Discord - Student Hubs

[Theblacksheep]

Still don't understand why you would want to do this.

[paulkerton]

Allowing email addresses to link makes it easier to do what? Not get scammed when trying to find your friends.

 

Your'e not serious. You cannot be serious. Not about this, or evidently your job.

One rogue parent to do what?

 

Hijack the account.

 

I give up. I'm not engaging with you on this any longer, there is no reasoning.

 

[mavhc]

I'm just interested in the massive overreaction to a method of letting kids talk to their friends. Why did you give them an email address at as the school might be blamed for the slightest thing.

 

So the parent is hijacking the student email account? Or the discord account? To do what?

[Garacesh]

I'm just interested in the massive overreaction to a method of letting kids talk to their friends. Why did you give them an email address at as the school might be blamed for the slightest thing.

Because we have to. So many educational resources are online now, plus the fact that if you take GCSE Computing, there's literally a module about e-mail where the kids have to document they know how to use it (though, this can be done with internal-only emails, that helps not for the likes of HegartyMaths, SenecaLearning, etc, that all require active email accounts)

 

So the parent is hijacking the student email account? Or the discord account? To do what?

We've literally had parents take phones off their kids to give abuse to the kid at the other end (even demanding the other kid's parent gets put on the phone). This includes, but is not limited to, threats of violence.

We've had parents pick up their kid at the end of the day, wind down their car window, and hurl abuse at other kids.

 

Never underestimate the capacity of a parent to do things via their kid.

 

Sure, like you say, they have methods to do it anyway. But those methods aren't sanctioned by us. We're not the ones telling kids to do it.

If a kid starts emailing some nonce via a school email account, who's on the hook for it?

If we tell a kid to sign up to a pose reference website for art, and a parent gets nouty because there's nude models on there for figure practice, who's on the hook for it?

If we tell kids to use a 'school' discord and something bad happens, who's on the hook for it?

 

Please do try and keep in mind that most of us have more than 80 kids in our schools, and some of them - and their parents - are right nasty pieces of work sometimes. They can, and will, find any opportunity to abuse something.

 

Then there's the other safeguarding matter of allowing the kids to use discord in school. Well it's a school resource, why should it be blocked in school? Oh, that's why, because there's no way to manage it, safeguard it, or restrict it. A kid could be on the 'school' discord, just as easily as they could be on one of discord's many 18+ communities.

 

How you fail to see the safeguarding concerns of this is beyond my comprehension.

But at this point, I think I'm just playing chess with a pigeon.

[jthompson]

As much as it powers the discovery of kids' school friends, it could be argued that it's also powering malicious activity such as cyberbullying to the same degree. Piggybacking schools' systems to do so. How that benign vs malign balance weighs up is going to be different at Discord HQ compared to schools, where safeguarding is more of a trump card. If Discord want to aid user discovery... fine. If schools want to impede cyberbullying by killswitching Student Hubs in their email systems... fine.

[mavhc]

Because we have to. So many educational resources are online now, plus the fact that if you take GCSE Computing, there's literally a module about e-mail where the kids have to document they know how to use it (though, this can be done with internal-only emails, that helps not for the likes of HegartyMaths, SenecaLearning, etc, that all require active email accounts)

Should have used oauth.

 

Sure, like you say, they have methods to do it anyway. But those methods aren't sanctioned by us. We're not the ones telling kids to do it.

If we tell kids to use a 'school' discord and something bad happens, who's on the hook for it?

 

It's not sanctioned by you, it's not a school discord. You're not telling the kids to do anything.

 

Then there's the other safeguarding matter of allowing the kids to use discord in school. Well it's a school resource, why should it be blocked in school? Oh, that's why, because there's no way to manage it, safeguard it, or restrict it. A kid could be on the 'school' discord

 

It's not a school discord. They're not using it at school. It's not a school resource.

 

Interestingly it would be pretty easy to set up a school discord, have a bot that only allows users with a school email address to join. https://github.com/gg2001/EmailBot

[Garacesh]

So, just curious...

