suggested that respondents believed that they access the Cloud more for

work related tasks than for home and personal tasks (with the exception of social media). Nearly

88% of respondents noted that they use the Cloud to share files and collaborate on work-related

tasks, while 79% of respondents agreed that they used the Cloud for sharing personal documents

and images outside of work. These findings also support other key findings, such as a small

number of respondents lacking the knowledge that many applications used at home are in-fact

Cloud-based. Some respondents shared a notion that the Cloud, when used at home, is more of a

data storage application, such as Dropbox, iCloud, and others. Additionally, while the Cloud

facilitates many tasks, routines, and communication, among other benefits, these conveniences

come at a cost, as the next key finding suggests.

The double edge sword. Technology is the driver of convenience, and this is no more

evident than with the continual expansion of Cloud-based computing across all fabrics of modern

society. Findings suggest that nearly half of the respondents of the semi-structured interviews

expressed grave concerns in regard to the double-edged sword that the Cloud creates.

Respondents have stated that the Cloud is “here to stay” because of the numerous conveniences

it has to offer. However, while the Cloud is “here to stay,” society’s dependence on the Cloud, as

some respondents elaborated, continues to grow and could create a detrimental paradox,

dependence at a cost that society has not yet gauged.

Numerous respondents further made the point that the Cloud’s conveniences come at a

cost. Jesse S. explained that “It seems like society likes all of these convenience factors, so I

would say that this is the reason why it [the Cloud] will continue to grow and develop in ways

158

that I can't even imagine.” Robin S. succinctly discussed the double edge sword of convenience

and security, expressing her concerns when stating, “I feel like we kind of sell our worries about

being secure and our privacy for convenience.” While Dylan S. shared similar sentiments as

Jesse S., Dylan S. also painted a darker side of society’s growing dependence on the Cloud,

stating,

I'm of two minds with that. One of them is, it's efficient, it helps me. Okay, I need that

something that I'm looking for. Click, boom, compare. Easily put up there. I can just

buy… and give it to me. On the other hand, and is that bad, actually in this case it's not so

much the privacy, it's the... If they're only feeding me the things that I'm interested in,

how will I ever learn that there's more outside of my own little interests. [Dylan S.]

The response of Dylan S. extends beyond potential security and privacy issues that the lay user

expresses. Dylan S. implies that the Cloud delivers pre-chosen content, based on the user’s e-

commerce habits (targeted advertising)

, previous news reads (personalized news

recommendations based on the users search history)

, and targeted content delivery based on the

user’s history and cookies collected from previous websites.

Findings suggest that a small number of respondents (three of the 11 who completed the

semi-structured interviews) expressed concerns that the common Cloud user does not fully have

an understanding of the double-edged sword that the Cloud and related technologies present. A

Crain’s New York Business article discusses society’s lack of understanding of the significance

of Cloud-based computing and growing dependence on technology. In this article, Avivah Litan,

an analyst at Gartner, explains that “The problem is humans can't keep up with all the technology

they have created…. It's becoming unmanageable by the human brain” (Associated Press, 2015,

(Boerman, Kruikemeier, & Zuiderveen Borgesius, 2017)

(Bai, Cambazoglu, Gullo, Mantrach, & Silvestri, 2017)

159

par. 5). Furthermore, as the Cloud increasingly becomes a much needed technology required to

carry out daily routines, the potential failure of any of a multitude of technologies that makes up

the Cloud could bring the Cloud to a stop, affecting productivity, communication, and life

supporting technologies. As the Cloud continues to develop, the “technological daisy chain [that

makes up the Cloud] will increase the complexity of the systems and raise the risks of massive

breakdowns, either through an inadvertent glitch or a malicious attack” (Associated Press, 2015,

par. 4). As a result, society has become ever more ominously dependent on the Cloud, and

technology in general, without truly understanding of how deeply ingrained the Cloud is and will

continue to be.

Another respondent discussed Cloud-based computing as a “double-edged sword,”

explaining that while the Cloud greatly facilitates information retrieval and productivity at home

and in the workplace, it could hamper critical thinking and problem solving skills. As explained

by Robin S.,

As technology advances, such as the Cloud, it's kind of a double-edged sword because for

all of the conveniences and all of the ways it's supposed to make our lives simpler, we

aren't using our critical thinking skills as much and our ability to get ourselves out of

certain situations or to protect ourselves or to even think in terms of ‘What do I need to

do in order to take care of this?’ without using technology. We're losing those skills…

[Robin S.]

While the Cloud facilitates communication and increases productivity and access to information,

it is also altering critical thinking skills that has a profound effect on the way we think and

process information” (Carr, 2010, 2011; Prensky, 2001; Wolf & Stoodley, 2008). Cloud-based

160

computing is changing the world, changing society, and without us even knowing it, changing

the way we think critically and process information.

The Cloud as a 5th utility. Four of the 11 respondents who took part in the semi-

structured interviews discussed the Cloud as such an important technology that it has become

ingrained in our minds as a necessity or as a fifth utility, in addition to electric, water, gas and

sewer services. Findings from the semi-structured interviews include the breadth of respondents’

understandings of the Cloud and its future implications. Jesse S. described the Cloud’s seamless

and ubiquitous integration into nearly every facet of daily routines. This respondent described the

Cloud as a fifth utility, similar to public utilities, envisioning greater dependence on the Cloud as

it continues to evolve. According to Jesse S.,

More and more [data and work tasks] are going to be moved to the Cloud as more and

more people want smaller and smaller devices, for instance where local storage is no

longer an option so to save space and also to free up speed and such. It's going to be

almost a necessity to have information stored in remote locations. [Jesse S.]

Three other respondents shared similar sentiments when describing the Cloud, noting that

though the Cloud is still in its infancy, and as dependence on Cloud-based applications

continues to grow, that it will increasingly become a necessity.

