Privacy for Students: Surveillance Self-Defense(ssd.eff.org)
ssd.eff.org
Privacy for Students: Surveillance Self-Defense
https://ssd.eff.org/en/module/privacy-students
94 comments
Certainly already happening:
> Over the next 15 days, the school district captured at least 210 webcam photos and 218 screenshots. They included photos inside his home of Robbins sleeping and of him partially undressed, as well as photos of his father. The district also snapped images of Robbins' instant messages and video chats with his friends, and sent them to its servers.
https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...
> "Many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, including, but not limited to, in various stages of dress or undress," the lawsuit charges.
https://www.inquirer.com/philly/news/homepage/20100218_Lower...
> Over the next 15 days, the school district captured at least 210 webcam photos and 218 screenshots. They included photos inside his home of Robbins sleeping and of him partially undressed, as well as photos of his father. The district also snapped images of Robbins' instant messages and video chats with his friends, and sent them to its servers.
https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...
> "Many of the images captured and intercepted may consist of images of minors and their parents or friends in compromising or embarrassing positions, including, but not limited to, in various stages of dress or undress," the lawsuit charges.
https://www.inquirer.com/philly/news/homepage/20100218_Lower...
Wow... they are one (or two) horny kid(s) away from a child porn charge and the confiscation of their servers.
They'll just get the kids arrested for child porn instead.
Some may try, but that won't fly if the kids didn't produce the images (not their cameras), didn't store them (not their servers), and didn't share or publish them (not their network.
A more plausible scenario is trying to sue the kids for indecency or similar.
A more plausible scenario is trying to sue the kids for indecency or similar.
Wow! That is full batshit crazy.
I agree with your point, however, I think the majority of teachers and even lecturers are simply uneducated, when it comes to avoiding surveillance of their students. When presented these issues, most shrugg it off, because they fear having to actually do something about it themselves. They carelessly throw away privacy of their students by suggesting to use the usual suspects for voice and video chat. In my opinion in this age of technology, getting educated about the issues here should be a mandatory aspect of the training of all people, who want to be teachers.
Then there is this illusion, of setting up something oneself, as an institution, being super difficult.
Schools could easily rent a decent server, costing something like 40-80 dollar/euro per month and protect their students. They do have an computer/IT/informatics teacher, who studied computer stuff, hopefully. If not, they could hire someone to do it, the country / state could finance it, or they could even get a talented student to set it up for them. The setup itself is really not that difficult and takes an afternoon or without much prior knowledge perhaps 2 days. And really, if it is a money question, just ask parents to donate and the school will be covered. No unsolvable problem at all.
Universities easily have the cash to rent servers and usually have IT people in employment as well, who manage all sorts of stuff. It should be an easy task for them to set up a privacy preserving text, voice and video chat.
Then you have the problem, that I experienced myself, when I wanted to make it happen for schools, contacting someone I know at a school: There is bureaucracy in the way, which demands a uniform solution for schools. Which results in using a centralized service provider, because the whole country (!) does not manage to set up the infrastructure for its students. Just imagine that. A whole country, incapable of setting up privacy preserving solutions for students, all the while everyone is whining about bad online teaching during the pandemic. Somehow this makes me doubt their motivation and willingness to solve the problem.
Unfortunately most people are not informed about the issues and choose to continue being uninformed that way. They do not want to deal with ethical questions and rather want to throw money at the problem, by purchasing licenses for surveillance products.
All it takes is people caring.
Then there is this illusion, of setting up something oneself, as an institution, being super difficult.
Schools could easily rent a decent server, costing something like 40-80 dollar/euro per month and protect their students. They do have an computer/IT/informatics teacher, who studied computer stuff, hopefully. If not, they could hire someone to do it, the country / state could finance it, or they could even get a talented student to set it up for them. The setup itself is really not that difficult and takes an afternoon or without much prior knowledge perhaps 2 days. And really, if it is a money question, just ask parents to donate and the school will be covered. No unsolvable problem at all.
Universities easily have the cash to rent servers and usually have IT people in employment as well, who manage all sorts of stuff. It should be an easy task for them to set up a privacy preserving text, voice and video chat.
Then you have the problem, that I experienced myself, when I wanted to make it happen for schools, contacting someone I know at a school: There is bureaucracy in the way, which demands a uniform solution for schools. Which results in using a centralized service provider, because the whole country (!) does not manage to set up the infrastructure for its students. Just imagine that. A whole country, incapable of setting up privacy preserving solutions for students, all the while everyone is whining about bad online teaching during the pandemic. Somehow this makes me doubt their motivation and willingness to solve the problem.
Unfortunately most people are not informed about the issues and choose to continue being uninformed that way. They do not want to deal with ethical questions and rather want to throw money at the problem, by purchasing licenses for surveillance products.
All it takes is people caring.