 

If I were to open a, let's say an instagram account, under the name of your school, and start badmouthing your staff, PMing your kids and adding them as friends or following them or whatever it is Instagram calls it, would you not move to shut that down? Would that not be considered a safeguarding risk and something that ought to be dealt with?

 

'cause that's 'not a school resource', right? So nothing to do with your school?

And the kids all use instagram anyway, so it's obviously not a safeguarding risk?

[paulkerton]

So, just curious...

 

Completely agree with what you say but still...

[jthompson]

I think it's quite easy to overthink this, tbh, but I'm still going to keep the blocking rule in place.

 

All that the feature amounts to is some signposting to direct school kids to Discord servers being run by other people who go to their school. That's not something that can't happen by other, less direct means, but what it does do is lower the friction for the spreading of fake accounts, etc. through a school's population of Discord users. It kind of amplifies the reach of a bad actor.

 

The pros for it are pretty marginal, and the cons just about outweigh them imho.

[mavhc]

So, just curious...

 

If I were to open a, let's say an instagram account, under the name of your school, and start badmouthing your staff, PMing your kids and adding them as friends or following them or whatever it is Instagram calls it, would you not move to shut that down? Would that not be considered a safeguarding risk and something that ought to be dealt with?

 

'cause that's 'not a school resource', right? So nothing to do with your school?

And the kids all use instagram anyway, so it's obviously not a safeguarding risk?

 

That would be against the TOS of Instagram.

 

So it's a safeguarding risk to not have Instagram banned from the planet?

 

If I were to start an account on any service doing the same thing. If I buy a domain with your school's name and buy ads so it's at the top of google, even more effective. If only there were a way to ensure that the people using the service were actually from your school, and not someone pretending to be from there....

[Garacesh]

Answer the question, please.

Would that, or would that not, be something you moved to shut down, on the grounds of it being a safeguarding concern?

 

This isn't about a global block of instagram. Nobody is advocating for a global block of Discord.

Your argument seems to boil down to "Well kids are going to use it anyway, so why shouldn't we let them create an unofficial, unaccountable, unmoderated account on the service, using our school name?"

So surely that applies to other services, no? You don't see an issue with an unofficial school Instagram, facebook, snapchat, TikTok, etc account, being leveraged to interact with minors under the guise of some fake legitimacy-by-association?

 

Or are they a safeguarding risk but somehow Discord isn't?

 

Just trying to understand your position here. Help me out, bud

[jthompson]

It might be useful at this point to see some real world examples of the feature in action, if anybody is able to share some? Like, to what extent is a school name or domain name displayed, if at all?

 

It's the sort of feature that could realistically start appearing on other social platforms, too, so it'd be worth getting a proper understanding of it.

Edited November 10, 2021 by jthompson

[Ironside]

"It's not a school discord. They're not using it at school. It's not a school resource."

It's a discord server that is accessed through school email systems that provides unregulated, unmoderated and unsafeguarded communications between pupils and anyone who joins the server.

 

If the school email system is used to facilitate joining a chat that gets used for bullying or safeguarding incidents, then that's absolutely our problem and we ought to stop it - not just because it could be seen as endorsed by us if we don't stop it, but also because we as IT need to act PROACTIVELY to prevent safeguarding failures.

 

It's not the same as kids making their own server and exposing themselves to harm as a result of their own private actions with their own emails because it involves our infrastructure and could be seen as our responsibility when fingers get pointed. Not worth the risk.

 

Block the emails, block the website, call it a job done right.

[Garacesh]

It might be useful at this point to see some real world examples of the feature in action, if anybody is able to share some? Like, to what extent is a school name or domain name displayed, if at all?

 

It's the sort of feature that could realistically start appearing on other social platforms, too, so it'd be worth getting a proper understanding of it.

Completely agree - that's why I started the process last night as my test pupil account, and got back that there was no school hub for my school 'yet' and they would email me when one was set up.

So far nothing new has arrived in the inbox.

 

If anybody is further along in the process, their input would be appreciated.

[mavhc]

Would that, or would that not, be something you moved to shut down, on the grounds of it being a safeguarding concern?

 

I'll pick Yes.

