The law, which went into effect on January 1, defines cyberbullying and makes harassment on Facebook, Twitter, or via other digital means a violation of the state's school code, even if the bullying happens outside of school hours.
A letter sent out to parents in the Triad Community Unit School District #2, a district located just over the Missouri-Illinois line near St. Louis, that was obtained by Motherboard says that school officials can demand students give them their passwords. The full letter is embedded below.
"If your child has an account on a social networking website, e.g., Facebook, Instagram, Twitter, ask.fm, etc., please be aware that State law requires school authorities to notify you that your child may be asked to provide his or her password for these accounts to school officials in certain circumstances," the letter says.
If we're investigating any discipline having to do with social media, then we have the right to ask for those passwords
"School authorities may require a student or his or her parent/guardian to provide a password or other related account information in order to gain access to his/her account or profile on a social networking website if school authorities have reasonable cause to believe that a student’s account on a social networking website contains evidence that a student has violated a school disciplinary rule or procedure," it continues.
The memo is very similar to a "model letter" put out by the Illinois Principals Association, and parents around the state are presumably receiving this letter.
Nowhere in the law does it explicitly state that schools are allowed to ask for students' passwords, but one section of it says that schools must implement a policy that includes a "process to investigate whether a reported act of bullying is within the permissible scope of the district's or school's jurisdiction." The cybersecurity law, when combined with one that went into effect last year specifically governing social media, may have spurred these letters.
Leigh Lewis, superintendent of the Triad district, told me that if a student refuses to cooperate, the district could presumably press criminal charges.
“If we're investigating any discipline having to do with social media, then we have the right to ask for those passwords,” she said.
"I would imagine that turning it over to the police would certainly be one way to go. If they didn't turn over the password, we would call our district attorneys because they would be in violation of the law," she added. "That would only be in some cases—we'd certainly look at the facts and see what we're dealing with before we make the decision."
students may be forced to violate federal law to comply with a state law
Lewis said that, so far, the district hasn't requested any passwords from students, but said that schools are in "the business of protecting kids."
"If there's a disruption to school, if there are threats or discrimination of any type that fall under bullying and harassment policies we have, we have to follow through and investigate," she said.
In the past couple years, several employers have made headlines by asking prospective employees to turn over their social media passwords during job interviews.
As a result, Maryland banned the practice, and several other states have followed suit. Oddly enough, Illinois banned the practice of asking students for their passwords, but only for colleges. An amendment proposed by Colorado Congressman Ed Perlmutter to the extremely controversial federal Cybersecurity Information Sharing and Protection Act raised at the last moment in an attempt to thwart the bill (or perhaps to make Republicans look anti-privacy), was voted down in 2013.
That the practice has expanded to schools is highly troubling, according to Kade Crockford, director of Massachusetts's American Civil Liberties Union. Crockford and the ACLU there are currently championing legislation that would make policies like Illinois's illegal in the state.
"It's a tragic example of government overreach—the notion that there's a substantial difference between cyberbullying and regular bullying is confusing," she told me. "Anytime a school is trying to control students' behavior outside school, it's a serious threat to their privacy and to their futures."
"You have to think about the school-to-prison pipeline—who will be affected by this legislation, who will be arrested in school as a result of information discovered by administrators on their phones?" she added. "It's kids of color, poor kids, kids with intellectual and learning disabilities. That's what we see across the country."
Crockford suggested that there's a good chance the Illinois law, or schools' implementation of it, is unconstitutional. She said that if cyberbullying is bad enough, there are already mechanisms to obtain Facebook messages—law enforcement can obtain a search warrant with a specific criminal complaint, for instance. Finally, the law may be in violation of the Computer Fraud and Abuse Act—Facebook and other social media companies prohibit their users from sharing passwords with unauthorized people, she said.
"Keep in mind that legislatures pass unconstitutional laws all the time," she said. "But here we may be having students who are being forced to violate federal law to comply with a state law."
In a press release, Triad school district has repeated that it has not yet requested any student passwords.
"Triad has not had an instance when its administrators have felt the need to request passwords for student social media accounts. The Board and administration hope that such a situation will never arise," it said. "However, we can anticipate situations where we might need to see a social networking site. For example, if a student makes threats on social media to harm the school or other students, there may be cause for an administrator to ask that student to open his or her account or share his or her password, particularly before he/she has the chance to delete the threats."