How to avoid the FBI seizing your school's records: lessons from a failed iPad rollout
What the FBI's 2014 records seizure at LAUSD teaches about technology purchases, FERPA and subpoenas, cloud vendor contracts, and data retention.
Updated with current data and sources. Originally published January 14, 2014.
You avoid the FBI seizing your school's records by running every technology purchase so the file answers the hard questions before anyone asks them. You also need to know who holds your data and what to do when legal process arrives, because the lessons of the Los Angeles iPad case of 2014 now apply to every cloud contract a school signs.
This post is general information, not legal advice. Laws differ by state and by type of school, so take any real demand or contract question to your counsel.
What happened in Los Angeles?
On December 1, 2014, the FBI removed 20 boxes of records from Los Angeles Unified offices. The superintendent said the seizure was part of an investigation of "procurement practices involving the Common Core Technology Project," the district's plan to give iPads to approximately 640,000 students.
In January 2015, the Los Angeles Times reported on a U.S. Department of Education review of the program. AppleInsider's account of that report describes inadequate planning, teachers not properly prepared, and an "absence of district-wide instructional technology leadership." Schools also lacked a common vision for how the devices should shift teaching and learning.
Emails had also shown top district officials in contact with Apple and Pearson before the contract was awarded. Those officials denied any wrongdoing. In February 2017, the district announced that the federal inquiry had closed, and the FBI said it was returning the evidence. No charges were filed. Pearson separately agreed in October 2015 to pay the district $6.45 million.
The Los Angeles iPad program in dollars (millions)
If you would not hand your purchase file to a stranger today, the purchase is not finished.Ernie Delgado, BeyondK12
Which rollout gaps turn into records problems?
Nobody at your school needs to do anything wrong for a thin file to become a problem. Each gap in Los Angeles has a matching document a school can keep.
| Gap | What was reported in Los Angeles | What to keep on file |
|---|---|---|
| Implementation plan | Inadequate planning, and some schools with no plan for how devices would support learning | A written plan with goals, phases, budget, and a way to measure impact |
| Professional development | A lack of sufficient teacher training | A training calendar that starts before devices ship, with attendance records |
| Leadership | No district-wide instructional technology leadership | A named project lead who reports to the board |
| Curriculum | Pearson content with only a few sample lessons per grade at the start | Proof that the content exists before you pay, and teacher review notes |
| Vendor relationships | Contact with vendors before the contract was awarded | Written conflict of interest rules and a log of vendor contact during a bid |
What should a technology purchase file contain?
If you spend federal award money, 2 CFR 200.318 already sets the standard. You must keep records sufficient to detail the history of each procurement, including the rationale for the method, the contract type, why a contractor was selected or rejected, and the basis for the price. You must also keep written standards of conduct on conflicts of interest. These are good habits even for purchases with no federal money.
Retention periods depend on the funding. Federal award records generally stay for three years from the final financial report. E-Rate documents stay for at least 10 years after the funding year or service delivery deadline, whichever is later. Ask your counsel about state schedules, which may be longer.
What does FERPA let a school do when law enforcement asks?
FERPA allows a covered school to disclose education records without consent to comply with a judicial order or a lawfully issued subpoena. The school must first make a reasonable effort to notify the parent or eligible student, so they can seek protective action. That notice is not required when a federal grand jury subpoena, or another subpoena issued for a law enforcement purpose, comes with an order that it not be disclosed.
- Records of a law enforcement unit: FERPA treats records created and maintained by a school's law enforcement unit for a law enforcement purpose separately. The Department of Education publishes guidance on school resource officers and these units.
- Recordkeeping: schools must log disclosures of student information. Disclosures under the nondisclosure subpoena provisions are an exception.
- Private schools: the department says private and parochial elementary and secondary schools generally do not receive the funding that triggers FERPA. Ask your counsel what applies to you.
Who holds your records now?
Your vendors do. FERPA lets a school treat a contractor as a school official only if the contractor performs a service the school would otherwise use employees for and is under the school's direct control for the use and maintenance of education records, among other conditions. That direct control lives in the contract.
Federal law also reaches the vendor directly. The government can require providers to disclose records through a warrant or other legal process, can ask them to preserve evidence, and can reach data regardless of whether it is stored inside the United States. Microsoft reports that demands for enterprise data are well under 1% of the law enforcement demands it receives, that it seeks to redirect them to the customer, and that it notifies the customer unless prohibited by law. Do not assume every vendor does the same. Ask.
How long should you keep student data?
Keep it as long as you need it and your schedule requires, then delete it on a routine you can show. Data you do not hold cannot be demanded, breached, or misused. Regulators are pushing vendors the same way. The COPPA Rule now requires operators to keep a written retention policy for children's personal information, and the Federal Trade Commission's June 2026 order against Illuminate Education requires a public retention schedule and deletion of data that is not reasonably necessary.
Once you have reason to think a demand or investigation is coming, ask your counsel before anything is deleted. FERPA bars destroying education records while a request to inspect them is outstanding. Federal law makes it a crime to knowingly destroy or conceal records with intent to impede a federal investigation, with penalties of up to 20 years in prison.
What should you do when a subpoena or agent arrives?
- Call your counsel first. Name one person in your written procedure who receives legal demands and makes that call.
- Read what you were handed. A subpoena, a court order, and an informal request are different things. Your counsel decides what each one requires.
- Pause routine deletion. With your counsel, suspend deletion schedules for anything the demand might cover, including in vendor systems.
