Skip to content
ParamergeParamerge
Stephen Lieberman
Through Paramerge
Contact

PAN Lab example

Gaggle Safety Management

The discontinuation that changed the vendor rather than the graph: a school monitoring scanner

A vendor scans everything students write on school accounts - email, homework, art, the school paper - and flags anything that might signal self-harm, 24/7. Modeled on Gaggle's school safety monitoring. A machine flags; an off-site reviewer triages; a counselor gets an alert; and, for an after-hours emergency flag, police can knock on a home. In one district about two-thirds of the flags were nonissues, and the archive of flagged suicide notes and coming-out essays was accidentally released - nearly 3,500 unredacted documents at once. When students sued, the district quit the vendor mid-lawsuit and quietly swapped in another one - same scanning, new nameplate, no board vote - and a judge found it broke open-records law trying to keep the swap's paperwork from the student journalists it had been flagging. The real question is not whether to buy a more accurate scanner. It is whether pulling the discontinuation lever changed the graph or only the vendor's name on it.

Stylized model of a documented deploymentBehavioral-health & crisis triage

Open this example in PAN Lab v0.1 to apply pressures and levers and watch what the system does.

What this models

This example runs on the Gaggle-monitoring-class student-communication safety scanner network: 9 components and 15 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 3 assumed · 3 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

  • assumed

    This models the multi-hop student-communication monitoring pattern documented in the Gaggle school-monitoring case file - not a reconstruction of the actual Gaggle or ManagedMethods system, and not a claim about either vendor's internal accuracy. The atlas-relevant object is the topology: a high-volume, low-precision content scanner over minors' entire school digital life, whose false-positive flood is absorbed by a multi-hop chain of human filters (vendor reviewer, district safety staff, after-hours police welfare check), whose flag archive became a self-created breach surface, and whose discontinuation swapped the vendor without changing the graph. Any reading that implies a per-student risk score misreads it - it is an event-triggered detector emitting per-item flags, and some automated actions execute at detection before any human review.

  • baseline

    The defining structural facts are drawn on the map three ways. First, the multi-hop attrition chain (scanner to vendor reviewers to district staff to police) is the model-to-staff and staff-to-staff pathways, each hop adding cost and its own failure mode - outing risk at the school hop (six near-outings in Vancouver; at least one student outed to an unsupportive family in Durham, North Carolina, which discontinued the tool in 2023), physical risk at the police hop. In Lawrence, officials deemed about two-thirds of 1,200-plus incidents nonissues, so the dominant downstream activity is dismissing false positives - a plaintiff-sourced count drawn from district records that the district has not independently accounted for. Second, the flagged-content archive is the self-created breach surface: Vancouver accidentally released nearly 3,500 unredacted flagged documents via unprotected 72-hour no-login links (drawn as an active data-leaving pathway plus the preserved no-login record-to-record access window). Third, the two defining absences are inactive check pathways: no independent accuracy or efficacy evaluation ever ran, and no periodic governance re-review or student recourse existed.

  • baseline

    The discontinuation-that-was-not is the case's signature, drawn as the successor-vendor externalBoundary and a bypassed internal board surface. Lawrence ceased using Gaggle mid-litigation and substituted a different monitoring vendor with no board vote and no public disclosure, surfacing only as a line in a check register; the superintendent cited about 38,700 dollars a year in savings and Children's Internet Protection Act compliance. The plaintiffs argued the swap does not moot the case because the core practice - suspicionless scanning, flagging, and seizure of student speech and effects - continues, so the vendor node changed while the graph did not. This is carried as the plaintiffs' position and the documented event sequence, not as an adjudication of the constitutional claims, which are live and set for a January 2027 jury trial.

  • baseline

    The only binding feedback came from outside the organization, drawn as the external litigation-and-open-records oversight node. The internal procurement and board surface proved bypassable, so a federal civil-rights lawsuit, the Student Press Law Center, and two Kansas Open Records Act rulings were the only loop that forced anything: on April 10, 2026 a federal judge found the district violated open-records law by never substantively answering students' requests for the substitution and Gaggle phase-out records, and on June 4, 2026 ordered attorney fees, characterizing the conduct as 'drawn out, hollow and perplexing.' A pointed feedback detail: the scanner had swept the reporting files of the student journalists who became the plaintiffs, and after they sued, the principal briefly barred the student paper from covering the lawsuit (a prior restraint later rescinded) - so the system fed back onto the speech investigating it. Effectiveness is genuinely unestablished in both directions (RAND 2023 found only scant evidence), so no benefit or harm efficacy is asserted here.

