Comstock | Getty Images
Christian Landgren’s patience ran out. Every day, the divorced father of three wasted precious time to keep the official school system of the city of Stockholm, Skolplattform, working properly. Landgren flipped through endless complicated menus to find out what his kids were doing at school. If figuring out what his kids needed in their gym gear was a chore, figuring out how to call in sick was a nightmare. Two years after its August 2018 launch, the Skolplattform has been a constant thorn in the side of thousands of parents in the Swedish capital. “All users and parents were upset,” Landgren says.
The Skolplattform was not intended that way. The system, which came into operation in 2013, was intended to make the lives of up to 500,000 children, teachers and parents in Stockholm easier. The platform is a complex system made up of three distinct parts, with 18 separate modules maintained by five third-party companies. The comprehensive system is used by 600 kindergartens and 177 schools, with separate logins for each teacher, student, and parent. The only problem? It does not work.
The Skolplattform, which has cost more than 1 billion Swedish krona, SEK, ($117 million), has fallen short of its initial ambition. Parents and teachers have complained about the complexity of the system: the launch has been delayed, there have been reports of mismanagement of projects and it has been labeled an IT disaster. The Android version of the app has an average rating of 1.2 stars.
On October 23, 2020, Landgren, a developer and the CEO of the Swedish innovation consultancy Iteam, tweeted a hat design with the words “Skrota Skolplattformen” – loosely translated as “trash bin on the school platform”. He joked that he should wear the hat when he picks up his kids from school. Weeks later, wearing that same hat, he decided to take matters into his own hands. “Out of my own frustration, I just started making my own app,” says Landgren.
He wrote to city officials asking them to view the Skolplattform API documents. While waiting for a response, he logged into his account and tried to find out if the system could be reverse engineered. In just a few hours he had made something that worked. “I had information on my screen from the school platform,” he says. “And then I started building an API on top of their crappy API.”
Work started in late November 2020, just days after the Stockholm Education Council was hit with a GDPR fine of SEK 4 million for “serious deficiencies” in the Skolplattform. Integritetsskyddsmyndigheten, the Swedish data regulator, had discovered serious flaws in the platform that had exposed the data of hundreds of thousands of parents, children and teachers. In some cases, people’s personal information was accessible through Google searches. (The defects have since been rectified and the fine has been reduced on appeal.)
In the weeks that followed, Landgren teamed up with fellow developers and parents Johan Öbrink and Erik Hellman, and the trio came up with a plan. They would create an open source version of the Skolplattform and release it as an app that can be used by frustrated parents all over Stockholm. Building on Landgren’s previous work, the team opened Chrome’s developer tools, logged into the Skolplattform, and noted all URLs and payloads. They took the code, which called the platform’s private API, and built packages so it could run on a phone — essentially creating a layer on top of the existing, glitchy Skolplattform.
The result was the Öppna Skolplattformen, or Open School Platform. The app was released on February 12, 2021 and all code is published under an open source license on GitHub. Anyone can take or use the code, with very few restrictions on what they can do with it. If the city wanted to use some of the code, they could. But instead of welcoming it with open arms, city officials reacted indignantly. Even before the app was released, the city of Stockholm warned Landgren that it may be illegal.
In the eight months that followed, Stockholms Stad, or the city of Stockholm, tried to derail and shut down the open source app. It warned parents to stop using the app, claiming it may be illegally accessing people’s personal information. Officials reported the app to data protection authorities and, Landgren claims, modified the underlying code of the official system to make the spin-off stop working altogether.
Then, in April, the city announced that it would involve the police. Officials claimed that the app and its co-founders may have committed a criminal data breach and asked cybercrime researchers to investigate how the app worked. The move surprised Landgren, who had met with city officials to allay concerns about the app. “It was pretty scary,” he says of the police involvement.