These responses resonate with recent academic discussions of the importance of the

Cloud as a fifth utility, and in many cases, being publically available similar to the utilities of

gas, electric, or water. The Cloud has become so essential for society’s day to day routines, that

it has become “like all other four existing utilities, [and] will provide the basic level of

computing service that is considered essential to meet the everyday needs of the general

community” (Buyya et al., 2009, p. 599). While the Cloud increasingly becomes a necessity

161

similar to other utilities, the recent deregulation of the Internet has allowed Internet providers to

speed up services for some applications and websites and even block certain websites

which

they do not favor. Federal regulators voted Thursday to allow Internet providers to speed up

service for websites they favor — and block or slow down others — in a decision repealing

landmark Obama-era regulations overseeing broadband companies such as AT&T and Verizon

(Fung, 2017, para. 1).

Research question 2. How do faculty and administrators perceive the issues of privacy,

security, and trust (PST) as related to Cloud computing? Overall, respondents who took part in

this study perceived the issues of PST as related to Cloud-based computing as a serious matter,

which strongly influenced their acceptance of the Cloud, and to a lesser extent, their use of the

Cloud. Findings also suggested that respondents have varying notions of PST. These notions are

dependent on a number of factors, including but not limited to (a) the sensitivity and

confidentiality of data being sent to the Cloud (Weber, 2014), (b) the reputation and trust of the

Cloud vendor (J. Reidenberg et al., 2013), (c) familiarity of security measures taken by the

vendor to protect privacy (J. Reidenberg et al., 2013), and (d) the integrity of security as well as

the knowledge of what implicit and explicitly data other parties may have access to (Russell,

Reidenberg, Martin, & Norton, 2018).

Respondents also discussed PST in terms of data breaches and other nefarious acts that

compromise data integrity. Specifically, respondents agreed that regardless of measures taken to

ensure data security and privacy, if there is a will, there is a way, leading data uploaded to the

Cloud never to be 100% private and secure. Findings also suggest that respondents perceive

Prior to the FCC repeal of net neutrality, the FCC ruled that Verizon could not favor Yahoo and AOL, which it

owns, by blocking Google. In addition, Verizon was not allowed to charge Google extra fees in order to connect to

Verizon customers, as exemplified in a 2017 article published in the Chicago Tribune, see

https://www.chicagotribune.com/business/ct-biz-net-neutrality-vote-fcc-deregulation-20171214-story.html.

162

morality as it relates to the Cloud vendor as an area of contention. This is due to the increasing

number of high profile cases where third parties have been able to access data while

circumventing user’s contractual terms, and more importantly, where third parties have been able

to breach inadequate vendor firewalls due to lax policies and security measures that are not up-

to-date. A 2018 Time Magazine article discussed perhaps one of the largest data exploitations

that involved Facebook sharing personal data with a data analytics company, Cambridge

Analytica, working for the Republican party, which only reinforces respondents’ sentiments of

Cloud-based companies,

The fallout from Facebook’s data scandal involving Cambridge Analytica continues this

week, as more information came to light confirming that at least 87 million Facebook

users were impacted by hidden data harvesting — an update from the “tens of millions”

figure that Facebook previously said were touched by its ongoing privacy crisis

(Langone, 2018, par. 1).

Respondents understanding of privacy, security, and trust. Overall, respondents were

relatively knowledgeable of the “basics” of PST as it relates to Cloud-based computing.

Privacy. Overall, respondents, such as Sasha Q., discussed the concept of privacy in the

context of the Cloud as “Having your private information or information that you have placed in

the Cloud only accessible to you and the other parties which you allowed to have access.”

Similarly, Dylan Q. described privacy as maintaining “information [that] belongs to you [and]

should not be shared, viewed, or accessed by anyone other than you without [your] permission or

a high legal threshold.”

Nearly all responses that focused on privacy in the context of the Cloud fit into one of

four categories. These categories include (a) the notion that privacy is set by the end user,

163

allowing for various levels of privacy as commonly used in social media and on collaboration

platforms; (b) the notion that the end users’ information, files, and data are private and cannot be

accessed by others unless authorized by the end user through the use of credentials provided to

allow access; (c) the notion that privacy in terms of the Cloud is a tradeoff, as the end user

relinquishes a certain amount of privacy for the conveniences that the Cloud offers; and (d) the

notion that files and data uploaded to the Cloud are never private, no matter how much

confidentiality and security is assured.

Security. Respondents commonly discussed security in general terms as “feeling safe and

comfortable” or “feeling that my life and my property will not be hurt or damaged by others.”

However, as findings suggest, while respondents discussed security in the context of the Cloud

as measures taken to protect the integrity of data, respondents also noted that these measures can

never provide 100% assurance against the compromising of data. As Jesse S. explained,

Personally, I believe that the fact that all the security systems are created by humans, it

can all be hacked and undermined by humans. So, I don't think that anything on the

internet or the Cloud is 100% secure, but I didn't think that anything was 100% secure

before the Cloud either. [Jesse S.]

Findings suggest that respondents perceive security as the “weakest link” in the chain of

concepts that make up PST. Respondents frequently discussed the notion that security is only as

effective as the weakest link, and this link could be one of a number of points ranging from

sharing passwords, phishing scams, malicious insiders, the use of outdated hardware and

software, and even outdated security technologies used by the Cloud vendor. As discussed by

(Chou, 2013), “There is no doubt that the convenience and low cost of cloud computing services

have changed our daily lives; however, the security issues associated with cloud computing

164

make us vulnerable to cybercrimes that happen every day. Hackers employ a variety of

techniques to gain access to clouds without legal authorization or disrupt services on clouds in

order to achieve specific objectives” (p. 79).

Trust. Respondents commonly discussed trust in general terms, Jackie Q.’s words, as

“feeling secure with the person you are interacting with” or as Sasha Q. stated, “knowing that a

person or company [you are dealing with] has your best interests in mind.” Respondents spoke of

trust as it relates to the Cloud in terms of knowing that a Cloud vendor is properly maintaining

data while proactively acting in the best interests of Cloud users, to ensure that the Cloud and its

related technologies are up-to-date, secured, and remotely accessible around the clock.

Respondents frequently described trust as related to the Cloud as knowing “that the business or

company running the Cloud will work hard toward keeping [my] information safe and secure.”

[Adriane Q.]

Findings suggest that respondents’ levels of trust varied greatly among Cloud vendors

and were dependent on which Cloud applications and services respondents were using.

