Impero - Chrome app installing on user owned machines

[pcstru]

Impero offer monitoring of chromebooks via a chrome app and extension. The instructions for install say that the apps need to be applied on users not devices, so we apply to our student OU (we do not monitor staff). Students logging into chrome at home are finding the impero app and extension installing itself onto their home machines when they log into google as users of our GA domain (we have reproduced this). This is causing issues - it can prevent them from changing user (which is a software defect) and obviously they and their parents are right to be concerned that we might be monitoring them on their home computers (we are not but we are causing them an issue when they then can't change users).

 

Anyone encountered this and have a solution? I've spoken to Impero support but I'm not entirely sure they understood the problem or why it might blow up as a bit of a thorny issue. So far I have no solution or workaround.

[skell]

IMO there is probably not a lot you can do about that. They are managed accounts, and as such they are subject to the restrictions we put on them. This would be the same for most extensions I imagine.

 

My thoughts are to inform students this might be the case, but as they are offsite, Impero is inert if you're not connected to the schools network.

[mjk]

That's exactly how chrome apps are designed to work and we use this method to deploy apps to students home computers.

Impero really need to have an opt out when the app installs so that students can chose not to install it.

[skell]

@mjk - Having an opt-in for students wouldn't work well for Chromebooks in school, for example.

[pcstru]

That's exactly how chrome apps are designed to work

Really? Chrome apps have no ability at all to be controlled at the device level rather than the user level or a combination of the two?

 

If so I guess then there is no way to stop the app deploying but the app itself must be able to make a determination, it just needs to ask should I be running for this user on this device rather than just should I run for this user?

 

Without notifying students and parents that this could happen and having their agreement, there is potential for someone to make a complaint under the computer misuse act. That's potentially a criminal matter.

[mjk]

Really? Chrome apps have no ability at all to be controlled at the device level rather than the user level or a combination of the two?

 

I'm sure that is the case, they are designed to be user based so that you can use them on any device that you use. Google's 'per device' mode is only for Kiosk mode which might not work for this either.

 

If so I guess then there is no way to stop the app deploying but the app itself must be able to make a determination, it just needs to ask should I be running for this user on this device rather than just should I run for this user? Without notifying students and parents that this could happen and having their agreement, there is potential for someone to make a complaint under the computer misuse act. That's potentially a criminal matter.

 

@mjk - Having an opt-in for students wouldn't work well for Chromebooks in school, for example.

 

I agree with both the comments here, it's something that Impero should really have thought about. @skell 's idea of having impero lookup to see if the device was in a predefined IP range and deactivate if it was not is probably the most workable solution, but knowing Impero there would probably have to be some high profile scandal before they fix it.

[Mic_Impero]

Good afternoon all,

 

Our ChromeOS extension and application are used extensively around the world and can absolutely assure that Impero will not monitor a Chrome OS device that is away from the network.

We couldn't create a scenario where the user chooses to load the app or not, as this would give them the same option in school and they could simply choose not to be monitored. My expectation would be that a learner is using their school account for school work, which is managed in G Suite, and their personal account for personal work and other uses. This should be clearly communicated in any AUP, including that the account is managed and will inherit the settings impose by G-Suite, regardless of location or device.

 

I can understand how this may be difficult to communicate and could blow up into an issue unnecessarily, and especially if there is an issue with changing users how this would impact personal devices. Please PM me your details so I can look up your establishment and support cases, and I'll be happy to work with you further on the change user issue.

 

The idea around deactivating if not in a predetermined IP range is exactly what it does, by design that if it can't connect to the server it isn't active. I think what you're looking for is for the application and extension to not be installed, or to be hidden if not within a predefined IP range. This couldn't be controlled by the app or extension by virtue of the app or extension needing to be present in order to determine whether or not to install itself.

 

Every other app loaded by G Suite will work in exactly the same way, users will get those apps logged in at home.

 

More than happy to set up a working party on this so that we can get our heads together and discuss the best way to communicate this to parents and manage this. If this is something you'd like us to facilitate, please do send me your details by PM and make clear you're happy for me to share them, and i'll setup a conference call for us.

 

Thanks

Mic @ Impero

[mavhc]

I guess the easiest thing is to have the Extension indicate when it's active.

 

If you're installing the chrome extension with GPO, then the problem is the user has set their home chrome install to sync extensions, just turn that off, or disable the extension.

 

If you're installing it via GSuite that's a different problem

[Mic_Impero]

As the users are running ChromeOS on Chromebooks it can't be pushed out by GPO and has to be managed in G suite which is where the problem is; it's by design with Google.

 

The extension is grey when it's inactive and colour when it's active.

 

Mic

[pcstru]

Our ChromeOS extension and application are used extensively around the world and can absolutely assure that Impero will not monitor a Chrome OS device that is away from the network.

We couldn't create a scenario where the user chooses to load the app or not, as this would give them the same option in school and they could simply choose not to be monitored. My expectation would be that a learner is using their school account for school work, which is managed in G Suite, and their personal account for personal work and other uses. This should be clearly communicated in any AUP, including that the account is managed and will inherit the settings impose by G-Suite, regardless of location or device.

 

I can understand how this may be difficult to communicate and could blow up into an issue unnecessarily, and especially if there is an issue with changing users how this would impact personal devices. Please PM me your details so I can look up your establishment and support cases, and I'll be happy to work with you further on the change user issue.

 

The idea around deactivating if not in a predetermined IP range is exactly what it does, by design that if it can't connect to the server it isn't active. I think what you're looking for is for the application and extension to not be installed, or to be hidden if not within a predefined IP range. This couldn't be controlled by the app or extension by virtue of the app or extension needing to be present in order to determine whether or not to install itself.