Spying on kids outrageous. The sad state of things is that the most valuable tool kids could learn now is that it's not strangers but authorities who are predatory and self interested, and you need to learn how to manage authorities and rules, which means, how do you extract value from them without being pulled in and subordinated to or hustled by them. Respect does not mean obedience, it means maintaining clear boundaries for something and recognizing what's safe and what isn't. Respect for authority today means treating it like fire or heavy machinery.
Raising kids being spied on is going to create a generation of spiritual fugitives and compromised, sadistic adult administrators. I could see home schooling being the next big tech platform trend, like a Montessori system with a way for parents to co-ordinate.
Raising kids being spied on is going to create a generation of spiritual fugitives and compromised, sadistic adult administrators. I could see home schooling being the next big tech platform trend, like a Montessori system with a way for parents to co-ordinate.
Schools and districts serve the bureaucracy more than the students, teachers, or parents, it seems to me. Not sure when the transition happened. Probably generations ago.
My schools tried to require school owned apple equipment that both restricted actions (couldn’t message with parents or email) and monitored all activity, even when used from home.
I forced my own equipment and they tried to install and reinstall various spyware throughout the year.
It seems like rather than proposing a basic system of assignments and material and grades, they are trying to treat as a wholly owned ecosystem.
This is also one of the things that frustrates me about “work computers” but at least they have a bit more claim since work computers are tools for work while school should be about learning.
I forced my own equipment and they tried to install and reinstall various spyware throughout the year.
It seems like rather than proposing a basic system of assignments and material and grades, they are trying to treat as a wholly owned ecosystem.
This is also one of the things that frustrates me about “work computers” but at least they have a bit more claim since work computers are tools for work while school should be about learning.
Surprising that schools are requiring additional certs to be added a a device for internet access.
This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device.
https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device.
https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
It's not really surprising.
Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm).
In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.
Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm).
In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.
There is a fine line between doing this to protect IP and actual privacy abuse - and as we're treading it's important to remember how important context is.
This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections.
There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.
This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections.
There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.
> This is absolutely a best practice in some corporate environments for DLP.
No, it's not, and this attitude is a major cause of resentment among technical employees.
The "DLP" industry, in general, is a solution in search of a cause. If you can't trust your employees, you'll never be able to stop the determined ones.
No, it's not, and this attitude is a major cause of resentment among technical employees.
The "DLP" industry, in general, is a solution in search of a cause. If you can't trust your employees, you'll never be able to stop the determined ones.
Of course, that means you can’t use the school’s Wi-Fi since now every site with https won’t let you pass.
Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing without cause.
(Yes, this practice sucks. But it’s the only way for them to implement the legally mandated filtering in a way they can guarantee it is working.)
Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing without cause.
(Yes, this practice sucks. But it’s the only way for them to implement the legally mandated filtering in a way they can guarantee it is working.)
An Australian state has intentions to do this soon:
https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Inte...
https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Inte...
I was the kid in school who told people about rebooting to single-user mode and creating hidden root user accounts :-D
Some people got in trouble for having learned about it and misusing it though >_<
Some people got in trouble for having learned about it and misusing it though >_<
> work computers are tools for work while school should be about learning
I really like this point. I think it's true but not obvious.
I really like this point. I think it's true but not obvious.
Looks like I will be a parent in this mess!
My own kids are done, but I have my granddaughter to raise. (Rough, but she is great and will probably make me live longer, so no worries.)
This is going to be a fight! That level of surveillance is unacceptable. I have no plan yet, but will in a year or so. Guess it is wake up call time.
Seriously, I look back at my upbringing and what I was able to do for my kids, and shudder. I cannot imagine this ends well.
Can you? Seriously. Anyone want to talk me down, or just talk?
My own kids are done, but I have my granddaughter to raise. (Rough, but she is great and will probably make me live longer, so no worries.)
This is going to be a fight! That level of surveillance is unacceptable. I have no plan yet, but will in a year or so. Guess it is wake up call time.
Seriously, I look back at my upbringing and what I was able to do for my kids, and shudder. I cannot imagine this ends well.
Can you? Seriously. Anyone want to talk me down, or just talk?
The best thing you can do, unfortunately, is teach them yourself. It is hard, but the real root of this problem is that people expect schools, and therefore the state, to not only teach their children math and history but raise them. As a result of this, people who actually want to raise their own kids get saddled with restrictive practices designed to raise your kids for you. The only way to opt out of it is to forego institutionalized education entirely, or at least if it hasn't gone quite that far yet, it will.
School the institution was not a very good place when I was there. It was not actually conducive to learning, peer influences were in general negative, authority figures were often abusive or at the very least ambivalent, and a sense of silent acquiescence to any authoritative demand was ingrained to the point that it takes young people years of their early adulthood to break this and begin building their own lives how they want them. Many of my peers went into massive debt on the presupposition that authority figures know what's best and that the institutional structure will look out for them, and I believe this is the direct result of the basically authoritarian environment they were raised in.
