Rising Popularity of GPS Bus Trackers Poses Security Risks for Schools and Parents

Around August, Louisville resident Robert Bramel became anxious after his two sons, 5-year-old William and 8-year-old Joseph, didn’t arrive home on time from their first day of elementary school. It was nearly 10 p.m. when the boys eventually returned safely on a school bus. Jefferson County Public Schools had referred to the incident as a “transportation disaster” caused by a tech-enabled bus routing system implemented to improve efficiency.

The incident left Bramel worried about his children’s safety. However, despite his concerns, the school district and many others across the country turned to GPS tracking systems to alleviate busing issues. Bramel now relies on the GPS tracking system provided by Education Logistics, also known as Edulog, to track his children’s school bus in real-time. Unfortunately, cybersecurity researchers discovered vulnerabilities in the system that exposed sensitive information.

According to James Sebree, a senior staff research engineer at Tenable, the Edulog apps lacked proper authentication and access controls, allowing anyone with a free account to access sensitive information about students and their families. This information included real-time school bus location, pick-up and drop-off times, details about scheduled delays, and contact information for parents. However, no evidence suggests that the data was exploited. Once Tenable alerted Edulog to the vulnerabilities, they quickly patched the issues.

Despite the potential risks, school districts continue to adopt GPS tracking systems to keep parents informed about their children’s bus arrivals and departures, especially during the ongoing school bus driver shortage. However, these arrangements with third-party technology vendors like Edulog introduce privacy and security concerns.

Louisville’s experience with bus delays led them to rely on Edulog’s “Lite” version for bus location information. Nevertheless, Bramel, a Louisville resident affected by the school bus delays, expressed concern about the potential privacy risks associated with open access to real-time school bus information. He worries about the safety of his child and the possibility of human trafficking. Bramel believes that the district or the company should have notified parents about the extent of the data exposure.

Privacy concerns surrounding GPS services have been present since their introduction to consumers in the late 1980s. Despite the amplified implications in the context of students and schools, convenience often outweighs privacy concerns. Edulog