 

> "Well kids are going to use it anyway, so why shouldn't we let them create an unofficial, unaccountable, unmoderated account on the service, using our school name?"

 

That's the thing, it's not that, it's just confirming their normal account is part of School X. There's no way for users to see that another user is in their school, or any other school.

 

> So surely that applies to other services, no? You don't see an issue with an unofficial school Instagram, facebook, snapchat, TikTok, etc account, being leveraged to interact with minors under the guise of some fake legitimacy-by-association?

 

But that's the opposite thing, it's an unconfirmed account. That would already happen on Discord, then they made a system to improve the authentication.

 

> Or are they a safeguarding risk but somehow Discord isn't?

 

Everything is a safeguarding risk, and one reason for risk is unconfirmed accounts. If I'm asked by MineCraftPlayer1004 if they can join my server because they know me, there's either a 1 in 8 billion chance they're who they say they are, or a 1 in 800 if I tell them my server invite url is on the school hub. That's a 10 million times risk reduction by doing nothing as the school admin.

 

> Just trying to understand your position here. Help me out, bud

 

Of course, can't dig deep into the question if there's no back and forth.

[Garacesh]

I'll pick Yes.

So why shouldn't we want to shut down unofficial discord servers as a safeguarding risk, then?

I just can't get my head around why one is a problem but the other isn't?

 

> "Well kids are going to use it anyway, so why shouldn't we let them create an unofficial, unaccountable, unmoderated account on the service, using our school name?"

That's the thing, it's not that, it's just confirming their normal account is part of School X. There's no way for users to see that another user is in their school, or any other school.

It is that, though. That's exactly what it is. It's letting a pupil (or, if I had to guess, whoever gets to the hub option first? But I'm not entirely sure, I think I've seen there can be multiple hubs per school, too, for like different subjects/clubs/etc) create an unofficial, unaccountable, and unmoderated server that is directly tied to the school via use of the school e-mail address.

Now you know that just because it's tied to the school email address, that doesn't make it official.

I know that just because it's tied to the school email address, that doesn't make it official.

But kids? Parents? People that aren't quite up-to-date with technology, or who haven't dove in to how exactly discord hubs work? They're not going to make that distinction. They're going to assume it is official. It's linked to the school email/domain. Why wouldn't it be official? Why wouldn't we have a hand in this?

Admittedly, that one isn't really our fault. Instead, it's an incredibly short-sighted, stupid, and quite frankly potentially dangerous decision on Discord's part, and I cannot understand why they've done it this way. It would be trivial to have schools that wanted to use this as a feature to have to create one via an admin@, security@ etc email address, aliases which I'd expect most network managers to have already. The fact that they've given no thought to moderation baffles me.

 

> So surely that applies to other services, no? You don't see an issue with an unofficial school Instagram, facebook, snapchat, TikTok, etc account, being leveraged to interact with minors under the guise of some fake legitimacy-by-association?

But that's the opposite thing, it's an unconfirmed account. That would already happen on Discord, then they made a system to improve the authentication.

Sorry, please clarify. What's unconfirmed?

The kid's Discord account? Why would it be unconfirmed? In your scenario, it appears you're completely happy to allow the emails from discord to reach the pupil's school inbox, and for them to confirm their account. I mean feel free to correct me if I'm wrong, but the way you're presenting your argument doesn't really make me think you're in favour of interrupting this process in any way.

The server is unconfirmed? I honestly don't think that matters. It's still tied to the school domain. People are going to think it's official no matter what we say. Hence the assumed (and false) legitimacy-by-association I previously mentioned.

 

> Or are they a safeguarding risk but somehow Discord isn't?

Everything is a safeguarding risk, and one reason for risk is unconfirmed accounts. If I'm asked by MineCraftPlayer1004 if they can join my server because they know me, there's either a 1 in 8 billion chance they're who they say they are, or a 1 in 800 if I tell them my server invite url is on the school hub. That's a 10 million times risk reduction by doing nothing as the school admin.

