BYOD - monitoring

[enjay]

Use a WPA2 enterprise SSID

 

Or Radius, which is what we've got here.

[w00dy01]

Or Radius, which is what we've got here.

 

So if you're using RADIUS you should be able to work out which user is on which device then?

[enjay]

So if you're using RADIUS you should be able to work out which user is on which device then?

 

Yes. Once authenticated through the Radius, our filtering (Lightspeed) picks their username, so yes, we can see which user is browsing.

 

We can also see the IP of their device, but that's meaningless in a BYOD environment as the device name doesn't allow us to identify the owner.

[AlanD]

I think all schools will need to re-evaluate what they are doing about web filtering because of this new guidance/law...because filtering by itself is no longer sufficient. You need to be able to monitor - although its not always clear what is meant by that. And I suspect many of the commercial products used by schools are weak at this - some are barely capable of identifying which user has been filtered from what. (RM safteynet - for example - is almost certainly not sufficient). If you want to - and I think you probably do - identify what has been typed by whom into search engines and get alerts when they use certain words or phrases - regardless of whether the resulting site is blocked - few commercial products are up to scratch...and I know...because I've been looking.

 

But there is an issue which no one seems to want to talk much about - which is that any student can access anything via a 3G/4G connection. What is more that can set up their phone as an access point - even giving it the same SSID as your school wireless - and give any student or group of students using laptops to tablets unrestricted access. And yes, I know some access points are good at detecting and blocking rogue access points. I see little point (yes... I see some point) in blocking and monitoring school wireless when they can effectively access what they like with mobiles devices. I wanted to make form teachers insist on checking every mobile phone that a suitable phone operator filter was in place (no = it would be monitoring - but at least it would be filtered)....but that seemed to make everyone in SLT jumpy about whether we had the right to do that....at best they agreed we could ask/tell parents to check.

[enjay]

But there is an issue which no one seems to want to talk much about - which is that any student can access anything via a 3G/4G connection.

That's not over our connections though, so a) we can't filter it, and b) we can't be responsible for what they access in that way. Same goes for their home Internet connection of course, and (going non-technical) what books they choose to take out of the public library. This is why monitoring is more than just a technical question and why online safety and Prevent are part of the safeguarding principles so fall to the CPO/safeguarding designated person not the IT Manager.

 

I wanted to make form teachers insist on checking every mobile phone that a suitable phone operator filter was in place (no = it would be monitoring - but at least it would be filtered)....but that seemed to make everyone in SLT jumpy about whether we had the right to do that....at best they agreed we could ask/tell parents to check.

I don't think you can insist on what they install on their personal devices, but educating the parents is certainly a good idea.

[Lonix]

That's not over our connections though, so a) we can't filter it, and b) we can't be responsible for what they access in that way. Same goes for their home Internet connection of course, and (going non-technical) what books they choose to take out of the public library. This is why monitoring is more than just a technical question and why online safety and Prevent are part of the safeguarding principles so fall to the CPO/safeguarding designated person not the IT Manager.

 

I don't think you can insist on what they install on their personal devices, but educating the parents is certainly a good idea.

 

This this and this.

 

Had a chat about 18 months ago I think it was, I mentioned 3G and our very protective child safety officer admitted there is little we can do. All you can do is "help" by:

Training staff to spot things (similar to general child behaviour/protection etc)

Education of students (similar to e-safety)

Information available on your School website (includes documents for parents)

 

At the end of the day you can only do your part which tends to be advice only..

 

Will say this, it's interesting how e-safety officers have changed their tone. We've had a few visit us even from the LEA and you always get one who insist that putting safe guards in place isn't always the best policy. "If students see a locked door they want to break in to it, if they see an open door they will ignore it" - No joke that was one example.

 

You can guess I didn't agree what so ever

 

Ever since radicalisation has popped up, we seem to see a lot more "Do your part" in safe guarding and tightening internet filtering while also improving monitoring.