And this, all I had to deal with were grainy cameras in the halls and police writing children tickets. From what I hear from people younger than me, it is much worse now.
School the institution was not a very good place when I was there. It was not actually conducive to learning, peer influences were in general negative, authority figures were often abusive or at the very least ambivalent, and a sense of silent acquiescence to any authoritative demand was ingrained to the point that it takes young people years of their early adulthood to break this and begin building their own lives how they want them. Many of my peers went into massive debt on the presupposition that authority figures know what's best and that the institutional structure will look out for them, and I believe this is the direct result of the basically authoritarian environment they were raised in.
And this, all I had to deal with were grainy cameras in the halls and police writing children tickets. From what I hear from people younger than me, it is much worse now.
Yeah. That's a hard scenario for us right now, but I think your overall take on this is the right one. We have much work to do.
A lot of what you said, is what my own kids said. It's amazing how much it has degraded.
A lot of what you said, is what my own kids said. It's amazing how much it has degraded.
We are trending that way for sure. Each few years, I can feel it all encroaching into areas of life that should be left alone.
This batch of kids are going to have it rough.
This batch of kids are going to have it rough.
I would consider this a teaching opportunity. Get her a Faraday case for the device. Explain to her that the case isn't to protect the device, but to protect her from the device. Try to make her control the device, rather than the other way around.
She is little, so yeah deffo time for tech education. My own kids were not particularly interested, but she is, so that's a nice change.
Edit: I am gonna start with Faraday Cage. Thanks.
Edit: I am gonna start with Faraday Cage. Thanks.
Being the "confused grandparent" might be a fantastic way to teach via the Socratic method. Moreso if one is savvy enough to know what's likely being done (such as remote-admin by the school board), what is rather dystopian and ought to be avoided (see above), and how to work around the blocks put in place by others.
I like the thinking here. Good to draw from.
I don't think you will, but just to be safe: don't come off as crazy paranoid grandpa please!
Yeah, not now. But when the discussion gets to radios and phones, I will. Foundation stuff.
Right now, we are doing lots of basic science.
She did ask how the cellphone works.
When she can understand something about radio, yeah. Cell phone does not answer in here, why?
Right now, it is TikTok. Fun!
Right now, we are doing lots of basic science.
She did ask how the cellphone works.
When she can understand something about radio, yeah. Cell phone does not answer in here, why?
Right now, it is TikTok. Fun!
Ham radio tech license is a great way to apply some of the "irrelevant" parts of science like the speed of light, frequencies, layers of the atmosphere, and can even lead to fun things like talking to astronauts on the ISS.
Agreed, and I had one as a teen. She is still young, but loves to communicate. Good to keep this idea in mind.
What makes this even scarier is the amount of technological incompetence the people have who are monitoring these things.
As far as I know, there’s no legal equivalent to HIPAA(which itself only scratches the surface of things) for ensuring the data and logs of these invasive systems stays under tight supervision. Now add in the fact that the people monitoring these systems may have an infinite amount of their own selfish agendas in mind for what to do with the information they gather… well, this will end poorly.
As far as I know, there’s no legal equivalent to HIPAA(which itself only scratches the surface of things) for ensuring the data and logs of these invasive systems stays under tight supervision. Now add in the fact that the people monitoring these systems may have an infinite amount of their own selfish agendas in mind for what to do with the information they gather… well, this will end poorly.
FERPA is the regulatory framework that governs how student records are handled. To the best of my knowledge it's similar to HIPAA but not as strong as it only applies to public schools. There may be additional state laws about it as well.
https://en.wikipedia.org/wiki/Family_Educational_Rights_and_...
https://en.wikipedia.org/wiki/Family_Educational_Rights_and_...
In the United States one of the HIPAA correlates in the Education space is FERPA (Federal Educational Records Protection Act), but it doesn’t have the same teeth that HIPAA does.
What bothers me most about this, is how there's even a debate about privacy. While we (western world we) acknowledge the need for privacy and anonymity when it applies to sources in corrupt regimes, depending on politics and time of the day, that same respect for privacy seems fleeting.
Children are always likely to learn something about themselves that displeases their parents. This can be anywhere from sexual orientation to religious inclinations. As a society we can and should enable this exploration - it only makes for a better outcome. Any society that can ongoingly say that critical thinking has led to the desired outcome is like (IMHO) to succeed and grow.
I fail to understand how we've moved from free speech to lack of privacy in such a short period of time. Today in many places, people are arrested for covering their faces in public - though not in the winter where such gear is warranted. People are arrested for expressing views (frequently violently, but not always) that are aligned with many, and abhorrent to others. Privacy would and should allow such exploration.
To me this is fundamental we ought be teaching, much like basic finance. Bother are important to get through life, and the ripple effects will be enormous. Clearly I have a bias.
