30 years ago, the Federal Communications Commission (FCC) launched the E-Rate program, which uses funding from the FCC’s Universal Service Fund (USF) to subsidize broadband connectivity for schools and libraries. With the dramatic increase in cyber threats to schools and the lack of funding to address these risks, in 2024, the FCC launched a K-12 cybersecurity pilot to assess the impact of cybersecurity services in protecting schools and libraries. When the FCC received more than 18 times the number of requests it could fund, that oversubscription sent an unmistakable signal of unmet need. So, when a blue ribbon task force convened to discuss USF reform, IST’s Senior Director for Preparedness and Response Michael Klein helped the task force coalesce around the importance of including funding for cybersecurity to support schools, libraries, and rural hospitals.
The E-Rate program, as Klein describes, is undoubtedly “an important program. But it doesn’t address future risks, and, unfortunately, the current funding picture is unsustainable.” One of the main shortcomings of the program is the absence of cybersecurity. “Everyone agrees cyber should be included, but not whose money should be taken to include it,” especially as schooling grows more and more reliant on digital systems.
On September 14, IST brought together members of the task force with backgrounds in education, telecommunications, and technology policy for a virtual event to discuss the importance of the E-Rate program, the recommendations in the report, and how cybersecurity could play a role.
The panelists included Narda Jones, a fellow at the Joint Center for Political and Economic Studies; Joseph Wender, Executive Director of the SHLB Coalition; Erin Mote, CEO of InnovateEDU; and Klein. Nicholas Leiserson, president of the Center for Advancing Cybersecurity at IST, moderated.
USF: The Critical Fabric of Our Country
As Jones put it, “USF is how the federal government makes sure… communications are available and affordable…where the market would not provide those services without government support.” The USF was established by the FCC in the mid 1990s and operates via four mechanisms, one of which is the E-Rate program.
E-Rate impacts 97 percent of schools in the country, both public and private. As Mote explained, “There’s really not a school or a library that you drive by or pass that isn’t touched by E-Rate, and that’s why it’s so important to the critical fabric of our country.”
In June, the FCC put forth a proposed rule on the future of E-Rate. It is accepting public comments on the rule through October 13. The notice raises questions about whether the program should continue to exist at all. But the FCC isn’t the only body with a say in E-Rate’s future: the task force’s recommendations were ultimately aimed at Congress, which is in the midst of a bipartisan, bicameral process over the course of the last year-plus to develop USF reform legislation. Klein framed the stakes bluntly: E-Rate is the difference between “keeping a teacher or not.” If the funding disappears, the need for connectivity does not, leaving superintendents and principals to weigh broadband against school lunches, teacher salaries, and other core programs.
The Demand is There
When the FCC’s cyber pilot program received more than 18 times the funding allocated in requests, it was made clear that the “demand [for cybersecurity funding] is there,” said Klein.
Education, Klein continued, “is the critical infrastructure that allows families to go to work, students to learn, and for them to be fed.” That infrastructure is under constant strain from cybercrime. Mote recalled a superintendent who was “terrified,” unsure how to weigh cybersecurity against needs like school lunches. “I’ve seen school districts have to shut down for weeks, almost a month,” she said.
For Wender, given the growing cybersecurity threat landscape, “it’s crazy that we’re talking about E-Rate going away. We should be talking about improving the program, making it more sustainable.”
An Evolving Threat Landscape
With the swirl about the future of the USF as both the legislative and executive branch looked to make changes, the task force brought together stakeholders who understand how the program affects Americans every day. Beyond the co-chairs, former FCC Commissioners Mignon Clyburn and Rachelle Chong, the task force drew on expertise from superintendents and technology directors from school districts, as well as leaders representing libraries, rural hospitals, and digital equity for urban and rural communities where broadband is either unavailable or unaffordable.
The task force’s recommendation on cybersecurity states that the program “must remain capable of dynamically responding to evolving communications technologies, escalating cybersecurity risks, network resilience requirements, and changing consumer expectations” and “policymakers should: strengthen cybersecurity and institutional resilience; preserve flexibility to respond to emerging technologies; support continuous modernization of program administration.” Emerging technologies, like artificial intelligence, cited in the recommendations have completely shifted the threat landscape, especially compared to when the E-Rate program was first created.
For example, third-party vendors have introduced new risks to schools. As Mote explained, nowadays, schools “don’t have to just watch their house, they now also have to watch everyone they invite into their house.”
She added, “security should not be a competitive market advantage or a premium, particularly when it comes to kids.” Wender drew a parallel to his work in healthcare cybersecurity, where backup systems cannot simply mean “keeping the lights on,” as might have been the case in 1995. Contemporary backup systems need to ensure that the systems still function; in an ICU, everything is life-critical. “You can’t say, ‘well, some cybersecurity threats are okay, but others are not,’” he said. “Healthcare is a perfect example of why you can’t pick and choose what services you protect.”
A Sacred Commitment
The task force report notes that while there was consensus on the importance of cybersecurity, there was no consensus on how cybersecurity should be implemented or funded. Jones stated that the reason the report framed cyber in this way was “to preserve the ability for [the] FCC to be nimble and respond to a variety of cybersecurity challenges across programs.”
Beyond the recommendations, when asked what action to take, all panelists emphasized the importance of making everyone’s voices heard. Speaking to those focused on national security, Klein connected the dots to broader resilience concerns: “If you’ve been worried about Chinese infiltration of American critical infrastructure… I think this, E-Rate, is the mechanism for resilience in education.”
Mote closed by pointing out the irony of debating student screen time while considering cuts to the very program that keeps kids connected, fed, and safe. Connectivity, she said, isn’t just about outcomes in the classroom, “it’s how we deliver school lunches, and the buses run on time… and a teacher’s able to call a parent.” She added: “This is about whether their data is secure and private, and whether we can uphold that sacred commitment we make to parents.”
This webinar is part of a series of policy analysis and development work conducted by Klein and Leiserson on cybersecurity and the USF. Read their policy memo on the topic, watch IST’s webinar in the wake of last year’s Supreme Court decision on the USF, or sift through their comments to Congress on the program and its impact on cyber risk to learn more.
