Portland schools to take TV-3 broadcast system offline after cybersecurity review

The Portland Public Schools Finance, Personnel and Operations Committee voted unanimously Oct. 27 to accept staff—s recommendation to take the district—s Tightrope/TV-3 broadcast system offline to mitigate critical cybersecurity vulnerabilities.

Brian, information-technology presenter, said a consultant engagement with DeepSeas and a managed detection and response (MDR) deployment identified multiple critical and high-priority vulnerabilities following an external vulnerability scan. Brian said the district has remediated a portion of the findings, identified a targeted plan for others, and that two remaining items will require external assistance.

Brian told the committee that seven of the identified critical vulnerabilities are associated with the Tightrope application and aging server hardware used to convert meeting Zoom streams into the Spectrum public-access channel 13-02. Vendor support for the application lapsed after a longtime staff member who maintained the system retired, he said. Because those Tightrope vulnerabilities could affect the district—s broader network, staff presented three options: 1) decommission Tightrope and retire the servers (staff recommendation); 2) modernize and maintain the existing Tightrope system (initial cost estimated at $17,100 with ongoing support costs); or 3) outsource broadcast delivery to a local vendor, which staff said would carry significantly higher recurring costs.

"The Tightrope application has seven critical vulnerabilities which would create a risk to the entire district if left incomplete," Brian said, explaining that taking the system offline would remove that attack surface. During discussion members clarified that the district will continue to produce board meetings and may post recordings on YouTube; the motion affects delivery via Spectrum channel 13-02 rather than the district—s ability to record or publish meetings online.

Chair Lance moved to accept staff—s recommendation to take the channel offline; Board member Opperman seconded the motion. The committee recorded a unanimous vote in favor of decommissioning the Tightrope system. Staff said they will present the recommendation to the full board for further consideration and next steps, and that the district's managed security operations center (SOC) is in place to monitor threats.

IT staff described additional ongoing cybersecurity investments including MDR/24-hour monitoring (SentinelOne/MDR), a vulnerability-management tool, staff awareness training, data-classification work and policy updates. Staff said they have applied for a state grant for awareness training and noted estimated per-user costs if the grant is not awarded.