Use of VPNs for Student access

[DrummerBoy]

Hi all, for those of you who don;t know me (probably most of you!!) I amd DOS_Box's brother and work for a Fibre AltNet/ISP.

 

Currently the governement is looking to get feedback on the online safety act, and further regulation that ight hit ISPs.  One of the parts they are after feedback on is the use of VPNs, and the potentail to ban VPNs based on age - bascically ban children from using them.

 

So, I thought I'd ask the techie community here around the usage of VPNs to access scholl learning resrouces etc.

 

If you could let me know if and how your particular establishment uses VPNs for students, I can collate this, and it will help ISPA (our trade body) formulate a response back to governemnt.

 

Thanks.

[3s-gtech]

We don't issue offsite devices to students below sixth form here, so had no need to enable to VPN for them (though it's possible in theory). Sixth form student laptops don't need it - they're set up with Entra.

[Rob_D]

We use cloud management and resrouces, so no VPNs here.

[altecsole]

The only issue we have with VPN use is BYOD using them to bypass our web filter. 

[Davit2005]

Surely there is a difference here. Consumer based VPNs vs organizational VPNs.

 

If a student is using a VPN to access services inside a school then they will be likely accessing the Internet through the schools filtering system at that time.

Edited March 3 by Davit2005

[DrummerBoy]

3 minutes ago, Davit2005 said:

Surely there is a difference here. Consumer based VPNs vs organizational VPNs.

 

If a student is using a VPN to access services inside a school then they will be likely accessing the Internet through the schools filtering system at that time.

At the moment, the government doesn't seem to be making a distinction.

[browolf]

does "direct access" count as a vpn?

[dhicks]

1 hour ago, DrummerBoy said:

If you could let me know if and how your particular establishment uses VPNs for students, I can collate this, and it will help ISPA (our trade body) formulate a response back to governemnt.

 

I've not come accross any pupil resources that require a VPN to access, i.e. coming from the school to an outside, external resource.

 

We do offer remote desktop access for pupils and staff, authenticated with their school Google accounts which should satisfy the age-restriction part of things ("this is a pupil account, filter appropriatly"). Filtering is applied at the school side of the connection, so they can access exactly the resources they would be able to from a normal classroom device. Our pupils do travel quite widely (something we noticed in particular over Covid), so in theory a pupil could use our remote desktop to access a resource banned in the country they are in but allowed here, although I don't think I've seen any practical examples of that.

[DrummerBoy]

6 minutes ago, browolf said:

does "direct access" count as a vpn?

I am working on the assumption that any communication path that an ISP can't access to block would come under any rules they are looking at.

[msi_school]

When discussing Laws and their technical interpretation please remember that politicians have less grasp of computing than teaching staff. If it is possible to write a law to make it harder to ensure child safety they will.

[dmj]

 

1 hour ago, DrummerBoy said:

I am working on the assumption that any communication path that an ISP can't access to block would come under any rules they are looking at.

I think they need to define a VPN before they decide to block them. 

An encrypted tunnel to another part of the internet. How do you even go about banning that? put age restriction on TOR? good luck.

[TechMonkey]

Interesting after the news the US government is looking to setup a VPN to allow UK citizens the chance to bypass our crazy censorship.

 

I honestly do not know how a VPN ban is going to work considering at our small scale it is a constant daily, if not hourly, whack a mole of IP addresses, which is based mostly on 365 reports of geo-locations or quick travel hacks. Even then I don't think we are getting them all.  Add in the legitimate uses for business traffic, then it just seems like an uneducated knee jerk.

[sigma]

20 minutes ago, dmj said:

 

I think they need to define a VPN before they decide to block them. 

An encrypted tunnel to another part of the internet. How do you even go about banning that? put age restriction on TOR? good luck.

Try blocking web proxies too.  School internet filering providers who have years of experience struggle with this, and I'm sorry to say, fail dismally, so what chance do ISP's have?

[Rob_D]

13 minutes ago, dmj said:

How do you even go about banning that?

If they're asking the ISPs, I assume it will be the same way some of them tried to block file sharing sites at the behest of the large media corperations. Which I think was done through basic DNS manipulation.

