06/02/2026
I was debugging a routine server sync error late on a Thursday night when I opened the outbound traffic log and realized the software our superintendent bought was secretly selling the depression scores and disciplinary records of 15,400 children—including my own niece and nephew—to insurance underwriters.
I am thirty-two years old.
I work as a Data Analyst for the Bridgewater Consolidated School District.
My desk sits in the basement of the District Office building.
The room is B-14.
It has no windows.
I administer the district Student Information System.
In August 2024, our district received a free software platform.
It was donated by BrightPath Educational Technologies out of Austin, Texas.
The CEO of the company stood in front of the Board of Education and presented it himself.
Our Superintendent signed the ninety-four-page Terms of Service that same night.
Two months later, the BrightPath Foundation awarded our Superintendent a one-hundred-twenty-thousand-dollar fellowship.
The money funded a three-week trip to Singapore and Helsinki for him and his wife.
On Thursday, September 18, 2025, I was at my desk at 22:14.
The BrightPath platform had failed a routine end-of-day sync.
The second-period algebra cohort could not pull up their assessments.
I ran a remote terminal session into our integration server.
The server is housed in a locked room two doors down from my office.
I opened the network monitor.
I looked at the outbound traffic counter.
The counter was running.
It was late on a Thursday night.
No classrooms were in session.
The server was transmitting fourteen-point-seven megabytes per minute to an external endpoint.
The encryption flag was turned off.
I piped the data stream to a local file.
I opened the file on my workstation.
It was full of unencoded JSON records.
I read the first record.
It contained a student ID.
It listed the grade as 10.
It listed a free lunch eligibility as true.
It listed two disciplinary incidents.
It listed a PHQ-A depression score of 19.
A score of 19 is in the moderate-to-severe range.
It listed the destination client as Sentient Analytics.
I opened a web browser.
I searched the company name.
Sentient Analytics is a firm in Virginia.
They sell juvenile-risk-scoring packages to family health-insurance underwriters.
The student in the file was fourteen years old.
The server was selling her depression score to an insurance company.
Twenty years ago, I was an eleven-year-old student in this same district.
I stepped between a seventh-grade bully and an eight-year-old boy in a hallway.
I pushed the older boy away.
The school suspended me for aggressive conduct.
My mother walked from her shift at the poultry-processing plant to sign the form.
She did not speak English well enough to read the box labeled ""Permanent Record.""
Three years later, a high school counselor opened my file.
He pointed to that single checkmark.
He denied my entry into the STEM magnet program.
It took me three years of petitions and hearings to get that mark expunged.
A child's data record is a gate.
On Saturday, October 11, 2025, I drove to Bridgewater East High School.
I was there to troubleshoot a token-rotation bug.
I walked into the guidance office.
The counselor was sitting at her desk.
Her screen showed the BrightPath clinical-screener interface.
She had just entered a PHQ-A score of 19 for Student ID 08-2247.
A girl was sitting on the wooden bench outside the office.
She wore a gray hooded sweatshirt with the hood pulled up.
She had headphones in.
She was staring at the floor.
I drove back to my basement office.
I opened the capture log.
I checked the timestamps.
The integration server had transmitted the package to Sentient Analytics at 14:52.
The counselor had entered the score at 14:47.
The transmission occurred exactly five minutes and twenty-three seconds after the data was typed.
The girl had been sitting on the wooden bench at the exact moment her score was sold.
(Read more in the first comment below)