Respondents frequently described trust as a measure of confidence in the Cloud vendor’s ability

to keep data secured and protected. According to respondents, the most trusted Cloud

applications and services included banking and e-commerce platforms, while social media

platforms were the least trusted and least private Cloud-based programs. Jackie S. expanded on

the reason for this distrust of social media when stating,

My wife has Facebook, I see the benefits, she's connected with some old friends, so to

some degree I am freeloading there, but none of my information goes on there, because

it's all tracked, that’s what social media does, takes your privacy and sells it. [Jackie S.]

165

A 2018 Forbes article supported these findings in regard to the loss of trust, especially in terms

of social media. Arnold (2018) discussed the recent decline in consumer’s trust of social media,

citing that "Forty percent of people claim to have deleted a social media account in 2017 because

they didn’t trust the platform with their personal information” (par. 1).

Six respondents discussed trust in the context of the Cloud as being “non-existent.” This

was due to potential threats of the compromising of data. Charlie Q. expanded on this when

stating that “Trust is non-existent… Companies may say your information is protected, but there

have been too many breeches for me to trust them. Example: Yahoo, Target, et cetera.” Another

two respondents discussed being cautious of trusting the Cloud, as it is susceptible not only to

hackers but also to governmental agencies who may use personally identifiable data for

surveillance. Sasha Q. stated that trust is “having faith that data is secured… and hoping [that]

the Cloud is protected from people and the government.” Findings suggest that respondents

cautiously trust the Cloud, with their level of trust based on by how confident they are that their

data is securely maintained.

Respondents underlying concerns of PST. Overall, respondents’ greatest concerns

when discussing PST, in terms of student data, centered on Cloud vendor and subscriber

morality. This section discusses findings in regard to how respondents perceived vendor and

subscriber morality as it relates to student data, especially PII.

Morality. Morality, as discussed in Chapter 4, is understood in this study as a system of

explicit and implicit standards of behavior or beliefs maintained by society, which concern both

acceptable and non-acceptable uses by Cloud vendors and subscribers of PII and other private

data. Nearly half of respondents who took part in the semi-structured interviews discussed their

perceptions of the responsibility, or lack of responsibility, by Cloud venders and subscribers in

166

maintaining data as contractually outlined in EULAs. While few respondents trusted vendors’

morality, the majority of respondents believed that vendor morality varied depending on

motivations for profit, especially when speaking of students’ PII. Jackie S. stated, “I don't think

there is morality related to the Cloud.” However, later in the interview Jackie S. explained, “I

think that most institutions try to do the right thing… but they’re more interested in the bottom

line, the financial gain… and in a capitalist system, morality isn’t typically factored in.” The

response provided by Jackie S. resonates with other respondents, who, while they are

increasingly more trusting of Cloud vendors and subscribers, were still weary of the sharing of

data by vendors and subscribers with third parties with lower morality standards. A paper

released by the Fordham Center on Law and Information Policy (CLIP) in 2018 substantiates

respondents’ sentiments with a discussion of how student information is shared with third

parties, some known as data brokers.

The Fordham CLIP states that they “could only identify

14 data brokers who conclusively sell or advertise the sale of student information or have done

so in the past” (Russell et al., 2018, p. 9); however, Fordham CLIP suggests that there could be

numerous more data brokers who not only deal in student data, but who also have a niche market

PII.

Two key factors that emerged while discussing morality in terms of student data were

trust of vendors and subscribers, and transparency about the use and sharing with third parties of

Fordham CLIP adopted the FTC definition of data brokers as “companies whose primary business is collecting

personal information about consumers from a variety of sources and aggregating, analyzing, and sharing that

information…” (Data Brokers: A Call For Transparency and Accountability: A Report of the Federal Trade

Commission, 2014)

Fordham CLIP was cautious to only identify data brokers that conclusively sell or advertise the sale of student

data, and not merely the personal information of minors and young adults, or the contact information of parents and

guardians of students (Russell et al., 2018, p. 9).

167

data, especially PII. Remi S. discussed the sensitivity of student data and how it could be of

interest to outside parties, explaining,

Despite the fact that I did not classify this information [student PII] as necessarily

sensitive, it could definitely be used and certainly interesting for somebody to look at…

So regardless of what exactly that material is, I am sure that it could be used for a

purpose other than the original intent of the author. [Remi S.]

A lack of trust between Cloud users and providers has hindered the universal acceptance

of Cloud systems as outsourced computing services (Hwang & Li, 2010, p. 14), and this lack of

trust is heightened by the lack of transparency on the part of vendors and subscribers about what

specific attributes of data are shared and with whom. This lack of trust is discussed in depth by

Jules Polonetsky, executive director of The Future of Privacy Forum, who focuses on the

relationship that exists between the Cloud and student data, as well as the knowledge parents and

guardians have about the ways in which their children’s’ data is accessed.

The paramount concern of schools and tech and data companies should be making sure

parents and students understand why and how technology and data are being used to

advance learning, how the information collected is protected in the process and what the

schools are doing to safeguard protected information. (Polonetsky, 2014, para. 5)

Morality and Student Data. Respondents generally discussed their “uneasiness” or

discomfort uploading confidential information to the Cloud because of their concerns about

privacy and the possibility of vendors sharing data with third parties, including data brokers. As

one example, Dylan S. discussed vendor morality when addressing data, especially PII and the

potential for data exploitation.

168

I think it depends upon the corporation where the data is stored, [and who] is running the

Cloud. I think that it is probably reasonably secure against third parties… However, there

is an assumption that these companies, like Google and Apple, are constantly doing

research to secure their data in their own sources. I just think that it's not secure against

the companies [operating] the Cloud in which I'm storing. I feel that it is not private as

they have access to it and they could share data with others. [Dylan S.]

Nine of the eleven respondents who took part in the semi-structured interviews shared sentiments

similar to Dylan S. For these respondents, the importance of safeguarding Cloud-based data from

“no-good doers” was a valued commodity. They frequently focused their attention on the need to

protect student data because of the sheer volume of that data, which in many cases traced back to

students’ pre-kindergarten registration. They also focused on the type of information contained

in this data, most of which was PII specific.