It also begs the question what happens if/when (I think it wasTalkTalk) refuses, like they did with the file sharing sites? 

[Andycat]

2 hours ago, altecsole said:

The only issue we have with VPN use is BYOD using them to bypass our web filter. 

Same

[psydii]

Not at the moment, but I certainly can see a point in time when we might need student devices to use VPN-Like services.

 

Entra Global Secure Access*   is increasingly looking like a VPN  - as do some on-device filtering platforms. (Defender on iOS, which might be gone now,  basically did VPN-like things for web content filtering)

 

Mostly though, VPN use is something the students  are doing on their home computers that caused them to get locked out of 365/Google because they don't have MFA set up because phone are about to be banned in schools so we can't enable it.

 

 

 

 

*Basically ISA 2004 /TMG in the cloud

[DrummerBoy]

1 hour ago, Rob_D said:

If they're asking the ISPs, I assume it will be the same way some of them tried to block file sharing sites at the behest of the large media corperations. Which I think was done through basic DNS manipulation.

It also begs the question what happens if/when (I think it wasTalkTalk) refuses, like they did with the file sharing sites? 

I can answer this!!  The online safety act has a provision inthat Ofcom can go to court, if the end site refuses to play ball, and require (by law) that the ISPs block the site - saying no is not an option then.

[dmj]

1 minute ago, DrummerBoy said:

I can answer this!!  The online safety act has a provision inthat Ofcom can go to court, if the end site refuses to play ball, and require (by law) that the ISPs block the site - saying no is not an option then.

So if an under 18 wants to spin up a server on Azure, GCP or AWS (which uses a VPN by default) ofcom will block them for everyone ?

[DrummerBoy]

5 minutes ago, dmj said:

So if an under 18 wants to spin up a server on Azure, GCP or AWS (which uses a VPN by default) ofcom will block them for everyone ?

Unclear, but that's one possibility.  Or, more accurately, Ofcom would require ISPs to block that IP/Site.

Hence we need all the feedback we can get to go back to Ofcom to point out why this would be a potentially unworkable idea.

[dmj]

5 minutes ago, DrummerBoy said:

Unclear, but that's one possibility.  Or, more accurately, Ofcom would require ISPs to block that IP/Site.

Hence we need all the feedback we can get to go back to Ofcom to point out why this would be a potentially unworkable idea.

I don't think it would be workable, because the way we provision GCP/AWS resources is not done with a company user account, it's using service accounts (and frequently AI agents). The accounts are not always linked to users - so getting employees to verify age isn't an option, therefore I can't see how they would enforce that for children (other than prohibiting them from starting businesses).

Sounds like the workable idea is to enforce the laws that already exist without adding more unenforcable things. 

Edited March 3 by dmj

[sigma]

Noting that its also appropriate for anyone in this commuity to respond to this consultation.

 

You can respond here https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation

 

I really think as many of us should respond as possible.

 

 

[sigma]

12 minutes ago, dmj said:

So if an under 18 wants to spin up a server on Azure, GCP or AWS (which uses a VPN by default) ofcom will block them for everyone ?

 

A few years ago, we had a pupil spin up a home server that they, and a few select classmates used to bypass filtering - until I blocked it.😎

[dmj]

3 minutes ago, sigma said:

 

A few years ago, we had a pupil spin up a home server that they, and a few select classmates used to bypass filtering - until I blocked it.😎

years and years ago, I recall a year 7 did the same thing using his home PC using apache mod_proxy. I think he went on to Stanford or MIT or something. Can't imaging what he's earning now. 

[sigma]

1 minute ago, dmj said:

years and years ago, I recall a year 7 did the same thing using his home PC using apache mod_proxy. I think he went on to Stanford or MIT or something. Can't imaging what he's earning now. 

 

Year7 - impressed.

[Rob_D]

1 hour ago, DrummerBoy said:

Or, more accurately, Ofcom would require ISPs to block that IP/Site.

But according to your OP only for minors?

Which wouldn't be possible. Or they could "technically do it" but it would be meaningless as the only details the ISPs are likely to have are for the main account holder who is (nearly) always going to be an adult.