 

Every other app loaded by G Suite will work in exactly the same way, users will get those apps logged in at home.

 

More than happy to set up a working party on this so that we can get our heads together and discuss the best way to communicate this to parents and manage this. If this is something you'd like us to facilitate, please do send me your details by PM and make clear you're happy for me to share them, and i'll setup a conference call for us.

Thanks for the response. I appreciate you may be constrained by Chrome in terms of deployment. Part of the reason this came up is they were then prevented from changing user. We reproduced that and quickly found a workaround (which I can't remember - it's been a long day!).

 

I think it would be useful for Impero to have supporting documentation that helps schools manage risks associated with privacy, monitoring and data protection legislation. Mention of that while running an installation would be good but the crown would be supporting documentation on systems implementation - i.e. all the the stuff like AUP's and policy that have to be in place to minimise risks which are associated with using monitoring software on students and potentially staff (the two are quite different, you need to be much more diligent to use the functionality on staff). If this kind of thing already exists, please point me at them.

 

I'd hope, given the fact that we are not monitoring students on their own property and that deployment is constrained by ChromeOS/GAFE, that we aren't at much risk - other than than looking silly, what with all the egg dripping off our cheeks. I am still a little concerned that there is some way for this to bite us all. I'll be happy to be wrong.

 

A potential help in the longer term would be for the app/extension to figure out it's context and perhaps offer some information to the user, on why the software installed, what it does, whether it is operating, who to contact for information etc.

[Mic_Impero]

Thanks pcstru.

 

The important thing here, is that it's your domain. The school own the account. The user is simply using a school account the same as they would be if on your network. I think that's where the AUP becomes important.

 

I accept that it may be their device, but that's no different in the home to BYOD, for example, in using your account on any device they accept the terms of using the account.

 

We can't advise on what should or shouldn't be in your AUP, and aren't best placed to do so. The bottom line is that you own the account and they have permitted use of it, according to your terms. So as long as you're explicit in those terms you shouldn't have a problem.

 

I'll submit to the product team a request to have the app / extension present to the user what it does, but i'm not sure it would win in a vote; the amount of disruption that would cause at the beginning of a lesson for users who currently simply login and receive the functionality would be quite a big deal to a lot of our users.

 

I'll pass your feedback around documentation onto our marketing and product teams and ask if we're in a position to elaborate on this. We do provide an online safety handbook (available via website), numerous white papers, and weekly training webinars (bookable via support), which help with these areas, but i don't think any of them directly address this topic; they're more focused on ensuring the information is in the hands of the right people and that each stakeholder in school is getting the most out of the software, particularly around safeguarding elements.

 

Thanks

Mic

[mavhc]

Which part is causing the non chromebooks at home to stop users being changed?

 

You can still choose to not sign in to chrome and just sign in to websites on chrome, or when you sign in it gives you an option, after you clicked link data, to change what's synced, to not include apps/extensions.

Edited October 6, 2017 by mavhc

[pcstru]

Thanks pcstru.

 

The important thing here, is that it's your domain. The school own the account. The user is simply using a school account the same as they would be if on your network. I think that's where the AUP becomes important.

 

I accept that it may be their device, but that's no different in the home to BYOD, for example, in using your account on any device they accept the terms of using the account.

I think my point would be that suppliers need to help us to understand the consequences of the technology their are supplying. It was not obvious to me that using Impero in a school to monitor our chromebooks (as I saw the use case) actually involved the possibility of Impero software downloading and installing itself on a users computer and then, functionally causing them an issue using their equipment. I appreciate there are functional constraints with GAE that mean everyone can happily say "well, YOU should have known" or toss the blame ball around between google/impero/school.

We can't advise on what should or shouldn't be in your AUP, and aren't best placed to do so.

I find that a little odd. You have no problem advising schools on Safeguarding, Prevent and other matters involving compliance with their legal obligations where your software enables that compliance. AUP's are essentially something we need to comply with legislation that is common to all of your customers simply for them to be able to use the software legally. I'm curious as to what exactly prevents you from offering such advice?

The bottom line is that you own the account and they have permitted use of it, according to your terms. So as long as you're explicit in those terms you shouldn't have a problem.

I believe you have a duty of care to your customers to help them understand the normal consequences of their use of your product, especially where it might lead them to be in breech of legislation that might involve criminal offences.

I'll submit to the product team a request to have the app / extension present to the user what it does, but i'm not sure it would win in a vote; the amount of disruption that would cause at the beginning of a lesson for users who currently simply login and receive the functionality would be quite a big deal to a lot of our users.

I would not envisage it doing that in a lesson (unless the software has yet to be properly configured and no one has turned that particular warning off or set it to occur (say) once a term). It needs to figure out where it is and who is using it - can it talk to the GA domain to query the info in the OU? It is only where it is unable to phone home and in an indeterminate context that the default needs to be intrusive. If it can phone home and figure out if it is running on a managed device then we can have it make sensible decisions about what it should do and how that relates to what users have agreed to in any AUP.

I'll pass your feedback around documentation onto our marketing and product teams and ask if we're in a position to elaborate on this. We do provide an online safety handbook (available via website), numerous white papers, and weekly training webinars (bookable via support), which help with these areas, but i don't think any of them directly address this topic; they're more focused on ensuring the information is in the hands of the right people and that each stakeholder in school is getting the most out of the software, particularly around safeguarding elements.

Thanks. I did have a look and I could not see anything. Compliance with things such as The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations should be/is part of a good implementation at any school. Privacy and snooping in schools is a sensitive issues and have a lot of potential to blow up. IMO it is probably cheaper to put together a few guides than deal with the cost of managing the impacts those guides might prevent, let alone the costs involved because the brand gets tarnished and impacts sales. It's not just good risk management for you, it would actually add value for your customers.