Other respondents, like Dylan S., addressed Cloud vendor and subscriber morality, as

well as the potential of data exploitation, while discussing some of the attributes of student PII.

One such example is Jesse S., who explained,

I don't know exactly all the information that is kept by the school, but for instance, the

student information system, I suspect there's a lot of sensitive information about students,

their backgrounds, independent history, grades, parents, and things of that nature…

names, birthdays, that could be pulled… Student information can be good as gold to the

right people, money and more money for retail and marketing. [Jesse S.]

Student PII not only includes family information and academic records but also strictly

confidential medical history, immunizations, and other health related information. Sydney S.,

looking at the potential profitability that student PII can deliver to pharmaceutical companies,

169

explained that “When you think about the nurse's information, pharmaceutical companies might

want to target those records in order to market whatever could help the children as far as

allergies or medications.”

Valerie Strauss, a Washington Post correspondent who specializes in education issues,

discussed the centralization of student PII as part of Student Longitudinal Data Systems (SLDS),

“…in which the personal information for each child is compiled and tracked from birth or

preschool onwards, including medical information, survey data, and data from many state

agencies, such as the criminal justice system, child services, and health departments” (Strauss,

2015, para 9). The federal government mandated that each state provide their SLDS to the

Department of Education as part of the Statewide Longitudinal Data Systems Factsheet

(2019).

With this vast amount of detail rich PII available for aggregated analysis, Cloud vendor

and subscriber morality does continue to be an area of concern for many. Not only have

respondents in this study discussed at length the issue of the availability of vast amounts of

student PII, but policymakers, school administrators, legal entities, and especially parents have

also voiced similar concerns. Student data privacy advocates, including Joel Reidenberg of the

Fordham CLIP, have written extensively about the need to strengthen policy and legislation,

especially with consideration of the increased use of Big Data and Learning Analytics.

Leonie

Haimson, the a co-founder of the Parent Coalition for Student Privacy, a national alliance of

This factsheet describes the statewide longitudinal data systems as “comprehensive data systems, [where] states

will be able to monitor their reforms and make specific changes to advance them. These data systems will capture

data on students from one grade to the next, measuring whether they are on track to graduate and telling K-12

schools whether they are preparing their students to succeed in college and the workforce” (Statewide Longitudinal

Data Systems Factsheet, 2009,para. 3).

Reidenberg in an abstract of Achieving Big Data Privacy in Education (2018) notes in the article abstract, "We

argue for the need to demonstrate the efficacy of learning systems while respecting privacy and how to build

accountability and oversight into learning technologies” (J. R. Reidenberg & Schaub, 2018).

170

parents has made it her mission “[to defend] the rights of parents and students to protect their

data” (Strauss, 2015, para 2).

Only three respondents who took part in the semi-structured interviews touched on the

notion that student data, especially PII, needs protection from “the inside” by Cloud subscribers,

and in this case, by local, state, and federal agencies that mandate the collection of data for

analysis. Remi S. discussed concerns related to personal PII; however, the sentiments of Remi S.

also apply to student PII, and its possible use by non-contractually approved vendors,

irrespective of state and federal legislation (e.g., HIPAA and FERPA). Remi S. explains that

…these companies are definitely benefiting more than I am despite the fact that these

services have become so integral to how I conduct business of my own… So they are

certainly benefiting and they have access to basically my entire life whether they choose

to use it or not. [Remi S.]

Sentiments shared by Jackie S., Jesse S., and Sydney S. allude to the ongoing controversies

waged over Big Data, which plays a crucial role in learning analytics. While respondents did not

directly reference the current controversies centering on Big Data and learning analytics, they did

discuss an overarching and controversial issue associated with Big Data. While Big Data is used

internally by state and federal agencies, it is also shared with third parties who have multiple

interests, many outside of the education sector. This, as three respondents alluded to, puts PII at

risk.

Numerous studies published by a range of researchers, managers of privacy forums, and

non-profit advocacy groups share similar and even stronger respondent sentiments in regard to

vendor and subscriber morality. One of the most publicized incidents was the New York State

Education Department’s (NYSED) selection of a non-profit corporation, Wireless Generation, to

171

manage its student data. Wireless Generation, “…supported by the Bill & Melinda Gates

Foundation and the Carnegie Foundation among others… won the contract over other vendors

through a no-bid contract awarding process” (Bennett & Weber, 2015, p. 2). This decision raised

numerous legal and ethical issues in regards to the maintaining of student PII by private third

parties. It may also be one of the reasons why the misuse of student data by private vendors, the

increased possibility of student PII theft, and the chance that student data is used to enhance

student online profiles compiled by corporations for targeted online marketing (González-

Martínez et al., 2015) continue to be of particular concern for many (see Appendix L.).

Understandings of legislation. Findings suggest that respondents believe, overall and to

varying extents, that they were aware of state and federal legislations and district wide policies

implemented to protect student data by assuring data privacy. When asked about HIPAA, nine

respondents from the semi-structured interviews described HIPAA as legislation enacted to

safeguard medical records. However, only four of these nine respondents were somewhat

knowledgeable about government legislation, such as FERPA, COPPA, and state legislation

meant to safeguard student privacy. Ryley S. indicated that even with legislation in place, there

could still be ways to circumvent protections to privacy. This respondent also talked about legal

wrangling that could undermine legislation and compromise data security. When asked if

government legislation aimed at safeguarding student information was effective, Riley S.

answered, “Yes, I think that they [legislation] probably can make a difference, but I think that

there are always going to be flaws and loopholes in any of those laws [Ryley S.]. Ryley S. shared

sentiments similar to other respondents’ who spoke to the popular phrase “If there’s a will,

there’s a way.” While legislation and policy can protect student data, this is only to a certain

extent because of possible human and technological error and nefarious actions taken to

172

compromise data in addition flaws and loopholes in legislation. The next paragraph provides a

perfect example of this, regarding a significant strategically drafted loophole in FERPA §

99.31(a)(1)(i)(B).

