Privacy folk raise alarm over schools snooping on kids' online habits

[mthomas08]

Sigh......

"46 per cent saying they were not offered a choice about the use of web monitoring technologies".

 

So does that mean I have to go through parents instead the usual 3 quotations to Governors?

 

They have any idea how many staff we've had to fight over the years to get a good filtering system in place? (you know.. those staff who think kids should have unfiltered access because they are all little darling angels)

Do they realise that they've no idea how these systems work and if I attempted to explain.. they'd be asleep in 5 minutes?

Are we going to have systems based on IT illiterate people instead of what we believe? It's like ignoring a mechanic to what breaks to have for your car.. sure cardboard ones will do because it's my choice..

 

"When asked what information they should have, 84 per cent of parents said they should be informed of which keywords are flagged. Some 69 per cent also said they thought the kids should know what the keywords were."

Here you go.. here is a list of all the keywords we have filtered.. oh *sends it to the students too*..I look forward to the kids not using those words more often... because again.. they are angels..

 

"Most parents (86 per cent) said they wanted to be told what the consequences were if the keywords are searched, and the same proportion felt the children should know too."

They do.. it's in the AUP which is part of the parent package and the first IT lessons students get covered this.. I would also assume every school had something similar..

 

"She also voiced concern about the effect web monitoring might have on childrens' willingness or ability to use "vital" advice sites like Childline."

Not got a clue have they? I've yet to see a single school block educational or helpline websites. In fact most if not all will have them setup 'allowed'..

So in simple terms they've not looked at filtering systems, not sat down and discussed with some one in IT who manages the system..

 

"CCTV in toilets is ludicrous," said Oladuti. "If your toilet is in such a state you need surveillance, I think you need to redesign your toilet."

 

We did that.. and they still got trashed.. try working in schools with some difficult children... how do you make a toilet that's bomb (child) proof..

[jenatddm]

Another thing, regarding transparency - schools are in a constant state of keeping up with their pupils as they find new things to injure themselves with online. What level of transparency would be wanted regarding monitoring? There was a mention of the list of keywords that are monitored. This list changes day to day, week to week. Should we keep the list up to date and published for parents to see? All that'd do is make it more difficult to keep up with pupils - they'd just use different words, making our duty of care more difficult to perform.

 

What about solutions which use URL block lists (we use one, and when kids go to the listed sites, they get flagged)? Do we list those too? Including the ones marked as extremist or terror related?

 

Filtering and blocking are very different from monitoring, screen content storage, web cam control. How much time are pupils unsupervised by staff -- it sounds like it's a lot, perhaps more than parents would expect.

 

What should be transparent is in the web monitoring at very least is the process, how what works, why, and what the consequences are. "If you search for this type of content, we will know and you'll be in front of a panel to explain yourself." The chilling effect on health related searches and teen issues is real, and familiar in any surveillance culture.

 

Where do you draw the line what school can do in the name of safeguarding, and have no parental objection allowed? Some have active webcam use. Some have home use. Some have most hits in the summer holidays.

[synaesthesia]

Again that's not technological, that's procedural/policy issues at work. Many of the systems used carry out all of those jobs so it's difficult to separate them. It's not the system at fault, or the type of system, it's how the staff use them. No computer system in the world will be able to apply context to a google search, which is where the human element comes in. If people rely 100% on technology to do that job, those people are actively failing their pupils and parents.

[djrscally]

some schools add content filtering for kids when they are at home too, we do.

 

How is this even achievable? I would die laughing if my kid's school asked to install some kind of filter on my home network. How do you persuade the parents to let you do it?

[jenatddm]

God knows we've tried. Every provider has refused to date, to have transparent discussions or reply to questions. Anyone welcome to PM me if you would be happy to write a paragraph for report how it does at your school because everyone we have asked are not talking about it. (And wearing my parent hat, so has my child's secondary school. It's not explained at all in the parent-child-school agreement. all it said is "I understand my Internet use will be monitored." (By staff? By a system? How - I asked, and have asked twice since in 18 months, still nothing.) The point is exactly this -- parents shouldn't have to "sit down and discuss with some one in IT" over a IT used in schools, and you shouldn't have to be in that position either. Policy and consequences should be public to access, easy to read, on a school website. Transparent to the person involved as both current Data Protection law and GDPR require, and most schools fail to meet.

[jenatddm]

How is this even achievable? I would die laughing if my kid's school asked to install some kind of filter on my home network. How do you persuade the parents to let you do it?

 

Some schools say home access is possible (can be required for homework) to the school network. Some install on BYOD. Not everyone limits to school network at least according to what schools have told us via FOI.