I'm not really convinced that impersonation is that big of a deal, I'll agree with you there. I don't think there's particularly a risk of a pupil adding John F. Rando on Discord under the false presumption that they're part of the same school. The problem is that the hubs are unmoderated, so they could be sharing anything from maths homework to pornography (which we know Discord allows, as long as it doesn't depict minors). Again, yes, they could be doing that on their own private servers, I completely agree. But again this ties back to the false legitimacy-by-association that comes with tying a hub/server directly to the school domain/email addresses.

Additionally, can you send an invite to a hub to other accounts that don't exist on that domain? Given how open discord's platform is, and its significant bot integration options, I'd expect you can.

Does the hub provide some kind of user access control, or is it just essentially a server list that matches a domain to a server?

I have no idea. Do you?

[LukeRowberry]

This is going to be a typical Mav thread where it goes to 25 pages and still not getting anywhere....

[Garacesh]

Slow day. I'm on 1st-line stuff because my tech is off ill. I got the time

[jthompson]

know that just because it's tied to the school email address, that doesn't make it official.

But kids? Parents? People that aren't quite up-to-date with technology, or who haven't dove in to how exactly discord hubs work? They're not going to make that distinction. They're going to assume it is official. It's linked to the school email/domain. Why wouldn't it be official? Why wouldn't we have a hand in this?

 

I think on this point, it really does come down to how things are actually being presented by the feature, and to what degree the school name or domain is attached to things. It could well be that there's absolutely no kind of green tick style "Verified for My School" badges getting applied to servers/users, which would go some way to avoiding an assumption that the school is actively involved.

[mavhc]

It's not one server that's the "official" school server, it's a list of servers that students run, that they've chosen to add to the list. And the list can only be seen by people with school email accounts. That's all it is.

 

Question is, what's the job, increase the safety of students, or make sure the school can't be blamed for anything?

 

Given that so many people are assuming it's something it's not, a proper decision can't be made.

 

And it's annoying that "ban it!" is the first response, before "understand what it is!"

[TechMonkey]

Wouldn't restricting access until there is more information be the prudent thing to do then, to increase the safety of students?

[Garacesh]

It's not one server that's the "official" school server, it's a list of servers that students run, that they've chosen to add to the list. And the list can only be seen by people with school email accounts. That's all it is.

So it's a series of unmoderated chat rooms.

And you fail to see why this is a cause for concern? Note that I said cause for concern and not a cast-iron guarantee that the planet is going to explode.

 

And it's annoying that "ban it!" is the first response, before "understand what it is!"

I feel like even though we don't have some of the information (e.g. can you invite a non-school user to a school hub server?) we know enough to reasonably decide "block it", given the prevalence of cyberbullying these days and a basic working knowledge of how some kids utilise digital communication software. Unfortunately yes, this is a case - as it often is - of a few bad apples, there are absolutely benefits to the idea of a school chat, but we still have a duty to safeguard, and unless we as a school can moderate the spaces being used, we cannot justifiably encourage use of that space. Which means we must, by design, discourage use of that space by placing roadblocks in the way.

 

And even if you've got the nicest kids in the world, with every single one of them literally having a harp, halo, and glowing celestial wings, we also know that Discord is A-OK with having 18+/NSFW content on their platform, therefore on that rule alone, it is inappropriate for school use (and as such emails from Discord to pupil accounts should be blocked)

[TechMonkey]

An alternate view, our policy states school emails are to be used for academic work, not personal use. Discord is not an educational resource so not appropriate use of a school email.

[paulkerton]

At it's very basic:

• Discord are allowing students to manage their own chat rooms, under their school's name without school interaction
  
• Discord are allowing students to advertise chat servers to each other that won't just contain students, but anyone from anywhere
  
• Discord already have a very lax attitude towards adult content
  
• Discord are profiling students and using school domain email addresses to collate registers of students and their location/school
  

 

Just those four points alone are enough for me to put the blocks on Discord doing this for our schools in any way I can.

[mavhc]

There is no school hub server, so you can't invite anyone to it.

 

There's 1000s of discord servers for studying, sounds educational to me

 

I've banned search engines as they contain adult content, and other people, and things with your school name in that aren't run by your school, and they profile you.

 

And blocking emails from discord to school will in no way will stop anyone using it.