Education & technology: blockchain - 10 years on - technology assurance in the AI age

Education is a data rich sector for businesses to work within. For many, their role is to make data accessible, secure and with users having absolute trust in what they see and work with in performing their role. Therefore, we asked ourselves the question – what can blockchain technology achieve in this sector? The question is answered by Freeths technology consultant Mark Lumley.

We are all familiar with the excitement and enthusiasm for new technology. We all see excitement and the explosion of use of the buzzwords that go with each apparently new thing. Right now, if any technology service proposition doesn’t mention AI, it is a great surprise, a few years ago, blockchain was similarly prevalent. 

It is safe to say that blockchain has already become part of the education space – one in which there is always the need to try to stay current and relevant, particularly in terms of:

• for a sector so reliant on data the needs of education in the here and now
• representing technology comprehensively in the subjects and content which might prove useful, and form part of expectations for the future workplace, and society more generally 
• maximising the technologies available to facilitate delivery of education 
• the operational aspects of running an education provision business or organisation that is supporting our education system. 

Somewhat in tension with the above requirements to stay current is the very real challenge in the education space of managing new technologies from a risk and contractual perspective, because of the sensitivity of handling personal and performance data, and the complexity that comes from public and private sector provision. In addition, there is the ever-present spectre of cyber-attacks and malign actors gaining access to, corrupting or destroying data.  

In which areas does blockchain have potential?

We think there are many, including:

• management of pupil data, and particularly the individual pupil’s school record. This data passes from school to school and authority to authority with different parties having roles to play in the record as it develops
• providing a lifelong reliable record of attainment – always accessible by the student for a multitude of purposes in later life
• ensuring ever more effective data sharing in areas of acute importance – including under the prevent duty and when a child’s safeguarding is at stake – again multiple participants will be replying upon the available data.

Blockchain - a recap

Blockchain did not simply appear with the mysterious Satoshi white paper in 2008 and the launch of Bitcoin, it developed on an iterative basis over an extended period. Like so many technology advances before and sinceblockchain developed from mathematical theory and cryptography. 

The story of Bitcoin is fascinating and if you ever have the time on a journey to listen to podcasts I would highly recommend the Acquired teams Bitcoin podcast.

However, we are concerned with the use of blockchain in the educational environment, what is blockchain? Well, I like to think of it as the next step on from double entry bookkeeping but with added data. A trusted and distributed (amongst computers) ledger holding records (blocks) which each hold a record of the previous block or transaction and are all protected by cryptography. An immutable, shared “perfect” record of transactions, held secure by cryptography.

This represented a great step forward on providing a platform for “trustless” management of information – that is the users would no longer have to rely on the record they are seeing not having been tampered with – as double entry ledgers or information might otherwise suffer from. Blockchain technology, properly implemented, is for now considered to be secure by design (ignoring developments in compute power and quantum computing for the purposes of this article).  

Linux as a key player in the open-source movement has proven to be a key driver in the solution focussed development of blockchain. Hyperledger has formed the basis for private as opposed to public blockchain deployment. A private blockchain is based on permission structures which allow only those with the right authentication rights to access the platform, the Hyperledger platform and specific projects under it that have been developed to meet specific use cases underpin much of what is offered to the education sector. You can find our more here.

Professional qualifications have developed for coding, deployment and management of blockchain projects. 

Specific projects to establish standards for securing records have also been developed.

Blockchain unlocked the ability to create more secure private and public databases and to facilitate more secure and potentially cheaper transaction management. These might seem somewhat prosaic uses but now form part of the underpinning of so many services used regularly in the education space. 

Education and blockchain 

Current use of blockchain in services provided to the education sector include areas where longevity and accuracy of records are important. The examples below are not intended to reflect the state of the art but to give an understanding of the kind of areas involved:

1. Underpinning records management on widely used base systems used by education providers
2. Providing verification for awards and certifications – credentialing. Note the input still needs to come from a verifiable source but, once verified, it can be held for as long as the blockchain operates. MIT operate a system for issuing digital qualifications using blockcerts
3. Managing identity and access control via blockchain and what has become known as self-sovereign identity (SSI). Presently the IP protocol for devices will identify a device, but that is not the same as identifying a specific user. SSI is based on the user establishing verifiable personal credentials and deciding on sharing of those credentials. This is intended to reduce risks of oversharing personal data for organisations and individuals.
4. Records integration, for example DocuSign have created an integration with Ethereum for evidence of agreement signature being able to be recorded on the Ethereum blockchain.   
5. Smart contracts – integrating text with machine readable data and code to create automated transactions run on blockchain technology – this has proved difficult to date and there have been some spectacular security related failures in the cryptocurrency space. Developments continue and smart contracts or automated transaction activities on private chains such as the records integration mentioned above continue to develop.  

How to respond to potential deployment of blockchain 

Legal, technical and sector-based issues arise when deploying any technology, the same is true for blockchain. 

Specific regulations as to use of blockchain have not developed as quickly as the technology and assessment and deployment of blockchain technologies, as a result, the reader has the existing legal and risk management frameworks and guidance for data privacy, information and cyber security and good practice in procurement, technology assurance, contracting (with appropriately knowledgeable legal support) to rely upon.  

Understanding the underpinning technology and reliability of it, the access to, and back up to records and data, remain key issues to understand. If the platform your data or records are held on fails or is damaged, what is the recovery plan and timeframe remain fundamental questions to ask and be satisfied about. 

Further reading around the development of blockchain and the legal and regulatory response can be found in the Law Society’s Blockchain: legal and Regulatory Guidance publication (third edition), which was created with the assistance of the Tech London Advocates Group and the Society for Computers and Law.
  
Guidance about how to onboard and deploy technology in the education sector is to be found in various places and the government provide information on the standards that apply.

Our support and guidance to education bodies and to providers is of course available!

Conclusion

From great steps forward in maths and imagination to becoming part of everyday background tools, blockchain has had and will continue to have a significant impact on the technology used in the education sector. It forms part of many platforms and an understanding of how it works and how it is being deployed and managed is important as part of overall assurance.

I could have just as easily picked the rise of cloud computing, or the development of APIs, or the use of containerisation, or use of machine learning or generative AI. The principles that underpin legal, data and security assessment prior to deployment currently remain fundamentally the same. 

Legislation relating to relatively new technologies is slow to appear and often is aimed at national security and infrastructure rather than sectors such as education. 

We should be careful not to be blinded by the shiny and new, whilst continuing to explore and deploy new technology. We should not forget that basic rules and good practice related to assessment, procurement, contracting and deployment management still apply. 

Key issues around disciplined technology assurance before and during deployment still need to be met. 

By way of limited example, we should always consider requiring, or if a supplier, consider how we address and document:

• Warranty to comply with legal and regulatory standards and clarity as to how these are met
• Some liability and insurance cover against failures including as an absolute minimum confidential information, information security & data breach cover
• Obligations to maintain information security standards and practices
• Powers to audit and to manage performance issues
• Service level management
• Disaster recovery, business continuity and exit management plans.

Technology can be reassuring but it does not absolve responsibility to ensure clear data mapping, and clarity as to tools used, access provided, and actual security stance. 

We so often see inadequate cut and paste terms and privacy notices; these can be tell-tale signs of poor attention to detail or poor understanding of the requirements of customers, and a lack of emphasis on good practice and compliance. If they can’t take the time and spend the money to get basic things right, what else might be lurking in their service delivery?

Finally, ensure you have good support from your managed service provider and technology providers, ensure good discipline in technology assurance, and remember our expert, experienced tech lawyers are available to advise in this significant area with so much potential.