Last week, “NLB Team,” a pro-Ukrainian hacker group, reportedly leaked the personal data of more than 17 million children and parents who used the online learning platform Moscow Electronic School.
The platform was built by the Moscow city government in 2016 and used as its primary means of delivering online education to children during the Covid-19 pandemic. The extensive breach, first reported by Data1eaks, included the names, dates of birth, social security numbers, login credentials, email addresses, and more than 3.3 million unique phone numbers of students and parents, dated as of September 2021.
Moscow’s city government denied that the leaked data were for real users. The independent news outlet Meduza reported that a number of users confirmed the data was theirs. Human Rights Watch could not reach NLB Team for comment.
But even prior to the hack, the city government was itself violating the privacy of Moscow Electronic School’s students. In May, Human Rights Watch reported the platform secretly surveilled children online and tracked them across the internet, outside of school hours, and deep into their private lives. The platform digitally fingerprinted children in ways that were impossible to avoid or get rid of and, without their knowledge or consent, sent children’s data to three advertising technology companies and to the Moscow mayor’s office.
The city government did not respond to requests for comment. Moscow’s mayor has announced that the platform will be rolled out nationwide in January 2023.
Children are entitled to special protections during armed conflict, whether they are in physical or digital spaces to learn, grow, and play. Since Russia’s invasion of Ukraine, pro-Russian hackers have targeted schools and critical infrastructure. Russian forces have forcibly transferred children to areas under Russian occupation and to the Russian Federation, and have collected biometric data, including fingerprints and facial images, in punitive and abusive processes.
Children and their data are not pawns in times of war, nor commodities to be exploited in peacetime. All actors should immediately refrain from physical or digital attacks on schools and on children. And the Moscow city government should protect its children’s privacy, including from itself.