Recent literature supports Ryley S. and the few other respondents who believed in the

possible circumventing of current mandates. Loopholes in federal legislation, one of which has

drawn much public attention, includes FERPA, as briefly discussed in two 2017 articles by

EdSurge

and Electronic Frontier Foundation,

both detailing that school districts and

educational agencies use of a loophole that allows schools to skirt around parental consent and

share PII with third parties who can be identified as “school officials.” The U.S. Department of

Education’s “Frequently Asked Questions” factsheet, which is focuses on protecting student

privacy, discusses who can and cannot be considered a “school official.” This factsheet also

references FERPA § 99.31(a)(1)(i)(B), which details four considerations that must be met before

an outside party is given access to educational records (see Appendix M.).

Overall, while considering respondents’ knowledge of state and federal legislation aimed

at protecting student data, nine respondents expressed the understanding that such legislation and

school district level policies was already in place to protect student data and privacy. However,

their understanding of FERPA and COPPA legislation was very limited as compared to their

understanding of HIPAA, which does provide protection to student data in terms of medical

records and immunization history, as detailed in a joint guidance policy

drafted by the U.S.

Department of Health and Human Services and the U.S. Department of Education. Results

showed that respondents understood HIPAA in greater depth for personal data protection. The

https://www.edsurge.com/news/2017-04-14-report-finds-loophole-in-federal-student-privacy-laws-highlights-

parent-concerns

https://www.eff.org/wp/school-issued-devices-and-student-privacy

https://www2.ed.gov/policy/gen/guid/fpco/doc/ferpa-hipaa-guidance.pdf

173

four respondents who discussed FERPA and COPPA at some length also shared the notion of

legal wrangling and loopholes leading to the skirting around of current legislation. These

respondents did not view current legislation as providing a minimum bar or level of protection

that school districts, state, and federal agencies could build on.

Education administrators and advocates for protecting student privacy, on the other hand,

do view current federal and state legislation as providing minimum standards for compliance, yet

they also feel this legislation does not provide a detailed master plan that sets a high bar for the

meeting of rigorous standards. Keith R. Krueger of the Consortium for School Networking

discusses this point:

While much of the current discussion is about compliance with federal laws such as the

Family Education Rights and Privacy Act (FERPA) and the Children’s Online Privacy

Protection Act (COPPA), mere compliance is the minimum effort required by school

systems (Krueger, 2014, para. 2).

Thus, while there may be a difference between how respondents in this study and educational

administrators and advocates view state and federal legislation aimed at protecting student data,

it is clear among these stakeholders that such legislation does not achieve a high enough standard

and does not do enough to protect student data.

Research question 3. How may perceptions of PST differ when completing school

related tasks as compared to personal, non-work related tasks? Overall, respondents

demonstrated noticeable differences in their perceptions of the Cloud when used for school

related tasks, and then, as used for personal, non-work related tasks. It followed that respondents

also perceived the issues of PST differently in terms of school related work and personal, non-

work related uses of the Cloud. Two primary findings spanning across the Chapter 4 themes of

174

PST as it relates to school tasks and PST as related to personal tasks help answer this third

research question. These key findings include (a) respondents’ differing understandings of the

Cloud as used at school, and then, as used at home; and (b) respondents’ perceptions of PST as

related to school related tasks.

Differing understanding of the Cloud at school and at used at home. Findings overall

suggest that respondents perceived considerable differences in the Cloud when using it for

school related tasks as compared to using it for personal, non-work related tasks. Specifically,

respondents perceived that they were accessing different types of Cloud-based programs more

frequently to complete school related tasks when compared to the personal tasks they completed

outside the school. It is not fully known why respondents had this perception; however, the

researcher believes that there could be two reasons supporting this finding. The first reason may

be attributed to how their districts inform and educate faculty about the Cloud; the second

potential reason may be based on how the Cloud is marketed for personal, non-work related use.

Reason 1: Faculty have been educated about the Cloud through the district. Findings

suggest respondents most commonly perceived using Cloud-based programs and applications for

school related tasks. This may be due to how school districts inform and educate faculty about

Cloud-based technologies, programs, and applications, such as G Suite, Blackboard, Infinite

Campus, and other commonly accessed Internet-based education solutions. Faculty and staff at

the three districts involved in this study take part in yearly professional development programs

that address newly implemented Cloud-based programs and applications. Professional

development also addresses enhancements and new features offered by many Cloud-based

programs, especially by G Suite, which is continuously evolving. In addition, all three school

districts invite faculty to take part in professional development and certification offered through

175

the Board of Cooperative Educational Services (BOCES) to familiarize themselves with Cloud-

based technologies, such as BrainPop, and even to become Google Certified Educators. BOCES

also offers courses in conjunction with the Lower Hudson Regional Information Center to

expand educators’ understandings of the Cloud, and in particular G Suite, by offering

professional development and continuing courses on Google Drive: Add-ons and Chrome

Extensions, Google Classroom, and Google Forms, as well as courses on the use of

Chromebooks and additional instructional technologies.

Findings also suggest that all eleven respondents who took part in the semi-structured

interviews understood that they routinely accessed one or more Cloud-based program to carry

out nearly every facet of education, from instruction and curriculum review, to communication

and collaboration, and even student reporting. Respondents most frequently discussed how

transformational G Suite has been for all constituents, including teachers, students,

administrators, and parents. Jesse S. discussed the benefits of the Cloud as used by educators:

We use Google to save public documents that could be used by any and all faculty

members… and they can be accessed at multiple terminals by anyone, faculty… [and]

students to save their work so that it's in one place… We don't have to worry about which

laptop the child was using the day before or if they're using the same laptop, because it’s

storage… It's also useful that we don't have to worry as much about students losing flash

drives or disks or try to access mobile hard drives… So reliability seems to be fine with

the Cloud computing as well. [Jesse S.]

Respondents nearly as frequently discussed other Cloud-based programs and

applications, such as SIMS and LMS, which include Infinite Campus, Blackboard, ClassDojo,

176

BrainPop, and Edmodo, to name a few. Jesse S. provided a succinct, yet informative overview of

the Cloud-based programs used in the school, stating,

We use a couple of them… We use a student information management system, I think

Infinite Campus for grades, progress reports, and attendance. We utilize Google for

student work… and that's it. There's also a learning management system [LMS] for

parents to use to see their kids’ progress [that] may be considered part of Cloud. [Jesse

S.]