Children are always likely to learn something about themselves that displeases their parents. This can be anywhere from sexual orientation to religious inclinations. As a society we can and should enable this exploration - it only makes for a better outcome. Any society that can ongoingly say that critical thinking has led to the desired outcome is like (IMHO) to succeed and grow.
I fail to understand how we've moved from free speech to lack of privacy in such a short period of time. Today in many places, people are arrested for covering their faces in public - though not in the winter where such gear is warranted. People are arrested for expressing views (frequently violently, but not always) that are aligned with many, and abhorrent to others. Privacy would and should allow such exploration.
To me this is fundamental we ought be teaching, much like basic finance. Bother are important to get through life, and the ripple effects will be enormous. Clearly I have a bias.
"Myth #1. “If you did nothing wrong, you've got nothing to hide."
The US supposedly already decided on this in the 4th amendment:
"Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
It's apparent how authoritarian regimes can abuse this, and it's becoming more common that incompetence or hacking can allow all this information to become public.
The US supposedly already decided on this in the 4th amendment:
"Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
It's apparent how authoritarian regimes can abuse this, and it's becoming more common that incompetence or hacking can allow all this information to become public.
A great justification my dear goverment uses is that because they don't perform the search directly, (they use third-party private businesses), they aren't violating the law. Of course reasonable people will disagree.
There are a lot of motivations for private businesses to collect as much information as they can, just in case they might be able to use it in the future.
Thursday of last week a solicitor came up to my door. Didn't knock. Leaned their electric scooter against my house, and was "working" on their tablet. I was just getting home and after parking I passed them and mentioned that I wasn't interested in what they were selling. They said "yeah, I saw the No Soliciting sign so I didn't knock, but they are also having us run a scan."
They were completely unaware of how creepy that is and how obtrusive it can be. I played it cool, even though I was irate. They actually showed me the interface and it scanned for wifi and bluetooth devices and recorded ids, etc. My address and photos of my house were on the screen as well. (Public information, I know, but still creepy.)
Apparently there's a market for knowing what brand of wireless computing equipment people have on site. Imagine that. They worked for a company selling home security, smart home devices, and bug extermination service. My my.
It wasn't every house. They had a queue to go through. Apparently I'm a "valuable" target, people. :)
There are a lot of motivations for private businesses to collect as much information as they can, just in case they might be able to use it in the future.
Thursday of last week a solicitor came up to my door. Didn't knock. Leaned their electric scooter against my house, and was "working" on their tablet. I was just getting home and after parking I passed them and mentioned that I wasn't interested in what they were selling. They said "yeah, I saw the No Soliciting sign so I didn't knock, but they are also having us run a scan."
They were completely unaware of how creepy that is and how obtrusive it can be. I played it cool, even though I was irate. They actually showed me the interface and it scanned for wifi and bluetooth devices and recorded ids, etc. My address and photos of my house were on the screen as well. (Public information, I know, but still creepy.)
Apparently there's a market for knowing what brand of wireless computing equipment people have on site. Imagine that. They worked for a company selling home security, smart home devices, and bug extermination service. My my.
It wasn't every house. They had a queue to go through. Apparently I'm a "valuable" target, people. :)
I wasn't quoting the US 4th amendment to say it's illegal. Rather to refute the argument "you have nothing to hide" -- the US government was founded with the ideal that it's simply not true. People are entitled to privacy. Simply hand-waving it away requires proof, not the other way.
Certainly. The Constitution is a guide to what the visionary founders had in their mind for the new nation. It shouldn't be law directly, but a light to help citizens realize what a balance of power looks like.
In the meantime we want to keep our shoes on at the aiport so we actually pay the government and agree to let them perform ongoing, perpetual background searches on us "to maintain eligibility". :)
In the meantime we want to keep our shoes on at the aiport so we actually pay the government and agree to let them perform ongoing, perpetual background searches on us "to maintain eligibility". :)
> "Myth #1. “If you did nothing wrong, you've got nothing to hide."
My usual reply to that is: "ok, what is your salary, and what is in your bank account?"
My usual reply to that is: "ok, what is your salary, and what is in your bank account?"
What if someone then said "I won't tell you of course, but I don't mind if the bank, tax collectors, the police or the govt knows. They already know everything about everyone anyways. I have nothing to hide from them"
Then they're just selective about the hiding and who they trust. They'se still hiding.
Instead, ask them if they're fine with surveillance cameras in their home that record them jerking off or taking a shit.
Most people wouldn't be happy about that. Most privacy invasions are too subtle and the dangers too abstract to make them care. But almost all agree that cameras in the bathroom is past the line.
Instead, ask them if they're fine with surveillance cameras in their home that record them jerking off or taking a shit.
Most people wouldn't be happy about that. Most privacy invasions are too subtle and the dangers too abstract to make them care. But almost all agree that cameras in the bathroom is past the line.
In my experience, they agree to the bathroom example, but don't care enough to realize the double standard with the subtler, more insidious privacy invasions. Kinda even agreeing with it, as long as it means lower prices or some other convenience. This is the fight I don't know how to win unfortunately.
