Student urges Biddeford School Committee to strengthen student password rules and breach-response procedures

During public comment at the April 29 Biddeford School Committee meeting, Ben Fog (who identified himself as a student in the Biddeford school system) told the committee that in late March a school email account was compromised and used to impersonate a student.

"A weak, easily guessed password simply isn't reasonable security," Fog said, adding that the family reported the incident immediately but has received no substantive update on the investigation after more than a month. He urged the committee to strengthen the district’s student password policy to meet widely accepted security standards and to establish a clear, timely process families can expect when accounts are compromised.

Fog cited Maine’s student information privacy law and said operators of school digital services "must maintain reasonable security procedures and practices to protect student data from unauthorized access." He requested both preventive changes (stronger password requirements) and procedural fixes (a defined timeline and transparent follow-up) so families are not left without information after a reported breach.

Committee procedure for public comment was noted by the chair: school committee members do not respond during the comment period but listen to remarks. The transcript records the request and the committee’s invitation to submit concerns to the administration; no formal policy change or vote on password rules was recorded at the April 29 meeting.