- Handle notice. With your counsel, decide whether parents must be notified before you comply and whether a nondisclosure order applies.
- Produce only what is required, and log it. Keep a copy of the demand, what was provided, and when.
Where to start this week
Pull the file for your largest technology purchase of the last three years and read it as a stranger would. Can you see why you chose the vendor, how the price was set, and who led the rollout? Then ask your counsel to review your procedure for legal demands.
The same discipline applies to AI tools. The free AI Readiness Assessment takes eight questions and scores you out of 24 across Policy, People, Curriculum, Guardrails, and Funding. If training was your gap, as it was in Los Angeles, see our professional development options.
Related reading: The role of AI ethics and human judgment in protecting student data in schools and Is your school protected from ransomware? What K-12 leaders should do in 2026.
Questions school leaders ask
Can a school give student records to the FBI?
A school covered by FERPA may disclose education records without consent to comply with a judicial order or a lawfully issued subpoena. It generally must first make a reasonable effort to notify the parent or eligible student, unless a court or issuing agency has ordered that the subpoena not be disclosed. Call your counsel before you respond.
Does FERPA apply to private and Catholic schools?
FERPA applies to institutions that receive funds from U.S. Department of Education programs. The department says private and parochial schools at the elementary and secondary level generally do not receive such funding and are not subject to FERPA. Ask your counsel which federal and state privacy laws apply to your school.
Can the government get our data from a cloud vendor without coming to us?
It can. Federal law lets the government require providers to disclose records with a warrant or other legal process, and providers must comply regardless of where the data is stored. Microsoft says it seeks to redirect such demands to the customer and notifies the customer unless prohibited by law. Your contract should cover this.
How long should a school keep technology purchase records?
It depends on the funding. Federal award records generally must be kept for three years from the final financial report, and E-Rate documents for at least 10 years after the funding year or service delivery deadline. State schedules and your own policy may require longer, so confirm the periods with your counsel.
Can we delete records after we receive a subpoena?
Do not delete anything the demand might cover until your counsel says you may. Federal law makes it a crime to knowingly destroy records with intent to impede a federal investigation, and FERPA bars destroying education records while a request to inspect them is outstanding.
Is this legal advice?
No. This post is general information for school leaders. Laws differ by state and by type of school, so ask your counsel about your own situation.
Sources
- Education Week, FBI seizes records in Los Angeles Unified's troubled iPad program (December 2014) (opens in a new tab) (checked 2026-11-05)
- CBS News Los Angeles, FBI seizes LAUSD documents linked to iPad rollout (December 2014) (opens in a new tab) (checked 2026-11-05)
- AppleInsider, on the Los Angeles Times report of the federal review of the LAUSD iPad plan (January 2015) (opens in a new tab) (checked 2026-11-05)
- LA School Report, Federal inquiry into LAUSD's iPad program ends with no charges (February 2017) (opens in a new tab) (checked 2026-11-05)
- EdWeek Market Brief, Feds drop investigation into Los Angeles district over $1 billion iPad purchase (February 2017) (opens in a new tab) (checked 2026-11-05)
- LAist, Feds won't file charges after investigation of LAUSD iPad program (February 2017) (opens in a new tab) (checked 2026-11-05)
- 34 CFR 99.31, conditions for disclosure without consent, FERPA regulations (opens in a new tab) (checked 2026-11-05)
- 34 CFR 99.8, records of a law enforcement unit, FERPA regulations (opens in a new tab) (checked 2026-11-05)
- 34 CFR 99.10, rights of inspection and review, FERPA regulations (opens in a new tab) (checked 2026-11-05)
- 34 CFR 99.32, recordkeeping requirements for disclosures, FERPA regulations (opens in a new tab) (checked 2026-11-05)
- U.S. Department of Education, Protecting Student Privacy, frequently asked questions (opens in a new tab) (checked 2026-11-05)
- U.S. Department of Education, School resource officers, school law enforcement units, and FERPA (opens in a new tab) (checked 2026-11-05)
- U.S. Department of Education, Protecting student privacy while using online educational services: model terms of service (March 2016) (opens in a new tab) (checked 2026-11-05)
- 2 CFR 200.318, general procurement standards (opens in a new tab) (checked 2026-11-05)
- 2 CFR 200.334, record retention requirements (opens in a new tab) (checked 2026-11-05)
- 47 CFR 54.516, E-Rate recordkeeping and audits (opens in a new tab) (checked 2026-11-05)
- 18 U.S.C. 2703, required disclosure of customer communications or records (opens in a new tab) (checked 2026-11-05)
- 18 U.S.C. 2713, required preservation and disclosure regardless of location (CLOUD Act) (opens in a new tab) (checked 2026-11-05)
- 18 U.S.C. 1519, destruction, alteration, or falsification of records (opens in a new tab) (checked 2026-11-05)
- Microsoft, Law enforcement requests report, enterprise customer data (opens in a new tab) (checked 2026-11-05)
- 16 CFR 312.10, COPPA Rule data retention and deletion requirements (opens in a new tab) (checked 2026-11-05)
- Federal Trade Commission, In the Matter of Illuminate Education, Inc., Decision and Order, Docket No. C-4833 (opens in a new tab) (checked 2026-11-05)
- Government Technology, FTC orders Illuminate to improve security, limit data retention (June 2026) (opens in a new tab) (checked 2026-11-05)
See where your school stands on AI, in five minutes
Eight questions. A score out of 24 across Policy, People, Curriculum, Guardrails, and Funding, with the three fixes that move it most. The report is yours whether or not you ever call us.