  • assumed

    The privacy surface is the deepest in the cell and is drawn on the ingest, the reads and writes, the breach egress, and the preserved no-login access window. The collection is 24/7 monitoring of minors' entire school digital life - email, documents, drives, chats, web activity, images, homework, college drafts, art portfolios, and journalism - with limited or no family opt-out, and it flags disclosures of sexual orientation and mental health. The realized breach released nearly 3,500 unredacted flagged documents at once. Gaggle's post-breach change (requiring login on screenshot links after 72 hours) and its justification (that a no-login window lets emergency contacts respond quickly) are carried as attributed vendor claims. data-minimization and connection-auth are the closers on exactly these surfaces - the archive the breach exposed, the window that made it reachable, and the outward flows the one-time contract approval never governed - and provenance-labels marks the low-precision flag history that the archive re-reads back onto the staff who act.

  • assumed

    Served students, and any clinical, disciplinary, outing, or welfare-check outcome for them, are not in the dynamics; this Lab reads institutional propagation only, and a flag, an alert, or a welfare check on this map is an institutional signal, never a person. The false-positive fraction (about two-thirds of Lawrence incidents deemed nonissues) is a downstream-disposition outcome statistic from the plaintiffs' complaint and district records, not this model's per-interaction generation rate; there is no published sensitivity, specificity, reviewer error rate, welfare-check volume, or outcome-efficacy data, and RAND 2023 found only scant evidence either way. Vancouver's figures (the 328,036 dollar contract, the ~2,200 flagged students) belong to Vancouver and are not conflated with Lawrence's roughly 160,000 dollar contract. GoGuardian Beacon and Securly are structural siblings named in the same investigation and are context only, not modeled here.

What this example does not show

  • Served students, and any clinical, disciplinary, outing, or welfare-check outcome for them, are not modeled here; the Lab reads institutional propagation only, and a flag, an alert, or a welfare check on this map is an institutional signal, never a person. The system's real harm surface - a flagged student outed to an unsupportive family, a late-night police visit prompted by a wrong flag, a chilled student newspaper - lands on people who are outside these dynamics by construction and is documented in the case file, never computed here.
  • Effectiveness is genuinely unestablished in both directions: a 2023 RAND review found only scant evidence of either benefit or risk, and the vendor publishes no sensitivity, specificity, reviewer error rate, or welfare-check volume. The 'about two-thirds deemed nonissues' figure is a downstream-disposition statistic from the plaintiffs' complaint drawing on district records, which the district has not independently accounted for; it is not a measured false-positive rate and not this model's per-interaction generation rate. A safe-looking or unsafe-looking baseline is a property of this model, not a claim about any real deployment's accuracy.
  • The vendor substitution and open-records events are reported as the documented sequence, not as an adjudication of the constitutional claims, which are live and set for a January 2027 jury trial. The plaintiffs' anti-mootness framing (that swapping vendors leaves the suspicionless-scanning practice intact) is carried as their position; the district's stated rationale (cost savings and Children's Internet Protection Act compliance) is carried alongside it. Vendor efficacy and design claims - the CEO's 'digital playground without fences' framing, the defense of the 72-hour no-login window, the post-breach fix - are labeled attributed vendor claims, not established facts.
  • Figures are kept to their own district and date. The realized breach (~3,500 unredacted documents), the ~2,200 flagged students, and the 328,036 dollar three-year contract belong to Vancouver Public Schools, Washington; the 1,200-plus incidents, the roughly 160,000 dollar contract, and the vendor substitution belong to Lawrence USD 497, Kansas - the two districts' figures are not conflated. GoGuardian Beacon and Securly, structural siblings named in the same investigation with the same scanner-to-school-to-welfare-check topology, are context only and not modeled as separate cells.
  • The outing exposure is stated as institutional exposure only: what the flag archive holds, and which hand-offs it can travel along. No outing, disciplinary, welfare-check or family outcome for any student is modeled, computed or gauged here - students are outside these dynamics by construction. The 2023 discontinuation after an outing incident and the students who risked being outed belong to the cited investigative record, not to this diagram. The general mechanism behind them - a protective store that becomes the exposure route, and the documented practitioner practice of deliberately omitting sexual-orientation and gender-identity data at a cost to record completeness - is carried from a peer-reviewed secondary synthesis in the direction-and-shape register, with no magnitude attached to it.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

