After voucher data leak, Missouri treasurer’s office pointed at its contractor

Newly released emails show that when the Missouri State Treasurer’s Office learned in April that spreadsheets on its website unintentionally exposed the names of students receiving private school vouchers, it downplayed the leak to families and drafted a statement blaming its software contractor.

That provider says that is not where the problem started. And the file itself carries markers suggesting it passed through a treasurer’s office employee’s computer before it was published.

Missouri treasurer’s office posted MOScholars student data on its website for nearly a year

The data — student names, parents’ email addresses, the schools and vendors paid through the program and each scholarship amount — sat on the treasurer’s website in downloadable spreadsheets for months.

These reports are required by a 2024 state law that mandates certain demographic information about MOScholars participants be published each year while ensuring “no personally identifiable information of any student” is disclosed.

One file presented the required figures in a table built with Microsoft Excel’s PivotTable function. The underlying records were reachable from that table in a few clicks.

The treasurer’s office said in its statement that the vulnerability was “fully resolved immediately upon notification.” It took several days to get the file pulled from internet archive sites.

Emails obtained by The Independent under the Missouri Sunshine Law show the office sent the seven educational assistance organizations that administer MOScholars a draft statement on April 20 — two business days after being told about the leak. Those organizations are families’ main point of contact with the program.

“Recently, the contracted application and fiscal management platform confirmed that the underlying data set generated for publication could potentially be manipulated to view unpublished information,” the statement began.

The Independent alerted the treasurer’s office the morning of April 16, minutes before the organizations’ monthly meeting, and published a story April 21 that did not reveal the specific route to find this information.

At the time of the data leak, the treasurer’s office used a company called ClassWallet to facilitate payments and track student enrollment with ClassWallet’s partner FACTS Management. ClassWallet is the largest software provider in the school-choice space, with contracts with the nation’s largest voucher programs like Florida and Arizona.

The company has drawn scrutiny before, most notably in Arizona where a permissions error let a parent view payment requests of other users, prompting an investigation by the Arizona Department of Homeland Security. Last year, State Treasurer Vivek Malek talked about letting ClassWallet’s contract expire, which eventually happened last month after a competitive bidding process.

But Missouri’s leak was not inside ClassWallet’s interface. It was on the treasurer’s own website.

The file downloaded from the treasurer’s website gives the name of the data source: a Microsoft Excel spreadsheet called “MoScholars Distro Amounts,” with a sheet labeled “All Time Raw Data.” The path also points to the account of Trent Blair, the treasurer’s director of programs.

The office, which has said little publicly, has not said whether it created the document.

Asked about the data in April, Malek’s chief of staff, Jackson Bailey, said: “The spreadsheet was compiled by the third‑party application and fiscal management platform that houses and maintains the data and is contractually obligated to provide expenditure information for publication.”

ClassWallet spokesperson Jason Hart said the platform provides “complete, unredacted exports of the data to the client for use at their discretion.

“How that data is then handled, shared, or reflected in any public-facing report,” he added, “is a determination made solely by the client.”

Nothing in the contract requires that the downloadable reports be ready for public posting, Hart said.

That contract, signed in 2022 prior to the law requiring certain annual reports, has two parts: the request for proposals from the state and ClassWallet’s offer. ClassWallet’s response characterizes the data’s purpose as “compliance monitoring and preparing for the audit.”

The request for proposals has few requirements for the data, though it notes that confidential information should be encrypted.

“We have a number of privacy measures in place designed to protect student information within the platform,” Hart said. “However, once data is exported and submitted to the treasurer’s office, it falls outside of the scope of our contract.”

In April, the office entered a contract with edtech company Odyssey after a bidding process led by the Missouri Office of Administration.

The bidding process this time around included additional requirements for the software provider, saying it should “allow the MOScholars program administrator to create ad-hoc reports” and “provide customizable dashboards and reports, including data updates.”

“The contractor shall use safeguards designed to prevent the inappropriate use or disclosure of the state’s proprietary or confidential information,” the office’s request says.

The contract’s definition of “state data” includes personally identifiable information, which it says is “any information that identifies an individual, such as an individual’s social security number or other government-issued identification number, date of birth, address, telephone number, biometric data, mother’s maiden name, email address, credit card information, or an individual’s name in combination with any other of the elements listed herein.”

The office now publishes the reports as PDFs, as most states with similar programs do.

The statement the organizations were asked to pass along to parents described the exposure as “limited to directory information,” which it said “United States Department of Education guidance acknowledges is not generally considered harmful or an invasion of privacy if disclosed.”

The records went further than that. They paired student names with parents’ email addresses. And the scholarship amounts carried something more: students with an individualized education plan qualify for 160% of the base award, so the figure indicates which children have disabilities.

Under the Family Educational Rights and Privacy Act, schools are allowed to provide student directory information. But there is a requirement that schools give notice about what it considers directory information and allow parents to opt out.

This article was originally published by Missouri Independent and is republished by MetroSTL under a Creative Commons license. The reporting is the outlet’s; please support them.