A small number of respondents also detailed accounts of their students’ enjoyment using

G Suite, as it facilitates assignment preparation and students’ abilities to turn in school work on

time, remotely (from home), and securely. Frankie Q. shared this sentiment when noting that,

My students love having access to their assignments and documents wherever they are…

Students are able to log into their Cloud and send, receive, and share documents more

readily than when they used their school drives as their primary location for saving

information. [Frankie Q.]

Literature reviewed supports the sentiments shared by Frankie Q. A qualitative study by Morquin

(2016) discusses G Suite use in the classroom, how it has evolved learning outcomes, and how

students enjoy using various G Suite applications, such as Google Docs, Drive, and Sites.

Morquin (2016) discussed students’ engagement and completion of assignments as well as

homework, explaining that teachers felt “using Google Classroom and Google Docs has

positively impacted the returned rate of students finishing assignment[s] outside the classroom

[and] that using Google Classroom and Google Docs has increased homework completion”

(Morquin, 2016, p. 56).

177

Reason 2: Marketing of the Cloud for personal use. The second reason why respondents

perceive that they access and use Cloud-based programs more frequently for school related tasks

than for personal, non-work related tasks may result from how the Cloud is marketed for

personal, non-work related use. Findings suggest that while respondents frequently discussed

using the Cloud in the classroom as a productivity, collaboration, and communication tool, they

much less frequently discussed using Cloud-based programs, such as Google Suite (consumer

version) or Microsoft 365, at home for productivity, collaboration, and as a communication tool.

Only three of the eleven respondents who took part in the semi-structured interviews discussed

using particular applications of G Suite, such as Google Docs, Spreadsheets, and Drive, as well

as particular Microsoft 365 apps, such as Microsoft 365 Docs, Excel, and OneDrive, to complete

personal, non-work related tasks. Casey S. discussed using Google Docs for coaching at a local

Police Athletics League (PAL), stating, “I use Google Docs at home for writing up notes… It’s

great as I can use it on my iPad or on my laptop [and] then send it out as a memo for the next

meet.” Another respondent discussed using Microsoft 365, in particular Microsoft Docs, stating

“I can be traveling on a train and creating Word documents, or personal documents, [then] I can

share them easily among many people.”

Respondents most frequently associated the Cloud, when used at home, in terms of data

storage and as a back-up, and in particular, for data accessed through their smartphones, tablets,

laptops, and other personal internet ready devices. Skyler S. elaborated on this notion,

explaining, “I just started to do iCloud, only because my phone’s storage was full. I like it as I

can get my pictures from any device and I am pretty sure it is secured….” Quantitative findings

support these sentiments shared by Skyler S., and similar sentiments shared by other interview

participants who discussed the importance of the Cloud for data management and storage. For

178

instance, when asked on the online questionnaire “Which of the following programs/

applications do you consider to be Cloud based?” nearly 92% of respondents agreed that iTunes

and Google Drive are Cloud-based, and 66% of respondents acknowledged that Google Suite

and Microsoft 365 are Cloud-based as well.

The most frequently discussed Cloud-based programs and applications used for personal,

non-work related tasks included iCloud, iTunes, Google Drive, Amazon Drive, Dropbox, and

other similar programs that allow for the secure storage and sharing of large formatted files.

Morgan Q. explained that, “The Cloud stores all of my phone and computer information, so if I

purchase a new device, all of my information can be downloaded to that device… It's great for

saving pictures and videos.” A review of literature suggests that respondents commonly associate

the Cloud with data storage and the “backing-up” of personal data. For instance, Brinson (2012)

explained, in an article describing how Cloud-based data storage works, that “More and more,

individuals and businesses are turning to the Cloud for data storage…. For some, the primary

reason is that the Cloud is the easiest, surest way to back up photos, e-mails and all sorts of

documents” (Brinson, 2012, para. 1).

Respondents’ views of the Cloud as used for personal use may well be the result of

current marketing strategies by smartphone manufactures and Cloud vendors, including Apple,

Google, and Amazon. The Cloud is heavily marketed by these and other technology giants

because of the predicted significant growth resulting from the rapid evolution of the Internet of

Things (IoT) and the need to remotely and securely store large formatted data – such as images,

music, and videos – so that it may be accessed across multiple internet ready devices. Apple

179

extensively markets iCloud as “a breakthrough set of free

Cloud services that work seamlessly

with applications on your iPhone, iPad, iPod touch, Mac or PC to automatically and wirelessly

store your content in iCloud and automatically and wirelessly push it to all your devices” (Mills,

2011, para. 1).

Google Drive, part of the G Suite, also strategically markets its Cloud storage solutions as

allowing you to “See your stuff anywhere…. Your files in [Google] Drive can be reached from

any smartphone, tablet, or computer. So wherever you go, your files follow… [You can] Store

any file… Keep photos, stories, designs, drawings, recordings, videos, and more” (Google,

2019). Consistent and uniform marketing of Cloud-based storage solutions reinforce users’

notions that the Cloud, as it relates to personal, non-work tasks, is more commonly associated

with being a storage solution than a platform that delivers numerous other applications and

services, ranging from email to online banking.

Perceptions of PST as related to school tasks. All 11 respondents who took part in the

semi-structured interviews discussed the importance of PST as it relates to Cloud-based

computing. However, findings suggested that respondents perceived PST as it relates to school

tasks much differently than as related to personal tasks. In fact, an interesting misconception

found was that some respondents believed student data was potentially held to a “higher

standard,” so that there was a higher level of privacy, confidentiality, and security when

maintaining student data as compared to their own personal data.

