Discord - Student Hubs

[networkmangler]

I have just been made aware of and been asked for advice about discord student hubs

 

I'm not a discord user but student hubs it looks like it's a way of having a school specific group. You can only sign up to your schools group if you have a school domain email address

 

I checked and it said a group hasn't been setup for my school yet. I have added an email address to the waiting list so should know if/when one is created

 

I had a quick conversation with the deputy head, he said he will discuss it with SLT but essentially he was thinking of 2 potential options

 

1. Let student's sign up but try to police it our self. Either using prefects or possibly staff

2. I black list the discord domain in Office365 so that any verification emails get blocked. Which essentially means students can't sign up for it assuming a verification email is required

 

Has anyone got any thoughts on it? or have plans to block/allow?

[mavhc]

I don't think it's available in the UK yet. It's just a list of servers that students in your school use really, nothing that couldn't be done on a random website someone writes, handy part is it means they're just advertised to known students, not everyone on the internet.

[jthompson]

Not a Discord user myself, but thinking here about the possible abuse of this. Reading the Disocrd FAQs on it, It seems like it's basically a way of bulk discovering Discord servers (and therefore accounts?) of students at a particular school. Whilst there may be some utility to that, I'm wondering about the following:

• Could this make student and staff email accounts more attractive to attackers wanting to pose as children online?
  
• Would schools have a bit of a PR job to do to make clear that they have no oversight whatsoever of the feature (particulary when it comes to students' conduct online)?
  
• What would Discord consider to be a verified school account, given that staff and students all eventually leave the school? How might an email address be unverified on Discord?
  
• How would Discord determine the official domain for a given school, and would that inherently involve some degree of opt-in by the school?
  

 

I expect it'll be based on a simple verification link in an email, so hopefully blocking delivery of those emails would be a way to unilaterally disable the feature for a school.

 

Again, not that familiar with the platform, but wouldn't be doing my job if I wasn't overthinking this stuff.

[mavhc]

I assume they'll accept .edu, .sch.uk etc. Does it matter what the official domain is?

 

You could force people to verify every year.

[jthompson]

I assume they'll accept .edu, .sch.uk etc. Does it matter what the official domain is?

 

I suppose not. The de facto domain will only be what the Discord users themselves will be reporting it as.

[jthompson]

I signed up, and its discord.com that verification mails come from.

 

So, all discord.com emails are now blocked from our students. Instantly rejected.

 

Yeah, I took a punt that it would be discord.com, and checking now I can see a number of verification emails in our quarantine, as planned. Do you happen to know if the school hub verification emails (as opposed to just regular accont sign-ups) also come from discord.com?

[paulkerton]

Yeah, I took a punt that it would be discord.com, and checking now I can see a number of verification emails in our quarantine, as planned. Do you happen to know if the school hub verification emails (as opposed to just regular accont sign-ups) also come from discord.com?

 

I don't, but I can't see why a sign-up verification email would come from a different domain for the student hub compared to a standard sign-up!

[mavhc]

Let's make it harder for our pupils to find their actual friends and more easy for them to be scammed, excellent

[jthompson]

What would be the scamming risk of doing this?

[paulkerton]

Let's make it harder for our pupils to find their actual friends and more easy for them to be scammed, excellent

 

Let's make it easy for our pupils to find each other on an unregulated system that deliberately takes advantage of school systems but excludes the schools and make it more easy for them to cyber bully each other and bring those issues into school with them, excellent.

 

What would be the scamming risk of doing this?

There wouldn't be. mavhc is a contrarian.

[mavhc]

They're already on discord, they want to talk to their friends, correct?

 

So how do they find their friends? These are people who probably don't have their own email addresses/have 16 they can't remember, so that's no use. They'll believe anyone who says they're at the school as they have no way, until now, of verifying.

 

"Hey, you go to X school, right? me too, join my server, full of totally real people who also go to your actual school"

[Ironside]

They're already on discord, they want to talk to their friends, correct?

 

So how do they find their friends? These are people who probably don't have their own email addresses/have 16 they can't remember, so that's no use. They'll believe anyone who says they're at the school as they have no way, until now, of verifying.

 

"Hey, you go to X school, right? me too, join my server, full of totally real people who also go to your actual school"

 

Counter-points:

 

1: Running a Discord Student Hub is a safeguarding and moderation task we don't need to deal with

 

2: They'll talk to their friends in person and ask them for their discord username, not just ask random people on the internet who say they're from that school, how do you think students add eachother on snapgram messenger or whatever they're using

 

3: That's an esafety and basic intelligence issue that needs to be handled by teachers, not us.

[paulkerton]

They're already on discord, they want to talk to their friends, correct?

 

So how do they find their friends? These are people who probably don't have their own email addresses/have 16 they can't remember, so that's no use. They'll believe anyone who says they're at the school as they have no way, until now, of verifying.