[localzuk]

Filtering and blocking are very different from monitoring

 

See, that simply isn't true. We monitor student web access via their block hits - ie. they get flagged if they go to a website that is on the extremism block list. This is just more proof that you are trying to blame technology that you don't fully understand.

 

screen content storage, web cam control. How much time are pupils unsupervised by staff -- it sounds like it's a lot, perhaps more than parents would expect.

What should be transparent is in the web monitoring at very least is the process, how what works, why, and what the consequences are. "If you search for this type of content, we will know and you'll be in front of a panel to explain yourself." The chilling effect on health related searches and teen issues is real, and familiar in any surveillance culture.

 

All schools have an eSafety policy, and a related acceptable use policy. They also usually have a home/parent agreement. This sort of thing is available there. I fear that a lot of the respondents of the survey simply didn't ask, or look, for these things. Put it this way - when we have run parents eSafety meetings, we have been able to count the number of parents who turn up on one hand.

Where do you draw the line what school can do in the name of safeguarding, and have no parental objection allowed? Some have active webcam use. Some have home use. Some have most hits in the summer holidays.

Don't want your child's device being monitored? Don't let them take it into school.

[djrscally]

Some schools say home access is possible (can be required for homework) to the school network. Some install on BYOD. Not everyone limits to school network at least according to what schools have told us via FOI.

 

Well connecting to the network is ok. I find it mad that they actually install something onto the kid's devices though.

[localzuk]

With the parents who responded - how many of those parents have visited https://www.saferinternet.org.uk, and looked at the information available there?

[LeMarchand]

Well connecting to the network is ok. I find it mad that they actually install something onto the kid's devices though.

 

I'd imagine that there are some schools that provide one to one devices for home use and would think that logging in to (say) Google with your "school" credentials would put you under some sort of monitoring whilst logged in. Also using a phone to access school/work emails seems to give the school/employer ridiculous rights to the device which appears to be the way O365 and GMail are set up. I use the web versions on the rare occasions I check my mail out of work!

[synaesthesia]

Also using a phone to access school/work emails seems to give the school/employer ridiculous rights to the device which appears to be the way O365 and GMail are set up. I use the web versions on the rare occasions I check my mail out of work!

 

This is something I'm looking at currently. On one hand it's great, but original assumptions were always "it'll delete the relevant data from your device". However the more we read the warnings when setting up the accounts it does make it quite clear that it's the *entire* device that gets wiped. Doesn't seem right. It's great from data protection point of view, and on work related devices absolutely; but like many of us here we have emails on personal devices. Worrying indeed! Not even education specific, that's just par for the course with 365/Gmail.

[jenatddm]

See, that simply isn't true **for your system provider**. (Bloxx and eSafe are different for example). Filtering, blocking and monitoring technologies can be combined. But they need not be.

 

Being prevented from fully understanding is precisely part of the problem. Having discussed or with FOI responses from 220 schools I agree it's a small sample, but many have no policy even if they think they do, having seen them. (Aside, my own child's secondary school agreement, just says "we monitor Internet use." That's not a policy or DPA compliant).

 

Our goal is to bring consistent, clear processes into the public domain, to help schools who struggle with this, staff who have concerns, communities who feel discriminated against, to ensure trust in the technology and the processes. If your school is already there, that's great. Many are not. It would be great to include your thoughts as a paragraph how this is done well and why, in our report if you wnat to contribute a positive view to aspire to.

[djrscally]

This is something I'm looking at currently. On one hand it's great, but original assumptions were always "it'll delete the relevant data from your device". However the more we read the warnings when setting up the accounts it does make it quite clear that it's the *entire* device that gets wiped. Doesn't seem right. It's great from data protection point of view, and on work related devices absolutely; but like many of us here we have emails on personal devices. Worrying indeed! Not even education specific, that's just par for the course with 365/Gmail.

 

Yeah they wipe everything. Although if the user installs the Microsoft Outlook App, you can then selectively wipe just account data...it doesn't work on downloaded files and stuff though.

 

I'd imagine that there are some schools that provide one to one devices for home use and would think that logging in to (say) Google with your "school" credentials would put you under some sort of monitoring whilst logged in. Also using a phone to access school/work emails seems to give the school/employer ridiculous rights to the device which appears to be the way O365 and GMail are set up. I use the web versions on the rare occasions I check my mail out of work!

 

I too just go through the browser now.

[synaesthesia]

Things change, often. Policies can't change that often as they have to go through several steps before they're ratified. Maybe they need to say more than "we monitor use" but you can't go into too much detail; one year the school could be using one product, then next something entirely different.