Yeah, I have no problem with ignorant people losing the game of evolution, but they are dragging me down with them.
Millions of Germans thought that they had nothing to hide, back in 1930.
Until they had.
I usually reply to the Myth #1 with "BECAUSE IT'S NONE OF YOUR FUCKING BUSINESS!"
Really guys, you don't have to know my age, gender, religion, browsing history and klick behavior to sell me a bottle of soda.
And for reading a government website or browsing a catalog of goods, you don't need to know aything about me.
I usually reply to the Myth #1 with "BECAUSE IT'S NONE OF YOUR FUCKING BUSINESS!"
Really guys, you don't have to know my age, gender, religion, browsing history and klick behavior to sell me a bottle of soda.
And for reading a government website or browsing a catalog of goods, you don't need to know aything about me.
> Millions of Germans thought that they had nothing to hide, back in 1930. Until they had.
Well this is just plain a massive rewrite of history. The Nazi's were not in anyway covert about who they were going after, and they enjoyed broad popular support to do it.
"Privacy" doesn't mean a whole lot when the actual metric of oppression was "we're going to grab everyone who goes into that church over there".
Well this is just plain a massive rewrite of history. The Nazi's were not in anyway covert about who they were going after, and they enjoyed broad popular support to do it.
"Privacy" doesn't mean a whole lot when the actual metric of oppression was "we're going to grab everyone who goes into that church over there".
It is a very valid argument against data collection for the sake of data collection, which is closely related.
Can't find the exact source, but there was this story about some French (?) town keeping a list of Jews in their documents, for no real reason. It's a piece of data - better to have it than not, right? Might be useful some day. Nazis certainly thought so when they occupied the town and got hold of the list.
Can't find the exact source, but there was this story about some French (?) town keeping a list of Jews in their documents, for no real reason. It's a piece of data - better to have it than not, right? Might be useful some day. Nazis certainly thought so when they occupied the town and got hold of the list.
The Nazi's weren't enabled by a database. They wouldn't have been stopped by the lack of one. And they certainly didn't care whether or not the the people they killed were actually Jews.
Fascism targets "the other".
Fascism targets "the other".
Soon, I'm sure it will be illegal to use the various ad blocking, tracking blocking, header alteration, mac address changing, tunnel shifting, and other technologies I both deploy and use. I'm confident that this will happen within my lifetime, which is chilling at best.
It's reasons like this that I've started to eliminate what little online footprint my meat-person has now, while I can. At issue is the fact that I cannot delete my HN profile, nor go back and delete posts. I find that troublesome.
It's reasons like this that I've started to eliminate what little online footprint my meat-person has now, while I can. At issue is the fact that I cannot delete my HN profile, nor go back and delete posts. I find that troublesome.
Surveillance of kids is a symptom of parents and schools are vastly overwhelmed and they fail in their duties.
It won't be the solution. Actually it won't solve anything.
It won't be the solution. Actually it won't solve anything.
I feel like educators watched Ferris Bueller’s day off, and decided they would crush that spirit with totalitarian tactics. What’s the point of this level of control?
If you’re talking about teaching staff, they almost certainly have no part in purchasing or deploying these systems.
I am married to a teacher who works in a district with absurd, heavy-handed IT policies imposed with no nuance or regard for the needs of the teachers. Simply researching curriculum on the school network has become very difficult in the past few years. Places where teachers often post collections of links to lesson topics, Pinterest and others, have been made unreachable.
Given that it’s almost impossible to get fired as a teacher I think they need to show a little bravery and push back against this damage being inflicted.
I am a public school teacher at the high school level. I’m a union member and I have tenure. My union participation means I have to be offered a PIP before I can be released, and I can request a union lawyer at disciplinary meetings. If my boss wanted me gone next school year, I would be ‘not renewed’ and gone. I only say this to underscore that the country is big and broad.
The most direct avenue for change on this front is probably through school board elections. Everyone can help solve the problem.
Schools I am familiar with are managed in a very top-down way, so it's hard to see at what point teachers could push effectively. They are not likely to be involved in purchasing the hardware, selecting the software, or choosing (surveillance) vendors.
You could argue that the teacher's union could be spearheading the pro-privacy push. I would support that, but it might be kind of far from the "core business" of the union. There are areas with a greater and clearer short-term impact my city's local teacher's union has choosen (e.g., internet access for low-income students).
Schools I am familiar with are managed in a very top-down way, so it's hard to see at what point teachers could push effectively. They are not likely to be involved in purchasing the hardware, selecting the software, or choosing (surveillance) vendors.
You could argue that the teacher's union could be spearheading the pro-privacy push. I would support that, but it might be kind of far from the "core business" of the union. There are areas with a greater and clearer short-term impact my city's local teacher's union has choosen (e.g., internet access for low-income students).
