Cyber attack the cause of EQAO online test botch

RAINBOW DISTRICT—Rainbow District School Board (RDSB) officials say it will be about a week before the Education Quality and Accountability Office (EQAO) can confirm if the Grade 10 Ontario Secondary School Literacy Test (OSSLT) that the majority of its students took and completed will be recognized and scored.

This comes after the EQAO office confirmed that the cause of technical issues that resulted in the cancellation of the October 20 province-wide trial of the online OSSLT was an intentional, malicious and sustained distributed denial of service (DDoS) attack-a type of cyber attack.

“EQAO shares the frustration that students, parents, teachers, schools and school board educators and administrators feel about the outcome of the assessment. We were shocked to learn that someone would deliberately interfere with the administration of the online OSSLT. There will be discussions over the next few weeks to determine how to strengthen the system, and we will continue to work with Ontario’s education community to understand how best to use online assessments to benefit our province’s students,” said Richard Jones, director, assessment with EQAO in a release October 24.

“There are a couple of major things we are concerned about, one being whether the tests that were completed will count-whether they will be recognized and scored, and whether there is a large enough sample size of those that took the tests (province wide) to make it legitimate,” stated Norm Blaseg, director of the RDSB, on Tuesday. He explained for RDSB, “about 88 percent of our Grade 10 students within the board wrote and submitted the tests. This includes 1,254 students having written the assessments, with 1,103 having (completed the assessment). To my knowledge we had the highest in Ontario in terms of percentage of students who completed the assessments.”

“We have a vested interest that the assessments the students completed will be counted and scored,” said Mr. Blaseg. He pointed out these assessments (done online) count towards the students’ Ontario Secondary School diplomas. “As a board we prepared for the assessments, and provided supports, for instance, making an investment so there would be enough computers for the students to take the assessments, and scribes available if they required support. In any event, our students, principals, teachers and support staff did a wonderful job to get through the assessment despite delays of about 15-20 minutes in some cases.”

Mr. Blaseg pointed out that while students in a lot of schools in the province were able to complete the assessments a lot weren’t able to. “We want to make sure all recognition is given for all the students who completed and passed the assessment. The students completed these assessments in good faith and with tremendous effort. We are very supportive of our students and it would be an injustice if the work they completed is not accepted.”

Larry Killens, a Manitoulin trustee with the RDSB said, “88 percent of Rainbow students completed the assessment. It is frustrating that all of this happened because it is costing taxpayers and putting additional stress on the students, that they don’t need.”

The EQAO release notes, “an extremely large volume of traffic from a vast set of IP addresses around the globe was targeted at the network hosting the assessment application. The impact of this DDoS, initiated by an unknown entity or entities, was to block legitimate users (i.e. school boards, schools and students) access to the EQAO test application.”

“An in-depth and ongoing investigation will lead to recommendations on how to prevent similar incidents in the future,” the release says. “EQAO is committed to openness and transparency, and we will continue to provide updates on this matter.”

The October 20 online OSSLT was a voluntary trial to test the system’s readiness before the regularly scheduled administration of the OSSLT in March 2017. Discussions about the feasibility of scoring completed online OSSLT assessments are ongoing and an announcement on this will be made shortly, the release points out. As well, it indicated an independent third-party forensic firm is involved in an investigation into the October 20 incident on behalf of EQAO. Data indicates that the DDoS attack began shortly before 8 am EDT.

At the height of the DDoS attack, 99 percent of the traffic in the system was not coming from schools or school boards. This effectively blocked legitimate user access to the system. No personal or private student information was compromised during the administration of the assessment.

Mr. Blaseg told the Recorder after a meeting of all school boards in the province with EQAO officials on Tuesday afternoon that, “we were told it will be about a week before the EQAO can determine whether the assessments that were completed will count. They have to ensure the integrity of the results of the submissions have not been compromised.”

“Our position is that students who wrote, completed and passed the assessments should get credit for it, period,” stated Mr. Blaseg.