Nearly every respondent who took part in the semi-structured interviews discussed the

importance of proactively protecting student data. Respondents also discussed initiatives taken

by their school districts to draw attention to this importance, including ongoing professional

iCloud offers free storage up to 5GB and then an incremented plan ranging from $0.99/month for 50 GB to

$9.99/month for 2TB for U.S. subscribers as noted by Apple and retrieved 8/13/2019. See

https://support.apple.com/en-us/HT201238

180

development, and to a lesser extent, mandated reviews of acceptable usage policies. As an

example, the Tuckahoe Union Free School District required yearly reviews of the “District

Acceptable Use Policies,” including the Computer Network for Education Policy. A review of

recent literature suggests that New York State is actively in the process of implementing even

stronger state legislation and mandates, requiring school districts to take additional measures to

strengthen existing district level policies. The New York State Education Department (NYSED)

proposed enhancements to NY State Education Law - EDN § 2-D after opening this item up for

public comment between January 30 and March 31 of 2019. The NYSED also published a Fact

Sheet for Parents, which included the following, among other key items:

 Educational agency employees who handle PII must complete annual training on the

laws and requirements necessary to protect sensitive data.

 NYSED adoption of the NIST Cybersecurity framework for the standard of data

privacy.

 The appointment of a Data Protection Officer with appropriate knowledge, training,

and experience to oversee data security and privacy. (NYSED, 2019, p. 1)

Respondents also discussed preventive measures encouraged and required by their school

districts to maintain a secured data environment. For example, Tuckahoe Union Free School

District policy states,

Staff must safeguard their passwords. Staff passwords often give access to confidential

information (i.e., student management system, financial system, IEP system) and keeping

them secure is a necessary responsible use of our resources. (Board Policy 4526 -

Computer Network for Education, 2005)

181

When asked about the importance of protecting student data, nearly half of the eleven

respondents noted that student data, especially PII, could be a much-desired target for data

thieves due to the volume and richness of this data. Harley S. discussed student data as including

“…everything on the student, everything, from grades and standardized test scores [to] also

medical history, guidance records, family details, and even disciplinary records.” Some

respondents foresaw that there was a greater likelihood of an educational data compromise or

breach, as further discussed by Harley S.; “I think the systems I use at work are more secure

based because it's a bigger database. [There is] Bigger risk in losing the information because the

school is in control of a lot of student and faculty information and confidential documents, a lot

of confidential information.” Literature suggests that school administrators and technologists are

actively engaged in strengthening current legislation, policies, and faculty awareness about the

potential value of PII access by unauthorized and nefarious identities. A Policy Consultant with

the New York State School Boards Association, as early as 2014, discussed student data privacy

and security, explaining, “Information is a hot commodity… As more districts move to local

electronic or Cloud information storage, there is widespread – and valid – concern that student’s

information be protected” (Sanik, 2014, para. 1).

Two respondents who took part in the semi-structured interviews elaborated on why

student data, especially PII, could potentially be targeted for theft, drawing on comparisons to

high profile private sector data breaches and compromises, including the Target and Equifax

incidents in 2013 and 2017, respectively.” A review of recent literature revealed that school

districts are increasingly being targeted for large-scale data breaches substantiate these

respondents’ concerns. One such example is a recent high profile and well-publicized breach in

early 2018 involving the San Diego Unified School District and the PII of over a half-million

182

students, staff, and parents. This data breach involved a “data file [that] contained information on

students dating back to the 2008-09 school year, or more than 500,000 individuals” (Strauss,

2015, para. 4). The author of this Washington Post article, who is considered a leading expert in

reporting on education issues, further stated, “Schools have increasingly become targets of

hackers and cyber thieves in recent years, with hundreds of incidents reported annually” (Strauss,

2015, para. 8). However, while some respondents discussed student data being targeted for theft

due to the sheer volume and richness of the data, no respondent could recall learning of a large-

scale data breach or the compromise of their school district’s SIMS, similar to the one that

occurred at the San Diego Unified School District in 2018.

Findings suggest that when respondents discussed PST as it relates to school, and in

particular, to student PII, their greatest concerns focused on internal threats carried out by

students and nefarious faculty members, as well as the concern of data sharing with third parties.

Casey S. echoed these sentiments when stating “I think that if students could find a way to go in

and change grades [they would], or for their buddies to do it so [they] can gain access to better

colleges.” Literature reviewed for this study supports respondents’ concerns that internal threats

may be more common than large-scale data breaches. While the researcher for this study could

not determine an accurate count of the number of instances that students or faculty have

breached K-12 Cloud-based platforms, findings published in a 2018 Education Week article

explain that

From California to New Jersey, teenagers have allegedly improperly accessed student-

information systems, online learning programs, and college-counseling software in at

least 10 states this school year… [and] K -12 information-technology experts say the

183

scope of the problem reflects an ongoing failure by schools and districts to take even the

most basic measures to protect their networks. (Herold, 2018)

A final and rather interesting finding discusses respondents’ understandings of the role

that third parties play in maintaining and sharing student data, especially PII. Six of the 11

respondents who completed the semi-structured interviews expressed concerns about the possible

sharing of student data with third parties. While respondents did understand, to varying extents,

how third parties such as Facebook and other social media platforms potentially share data, they

also expressed sentiments about the morality of corporations, the notion that corporations and

Cloud vendors should follow appropriate regulatory legislation, and the district policies and

business ethics that are related to how student data is maintained. Jackie S., who explained

morality as it relates to student data, offers one example: “I think that most institutions try to do

the right thing… but they’re more interested in the bottom line, the financial gain… and in a

capitalist system, morality isn’t typically factored in.” This statement, which was similarly

shared by other respondents, is reinforced by recent high profile incidents, including the 2018

Facebook–Cambridge Analytica

data scandal, and the most recent and still emerging Federal

Trade Commission

announcement in July of 2019 of a $5 billion penalty levied against

Facebook over such privacy breaches.

One area of interest not discussed by respondents was that of the sharing of student data,

especially PII, with third parties. While school districts may first authorize the sharing of PII, this

data may then be compromised by another party for personal gain and profit as the result of a

security breach. Three interview respondents stressed the need to assure that Cloud vendors, and

https://www.nytimes.com/2018/04/04/us/politics/cambridge-analytica-scandal-fallout.html

https://www.cnn.com/2019/07/24/tech/facebook-ftc-settlement/index.html

184

even subscribers, strictly maintain student data with the utmost confidentiality; however, not one

of these respondents discussed the “what if” notion of the compromising of student PII while

being shared with third parties. Large educational companies, such as Blackboard, Follett, and

Pearson, which access and share student PII, are increasingly targeted for data breaches. For

example, Pearson Educational Software had a data breach in March 2018, which, according to

Olson (2019), “affected more than 13,000 school and university accounts, some containing

information—such as names, dates of birth, and email addresses—on thousands of students

each” (Olson, 2019, para 2).

