In almost 11 hours of testimony that ended a few hours before dawn Thursday, a Jefferson City Public Schools technology coordinator and her attorneys attempted to mitigate her responsibility in the improper transfer of district data by questioning the clarity and effectiveness of JCPS' cybersecurity policies and practices.
Key questions remain for the school board to decide whether to fire the employee, who is also suing the district in a discrimination lawsuit, within the month.
The public hearing to discuss the potential dismissal of JCPS employee Tammy Ferry - the hearing was requested by Ferry - began at about 3:30 p.m. Wednesday in the auditorium of the Miller Performing Arts Center, with about 50 people in the audience. It ended at about 2:20 a.m.
JCPS has alleged Ferry violated district policies by transferring thousands of files of district data - some of which included sensitive personal information about students - to a personal email account, as well as disregarding directives given to her as part of the investigation that followed.
A key issue the board will have to decide is whether Ferry's taking possession of files she copied for personal use constituted a breach of students' privacy, given the personal information contained in some of those files.
Ferry and her attorneys said they have not disclosed those files by looking at or sharing the files.
"I would absolutely never put any student data in jeopardy," testified Ferry, who is an instructional technology coordinator and who has worked for JCPS for 11 years. She has been on paid administrative leave since February.
Ferry has filed an employment discrimination suit against the school district, Superintendent Larry Linthacum and Joe Martin - her supervisor and director of technology - alleging retaliation, sex discrimination and a hostile work environment. She filed the suit in April 2017.
The trial in Ferry's lawsuit was originally scheduled to begin in February, and she was concerned that as the trial date neared, access to files or accounts would be taken away from her, when she wanted to be able to use the files as a record of her work history for the trial and in pursuing future employment opportunities.
However, the attorneys for the school district at Wednesday's hearing - Duane Martin, J. Drew Marriott and Rachel Meystedt, of Columbia's EdCounsel firm - and district administrators who testified argued possession of sensitive information for personal purposes is still a breach.
"Tammy Ferry put herself above all others," above students, and "she has abused the privilege she's been given," Martin argued in his closing statement.
Ferry and her attorneys - David Moen and Roger G. Brown, of Jefferson City, and Dennis Egan, of Kansas City - complicated the question of what constitutes a data breach by highlighting that there is not an explicit school district policy against transferring files to a personal account.
"I didn't need to get permission. It was a common practice," Ferry said.
Her attorneys called witnesses to also support the claim that such transfers of files were common practice among JCPS employees, and that other file transfer cybersecurity risks remain - such as through the use of personal Apple IDs on iPads that were provided by the district, or through the district sharing information with its attorneys.
In cross-examination by Moen, Dawn Berhorst, who is the JCPS director of student information, planning and assessment, said the district is investigating the claim that hundreds of district staff have done the same kind of file transferring as Ferry.
Berhorst said Google retains records of file transfers for 180 days; the district has examined 12 days' worth of data.
Within those 12 days, Berhorst said four staff members shared four files that need further investigation to see if there was a legitimate educational purpose for the transfers.
Berhorst said those staff members have not been spoken with.
Ferry said she could have copied the data she did in other ways, but "the most efficient way" was the way she did it - printing, downloading or otherwise being more selective about what she copied could have taken a year to complete.
The method Ferry used - the Google Takeout app, which lets users have a copy of their data available outside of a Google system, such as JCPS' - she said was an all-or-nothing approach, that did not weed out files that could have contained student information.
Out of about 58,000 files available to Ferry in her work account, Berhorst said Ferry transferred 19,871.
Those 19,871 files included 3,636 instances of personally identifiable information, which impacted 1,304 students - though that does not include all parents who received notice under the federal Family Educational Rights and Privacy Act, or FERPA.
Berhorst said remote access to JCPS' Google system has been cut off, which is an inconvenience to staff. However, she said it is something that will prevent future file transfers of the type Ferry did.
Berhorst acknowledged "there's no direct language" about a prohibition of transferring district files to a personal account, but that's covered by references in board policies.
She said it is appropriate, for example, for a staff member to have student data such as a picture of a class' student roster with basic information on a personal device, "to be able to respond in an emergency" - if that's the actual purpose of having that data.
She also said the district has to rely on trusting its staff and their training to make professional judgments that protect students' privacy, given how often technology or ways of doing things change.
As part of the termination hearing, another key issue the board will have to decide is whether Ferry should be disciplined for violating the directives given to her by JCPS' human resources director Shelby Scarbrough: not to contact other employees about her being placed on administrative leave; return district devices in her possession; and not be on district property.
Ferry acknowledged she agreed to follow district policies and administrators' directives as part of her employment and as a condition of her administrative leave, but she interpreted the directives as giving her some flexibility.
Ferry thought is was her right to text several staff members after she was placed on administrative leave, and she also thought it was her right to be on district property on multiple occasions for her grandchildren's events, such as assemblies, track meets and concerts.
As for not returning several district devices as requested, Ferry's attorney Egan testified her counsel advised her to give the devices to them, saying they had a right to preserve potential evidence for their client's lawsuit, and they would protect any confidential information contained in it.
"Maybe (her attorneys) were wrong, but she wasn't," Moen argued in his closing statement of Ferry following the advice of her attorneys Brown and Egan.
With the exceptions of Ferry's attorneys, witnesses who testified at Wednesday's hearing had to remain out of the auditorium at the Miller Performing Arts Center until they were called in to testify.
Linthacum was not present for most of the proceedings, as he was one of the last few witnesses who testified. As part of that testimony, he said he has distanced himself from Ferry's disciplinary proceeding.
The district's Statement of Charges against Ferry in support of termination was signed off on by JCPS' Chief of Learning Brian Shindorf, and Shindorf sat on the stage with EdCounsel's attorneys.
Ferry should know by the end of the month whether the board has terminated her employment; the board had 10 days to receive the hearing transcript from the court reporter, a further seven days to review the transcript, and a further three days to give notice to counsel of a decision.
The trial in Ferry's employment discrimination lawsuit against JCPS is scheduled to start Nov. 12, according to online court records. It was rescheduled from February because Brown was out of the country at the time.
Statements made by attorneys in deposition and correspondence indicate the district's counsel has at least considered criminal liability against Ferry, and that Ferry's attorneys have considered the possibility of further legal action against the district.