Skip to main content
HackFirstAidEducation
All playbooks

Playbook

Social-media incident involving a student or teacher

Doxxing, AI deepfakes of teachers made by students, coordinated bullying campaigns crossing platform and school lines.

The scenario

An AI-generated image of a teacher has been circulating in a student group chat overnight. By morning, parents have seen it.

First 60 minutes

  1. Preserve evidence (screenshots with timestamps, URLs, account handles) before requesting takedowns.
  2. Make takedown requests through each platform's trust-and-safety reporting flow.
  3. Notify district counsel — deepfakes of minors and educators trigger criminal statutes in most jurisdictions.
  4. If the originator is a student, loop in building admin and counselor — discipline and criminal exposure are parallel tracks.
  5. Communicate with the affected teacher first, families second.

Decisions to make

Target

  • — Teacher / staff target: deepfake policy + counsel + union if applicable.
  • — Student target: counselor + mandatory-reporting check if image is intimate.

Who to call

  • Local law enforcement
  • Platform trust-and-safety teams
  • State attorney general if jurisdiction has deepfake statute

FAQ

More playbooks

Ransomware mid-school-day

Encryption hits during classroom delivery — transportation routing, lunch accounts, IEP accommodations, or state testing.

Student Information System compromise

PowerSchool, Aspen, Infinite Campus, Skyward, or Synergy account takeover, grade tampering, or credential-stuffing.

Teacher email / BEC

Compromised teacher mailbox — gradebook variant (transcripts) and the payroll-redirect variant (paycheck reroute).