 

"Hey, you go to X school, right? me too, join my server, full of totally real people who also go to your actual school"

 

They need a personal email address to set up a Discord.

 

Sorry, but I don't think its for schools to facilitate Discord bringing student groups together.

 

We already have enough issues with WhatsApp/Xbox/PS communications being brought into schools - We don't need more platforms allowing students to create issues, especially with Discord are specifically excluding schools from being part of this, but want to piggy back on our existing systems to bring these communities together.

 

If you genuinely believe "They'll believe anyone who says they're at the school as they have no way, until now, of verifying" when they... you know... actually speak to each other in person and on other platforms, then I'm genuinely surprised.

 

We're not letting Discord essentially use our platform as their member verification tool for a system that creates safeguarding and behavioural issues. No way, no how.

Edited November 9, 2021 by paulkerton

[jthompson]

They're already on discord, they want to talk to their friends, correct?

 

So how do they find their friends? These are people who probably don't have their own email addresses/have 16 they can't remember, so that's no use. They'll believe anyone who says they're at the school as they have no way, until now, of verifying.

 

"Hey, you go to X school, right? me too, join my server, full of totally real people who also go to your actual school"

 

I do get your point, but for me, I'd still rather not have school systems invovled. At least not until there's a clearer picture of how the feature actually works. Verifying a school address might only tell other Discord users that you are a school account holder, but would it verify which account holder? [it might, but I don't know]. That right there could be an opportunity to scam/bully/defame someone, too, but facilitated by school systems. Since we can't vouch for the integrity of Discord accounts, we ought to be able to opt out of having Discord borrow our integrity in this way.

 

Edit: hoping this isn't coming over as a pile-on. I think it's an interesting discussion.

Edited November 9, 2021 by jthompson

[Garacesh]

I know Discord really tried to pitch in at the start of the pandemic and whilst I do agree it's a noble pursuit, I would be heavily against this idea.

As an organisation with a duty to safeguard, we should not be encouraging the students to use any communication service we don't have control over.

 

Take G Suite for example. All our pupils here sign an agreement and get a G Suite account as part of their enrolment. But if a kid decides to 'PM' (read: email, we have Hangouts or whatever it's called now disabled) another kid, I can pull that email via Vault even if it's been deleted by all parties. With Discord there's not really any management. Sure, you can manage a server, but not the platform itself. If a pupil decides to PM another pupil, we got nothin'. Can we even prove who owns what username, given that you can change your discord ID at will? Not to mention the issue of sharing links and/or images.

 

Sure, there are a few proactive steps.. You can tell kids to restrict their messaging to friends only, for example, but with discord being so huge for gaming who's going to do that? You can set roles on a server that don't allow posting images or gifs, or generating that little URL preview, but that only goes so far. And of course, you've got the human moderation element. Live chat moves a lot quicker than email does. What if your mods are all offline?

 

Speaking of mods, who's going to moderate it? I sure as hell wouldn't want to, I already use discord in both a personal capacity. I don't want that bleedover. Is the school going to start buying new phones and contracts that always have data so their staff can always moderate it from a different account, since Discord doesn't have a multi-user mode? Unlikely.

 

It is an interesting topic, and with a bit more thought it might actually be useful, but I see the risks far outweighing the benefits for kids our age. Maybe for university students, go for it. But high school? No way.

[Boredguy]

Also do remember that Discord is a US company so safeguarding considerations are a bit different, but it is kind of a pointless feature

[mavhc]

It's not a school server, it's a list of servers that you can ensure people at your school use, anyone could put up a website with that same list, but this is a list that only authenticated people can see.

 

You only need an email address for some functions.

 

If kids aren't being tricked into talking to strangers online, why are we panicking about kids talking to strangers online?

 

They're already on Discord, you can't stop them communicating.

 

In what way are they excluding schools?

 

The impersonate someone at school is interesting: Be Y, Sign up as X, use Y to authenticate. But I don't think the system would show a user as being from School A, the other thing is does is let them see the webpage containing a list of servers pupils want other pupils at that school to join.

[paulkerton]

It's not a school server, it's a list of servers that you can ensure people at your school use

Incorrect. It's a list of servers created by your students, that your students can advertise to each other. Schools are not involved in the slightest, and the severs could include people who are not from your school.

You only need an email address for some functions.

Like creating an account.

If kids aren't being tricked into talking to strangers online, why are we panicking about kids talking to strangers online?

They're not being tricked into talking to people pretending to be from their school, and this system doesn't limit them to talking to just people from your school.

They're already on Discord, you can't stop them communicating.

No, but you shouldn't enable them either.

 

In what way are they excluding schools?

https://support.discord.com/hc/en-us/articles/4406046651927-Discord-Student-Hubs-FAQ

 

Is this a Discord partnership with high schools/colleges? Hubs are not officially affiliated with or managed by schools. A Student Hub is a collection of student-run servers. The Hub’s function is to make it easier for classmates to find and join one another’s servers if they choose to do so.

