free780 Posted March 26, 2018 Posted March 26, 2018 password emailed separately. Does that mean we need to encrypt the email and somehow Pearson need to authenticate?
theeggmaster Posted March 27, 2018 Posted March 27, 2018 password emailed separately. Does that mean we need to encrypt the email and somehow Pearson need to authenticate? The encrypted DVD will go with the moderator, which is a separate delivery route to the email. The password is useless without having the disk, and vice-versa.
mjk Posted March 27, 2018 Posted March 27, 2018 Pearson have just confirmed with our Exams Officer that they are happy to receive videos if it is encrypted on a DVD, and the password emailed separately. Did they elaborate on how they wanted it encrypted ? I can see this ending in some confusion.
theeggmaster Posted March 27, 2018 Posted March 27, 2018 Did they elaborate on how they wanted it encrypted ? I can see this ending in some confusion. No specifics unfortunately, but my intention is to encrypt it with 7-Zip using AES-256 encryption and as a ZIP file. As it's free software, there is no cost to the Exam Board or moderator.
Love_Sausage Posted March 28, 2018 Posted March 28, 2018 We spoke to AQA today - nice person there had never heard of GDPR but did suggest files on an encrypted USB stick was "a good idea". 1
mavhc Posted March 28, 2018 Posted March 28, 2018 We spoke to AQA today - nice person there had never heard of GDPR but did suggest files on an encrypted USB stick was "a good idea". A Questionable Authority? 1
gh5000 Posted April 23, 2018 Posted April 23, 2018 Has anyone got any further with the AQA on encrypting etc. I had the Head of English asking about it and he just referred me to the link in the email he got for the instructions. No mention of securing the data in transit. http://filestore.aqa.org.uk/resources/english/AQA-8700-SL-AV-GUIDANCE.PDF?_cldee=ZXhhbXNAc3RwaGlscy5vcmcudWs%3d&recipientid=account-16887e0b0f09e3118b6278e3b519b0a5-cb46ca70607141b28f0cb023a7074391&esid=00d9f9ef-cb31-e811-813b-e0071b6e4481
Anonimouse Posted April 26, 2018 Posted April 26, 2018 Just received this from AQA: "Unfortunately, we cannot accept encrypted USB's the margin for error logistically is the main reason for this. The last thing that we want is for examiners to end up with USB sticks that they cannot access. We are recommending that the USB's are sent out using recorded delivery to ensure their security. I have attached a copy of an email that was sent out to exams officers with guidelines on sending these USB's or CD's if you require further information please don't hesitate to get back in contact." Recorded delivery to ensure their security?! So, what happens if the package becomes lost in transit?
enjay Posted April 26, 2018 Posted April 26, 2018 So, what happens if the package becomes lost in transit? One could argue if it has been lost in transit, no-one can access it! I guess it depends where things actually go when they don't make it to their destination.
DSapseid Posted April 26, 2018 Posted April 26, 2018 We were told we could send it encrypted if we really really wanted to and then email the password to a specific email address they had. They told our exams officer that they had lots of enquiries about encrypted memory sticks this year due to gdpr and it is something they are going to look into in more detail for next year... Ive left the decision with the exams office as i dont want to get it in the neck if we chose to send encrypted and then they cant open it and the students all get 0 marks!
theeggmaster Posted April 26, 2018 Posted April 26, 2018 As I posted earlier in this thread, we got this from [email protected]: "Thanks for your email. We're currently in the process of reviewing how GDPR affects our processes, encypted/unencrypted data being included in this, and we'll be contacting all schools with further guidance. In the meantime, we would be happy to recieve encrypted data sent on a memory stick. BitLocker is the preferred encryption feature. You can email the encyption key separately to us at [email protected] and we'll forward it on to your moderator."
mavhc Posted April 27, 2018 Posted April 27, 2018 If only they'd had, say, multiple years notice of GDPR....
theeggmaster Posted May 2, 2018 Posted May 2, 2018 New update from AQA, stating that they are happy to use Winzip or Bitlocker. There is also a link to some guidance on how to encrypt media and a form to be emailed separately with the password on it.
mavhc Posted May 3, 2018 Posted May 3, 2018 Hilarious that they're still using Win 7, and completely ignored the Win 10 new encryption issue.
mjk Posted May 3, 2018 Posted May 3, 2018 New update from AQA, stating that they are happy to use Winzip or Bitlocker. There is also a link to some guidance on how to encrypt media and a form to be emailed separately with the password on it. For those that don't want to faff around with educational licensing with winzip, or cannot use Bitlocker (macs, older windows): I can confirm that 7zip is a good opensource alternative that will create files that can be opened in winzip. Just choose zip and AES-256 as the encryption method. 1
free780 Posted May 3, 2018 Posted May 3, 2018 Put the password on a form and email it. I'm sure thats breaking some GDPR guidance.
3s-gtech Posted May 3, 2018 Posted May 3, 2018 Just remember when using password protected ZIP as the archive format that it only encrypts the files within, not the structure. If you have files in the .zip called year_student_name_subject this won't be good enough.
dapaulio Posted May 3, 2018 Posted May 3, 2018 Ask them what the ICO would make of it. see what their response is then?
djrscally Posted May 3, 2018 Posted May 3, 2018 Put the password on a form and email it. I'm sure thats breaking some GDPR guidance. This is fine really. The methods you use to protect data from loss don't have to be GCHQ proof, they just need to mitigate the risks associated with the processing you're doing. With regards to a posted USB stick, the risk is obviously that it will be lost along the way and found by an unauthorised person; emailing the password obviously mitigates that risk.
theeggmaster Posted May 3, 2018 Posted May 3, 2018 Just remember when using password protected ZIP as the archive format that it only encrypts the files within, not the structure. If you have files in the .zip called year_student_name_subject this won't be good enough. It's a shame they won't allow the 7z format, as that can encrypt file names.
3s-gtech Posted May 3, 2018 Posted May 3, 2018 It's a shame they won't allow the 7z format, as that can encrypt file names. Exactly. ZIP is too crude to be practical here.
enjay Posted May 3, 2018 Posted May 3, 2018 Put the password on a form and email it. I'm sure thats breaking some GDPR guidance. The encrypted files themselves are going in the post, so sending the password in plain text via another method is okay I reckon. Of course, the examiner's laptop will end up with the encrypted files and the note of the password on it, but that's an acceptable risk in my opinion.
Arthur Posted May 3, 2018 Posted May 3, 2018 (edited) ZIP is too crude to be practical here. Would they accept a self-extracting (encrypted) 7-Zip archive with the extension renamed to .zip? After the file has been downloaded the other end they could rename the extension back to EXE and then extract the files without installing 7-Zip. Edited May 3, 2018 by Arthur
mjk Posted May 4, 2018 Posted May 4, 2018 Ever get the feeling we might be over thinking this?: we don't encrypt paper copies and seem happy enough using the same postal system that we do for the USB/CD's. As the AQA said - it's not a requirement and there is no more risk of anything getting into the wrong hands being on USB/CD.
enjay Posted May 4, 2018 Posted May 4, 2018 Ever get the feeling we might be over thinking this?: we don't encrypt paper copies and seem happy enough using the same postal system that we do for the USB/CD's. As the AQA said - it's not a requirement and there is no more risk of anything getting into the wrong hands being on USB/CD. It's a safeguarding thing. A video recording contains the student's name and face, their exam paper just contains their name.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now