USB Pen Drives

[westleya]

Just had an incident here that's left me wondering...

 

A member of our teaching staff has just demanded that a pupil hand over his own USB drive, suspecting that it contained flash games that he's been using in lessons. As it happenes it did, but having just inspected the contents of his drive, I'm wondering about the legality of this.

 

I know that staff can confiscate mobiles, but are NOT allowed to look at what's on them. Would it be the same with usb drives ?

[irsprint]

I class it as anything that poses a threat to the school Edited May 20, 2009 by irsprint

[ricki]

Me too but if in doubt have it written into your aup.

 

Richard

[CyberNerd]

that'll teach the kiddie to encrypt it next time..

[Tim_S]

Well.... After finding out that a pupil had used a teacher login (hmm) to get a list of all pupils email accounts & passwords, he was made to bring in all phones, pen drives, laptops and computers from home and have them formatted.

 

Either that or being expelled. I don't want to consider the legality of that....

[jamesb]

Well.... After finding out that a pupil had used a teacher login (hmm) to get a list of all pupils email accounts & passwords, he was made to bring in all phones, pen drives, laptops and computers from home and have them formatted.

 

Either that or being expelled. I don't want to consider the legality of that....

 

Why did the teacher have a list of pupils passwords?

[Dos_Box]

How appropriate. At the conf we are allowing one company to demonstrate a very, very nice piece of software (I'm allowing it as they are to give quite a few of you the opportunity to win full licences for your schools). It's called Gatekeeper and will log any and all USB devices\drives connected to your systems, log the contents and give you the options of specifying just what files can or cannot be added or removed. It also has the ability to encrypt drives for staff.

This is just a quick overview, and you can see more here: TakeWare Gatekeeper

They will be coming to the conf in the afternoon to give you all a quick demo, and best of all, it does seem very affordable

[witch]

Well.... After finding out that a pupil had used a teacher login (hmm) to get a list of all pupils email accounts & passwords, he was made to bring in all phones, pen drives, laptops and computers from home and have them formatted.

 

Either that or being expelled. I don't want to consider the legality of that....

 

How would you know that he had brought them all in anyway?

[Tim_S]

Why did the teacher have a list of pupils passwords?

 

A very good question. Not my decision and something I'm against, but hey ho.

 

His parents were brought in, and as they were friends of a senior member of staff, the dad brought everything in - even digital cameras etc. Interesting day....

[westleya]

Me too but if in doubt have it written into your aup.

 

Richard

 

We have - the AUP says that pen drives are classified as the same as the lockers, that is any staff member can demand to look at what's inside.

 

The point is, is that actually legal. As far as I know the school isn't an independent nation and isn't above British law...

[grumpy_git]

We have - the AUP says that pen drives are classified as the same as the lockers, that is any staff member can demand to look at what's inside.

 

The point is, is that actually legal. As far as I know the school isn't an independent nation and isn't above British law...

 

I think the locker analogy is good for students home directory on a server (eg it's provided by the school, for the student to store things in - but staff might need to look in it (as they would with a locker if they suspected you were keeping things you shouldn't be in it), or equally may need access for maintenance (as they would if your locker was damaged and the site staff needed to fix it)).

 

But I'm less sure about pen drives. Surely they're like a students ringbinder - they buy it, for school use, but might also keep things from home on it.

 

I suppose that once they plug the pen drive into a school computer, we're allowed to set rules on what can/can't be on them. So if students want to bring in pen drives full of porn or downloaded music, that's nothing to do with the IT department - but if they stick them in a school computer it is.

 

More of concern IMHO is the number of staff who store confidential information on pen drives, but I don't think anybody is going to worry about that too much until it gets lost and the sh*t hits the fan.

[jamesb]

I suppose that once they plug the pen drive into a school computer, we're allowed to set rules on what can/can't be on them. So if students want to bring in pen drives full of porn or downloaded music, that's nothing to do with the IT department - but if they stick them in a school computer it is.

 

If they bring a Playboy magazine into school, that is the school's business. I don't see the difference just because it might be electronic.

[westleya]

If they bring a Playboy magazine into school, that is the school's business. I don't see the difference just because it might be electronic.

 

Any Playboy magazines brought here would be instantly confiscated by ICT support. And held indefinately.

[penfold]

I'm of the same view as jamesb, if they bring in something they shouldn't have, the school can confiscate it if they find it. If it is plugged into a computer then it should be checked. And this was added to the AUP and signs were placed in rooms stating that nothing should be connected to the network without being checked through IT first. The way I see it, it is the schools network and they set out the rules for using it, if you dont agree with the rules, dont use the network.

[BTCC_Fan]

Its an interesting situation to be in really.

 

I suppose it could be thought of like the students school bag. It may have personal items in it but the school has the right to search it if they suspect that there is something in it that they shouldn't have.

[Sirbendy]

phones can't be examined? We do here..SLT often bring phones in and ask us to interrogate/copy data from/wipe them.

[Edu-IT]

How appropriate. At the conf we are allowing one company to demonstrate a very, very nice piece of software (I'm allowing it as they are to give quite a few of you the opportunity to win full licences for your schools). It's called Gatekeeper and will log any and all USB devices\drives connected to your systems, log the contents and give you the options of specifying just what files can or cannot be added or removed. It also has the ability to encrypt drives for staff.

This is just a quick overview, and you can see more here: TakeWare Gatekeeper

They will be coming to the conf in the afternoon to give you all a quick demo, and best of all, it does seem very affordable

Why don't companies put prices on their website anymore?

 

Anyway, I was under the impression that teachers were no longer allowed to go through peoples possessions. Is that wrong?

