Privacy folk raise alarm over schools snooping on kids' online habits

[Gibbo]

From The Register

 

Privacy activists have called for more transparency and parental control over web monitoring in British schools after a survey indicated that almost half track their students online.

[Mako]

Not even sure where to begin with that one. I do despair.

[FishCustard]

Yes, we track students online actions while they are at school, and therefore we are acting in loco parentis. I imagine parents at least keep an eye on what their kids do online, right? Well, we have hundreds of kids to watch over.

 

Sod off 'activists', find something else to agitate about.

[Ephelyon]

Just point them in the general direction of PREVENT... =]

 

Although I'd agree with their point that I can't see a need for any of this logging/metadata to be shared externally... might put that firm eSafe in a tricky position if enough fuss were made though...

[free780]

Clearly this group havent seen filtering logs in a school. Or any idea about Safeguarding, Prevent etc.

[pete]

Really @jenatddm ?

[GrumbleDook]

I didn’t catch the whole event but caught some of the comments involved.

 

The stress is more on transparency and the fact that some parents don’t know what is going on or, and possibly more importantly, why ... and the importance of it. That is something built into the update of the regulation.

 

The amount of checks involved and ensuring that tech is set up properly will always be a discussion point and if we are going to teach children to look after their data then we have to have some of the difficult conversations too. Nothing wrong with that ...

 

Some of the emphasis of others there I do understand (Big Brother Watch as an example) but don’t completely agree with ... it that’s partly because I’ve seen both sides of it and err on the side of trusting the school (who often take far more care of the children online than parents do).

 

I do look forward to the full report so that it keeps the discussion going, but would suggest that the media representation might be coloured a particular way.

[jenatddm]

Yes, we track students online actions while they are at school, and therefore we are acting in loco parentis. I imagine parents at least keep an eye on what their kids do online, right? Well, we have hundreds of kids to watch over.

 

Sod off 'activists', find something else to agitate about.

 

Just as soon as it's fair and lawful.

[jenatddm]

Really @jenatddm ?

 

The main issue of the web monitoring and keylogging (not filtering) is utter lack of transparency and fair and lawful processing, aside from the baked-in issues that Prevent has of its own.

 

Constructive solutions sought for:

 

1. Legal basis outside school hours. [see ]Oral evidence - Children and the internet - 11 Oct 2016

2. Legal basis of excessive data collection.

3. Genuine error rate is opaque and system providers have little incentive to be transparent about it. Teachers concerned enough to contact us saying they have children who search for something uncontroversial, system flags it, and system only allows to make a 'note', that it was an error, but not delete the error. And that a move from one system to another create sudden spike in the volume of flagged words, which are all nothing to be concerned about — so the system should not be flagging them.

4. Security researchers warned Impero twice of serious flaws but the company has reportedly failed to fix them.

5. Collecting someone else's web searches and content in-and outside school hours and assigning the results of monitoring to the child’s record (i.e. a parent or older brother or classmate prank)

6. Opaque direct contact with police without trusted teacher intermediary.

7. Behavioural effects are unresearched but there’s qualitative feedback that it has a chilling effect on safe searches for sexuality, health, teenage development questions.

8. Necessity and proportionality of web cam access to take photos of the child; and risk of misuse.

9. 50% of schools that have responded to us impose on Bring-your-own-device which is opaque level of surveillance of personal property, active wherever logged in to school network and some at all times regardless of network.

10. Lack of transparency to parents and children of the consequences of the web content monitoring and keylogging. 84% of parents in survey said they believe they should be informed which keywords get flagged, and 86% want to know what the consequences are — but do not currently know.

[synaesthesia]

"Yup, here's the current list of the flagged keywords. If you don't know what a **** is I suggest you ask your 12 year old son."

Sometimes transparency is used for the sake of it and isn't entirely necessary. Schools should however be giving parents an idea of what they do to look out for the safety of their children which oddly enough ticks all the same boxes as the above transparency claims.

Again, a bit like the above post, some of that PDF is a little shock-and-awe and indicative of the researchers involved not being fully clued-up on what's required in a modern school.

