FERPA: Only Grades Are Safe; OSINT In Higher Education

### Higher Education: The Open-Access Security Dilemma At 00:00, data analyst and researcher Leah Figueroa opens her presentation at the Recon Village by examining the unique cybersecurity posture of higher education. Unlike corporate enterprises that enforce strict network perimeters and data access controls, universities are philosophically designed to be open, collaborative, and publicly accessible environments. Figueroa argues that this open-access culture creates massive reconnaissance opportunities that leave students, faculty, and research data dangerously exposed.

### The Illusory Protection of FERPA At 05:40 and 11:20, Figueroa deconstructs the Family Educational Rights and Privacy Act (FERPA), the primary federal statute governing student privacy in the United States. She exposes a critical truth: contrary to popular belief, FERPA legally protects only formal academic records—specifically grades, GPA, and transcripts. Non-academic student information is classified as "directory information," which universities can legally publish online unless students actively submit complex opt-out paperwork.

### Harvesting Personal Telemetry from Public University Directories At 18:20, the speaker demonstrates how easily an adversary can harvest granular student profiles using OSINT techniques. Through public campus directories, student athlete rosters, departmental newsletters, and social media groups, researchers can scrape student home addresses, personal phone numbers, campus employment schedules, dorm locations, and class schedules. Figueroa highlights alarming scenarios where campus health clinics and academic scheduling systems inadvertently leak sensitive personal appointment details.

### Physical Security and Real-World Stalking Risks At 25:30 and 31:15, the presentation explores the physical safety risks stemming from academic OSINT. Figueroa illustrates how stalkers, abusive ex-partners, or malicious actors can correlate public course schedules with social media check-ins to track students' physical movements across campus in real time. Furthermore, international students and vulnerable populations face heightened risks of state-sponsored harassment and targeted financial fraud enabled by exposed campus directories.

### Reforming Academic Data Policies and Protecting Students Concluding between 34:10 and 36:39, Figueroa calls for immediate, sweeping reforms in higher education data governance. She urges university administrators to implement privacy-by-default policies, making directory information private unless students explicitly opt in. She advocates for comprehensive privacy awareness training during student orientation, mandatory data minimization across university departments, and regular attack-surface audits to safeguard campus communities.

(AI summary — Gemini 3.8 Flash)