[enjay]

Will say this, it's interesting how e-safety officers have changed their tone. We've had a few visit us even from the LEA and you always get one who insist that putting safe guards in place isn't always the best policy. "If students see a locked door they want to break in to it, if they see an open door they will ignore it" - No joke that was one example.

Now you're in to semantics. Putting safeguards in place is of course the best policy, but those safeguards need to be more and reach further than filtering the school Internet connection. Students have ready access to an unfiltered Internet connection both at home and on the go, so block the "bad" sites but educate students and parents on why, then educate students, parents and staff on the other warning signs to look out for.

Edited June 20, 2016 by enjay

[IrritableTech]

I think all schools will need to re-evaluate what they are doing about web filtering because of this new guidance/law...because filtering by itself is no longer sufficient. You need to be able to monitor - although its not always clear what is meant by that. And I suspect many of the commercial products used by schools are weak at this - some are barely capable of identifying which user has been filtered from what. (RM safteynet - for example - is almost certainly not sufficient). If you want to - and I think you probably do - identify what has been typed by whom into search engines and get alerts when they use certain words or phrases - regardless of whether the resulting site is blocked - few commercial products are up to scratch...and I know...because I've been looking.

 

But there is an issue which no one seems to want to talk much about - which is that any student can access anything via a 3G/4G connection. What is more that can set up their phone as an access point - even giving it the same SSID as your school wireless - and give any student or group of students using laptops to tablets unrestricted access. And yes, I know some access points are good at detecting and blocking rogue access points. I see little point (yes... I see some point) in blocking and monitoring school wireless when they can effectively access what they like with mobiles devices. I wanted to make form teachers insist on checking every mobile phone that a suitable phone operator filter was in place (no = it would be monitoring - but at least it would be filtered)....but that seemed to make everyone in SLT jumpy about whether we had the right to do that....at best they agreed we could ask/tell parents to check.

 

I think you are correct with your analysis in the first point - schools, LEAs/RBCs and private companies need to sort out any filter that doesn't allow the schools to see reports. What's more I think any filter in 2016 needs to actively monitor and inform. IE. we need an email saying, user x has attempted to look at site y or user x has searched for the term z. I've seen these reports on a number of occasions allow CP staff to intervene and possibly prevent harm. Many schools, LEAs/RBCs and private ISP do have these tools but some do not. Some schools are using systems that can do this, but they don't know about it. Some companies aren't pushing the fact that their solution does do this type of active monitoring. Sadly a few companies are saying they've dealt with prevent, but they've simply blocked a few sites.

 

The head teacher (or someone instructed by him or her) has the power to confiscate or examine anything which a pupil brings into school - now I'd suggest confiscation, and examination with parents in the room if the material is not thought to be illegal is best (If there is any suspicion the material could be illegal then hand the sealed device straight to the police). So a suspicion that a pupil is providing a hot spot can be confirmed and dealt with under usual school sanctions. Presumably your student AUP or home school contract includes something along the lines of 'any attempt to circumnavigate the filter or safeguards is a breach of this agreement..?'

 

I said earlier in this thread two important points as I see it. Firstly monitoring is not just a technical solution. Our prevent training talked mainly about social changes within a person - who they mixed with, if their appearance changed, spending more time at school, less time, a change in their contribution to discussions. All this tends to happen well before a change in their views. None of these things are going to be identified by a filter.

 

Secondly, opening up student access to your wifi - and perhaps allowing a little lighter level of filtering will undoubtedly give your school access to more information to highlight any pupil involvement with extremism. You'll increase your monitoring of those devices typically under the desk and out of sight. Now this type of access has to be well managed and not impact (but possibly improve) learning but it does help you fulfill your organisations prevent duty.

 

Add to the above some good training for staff and parents and you're doing well as a school. It's worth remembering however that peers will probably notice changes in their friends much sooner - education for our pupils on how to spot changes may also be of benefit along side a well established route to report any concerns - anonymously will help here too.