[Ephelyon]

Indeed, besides the risk that these keywords will then somehow get into the hands of the kids, who will then invent new nicknames for things (as they do anyway, but still).

 

It's a bit like telling the security/intelligence services that they ought to be "more transparent"...

[jenatddm]

"Yup, here's the current list of the flagged keywords. If you don't know what a **** is I suggest you ask your 12 year old son."

Sometimes transparency is used for the sake of it and isn't entirely necessary. Schools should however be giving parents an idea of what they do to look out for the safety of their children which oddly enough ticks all the same boxes as the above transparency claims.

Again, a bit like the above post, some of that PDF is a little shock-and-awe and indicative of the researchers involved not being fully clued-up on what's required in a modern school.

 

Answer the questions. Solve the real issues above. Teachers are really unhappy with children flagged as a suicide risk, or potential gang risk, who is not. Some people seem very keen in all our research, that parents and children are explicitly not "clued-up". And yes, SWGFL et al, needs to answer the questions.

[jenatddm]

Indeed, besides the risk that these keywords will then somehow get into the hands of the kids, who will then invent new nicknames for things (as they do anyway, but still).

 

It's a bit like telling the security/intelligence services that they ought to be "more transparent"...

This level of intrusion into home life even for the sec./intell services, has more oversight, due legal process, and transparency.

[Ephelyon]

What we monitor at school isn't home life, though - quite the reverse. This is more the "work life" of minors for whom a duty of care applies. I don't really understand why students should have an expectation of privacy in their use of school systems, although I do agree that there are potentially valid concerns around the use of e.g. Lightspeed to monitor all activity on a school-issued student tablet at home as well.

[jenatddm]

What we monitor at school isn't home life, though - quite the reverse. This is more the "work life" of minors for whom a duty of care applies. I don't really understand why students should have an expectation of privacy in their use of school systems, although I do agree that there are potentially valid concerns around the use of e.g. Lightspeed to monitor all activity on a school-issued student tablet at home as well.

 

It's not what you or I *think* they should have, but they do have rights that need respected. How we all balance those between right to be kept safe, their best interests, right to freedom of expression, right to participation, right to digital access, right to equality and non-discrimination, and right to privacy is the hard part.

 

We genuinely have teachers upset their children are flagged for nothing. That's a pressing issue, that should(?) be an easy fix if there were a technical option to do so, and guidance how and when it was appropriate to do so.

 

"potentially valid concerns at home." Um, yes. And if you can help us at all with the 1-10 we would be genuinely grateful. There needs to be much more fairness and consistency in what companies and policy decide how to operate, as well as what parents get told.

[synaesthesia]

Sorry, that's imbecillic. If anyone is being "labelled" or "flagged" for something purely down to a school's interpretation of those systems logs then they have a procedural problem, not a technological one. Not only is it moronic to think that, it's also dangerous.

 

So, real life example that has happened.

 

One of our system flags up on a search term "how long after sex can I take morning after pill"

In one example, this was during a sexual health lesson/PSHE. Without the child or parents being aware, this was an easy check to make.

 

However a near identical search a little while later. No such lesson; in fact it's not taught in that year group. A quick chat with head of year shows they should have reason for concern. Pastoral team jump on this immediately, see the child and get everything resolved quickly and amicably being absolutely sure that the child's safety is paramount. Whether or not the parents were involved, I don't know; I'm just a technician; if it was my daughter I'd hope to be told personally.

 

Now, the same checks can easily be carried out without permanently "flagging" anyone and anyone who thinks otherwise should perhaps be working the tills at Lidl.

[Bompalompalomp]

Honestly disappointed. I donate to multiple privacy groups (ORG seems to be more leve-headed thankfully) and this is something that is so below worth caring about it's ridiculous. There are so many more worthwhile endeavours right now. Cambridge Analytica is about to be exposed and Facebook needs to be taken to task over it!

 

Schools have a duty of care to monitor and safeguard kids under their care. Nobody is checking kids' browser histories outside of school concerns. In most cases (and I agree that it should be) it's transparent in that there's an AUP that's signed by parents/pupils that states what's monitored and agreed to. Schools monitoring pupils under in loco parentis requirements are not comparable to government monitoring of citizens.

