Talawanda City school board waives privilege to release cyber-investigation executive summary after Google Calendar data exposure

The Talawanda City School District Board of Education voted 5-1 on March 26 to waive attorney-client privilege for the executive summary of a cybersecurity firm’s report into a Dec. 19, 2024 data exposure that allowed unauthorized access to student individualized education program (IEP) documents and staff calendars, board members said.

The board adopted a resolution specifically waiving privilege only for the executive-summary report dated March 20, 2025, produced by the district’s outside cybersecurity investigator and engaged through the board’s legal counsel. The resolution authorizes the district treasurer to release that executive summary and to take any policy steps necessary to carry out the release.

Why it matters: Board members and public speakers said the release was necessary for transparency after confidential student information appeared online and community members publicly demanded answers. The board’s action makes the executive-summary findings available for public-records requests while keeping other privileged communications protected, according to the resolution language read at the meeting.

Board member remarks and investigation findings Board member Dr. Howard (board member) summarized the district’s response and the primary findings the board disclosed after the vote. According to that summary, the district’s cyber-insurance carrier connected the board to a cybersecurity firm (identified in board remarks as SureFire Cyber), which examined Google Calendar logs and produced a report. The executive summary the board authorized for release is dated March 20, 2025.

Dr. Howard said the firm’s documented findings include: logs showing multiple student email accounts were used to access IEP documents they were not authorized to view between Dec. 15 and Dec. 16, 2024 (times cited in board remarks were 11:55 a.m. Dec. 15 through 10:26 p.m. Dec. 16, Eastern); a student account was used Dec. 14 at 7:35 a.m. to access an administrator’s calendar without authorization; and the email account of board member Dawn King was used on multiple occasions between Dec. 8 (7:45 a.m.) and Dec. 16 (9:22 p.m.) to access calendars and IEP documents for which that account did not have authorized access. Board remarks also stated that on Dec. 8 at 1:53 p.m. the access level on King’s Google Calendar had been changed to prevent further unauthorized access.

"We have felt very supported by our community," resident Molly Farler told the board during public comment, asking for "transparency and accountability" and the public release of the investigation results.

Community reaction and board debate Public commenters at the meeting pressed for full accountability and for law-enforcement referrals and student-discipline follow-up. Patty King, who identified multiple alleged prior technology and records-access problems in district policies and public records, urged stronger protections and public disclosure of the investigation results. Several speakers called the incident a potential violation of students’ privacy and urged criminal investigation; the board did not take immediate action at the meeting to refer the matter to law enforcement.

Board members described the issue as serious and emphasized the district’s limited immediate disciplinary options for elected board members. "This is perhaps the most serious issue," board member Mr. Mead said at the meeting, adding that protecting student and staff information is a top priority. Board member Mr. Wyatt likewise said the breach "infuriates" him and said the district must prevent a recurrence.

Actions not taken and additional motions A separate motion to adopt a resolution of censure against board member Dawn King was moved by a board member and read into the record but failed for lack of a second; the censure motion therefore did not proceed to a vote. The censure language cited multiple board policies by number and alleged violations of those policies and the member’s oath of office; because the motion received no second, the board did not vote on it.

Next steps The adopted waiver directs the treasurer to release the executive-summary report dated March 20, 2025, and to take steps to administer any related employee-policy actions under the district’s employee-dishonesty and faithful-performance policy. Board remarks also said that spreadsheets generated from Google Calendar logs are not protected by attorney-client privilege and are available via public-records request. Board members said they expect additional follow-up, including possible student-discipline proceedings for the student accounts named in the investigator’s findings and further review of district technology practices, but no additional formal actions were adopted during the special session.

Votes at a glance: the March 26 special session - Resolution waiving attorney-client privilege for the SureFire executive-summary report (dated 03/20/2025): adopted, vote recorded in roll call as Yes — Dr. Howard; Yes — Mr. Mead; No — Dawn King; Yes — Mr. Otto; Yes — Mr. Wyatt (tally: yes 5, no 1). The resolution authorized the treasurer to release the executive summary and to implement related policy steps. - Motion to adopt a resolution of censure against board member Dawn King: moved and read into the record, failed for lack of a second (no vote taken). - Motion to go into executive session at the meeting start to consider investigations and privileged matters: adopted by roll call earlier in the meeting (unanimous yes on the roll call to enter executive session); the board later voted to exit executive session (unanimous yes on the roll call to exit). - Agenda approval and adjournment motions: approved by roll call during the special session.

What the board did not claim or do at the meeting Board members said the full investigative report and other attorney-client communications remain privileged; the board waived privilege only for the single executive-summary document specified in the resolution. The board did not announce formal criminal charges, and it did not take binding disciplinary action against an elected board member at the meeting. The district noted spreadsheets of calendar-access logs can be requested as public records.

The board scheduled further routine business (an April 14 work session) and closed the special session after the roll-call votes.