Buyer: Edcouch-Elsa ISD sold computers with sensitive information

Edcouch-Elsa Independent School District mistakenly sold six devices with “sensitive information” to a private businessman during an auction on April 6.

RDA Technologies operations manager David Avila found several computers with a hard drive disk attached to it. They displayed social security numbers, vaccination records, addresses and other personal information of students.

Avila refurbishes computers along with his son, who is also named David. The father and son duo said they were alarmed during the auction.

Avila and his son noticed laptops started up with the Windows operating system, which should not have occurred if the hard drive and device were properly “sanitized” prior to the auction, he said. He and his son took photos of the incident and reported it to a district employee during the auction.

“They did not stop the auction,” David Avila said.

Putting computers up with sensitive information for bid, along with his complaints that went unheeded on the day of the auction were the first two examples of what he saw as irresponsible behavior from the district, Avila said. Other people who attended the auction could also have access to sensitive information.

Avila said he knows other computers were sold with sensitive information during the auction and has photos of laptops he did not purchase, which he believes were not properly wiped.

“It’s not an if,” he said.

When the computers were processed, he contacted the school district following his findings on May 24. Avila met with the technology department director following the initial contact. The technology director Jose Luis Torres notified Avila that the superintendent would call him following their meeting.

“I understand the seriousness of this matter and I am willing to sit down and discuss this with you at your earliest convenience,” Torres said in an email reply to Avila on May 24, with the email exchange provided by the district and Avila. “At this point we are (conducting) an investigation in order to get to the bottom of how this happened. I do need some information from you in order to be able to complete this.”

Torres also requested the “asset tag information” for the computers Avila purchased in a May 27 email.

This became a source of contention for Avila, as it seemed like the district was looking out for itself and not necessarily the public, Avila said.

However, Avila also stressed the importance of proper procedures and the potential future steps the district should take.

“We can’t rely on your professionalism and we want to make sure that something is done about protecting people’s information. The way your school district managed our (complaints) from the beginning it doesn’t make it trustworthy anymore, each of you blaming the other department doesn’t look (good) at all,” Avila said in an email sent to Torres May 27.

However, Avila said the superintendent took no action or made contact as of June 18, despite trying to follow up on June 10.

Avila sent the computers to the Texas Attorney General as a response.

The six computers cost him over $2,400, but he ultimately believes the purchase could cause damage to the public, Avila said.

“We’re above and beyond our legal obligations trying to make them aware about it, nothing was done,” Avila said.

The school district did not respond publicly until nearly three months after the initial “improper handling,” issuing a statement to KRGV in July, who first reported the story. It was the first time the incident was made public.

The district is currently undergoing a transitionary period and summer break, school officials said.

Ronaldo Cavazos was the superintendent at the helm of the district during the ordeal that began in April.

Cavazos said there was an internal process for wiping hardware before being put up for auction, said but this procedure was overlooked in April.

“Somewhere along the line, somebody didn’t listen to the directions that were given and put up equipment there for auction without letting (the) technology (department) know so that we (could) clean the hardware out properly,” Cavazos said.

The district will not sell hardware with storage equipment in the future and will instead send it to state agencies for disposal, he said.

Cavazos declined to comment further, ending the phone call before further questions could be asked.

Richard Rivera stepped in as interim superintendent July 1, but said he did not know enough about the situation to provide a comment when reached on Tuesday.

Edcouch-Elsa ISD board president Robert Schmalzried called the processes “internal” and declined to comment as an elected official, who does not work directly under the district, he said.

“It’s something that we’ve already taken precautions and put protocols in place so that this will never happen again,” Schmalzried said.

However, as board president and trustee, he said the policies will change so that information is disposed of through a state agency to ensure student information is secure, Schmalzried said.

Avila said that the district had multiple instances to rectify its “improper information handling.” However, district officials said they have attempted to solve the situation through communication with Avila.

“As soon as we found out, we have been in contact with Mr. Avila,” school attorney Benjamin Castillo said. The attorney said that the district has made attempts to send staff to wipe the computers in his possession, but claimed Avila has made it difficult for them and has not been “cooperative” in this process.

“He didn’t allow us to correct this oversight, so again at this time there’s no evidence that any of the data had been… exposed,” Castillo said, saying there has been constant contact between the district and Avila.

“Based on our records, those were the only computers that were at issue that possibly had information that should have been wiped,” Castillo said.

Avila said he tried to make the district aware of proper procedures and aware of their mistake, and that he has used “my equipment, my time, my resources.”

The lack of speed in addressing the incident publicly and transparently became a major issue for Avila in taking those measures, he said.

He kept a communication log, email exchanges and the receipts of his purchases.

The school district, however, is not the first entity to allegedly have its information compromised.

The city of Edcouch faced a data breach in late May and held a city council meeting in early June, as previously reported by The Monitor. Avila said the school district’s incident differs from this data breach, where hackers infiltrated their computer server. The school district essentially caused a problem by putting computers up for auction without following a proper procedure, he alleged.

Edcouch-Elsa ISD elected officials are set to hold a board meeting on July 9 and this incident may come up for discussion, Castillo said.