The impersonate someone at school is interesting: Be Y, Sign up as X, use Y to authenticate. But I don't think the system would show a user as being from School A, the other thing is does is let them see the webpage containing a list of servers pupils want other pupils at that school to join.

One disgruntled or alterior motive driven parent hijacked account later...

[jthompson]

Students may want to chat with their school friends online, fine, but they may not feel comfortable with the price of that being discoverability of their Discord account by 1000+ people from meatspace. And all of their teachers.

 

Again, it might not actually work in the ways that I'm assuming, but I don't know.

Edited November 9, 2021 by jthompson

[mavhc]

AFAICS if you authenticate your email you get to see the list, and add servers to the list.

 

> It's a list of servers created by your students, that your students can advertise to each other. Schools are not involved in the slightest, and the severs could include people who are not from your school.

 

It's exactly the same as someone putting up a website saying "I'm a child from school X, If you're from school X, join our server", except only people from your school can see it.

 

You only need email to claim your account, could just make a new random account every time if you wanted.

 

> They're not being tricked into talking to people pretending to be from their school, and this system doesn't limit them to talking to just people from your school.

 

Yes, it's Discord, it's for talking with lots of people.

 

But they'll only be doing this if they already have Discord.

 

They're not excluding schools, you can sign in as an adult.

[paulkerton]

AFAICS if you authenticate your email you get to see the list, and add servers to the list.

You seem to be ignoring that the server isn't school exclusive, and it can be any server from anywhere in the world.

 

> It's a list of servers created by your students, that your students can advertise to each other. Schools are not involved in the slightest, and the severs could include people who are not from your school

It's exactly the same as someone putting up a website saying "I'm a child from school X, If you're from school X, join our server", except only people from your school can see it.

 

OK... Great. So what you're saying is, we should let Discord harvest our student emails because they might use a third party service to do this anyway, so let's allow a multimillion dollar corporation collate the children together and allow them to advertise servers across the student body, filled with people who aren't, in a much easier and simpler way.

 

Do you realise this argument isn't the slam dunk you think it is, don't you? "They're going to do it anyway...."

 

You only need email to claim your account, could just make a new random account every time if you wanted.

Which would require you to use an email to sign up.

Yes, it's Discord, it's for talking with lots of people.

So let's facilitate this by essentially creating a school membership list on their behalf.

 

But they'll only be doing this if they already have Discord.

Yes, but schools shouldn't be facilitating this, which is what allowing this will do.

They're not excluding schools, you can sign in as an adult.

 

So another safeguarding matter where teachers can communicate with pupils through systems we can't audit. Fantastic. Just what we need to protect kids eh?

 

Even better, the server owners are responsible, so the kids will just kick the staff out. Fab. Great system this is.

 

Once again

https://support.discord.com/hc/en-us/articles/4407546283031-Discord-Student-Hubs-Guidelines

NOTE TO ALL HUB MEMBERS

 

Please be mindful that:

 

• Hubs are not affiliated with or managed by a school or school staff.
  
• Servers in a Hub are student-run but may include non-students.
  

NOTE TO SERVER OWNERS AND MODERATORS OF SERVERS IN A HUB

 

Server owners and moderators are responsible and accountable for their server's affiliation in a Student Hub.

Edited November 9, 2021 by paulkerton

[Ironside]

A student run discussion channel that Safeguarding can't moderate or audit without student cooperation that can also result in inappropriate discussions between adults and children if the students running the server let it happen, and it can be tied to school emails. Or we can just block all emails from Discord and nip this safeguarding catastrophe waiting to happen in the bud.

[mavhc]

But it's already happening, you're just ignoring the fact that is it.

 

Do you think your pupils don't have their own servers where they hang out and get into trouble already?

 

> You seem to be ignoring that the server isn't school exclusive, and it can be any server from anywhere in the world.

 

It's not a server, that's the point, it's a list of servers.

[paulkerton]

But it's already happening, you're just ignoring the fact that is it.

But once again, we're not facilitating it. Allowing those email addresses to link makes it easier.

It's not a server, that's the point, it's a list of servers.

Yes, a list of servers, lots I'm sure ran by the kids who'll instantly ban any staff looking accounts and containing people from all walks of life, everywhere... and all it will take is one rogue parent to take over an account.

And not even that. If a kid creates a list on their own steam, then there isn't anything we can do about that. We can stop them autocollating them and advertising them to everyone within the same school domain.

Edited November 9, 2021 by paulkerton

[mavhc]

But once again, we're not facilitating it. Allowing those email addresses to link makes it easier.

 

Yes, ran by the kids and containing people from all walks of life, everywhere... and all it will take is one rogue parent.

 

Allowing email addresses to link makes it easier to do what? Not get scammed when trying to find your friends.

 

One rogue parent to do what?