In some cases, large educational companies like Blackboard and Follett have not

effectively secured and “de-bugged” their Cloud-based platforms, which can potentially put

millions of students’ PII at risk. One high profile incident involved a high school freshmen who

successfully hacked into both Blackboard’s and Follett’s software, allowing unhindered access to

millions of student, parent, and faculty PII. Wired Magazine reported that this high school

freshmen announced his successful data breach at a 2018 Defcon hacker conference. Wired

Magazine notes that for Blackboard alone, “more than 5,000 schools appeared to be included in

the data, with roughly 5 million individual records in total, including students, teachers, and

other staff” (Greenberg, 2019, para. 4). This is a paradoxical finding for this study, considering

that while 6 of the 11 respondents who did express concerns about student data being shared with

third parties, and even being exploited by these parties, did not discuss the possibility of student

data being compromised by another party beyond that of the third party.

Implications for Practice

This study found that faculty have a fairly grounded understanding of the Cloud, with all

respondents who took part in the semi-structured interviews providing at least one characteristic

185

that defined the Cloud, and with nearly half of these respondents referencing two or three

examples of these same characteristics. Overall, respondents often demonstrated a clear

understanding of PST, commonly referencing a tug-of-war between the conveniences that the

Cloud offers and the degradation of PST as associated with the use of the Cloud. This study also

revealed that there are differences in the understanding of PST as related to student data and then

as related to respondents’ personal data. Based on these findings, the following recommendations

for practice are offered to school districts interested in better incorporating the use of technology

within their schools.

Recommendation 1. It is recommended that school districts incorporate professional

development programs that address the Cloud as an overarching and all-encompassing

technology that does not fit neatly into a single box. Educators would benefit from understanding

that the Cloud is more than G Suite, Microsoft 365, Infinite Campus, Blackboard, and the

Internet, as well as a number of browser-based applications and programs. For instance, recent

advancements in IoT, virtual and augmented reality, artificial intelligence, and immersive

learning are all Cloud-based. Professional development time needs to be set aside to teach

educators that the Cloud is a larger integrated technology that will play an expanding and critical

role in education. Once users, in this case educators, learn of the different roles that the Cloud

plays as an integrated and all-encompassing technology which society has become increasingly

dependent on, will the benefits and limitations of Cloud-based computing be fully explored,

especially as it relates to the sector of K-12 education.

Recommendation 2. The three school districts involved in this study had relatively

thorough policies and professional development opportunities focused on the protection of

186

student data. However, the recent increase in ransomware

attacks will likely force districts to

re-analyze current policy, security mandates, and professional development in regards to Cloud-

based security. As a result, districts should seek to employ staff members exclusively dedicated

to cybersecurity. According to Keith R. Krueger, the chief executive of the Consortium for

School Networking, “Nearly two-thirds of school districts in the United States serve fewer than

2,500 students, and many do not have a staff member dedicated solely to cyber security” (Bogel-

Burroughs, 2019, para. 3).

In addition to the employment of individuals whose sole responsibility is cybersecurity, it

is further recommended that school districts take immediate action to educate all school

constituents about increases in ransomware attacks and the preventive measures that can be taken

to keep student data private and secured. School districts should also hold regular Technology

Security Awareness meetings, or similar information sessions, to help inform all at the school

site of ways they may identify issues of PST, such as phishing and the use of non-password

protected Wi-Fi. These information sessions should also cover the careful examination of

external links. Furthermore, it is recommended that technology and network administrators

maintain additional proactive measures to help thwart ransomware attacks, including segmented

network

access, and that they ensure backup data is up-to-date, encrypted, and both virus and

malware free.

Ransomware attacks are increasingly on the rise, especially within the education sector. Most recently (August

2019), there have been ten school districts identified as victims of ransomware attacks, just over the last three

months. School district currently dealing with ransomware attaches includes the Mineola Public Schools of New

York and in Connecticut, the Middletown, Wolcott, Wallingford and New Haven School Districts. See

https://arstechnica.com/information-technology/2019/08/rash-of-ransomware-continues-with-13-new-victims-most-

of-them-schools/

A segmented network is a district wide network, which comprises of both wired and wireless sub-networks, each

considered a “segment.” This type of networking reduces the possibility of cyber-attacks (i.e., ransomware), while

also allowing for more granular control of network users, as each subnetwork can include its own firewalls and

virtual local area network.

187

Recommendation 3. All three school districts that took part in the study have outlined

the adoption of Bring Your Own Device (BYOD) initiatives. However, the increased use of

personal mobile devices in the classroom has a greater impact on the privacy and security of

student data, and this is especially true because students privately own these devices, and thus

contain a great deal more of students’ personal data and applications. As school districts continue

to introduce BYOD initiatives, it is recommended that school administrators and technologists

regularly evaluate the impact of these devices on learning outcomes, and especially in terms of

PST, as related to the Cloud and student data. It is further recommended that school

administrators and technologists regularly review and amend district policy and acceptable usage

agreements.

District administrators should include in the review process the teaching faculty who are

on the front lines – in the classroom – and directly witness to how BYOD initiatives are being

carried out in real time. The teaching faculty can add to crucial discussions related to the success

of BYOD initiatives, areas of the initiatives that need to be evaluated further, and outcomes.

These teaching faculty may further discuss related topics not fully understood by district

administrators and technologist who do not work in the classroom and engage students on a daily

basis.

Furthermore, as faculty continue to take part in regularly scheduled professional

development courses and technology update meetings, it is recommended that these trainings

also address BYOD initiatives and any implications these initiatives may have on PST as it

relates to district Cloud systems and student data privacy and security.

Students also viewed