Surveillance in schools is nothing new. The library computers back in the early 2000s had MasterEye, so that teachers could see whether students were using the PCs for homework or games, and block accounts accordingly.
I thought it would get better when I got older, but company Internet is also monitored and controlled through a proxy (ZScaler).
More egregious spying does frustrate me, because it breaks down trust (e.g. my mum reading my emails, or ex-girlfriend lying about having read my emails despite web history proving otherwise).
It does cause a chilling effect, especially when discipline is involved (punishment at a volunteer group for a humorous social media post means I don't post much online any more). I can't install a local web server on the company PC, and didn't even get admin privileges by default. Therefore my creativity has shifted towards hardware, because it's less restrictive.
These policies are not new, they're supported by management/HR/ICT who (perhaps correctly) assume that most people don't know what they're doing, and try to keep people "safe". There are causes worth fighting for, but privacy on other peoples' computers is a privilege that I've given up hope about changing.
I thought it would get better when I got older, but company Internet is also monitored and controlled through a proxy (ZScaler).
More egregious spying does frustrate me, because it breaks down trust (e.g. my mum reading my emails, or ex-girlfriend lying about having read my emails despite web history proving otherwise).
It does cause a chilling effect, especially when discipline is involved (punishment at a volunteer group for a humorous social media post means I don't post much online any more). I can't install a local web server on the company PC, and didn't even get admin privileges by default. Therefore my creativity has shifted towards hardware, because it's less restrictive.
These policies are not new, they're supported by management/HR/ICT who (perhaps correctly) assume that most people don't know what they're doing, and try to keep people "safe". There are causes worth fighting for, but privacy on other peoples' computers is a privilege that I've given up hope about changing.
Surveillance in schools is a symptom, not a cause.
To keep it focused on technology though, schools are super interesting - physical security is routinely violated. The iPhone really needs a dual-password mode, or some similar strategy, to protect its users.
To keep it focused on technology though, schools are super interesting - physical security is routinely violated. The iPhone really needs a dual-password mode, or some similar strategy, to protect its users.
I don’t have a bucket large enough for me to throw up in. Disgusting.
Ever increasing spyware, tracking this, recognition that, useless recommendations, ads everywhere I look.
This stuff is eating me up.
Ever increasing spyware, tracking this, recognition that, useless recommendations, ads everywhere I look.
This stuff is eating me up.
Me too - im so worried about it. Most recently Im preoccupied with the loss of cash / establishment of the cashless society. All purchases can be tracked and all require pre-approval without cash. Really worries me.
Gen Z-er here. I really appreciate that the EFF is writing a guide aimed at students. I was in high school only a few years ago, we were provided MacBook Pros (13-inch, mid-2012), which for me also served as my personal laptop (my own MBP had a failing hard drive). After a few weeks of using it in classes, I realized that none of the class activities required exotic software I couldn't figure out how to obtain, so I formatted the disk and reinstalled macOS (even though we had admin, I booted into recovery instead). For my younger sibling, who was in middle school at the time, they did not have admin access and there was a surveillance software that allowed the teacher to view their screen (and god knows what else), I decided to protect their privacy as well and reinstall the OS. This got me into a bit of trouble (for modifying "someone else's computer"), but to no long-term harm, and when they reinstalled the OS with the software I removed it again anyway.
EDIT: I also randomized my MAC address while using the school network using a script I wrote during a free period[0]
The worrying bit is that most gen-Zers have a radically different and weakened view of digital privacy. They are more than happy to use services with bad privacy track records just because "their friends are on it", network effects trump everything else. They self-censor constantly and mistakenly think that perceived impermanence (e.g. Snapchats, or Instagram stories) means things would be deleted forever. They happily share passwords with romantic partners, even viewing grades (!) (despite constant stories of blackmailing after breaking up), constantly reuse passwords, don't have TFA, the list goes on. Out of convenience, secondary schools use services like GSuite, but in doing so they condition the next generation of people to increasingly give up their privacy.
At one point I tried to deactivate my Facebook account, but the day after, ran into problems because my clubs were using it as a proto-Slack platform, so I bit the bullet and continued using it.
Now that many of us are in university, the surveillance gets more ridiculous, especially in a pandemic. Most notably, I've heard friends complain of software that tracks your eye and body movement, audio, video and screen while taking a test. Fortunately for me the most I've had to do is join a Zoom call while the (human) professor proctors.
More hacker culture-minded types take more precautions, but it is sadly an extremely minority opinion, IME.
[0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...
EDIT: I also randomized my MAC address while using the school network using a script I wrote during a free period[0]
The worrying bit is that most gen-Zers have a radically different and weakened view of digital privacy. They are more than happy to use services with bad privacy track records just because "their friends are on it", network effects trump everything else. They self-censor constantly and mistakenly think that perceived impermanence (e.g. Snapchats, or Instagram stories) means things would be deleted forever. They happily share passwords with romantic partners, even viewing grades (!) (despite constant stories of blackmailing after breaking up), constantly reuse passwords, don't have TFA, the list goes on. Out of convenience, secondary schools use services like GSuite, but in doing so they condition the next generation of people to increasingly give up their privacy.