[jenatddm]

With the parents who responded - how many of those parents have visited https://www.saferinternet.org.uk, and looked at the information available there?

Can't see anything there that is obvious how filtering and monitoring work, but perhaps I'm missing it? [schools are the data controllers, so we need a consistent communication approach across UK form each school; but I agree it's a good site so in addition to school level, perhaps together we could get a good simple explanation written and ask SI.org.uk to post it on their site?]

[localzuk]

Being prevented from fully understanding is precisely part of the problem. Having discussed or with FOI responses from 220 schools I agree it's a small sample, but many have no policy even if they think they do, having seen them. (Aside, my own child's secondary school agreement, just says "we monitor Internet use." That's not a policy or DPA compliant).

 

As I said before, how many of the parents who replied earlier have actually tried getting the answers they wish they have? Many things in schools are driven by demand (as, quite frankly, we all have better things to be getting on with than writing yet more policy documents), so they might not have formalised what they do simply because no-one has ever asked about it.

Our goal is to bring consistent, clear processes into the public domain, to help schools who struggle with this, staff who have concerns, communities who feel discriminated against, to ensure trust in the technology and the processes. If your school is already there, that's great. Many are not. It would be great to include your thoughts as a paragraph how this is done well and why, in our report if you wnat to contribute a positive view to aspire to.[/Quote]

You're wanting consistency in a inconsistent world. There isn't central guidance on half of what schools do, so why focus on this one aspect? People don't distrust technology until someone starts creating things like this PDF and waving their arms with statements like "CCTV in toilets is ludicrous," said Oladuti. "If your toilet is in such a state you need surveillance, I think you need to redesign your toilet.".

 

- - - Updated - - -

 

Can't see anything there that is obvious how filtering and monitoring work, but perhaps I'm missing it? [schools are the data controllers, so we need a consistent communication approach across UK form each school; but I agree it's a good site so in addition to school level, perhaps together we could get a good simple explanation written and ask SI.org.uk to post it on their site?]

https://www.saferinternet.org.uk/advice-centre/teachers-and-school-staff/appropriate-filtering-and-monitoring

[jenatddm]

As I said before, how many of the parents who replied earlier have actually tried getting the answers they wish they have? Many things in schools are driven by demand (as, quite frankly, we all have better things to be getting on with than writing yet more policy documents), so they might not have formalised what they do simply because no-one has ever asked about it.

 

You're wanting consistency in a inconsistent world. There isn't central guidance on half of what schools do, so why focus on this one aspect? People don't distrust technology until someone starts creating things like this PDF and waving their arms with statements like "CCTV in toilets is ludicrous," said Oladuti. "If your toilet is in such a state you need surveillance, I think you need to redesign your toilet.".

 

- - - Updated - - -

 

https://www.saferinternet.org.uk/advice-centre/teachers-and-school-staff/appropriate-filtering-and-monitoring

 

Thanks for the link. "People don't distrust technology until someone starts creating things like this PDF and waving their arms", is not the upset and harm that many children and families experience unfortunately. You don't see it as an issue as it's not been brought to your door perhaps, but that doesn't mean it doesn't exist. I'm glad that for you they do not. Do contribute if you want to write something (even if anon) for report. PM open.

[Garacesh]

Also using a phone to access school/work emails seems to give the school/employer ridiculous rights to the device which appears to be the way O365 and GMail are set up. I use the web versions on the rare occasions I check my mail out of work!

If I might, as someone that's set up G Suite for the school, this is unfortunately a necessary evil.

 

One assumes that if you're using it for work, it's going to have access to sensitive information. That might be pupil medical information, information about home issues, potential safeguarding stuff, etc. The admin permissions allow for the account to be removed from the device remotely, or, should the worst be feared, the device wiped entirely. The admin permissions also mean you can force some kind of lockscreen, which just adds another layer of security between any potential miscreant and the data.

 

I would agree that the all-or-nothing approach is a little bit excessive, though. I think the permissions for a full wipe and for account removal ought to be separate, personally, but there isn't an option for anything more granular. Because it's all-or-nothing their end, we have no choice. We have to go with the 'all' choice.

Edited March 19, 2018 by Garacesh

[Ditto]

My own child's secondary school is just one school, but my own experience is it has refused point blank to explain to me how this works which we asked when we were given the agreement to sign, we asked what it was we were being asked to agree to. We're still waiting over a year on. The primary simply has never mentioned that they monitor and there is no agreement, but know that they do as well."

 

Going back a little in the thread; Have you approached the Governing bodies? I'm against overuse of FOI requests, but would that be an option?