 

If you're targeting schools for monitoring data I don't see much difference in targeting parents monitoring their children's data.

 

Digital liberty and privacy is a concern for us all and need to be protected at all costs, but schools are not a worthy target.

[Ephelyon]

Just to add to that, another example that has happened at my last-but-one school:

 

Google Search: "how to make teachers not find out about self harm" (this is an additional needs student, MLD and profoundly deaf)

 

Picked up through Securus, dealt with immediately.

 

There should be no expectation of privacy on a school network, and we make this clear in our AUPs. Anything you do may well be monitored and/or recorded, although I see nothing wrong with reasonable limits on how long this will be stored for.

 

I have no problem with technologies such as Impero or Securus for detecting these things, although I do object to e.g. eSafe's way of doing things, whereby they monitor externally and will call the police if they detect something extremely serious, even if the school doesn't consent to this. I had a good long chat with their MD about this a couple of BETTs ago. My view is that the duty of care should ultimately lie with the school, as that's where it originates, not with a private firm that doesn't actually have statutory obligations to these kids.

 

Put bluntly: safeguarding trumps privacy. That said, I think there's a valid debate about what, if anything, should change once a student turns 18. But even then, as an adult employee I don't expect full privacy from my employer when it comes to e.g. web searches or accessing pornography/gambling, assuming I were using the employer's equipment to do so while I'm at work. My private life, and my own personal equipment, is none of their business, although even then I'd argue that if I connect my personal phone to the employer's guest WiFi and authenticate as myself, I'm still accountable for what goes on via my credentials and I don't expect it to be completely private.

Edited March 19, 2018 by Ephelyon

[mjk]

Yes, we track students online actions while they are at school, and therefore we are acting in loco parentis. I imagine parents at least keep an eye on what their kids do online, right? Well, we have hundreds of kids to watch over.

 

Sod off 'activists', find something else to agitate about.

 

some schools add content filtering for kids when they are at home too, we do.

[synaesthesia]

although I do object to e.g. eSafe's way of doing things, whereby they monitor externally and will call the police if they detect something extremely serious, even if the school doesn't consent to this.

 

Eek, that is OTT indeed and certainly a method of permanently labeling someone erroneously. That could easily end up with social care services keeping a watchful eye too if not dealt with correctly.

The people best placed to make the judgement over what constitutes a risk are those currently with duty of care; parents at home, staff at school or a combination of both where applicable. You wouldn't flag someone a racist for searching KKK related materials in the middle of related lessons after all...

[localzuk]

Teachers are really unhappy with children flagged as a suicide risk, or potential gang risk, who is not.

Then, quite frankly, those teachers need better training. They misunderstand the purpose of the monitoring systems we have in place in schools. The way you are writing it makes it sound like as soon as a keyword trigger happens, that kid is marked for life and their search will follow them everywhere they go, which is nonsense.

 

As you well know, schools have a legal duty of care towards children in their care. This duty of care comes from a variety of legislation - so it isn't just a catch all. So, for example, if a child is searching for guns, or ISIS related stuff, that will likely flag up on monitoring solutions as those things fit within our duty under PREVENT. That flag doesn't immediately send MI5 to their doors, but there is a large and details system in place to ensure that child isn't at risk of radicalisation, or if they are, to prevent them getting hurt etc...

 

Similarly, searches for self harm and sex related things are dealt with by pastoral staff in schools - to make sure those children are safe. It doesn't mean we have social services knocking on the door as soon as a child searches "condom".

 

If teachers are coming to you, upset that a child was flagged for whatever reason then that is neither the fault of the concept of monitoring, nor the technology. It is the fault of poor training and processes in the schools involved.

[kennysarmy]

I'm more concerned with the school's that DON'T monitor their students online activities!

 

My daughter can search for what she likes on the school laptops and they've no idea what she's looking at!