At one point I tried to deactivate my Facebook account, but the day after, ran into problems because my clubs were using it as a proto-Slack platform, so I bit the bullet and continued using it.
Now that many of us are in university, the surveillance gets more ridiculous, especially in a pandemic. Most notably, I've heard friends complain of software that tracks your eye and body movement, audio, video and screen while taking a test. Fortunately for me the most I've had to do is join a Zoom call while the (human) professor proctors.
More hacker culture-minded types take more precautions, but it is sadly an extremely minority opinion, IME.
[0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...
Why do people (schools) care?
What's the goal here?
How does tracking everything a student does help them and how can they justify wasting time and money on this?
What's the goal here?
How does tracking everything a student does help them and how can they justify wasting time and money on this?
Schools are tasked with trying to solve all manner of social problems. Kids didn't show up? Blame the school for not dragging them in. Kids cheat? The administrator has to deal with it. Kids are fat? Must be that the school isn't managing their lunches. This is what they have come up with.
And people say young people have no initiative now. Wait until this surveillance system is done with them.
Personally, I think surveillance tech provides another way to exfiltrate dollars from the school system while at the same time providing rear-end cover. Look to see if the vendor is either (1) barely competent but policitically connected or (2) a startup cashing in...
[deleted]
Reads like this is about some highly guarded prison in a dystopian future.
This sucks. My school district used a bunch of money to buy every student chromebooks. I remember just a few years ago, back when I was in middle school, I helped unbox all the chromebooks that were shipped to the school - about 2500 of them. Just for one middle school. Every student having access to these laptops made some thing a lot easier, like using Canvas to submit work done on Google Docs.
However, this is in fact a real problem. Our district forced very obtrusive monitoring and blocking software, as well as literal bloat to be installed on the chromebooks - there's like 20 browser extensions that cannot even be turned off, making the already low performing chromebooks so laggy that it's hard to use. Obvious "bad sites" like pirate bay, porn, and etc are understandably blocked, but they also block access to "social media" like reddit and discord.
This doesn't sound that bad yet. The problem comes when students use their own devices instead of the school provided ones. Some sites and services are still blocked at the internet level, but can by bypassed easily. This means that, students with own laptops could communicate with each other using services that chromebook students cannot access. This means that students from families with lower income or with more siblings literally get blocked out of friend groups, with access only to heavily monitored google chat. During distance learning, this problem has only been made worse.
Additionally, district chromebooks are absolutely no less distracting with the various censorship and monitoring and bloat - kids would still much rather browse the limited internet than pay much attention in class. I think there was some study that showed laptops drastically reduced student's academic performance on average. (Though I think access to computer is really powerful for learning how to access internet resources and developing actual knowledge.)
TLDR my opinion and experience on technology + kids
However, this is in fact a real problem. Our district forced very obtrusive monitoring and blocking software, as well as literal bloat to be installed on the chromebooks - there's like 20 browser extensions that cannot even be turned off, making the already low performing chromebooks so laggy that it's hard to use. Obvious "bad sites" like pirate bay, porn, and etc are understandably blocked, but they also block access to "social media" like reddit and discord.
This doesn't sound that bad yet. The problem comes when students use their own devices instead of the school provided ones. Some sites and services are still blocked at the internet level, but can by bypassed easily. This means that, students with own laptops could communicate with each other using services that chromebook students cannot access. This means that students from families with lower income or with more siblings literally get blocked out of friend groups, with access only to heavily monitored google chat. During distance learning, this problem has only been made worse.
Additionally, district chromebooks are absolutely no less distracting with the various censorship and monitoring and bloat - kids would still much rather browse the limited internet than pay much attention in class. I think there was some study that showed laptops drastically reduced student's academic performance on average. (Though I think access to computer is really powerful for learning how to access internet resources and developing actual knowledge.)
TLDR my opinion and experience on technology + kids
Do you still use those Chromebooks in high school? Did technically-minded kids eventually find their way around the restrictions such as reinstalling the OS?
Yes, we still use chromebooks in high school - though most of my friends have nagged parents enough to get their own laptops - me included :)
They all got "enterprise enrollment" feature that makes them kinda useless. Pretty much impossible to reinstall OS, and believe me, lots of people have tried.
They all got "enterprise enrollment" feature that makes them kinda useless. Pretty much impossible to reinstall OS, and believe me, lots of people have tried.
I wonder if the Chromebooks could dual-boot with regular Linux.
They can but they need to be dis-enrolled in enterprise management, so students cannot do this themselves. At least at the time I looked at it, there was no reasonable workaround.