[enjay]

The Computer Misuse Act defines a computer as the whole thing, and anything connected to it, i.e. pen drives. This is why we are allowed to run on-access virus scanning on pen drives. As this is an automated, non-logging process, it is different to the situation under discussion here, however.

 

The locker/bag analogy is possible a good one, but it should be noted that your school rules (should) specifically say that teachers can check these items. I would therefore amend either your school rules or your AUP to say that you may check pen drives (probably better in the school rules, as the pen drive is arguably only covered by the AUP when the owner plugs it in).

 

Remember also that teachers are likely only going through bags when they believe there to be something illegal in there, e.g. knives or stolen mobiles; this is different to doing it simply because they suspect an infraction of the school rules. There is no law preventing students from carrying flash games on pen drives, so you may be on dodgy ground demanding to check their drives for them. Following that logic, though, you might be able to check a pen drive if you believe it to contain the wherewithal to gain unapproved access to the school's network, thus breaking the CMA and being illegal...

 

Alternatively, you could possibly argue that since the pen drive is in the bag, which you are allowed to search, you have permission to check the drive's contents, just like you would open the student's pencil case during a bag search...

 

Perhaps if you wanted to soften the blow of extending Big Brother's arm, you could wrap it up around saying that if you have permission to view pen drives, you would be able to identify the owner of a lost drive, and return it.

[Dos_Box]

Why don't companies put prices on their website anymore?

 

Anyway, I was under the impression that teachers were no longer allowed to go through peoples possessions. Is that wrong?

 

Because it hasn't been released yet, and it all depends on the type of school etc.

[penfold]

Perhaps if you wanted to soften the blow of extending Big Brother's arm, you could wrap it up around saying that if you have permission to view pen drives, you would be able to identify the owner of a lost drive, and return it.

 

I have been asked to do that in the past. It's the same thing as finding a book left behind and looking inside for the work that was done. Normally the teacher who is asking can recognise the work on the pen and can then pass it back to the pupil. I wouldn't go searching for no reason. I see valid reasons as looking whats on the pen to identify who it belongs to, or suspecting a pupil has been using their pen to bypass network security and/or access inappropriate content.

 

I was asked to assist a headteacher in searching what was on a floppy disk(a long time ago now) as 1 member of staff had raised concerns as they thought inappropriate pictures were on it. I was asked to look at the content with other staff present to ensure that there were witnesses. The headteacher initially said it looked fine because there were only word files on the disk, however when we opened one of them up the pupil had pasted some adult material inside. Once this was discovered the teachers carried out the appropriate punishment(cant remember what they did now though)

[enjay]

I see valid reasons as looking whats on the pen to identify who it belongs to

 

So do I, but it isn't quite so simple. Imagine, for example, that you find a pen drive lying around so plug it in to see whose it is. In the process of so doing, you find something on there which raises concern for one reason or another - adult material, evidence of bullying/threats towards to other students, documents about self-harming, a diary about coping with domestic abuse (okay, I know that last one is unlikely, but it isn't impossible). In that situation, you would be duty bound, possibly legally required, to report it. If it then came out that you didn't have the legal right to have looked at the pen drive, you/the school could be in all sorts of trouble.

[john]

OoOoOoO that software sounds good

[TheydonBois]

I'm of the same view as jamesb, if they bring in something they shouldn't have, the school can confiscate it if they find it. If it is plugged into a computer then it should be checked.

 

/agree

 

I recently was told I was being too harsh when I was 'training' McAfee to delete Game emulators (just the roms) from students USB drives. I was told you cant simply delete files that they may not have actually used in the school, but are on a USB drive that contains their schoolwork.

 

This is (reluctantly) correct, but most of them where using the games and then sharing them with everyone else, meaning our students H drives where full of game emulator roms. I had to stop deleting the files, and they sort of got the message when I would search and destroy Gbs of Roms from the whole of year 7.

 

Luckily, Sophos Game Applications stops the emulators from working, meaning their drives are less likely to be full of games

[enjay]

@TheydonBois - fairly sure you can automatically delete certain files from pen drives when they're connected. As I said earlier, the CMA states that the pen drive becomes part of the computer when connected, giving network administrators the same rights over connected pen drives as they have over home directories.

 

I don't think these rights would be extended to network admins who plug other people's pen drives in without consent, but if the owner/user does it, it is fair game.

[penfold]

So do I, but it isn't quite so simple. Imagine, for example, that you find a pen drive lying around so plug it in to see whose it is. In the process of so doing, you find something on there which raises concern for one reason or another - adult material, evidence of bullying/threats towards to other students, documents about self-harming, a diary about coping with domestic abuse (okay, I know that last one is unlikely, but it isn't impossible). In that situation, you would be duty bound, possibly legally required, to report it. If it then came out that you didn't have the legal right to have looked at the pen drive, you/the school could be in all sorts of trouble.

 

What you describe is no different than if you find something in someones user area. Depending on the content you would need to alter your next actions. Personally if I find a pen drive, I keep it on my desk until someone reports it missing and comes to find me to see if I have picked it up. If they recognise it, they have it back. I keep ending up with loads of CD's to bin after each term from pupils who either forget they had work on it or just cant be bothered to pick them up.

 

If I find a pen in a room I will inform the teacher who *usually* knows which class it has come from. Most of the time I am asked to check something comes from a teacher who has been away and has had cover instead so is not sure which class it would be from. So long as you inform people that if they bring in pen drives there is a chance they will be checked for content I think your covered. I only look what is on a pen drive on request, whether this is for content or because of it being lost and needs identifying.

 

Unless of course your saying thats illegal?