Acceptable Use Policy
Public wifi: the risk, and what your policy should say
Open wifi matters to a school for one specific reason: staff work on school systems from places that are not the school. A hotel at a conference, a café on a Saturday, an airport. The policy question is what they may do from there, not whether public wifi is dangerous in the abstract.
Last reviewed 16 October 2026
What the risk is now
The classic description — an attacker on the same network reading your traffic — has narrowed considerably. Nearly everything is encrypted in transit now, so the old picture of someone harvesting passwords out of the air is mostly historical.
What remains is worth naming precisely: a network that intercepts or redirects connections, an imposter hotspot with a plausible name, and session or credential theft via a prompt that looks like a login page. Alongside those sits the unglamorous one that causes the most actual exposure — somebody reading a pupil’s file on a train while the person in the next seat can see the screen.
The clauses worth having
- Whether school systems may be accessed from public networks at all, and if so which. Reading email is a different decision from opening the MIS.
- A requirement to use the school’s VPN where one exists, and an honest statement where one does not.
- Multi-factor authentication on anything reachable from outside the building, which does more than every other clause here combined.
- No installing certificates or accepting security warnings to get a network working. That is the one that turns an inconvenience into an interception.
- Personal hotspot in preference to open wifi for anything involving pupil data — it is free, already in everyone’s pocket, and removes the question.
- Screen privacy in public — the shoulder-surfing clause, which sounds trivial and is the one most likely to be breached.
Where this belongs
These clauses sit in the Acceptable Use Policy beside the device, password and remote-working rules, because that is where a member of staff would look for them, and because they are only enforceable if the Board has adopted them and staff have acknowledged the version in force.
Rules circulated by email after an incident are not a control. A policy with an approval date and an acknowledgement record is.
Giraft
One policy, approved, acknowledged, and current.
Giraft takes your Acceptable Use Policy through drafting, consultation and Board approval, records which staff have acknowledged which version, and flags it when it falls due for review.
Book a Giraft demo