When Classes Go Online, Kids’ Privacy Is Put at Risk

Just before spring break, as the seriousness of the pandemic hit B.C., I began to notice the offers. Even before teachers like me were told that school wouldn’t be in session for the foreseeable future, the promoted tweets in my Twitter feed had already figured it out.

Companies began offering free stuff they promised would cushion the stress and uncertainty around the school year: educational software, free trials, upgrades and training webinars.

During spring break, I learned that my students and I were eligible for Microsoft Office 365, Google’s G Suite for Education and unlimited video conferencing over Zoom. Then Apple offered us 90-day trials of Final Cut Pro X and Logic Pro X — slick, professional sound and video editing software, for nothing!

The tech giants pitched their offers as their way of helping students and teachers during the crisis. Google even used the word “philanthropy.”

Over the years, I’ve become warier of the creep of commercial technology products into the day-to-day operation of our schools. At the online learning centre where I teach, we run all of our courses on a Moodle server situated in Canada, so I could ignore the pitches to host courses where they might sit on servers located in the U.S. or China.

Meanwhile, my colleagues at the regular schools were figuring out how to surf this software tsunami. I learned that some districts had signed up for Brightspace, others were using Microsoft Teams, while our local schools were training in Google Classroom.

At the Digital Learning Symposium in late April (offered remotely for the first time this year), I signed up for a session titled “Privacy in Pandemic-Era Education” offered by Julia Hengstler, Vancouver Island University education professor and researcher for the White Hatter internet safety firm.

“There are no free services,” she began. “We barter the rights of our children for them.” Even after software programs are developed, there are costs to hosting, maintaining and upgrading, which means employee costs, she said. Those bills are paid by selling data to brokers.

Information mined from the online actions of individuals is valuable to everyone from marketers to political parties. And education software now being used by hundreds of thousands of students could be the next data motherlode.

I asked Hengstler to help me cut through the acronyms, legalities and tech jargon to see how the commercialization of data might affect our lives in the coming months and possibly years.

Hengstler said that while she allows graduate students to use “dummy accounts” in Google, she doesn’t feel comfortable with a company that’s “had so many privacy fails, especially in regards to students.”

Google has violated privacy laws, she said. “In 2014, for example, [Google] said that they would not scan student emails for advertising, but then it was found out that they did.”

We discussed the implications of students using Chromebooks (cheap netbooks manufactured by Google) at school, and what that might mean now that students have signed these devices out to use at home.

Hengstler noted a lawsuit underway in Illinois that alleges Google collected face scans and voice templates of students that used its educational software tools.

It isn’t just Google. “There is no real oversight of these companies,” she said. Indeed, B.C.’s auditor general has warned British Columbians about Google, Apple and Microsoft all processing voice-commands on servers outside of Canada.

Hengstler explained that we only find out about problems such as data breaches when “an interested third-party uncovers it.” For example, a third party discovered that Zoom was routing data through China in contravention of its own policy.

The easiest solution she said, is to ask, “Do we need this?” She reminded me that schools are only allowed to have students sign up and create accounts for these products when it is “educationally necessary.”

Parents and students need to know that “under B.C. privacy law, they have rights which need to be respected, even if it isn’t convenient.”

Hengstler said that students should only use education software programs in a browser, not as apps on a mobile device. The danger is that a phone app tracks a student’s physical location using GPS. It also links to other apps on the phone, including social media accounts. The privacy risks are greatly increased.

Hengstler reinforced this point: Do everything in your power to make sure that the accounts used at school are not linked, whether physically on a device or across a network, to any personal accounts.

“Even when using these apps in a browser,” she said, “make sure that the cookies are off.” Usually, the program will still work fine. It’s also an opportunity to teach a lesson regarding digital literacy.

I asked Hengstler what schools can do.

“We must teach digital literacy by making sure that students know the privacy impacts of using these tools,” she said. Schools should have some teachers that “at least know how to read the terms of service when it comes to intellectual property and privacy policy,” she added.

Hengstler said that what she calls “domino reliance” — when one district sees that another district has approved something and decides it must be OK — has become too prevalent.

One issue, she said, is that various terms of service are not being written in a way that the average person can understand them. “So if the teachers can’t do that, how can they guide students and parents through it?”

Hengstler told me about a teacher who had students print out the terms of service for the social media app Snapchat. He had students pull out every term and phrase that they didn’t understand. As a class, they were able to make sense of most of it.

However, some of these agreements that we all sign on to get so murky that even Hengstler can’t make sense of them. “I have gone in there, and it has turned into a morass of circular links,” she admits.

“Any time you are leading people into an environment, and you cannot explain the risks, and provide alternatives, to me that is a professional moral obligation, especially when dealing with children.”

At this point, in the midst of the pandemic, her concern is the “lack of accountability by the schools.” She is afraid that many teachers have received the message that they can use anything now and that “this Wild West approach” could continue.

Our conversation wrapped up with a discussion of the potential for AI to process all of this data, which she warned may be stored for decades.

Our present laws were written so that we’re protected against the potential of individuals seeing our information and identifying us, but not against algorithms processing it. “You can get much greater extraction of information than an individual could by seeing it, but it is viewed as safer somehow.”

We can’t fathom the supercomputers of tomorrow, nor the sophisticated programs that they will run. They will know us, though. With billions of data points collected throughout our histories, they might know us better than our friends and families. What might they do with this familiarity? How might they shape us?

Hengstler holds out hope, pointing out that in Europe companies receive fines for actions that go unpunished here. Laws have been passed that don’t allow for the collection of so many unique identifiers. The EU has set in law the right to have one’s data erased, also known as “the right to be forgotten.”

Until we get such protections, we need to be cautious, especially in schools, by making sure that school devices don’t identify students, by teaching kids about terms of service and which apps to keep off of their phones, and by distancing ourselves from the freebies.