The end of paper-based testing: will ACT domestic security breach accelerate the migration to digital testing?

Days before the planned administration of a school-day ACT, to be given at the district and state-level on October 2, a test-security breach led to the first widespread cancellation due to a compromised test, of an SAT or ACT in the domestic market. We’ve seen SATs and ACTs canceled abroad due to cheating and test-security breaches, but this is a new development for the home market. The leadership at the ACT, Inc. surely observed the fallout the College Board faced for administering an August SAT whose items had been compromised abroad. The ACT, Inc. could have followed the College Board’s lead and attempted to isolate the damage from the breach, but instead chose to cancel the test date for all students. It is clearly the right move and will likely prevent the kind of lawsuits and PR backlash the College Board is now facing.

We first learned of the breach and the test cancellation Friday morning when we received a communication sent to students in a Mississippi school:

[The school] has been notified by ACT and [the school’s affiliate organization] of the cancelling of the October 2, 2018, test administration. ACT has received credible evidence that there was a compromise in the testing process related to the October 2 test date. As a result, ACT took the difficult but appropriate step of cancelling the October 2 test administration to ensure the exam is fair and valid for all examinees. The planned make-up test date scheduled for Tuesday, October 16, 2018, is now the initial test date.

Students from this school were affected along with thousands of students whose schools were planning to participate in district and state-wide ACT testing tomorrow. Tennessee was preparing to administer this test as the first of three official retest dates for its seniors, so this cancellation will have the greatest effect in that market. Ed Colby, ACT’s Senior Director of Media & Public Relations said Tennessee is the only state to offer a statewide retake program.

ACT’s Chief Operating Officer, Janet Godwin, sent an email to affected districts that the test date was canceled ‘to ensure the exam is fair and valid.” She communicated, "We deeply regret that you are affected by this unfortunate situation and sincerely apologize for any inconvenience it may cause you, your staff, and students.” She notified the districts that they could shift testing to October 16 (the scheduled make-up date) or October 30. "For districts that cannot participate in either day, ACT will make vouchers available to enable students to test on December 8 at an available Saturday test center."

In terms of the nature of the security breach, Colby communicated that the compromise was under investigation and that the ACT, Inc. would not be “releasing any details at this time.”

The impact of the breach

The cancellation of a school-day ACT will have a much smaller impact than the cancellation of one of the ACT’s seven national administration dates. Thousands or tens of thousands of students will be affected, rather than hundreds of thousands. Many affected students will take the ACT on the scheduled make-up date on October 16, which is a relatively minor scheduling shift. This is nothing like the nationwide cancellations overseas where students sometimes had to wait months for the next testing administration.

The more important story here is that even in the domestic market, paper-based, fixed test forms are not secure. It only takes one unscrupulous employee or a poorly-designed system of protections to allow a test-form to be compromised. The leadership at the ACT, Inc. is well-aware this entire system has to change. Over the weekend, at the conference of the National Association for College Admission Counseling, I spoke with Marten Roorda, the CEO of ACT, Inc., who shared with me the technological innovations underway at the ACT, Inc. These new developments will allow the creation of computer-generated test items, in real-time, empowering the ACT to create a unique test for each student, solving these security issues. The solution exists, and it appears as though the ACT, Inc. is committed to making the transition to highly secure 21st century test-forms.