  • Gaggle's student-communication safety monitoring, used by roughly 1,500 US districts covering about 6 million students as of a March 2025 AP and Seattle Times investigation, scans school-issued accounts around the clock and routes flags through a multi-hop chain (a machine flag, an off-site vendor reviewer, district safety staff, and, for imminent-danger after-hours alerts, occasional police welfare checks); in Vancouver Public Schools nearly 2,200 students (about 10% of enrollment) triggered alerts in one year, in Lawrence USD 497 more than 1,200 incidents were logged in ten months with about two-thirds deemed nonissues by officials (a figure the plaintiffs drew from district records), and the archive of flagged documents was accidentally released to reporters as nearly 3,500 unredacted files through unprotected links, while a 2023 RAND review found only scant evidence of either benefit or risk and the vendor publishes no accuracy figures.

    empirical
    • Investigative Bryan and Lurye, Schools use AI to monitor kids. An investigation found security risks (The Christian Science Monitor, AP and Seattle Times Education Reporting Collaborative, 2025) https://www.csmonitor.com/USA/Education/2025/0312/ai-surveillance-schools-gaggle
    • Investigative Associated Press, Takeaways from our investigation on AI-powered school surveillance (2025) https://srnnews.com/takeaways-from-our-investigation-on-ai-powered-school-surveillance/
    • news Lawrence Journal-World, Lawrence school district sued in federal court for use of AI-powered surveillance system; students claim Gaggle results in illegal searches (2025) https://www2.ljworld.com/news/schools/2025/aug/07/lawrence-school-district-sued-in-federal-court-for-use-of-ai-powered-surveillance-system-students-claim-gaggle-results-in-illegal-searches/

  • After nine Lawrence, Kansas students sued their district in early August 2025 over its use of AI communication monitoring, court filings revealed the district had ceased using Gaggle mid-litigation and substituted a different monitoring vendor with no board vote or public disclosure — surfacing only as a line in a check register — and the plaintiffs' amended complaint argued the swap does not moot the case because the core practice of suspicionless scanning, flagging, and seizure of student speech continues; on April 10, 2026 a federal judge found the district violated the Kansas Open Records Act in withholding the substitution and phase-out records, and on June 4, 2026 ordered it to pay the students' attorney fees, characterizing the conduct as drawn out, hollow, and perplexing, with a jury trial on the surviving constitutional claims set for January 2027.

    empirical
    • news Heimsoth, Students allege continued unconstitutional AI digital surveillance with new vendor and violations of Open Records Act in school district lawsuit (Lawrence Journal-World, 2025) https://www2.ljworld.com/news/schools/2025/nov/21/students-allege-continued-unconstitutional-ai-digital-surveillance-with-new-vendor-and-violations-of-open-records-act-in-school-district-lawsuit/
    • news Heimsoth, Federal judge finds Lawrence school district violated open records law in student lawsuit regarding Gaggle (Lawrence Journal-World, 2026) https://www2.ljworld.com/news/schools/2026/apr/10/federal-judge-finds-lawrence-school-district-violated-open-records-law-in-student-lawsuit-regarding-gaggle/
    • news Heimsoth, Federal judge orders Lawrence school district to pay attorney fees to students in Gaggle case after KORA violations (Lawrence Journal-World, 2026) https://www2.ljworld.com/news/schools/2026/jun/04/federal-judge-orders-lawrence-school-district-to-pay-attorney-fees-to-students-in-gaggle-case-after-kora-violations/

Where this connects

Institutional pressures in this domain

  • Workload surge — Demand outruns staffing; per-case attention shrinks and review becomes triage.
  • Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.
  • Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
  • Deadline pressure — Statutory or managerial timeliness rules reward fast approval of machine output over slow disagreement.
  • Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.

All of them in context on the Behavioral-health & crisis triage domain page.

Levers available here and the patterns behind them

Documented case histories