USB sticks in schools: the risk and the policy clause

Why it is still a problem

Loss, not hacking. A stick with reports, assessment data or a child-protection document on it is left in a taxi, lent to a colleague, taken home and never brought back, or simply stops working with the only copy on it. None of that requires an attacker.

Then the quieter ones: sticks carried between a home machine and the school network, which is a reliable route for malware; sticks that stay in circulation years after the member of staff left; and sticks nobody can account for, which means the school cannot say whether a given file was on one.

What to require

• A default position that pupil personal data does not go on removable media at all, with school-provided cloud storage as the route instead.
• Where that is genuinely impossible, school-issued encrypted devices only — never a personal stick, never a conference freebie.
• A named owner for every issued device, and return on leaving, which is the clause that fails most often.
• No device found on the premises is ever plugged in. It goes to whoever looks after IT.
• Deletion when the task is done, rather than indefinite accumulation.
• What to do when one is lost, including that it is reported the same day — because an encrypted lost device and an unencrypted one are very different conversations with the Data Protection Commission.

The clause only works with an alternative

Staff use sticks because they need a file at home and the alternative is awkward. If the school’s cloud storage is slow, blocked or confusing, the policy will be ignored by people trying to do their job.

So the useful sequence is to fix the alternative first and write the prohibition second. A Removable Media clause adopted on top of a broken file-sharing setup produces a school that is non-compliant with its own policy, which is worse than having no policy at all.