[jenatddm]

Honestly disappointed. I donate to multiple privacy groups (ORG seems to be more leve-headed thankfully) and this is something that is so below worth caring about it's ridiculous. There are so many more worthwhile endeavours right now. Cambridge Analytica is about to be exposed and Facebook needs to be taken to task over it!

 

Schools have a duty of care to monitor and safeguard kids under their care. Nobody is checking kids' browser histories outside of school concerns. In most cases (and I agree that it should be) it's transparent in that there's an AUP that's signed by parents/pupils that states what's monitored and agreed to. Schools monitoring pupils under in loco parentis requirements are not comparable to government monitoring of citizens.

 

Digital liberty and privacy is a concern for us all and need to be protected at all costs, but schools are not a worthy target.

 

"Nobody is checking kids' browser histories outside of school concerns" may be true for you. It's not elsewhere. If you think it should not be monitored at home and outside school hours, then we agree. It's why there needs to be guidance to have consistency across the sector.

 

Delighted to hear your processes are transparent. Clearly of the 1,004 parents in survey if 86% want it to be and it's not, they might not be in as good a position as you. My own child's secondary school is just one school, but my own experience is it has refused point blank to explain to me how this works which we asked when we were given the agreement to sign, we asked what it was we were being asked to agree to. We're still waiting over a year on. The primary simply has never mentioned that they monitor and there is no agreement, but know that they do as well.

 

Schools monitoring pupils in loco parentis is exactly why they shouldn't keep the whole process opaque, but in partnership with parents and full transparency of consequences. If we met, you'd know I'm a very reasonable and practical person. But the number of questions we get on this from teaching staff, shows there are concerns how it operates very differently across the sector, without enough clear policy and guidance how.

[localzuk]

Another thing, regarding transparency - schools are in a constant state of keeping up with their pupils as they find new things to injure themselves with online. What level of transparency would be wanted regarding monitoring? There was a mention of the list of keywords that are monitored. This list changes day to day, week to week. Should we keep the list up to date and published for parents to see? All that'd do is make it more difficult to keep up with pupils - they'd just use different words, making our duty of care more difficult to perform.

 

What about solutions which use URL block lists (we use one, and when kids go to the listed sites, they get flagged)? Do we list those too? Including the ones marked as extremist or terror related?

[jenatddm]

Then, quite frankly, those teachers need better training. They misunderstand the purpose of the monitoring systems we have in place in schools. The way you are writing it makes it sound like as soon as a keyword trigger happens, that kid is marked for life and their search will follow them everywhere they go, which is nonsense.

 

As you well know, schools have a legal duty of care towards children in their care. This duty of care comes from a variety of legislation - so it isn't just a catch all. So, for example, if a child is searching for guns, or ISIS related stuff, that will likely flag up on monitoring solutions as those things fit within our duty under PREVENT. That flag doesn't immediately send MI5 to their doors, but there is a large and details system in place to ensure that child isn't at risk of radicalisation, or if they are, to prevent them getting hurt etc...

 

Similarly, searches for self harm and sex related things are dealt with by pastoral staff in schools - to make sure those children are safe. It doesn't mean we have social services knocking on the door as soon as a child searches "condom".

 

If teachers are coming to you, upset that a child was flagged for whatever reason then that is neither the fault of the concept of monitoring, nor the technology. It is the fault of poor training and processes in the schools involved.

 

I agree one thing that is missing is consistent training and guidance, but as often seems the way, a huge technology solution can be misapplied trying to fix what are nuanced human issues. If one system appears to be filtering and monitoring appropriately, and then a new system is trialled which has a significant spike in flagged words, but no more issues in reality, it could indicate it is indeed the fault of the technology in the second provider as over-sensitive by deisgn.

 

There's questions and concern in some communities in particular how SWGFL works when its website -- for a product in use by children -- says re Online Terror Content, "... attempts are proactively monitored with unique links to Police and expert support in an emergency." So when questions are asked and there's no answers offered, it simply builds mistrust, rather than ensuring a sensible, proportionate approach to safeguarding.

 

Parents should have been involved in this DfE policy introduction from the start, and should be at school level, but it's the exception rather than the norm.