I heard rumors (friend of a classmate of a friend) that some kid was able to get their older brother to help wipe the boot memory chip or something to get rid of it. Nothing reasonable for non experts that I know of
One way I try to influence my friends with teenage kids is to gift their kids or their parents Doctorow's Little Brother.
https://gutenberg.org/ebooks/30142
Perhaps I date myself with that recommendation, but I consider it an important reading.
https://gutenberg.org/ebooks/30142
Perhaps I date myself with that recommendation, but I consider it an important reading.
I've set that book as a reading task for my high school students - it goes down rather well.
We changed the URL from https://www.eff.org/press/releases/schools-are-spying-studen..., which points to this.
I'm fine with school equipment and software being fully locked down, but the facial recognition and automated behavior detection (let alone correction) is way beyond the line.
Why are kids, the ones we're supposed to protect, being used as lab rats here? (Rhetorical—it's because they have no agency and the parents are kept at arm's length. Near-perfect conditions for abuse of power, however well-intentioned.)
What if the student government could declare no confidence in the school administration and have them removed? Would at the very least get more kids interested in civics.
Why are kids, the ones we're supposed to protect, being used as lab rats here? (Rhetorical—it's because they have no agency and the parents are kept at arm's length. Near-perfect conditions for abuse of power, however well-intentioned.)
What if the student government could declare no confidence in the school administration and have them removed? Would at the very least get more kids interested in civics.
I believe we should accept mass surveillance in our lives as a public utility and heavely regulate/democratize it. Mass surveillance is too tempting for any organization to be fought effectively. In the case of youth education i see a strong case of publicly streaming kindegarten activities delayed of few second with a software that obscure facial traits and personal names in the audio (unfiltered version can be requested by police). This is a cheap way to keep accountable child carer while protecting childs privacy
I wouldn't expect most students to be able to follow this, if they want to enjoy their youth.
The problem is the school system, and people with a patronising ideal of what the State or affiliated companies should be able to do.
More and more happy to be living in the EU where this kind of surveillance nonsense can't be implemented as easily as in other parts of the world, thanks to privacy laws.
The problem is the school system, and people with a patronising ideal of what the State or affiliated companies should be able to do.
More and more happy to be living in the EU where this kind of surveillance nonsense can't be implemented as easily as in other parts of the world, thanks to privacy laws.
Schools in the US are usually required by state law to provide a baseline level of content filtering and auditing on any school operated network, device and accounts. The school district has the right to choose which proxy service to use, but not wether to uses one or not. To get this fixed it has to be done at the state legislative level.
its hard to see how that requirement extends to audio/video surveillance, MITMing TLS streams, scrutinizing social media with automated software.
But, it may indeed have to be addressed at the legislative level. I have dim hopes for US legislation forcing anybody to un-spy on innocent people.
But, it may indeed have to be addressed at the legislative level. I have dim hopes for US legislation forcing anybody to un-spy on innocent people.
This will be controversial, but an awesome form of self-defense is wrong information. Flood information infrastructures with spam, rumors and fake news.
We should teach kids to game these systems. Eventually they would do so anyway. The surveillance abuse that already happened is just a small example of what future pupils have to content with.
We should teach kids to game these systems. Eventually they would do so anyway. The surveillance abuse that already happened is just a small example of what future pupils have to content with.
[deleted]
The one sort of surveillance schools need is live webcams so parents can monitor lesson content
This actually isn’t such a bad idea. Parents being able to see their children and what they are encountering during the day. I would even say that the schools shouldn’t be allowed to see this. Only the parents.
Spying off hours is unacceptable, but during class teachers should be able to see what students are doing on district-provided equipment.
Why? Like seriously - grade them on their work and tests and who cares what they do else wise
That only works for some students. Others will simply fail. Fifth grade is far too young to condemn a student just because they’re too young to understand the consequences of their inaction and come from a shitty household incapable of teaching that lesson.
That being said, it’s only acceptable IMO when:
1. It’s only on school-issued equipment.
2. It’s only during hours when the school is responsible for the pupil.
3. What’s being monitored and recorded is stated explicitly in and limited to a document that is distributed to students and parents when the equipment is issued.
4. When screen grabbers or Remote Desktop are used, the student is given some kind of obvious on-screen warning that they are being surveiled in real time.
That being said, it’s only acceptable IMO when:
1. It’s only on school-issued equipment.
2. It’s only during hours when the school is responsible for the pupil.
3. What’s being monitored and recorded is stated explicitly in and limited to a document that is distributed to students and parents when the equipment is issued.
4. When screen grabbers or Remote Desktop are used, the student is given some kind of obvious on-screen warning that they are being surveiled in real time.
I think that it is even worse than that. In a decade or two, we are going to learn the many cases of sexual abuse that this surveillance facilitated. To give such an absolute power to adults over other people's children never ends well. And the kind of person that wants to spy on kids and teenagers 24/7 is the kind of person that should not be allowed to work with them.