psydii

If you can look through the staff photos and identify the member of staff then it was pseudo-anonymous but has now become (by virtue of you actually preforming the cross referencing) personally identifiable in the scope of the record of that event. In the written record you might see the the student statement "teacher with the big ears", and in the comms trail after that you would see "..do you thing they mean Mr X?", and later "yeah it was Mr X"... so if you ask the AI to find the adult with the big ears, it will return imagges of who it thinks matches, and then you take action (producing an audit trail) the "big ears" has become personally identifiable :shrug:

Yes initials are personally identifiable and in scope when someone asks for all the email that talks about them.

@tom_newton or @PaddyNewman feel free to correct me, but my understanding is that the initial SIP setup is on known ports and tends to involve a very small number of remote IPs. During the SIP set up for each call the "phone" is told what IP and port to use for the RTSP (the audio) for the call. Thus the phones will only be sending out UDP to IPs the remote PBX has told them to, and the firewall does its magic (sip proxy or otherwise) to ensure the inbound traffic from those IPs flows only in circumstances where a call is starting/in progress. Yes if someone gets hold of your firewall config they can realise that they are free to set up a UDP traffic flow to that range of IPs, but unless they also have a a server in that range they aren't going to be able to do much. To re-iterate: I hate this, but I have to live with it, the risk is relatively low. By the way, unless explicitly encrypted, wireshark can decode and play back sip calls if you captured the packet as they transit your network.

If you can cross reference it with other data you hold to identify an individual then it falls into scope as pseudoanonymised data. So "red jumper" probably requires human knowledge not recorded anywhere, but physical characteristics (big ears) are likely recorded in the MIS as a photo.

SIP is old and crappy and sensitive to latency so pushing it through a vpn presents its own challenges. We've got firewall rules for all the SIP devices to allow them the access they have asked for. It hurts my soul, but not as much as getting fired because the phone system doesn't work properly.

Hah. Likewise.

It can be done very badly, but that is a risk not an intrinsic property of the idea. That is true, but chipsets, drivers, firmware and wiring can all cause chaos over time even with wired desktops (see recent thread re DP vs DP++ vs HDMI adaptors vs DP->HDMI cables) First point: happens maybe twice a term here. Second point: yes this is a risk, but standardisation is key, and testing new models of laptop against your standard configurations before purchase mitigates much of the risk. It is true that with hundreds of connects/disconnects things do wear out, but this is offset by the improved flexibility for staff of having all their work on a mobile device able to work or teach in any room. IME

I've kept that parked in the "lets keep that can of worms/pandora's box firmly closed" category. I do this by inviting the person who raised it to take on the project to work through and take ownership of the legal and local/external "political" issues that may arise from enabling that technology. Same with any cameras that might have microphones. Our DPIA for the system states that we do not and will not make use of these features. I would observe though that the utility of facial recognition is limited in schools - you are usually looking at an incident and so SLT/Admin support do the facial recognition using that which lies betwixt their ears. If we are trying to trace a student's movements we almost always know a point in time where they were, and then work through from that.

…and “all traces” is a bold goal. “Good enough” is what we settled with. We’ve been using a version of that script for 5-6 years and even though sometimes artifacts are left behind, machine performance remains acceptable. One of the most common reasons files get left behind is because they have not been flagged by OneDrive as sync’d back to the cloud. Files in this state are not removed. (Or so it behaved last time I checked about 3 years ago). This is a good thing as it gives recovery options when a student reports some files are missing. We also have seating plans and per-class laptop laptop assignments. This is officially for behaviour/accountability (as per behaviour policy) but in fact makes the Windows 10/11 default profile/onedrive/app management strategy viable (when paired with aggressive storage sense and that script) I will note that on machine with 512gb disks we never see disk space issues. Other reasons for files to get left behind are them being locked open by an update (windows or app) or AV scanning in progress, or actual corruption. Also naive administrators just deleting files or registry entries have been a common occourance, but sometimes a machine just needs a complete wipe and to start again.

This is a good start. https://adamtheautomator.com/powershell-delete-user-profile/ There has been shenanigans about how to correctly identify the time a profile was last used, at various points in W10’s life various indicators have been misleading/broken. I can’t remember where we ended up, but when we need to run it were are in a pickle so take a very aggressive stance on profile age.

use fiddler to identify the specific url of the image and block that using your filtering platform? (I've no idea if clipart uses static URL, but if it does that should work)

I can't read: and not ask if you'd also be expected to have a BA (Hons) Ceramic Design?

Unless you are able to maintain an iron grip on standardisation of equipment, having a second monitor in the set up will cause some people some problems some of the time. We operate on a "if you want that, you will have to learn to troubleshoot it yourself/deal with limited functionality when it lets you down at the start of a lesson". A few teachers are happy with that, but most settle for laptop + IWB (via HDMI because we had a bad run of USBC issues back in 2019-2021)

Teams / Chrome / OneDrive and Outlook are all really good at consuming diskspace in user profiles. We get around this by: not installing Teams or outlook on shared devices, instead use the web based versions Blocking all browsers apart from edge (its chrome under the hood so no compatibility issues there) Making sure OneDrive files on demand is the default (or not having onedrive fire up at all if its a shared pc with very small drives - there are special Intune profiles for that) Being quite aggressive with Storage Sense settings and profile clean up. We have seen a small up-tick in misbehaving start menus recently, but mostly the problem seems to go away after a while. Does feel like an update to something has made it (slightly) less reliable than it has been these last few years.

I also enjoy messing around in wireshark and have a historic interest in filtering proxies (trying to roll my own while the original patches to squid were being developed by people over at rm / pavilion - i think predating dansguardian too?), but since 2011 I'm a huge fan of LGfL, and they have got really good at the firewall change request / troubleshooting piece in the last decade,. I love that side of things being "not my problem", and when we do have an issue, it feels like working with a specialist who is part of the team! But bak on topic, with the higher end (non-unifi) switches, one can poke around arp tables and do remote port mirroring (analysing network traffice in wireshark etc) control spanning tree propogation and dig deep into what the switches are doing. This is very handy every so often for troubleshooting oddness (finding that switch that decides it wants spanning tree recalcuted randomly) and identifying configuration drift (e.g. cameras on the BMS vlan), or proving that that random box in the basement is not sending valid network traffic to its server... I 've only had a little play with some low end unifi kit but it seems that some of this diagnostic capability is not available? Is this right, or is it all there in the higher end stuff?

the 2930's 5406's are basically procurve though.

Good grief. I think its time the DfE and ICO step in, this is going to impact 50% of all schools. I recall negotiating a very reasonable perpetual (single user?) licence for Facility/CMIS when we migrated away from them. Perhaps something similar can be worked out with ESS.

anecdote: since Windows started sending a huge amount of telemetry back to the mothership, overall reliability of Windows has improved. Think about it, most people do not re-install or need to re-install their OS and as per this thread 30% of computers out there are 7+years old.

This really is a multi-faceted issue. Device Security is linked to national security, older devices draw 100W+ more than a modern device, and people not buying new devices contracts a market at a time when governments are desperate to see growth (of consumer spending). Perhaps, the transition of leaded vs unleaded petrol cars might be a useful comparison.

The challenge is that pretty much anything post Sandy Bridge is good enough in terms of power (Watts) and performance (LoB/'Office'/Web browsing), but architecturally they are insecure, and supporting older platforms restricts what can be done to push capabilities forward (AV decoding, modern encryption and on chip security, more efficient CPU inter process management etc etc). I do support Windows 11 being a line in the sand, its basically the same as Apple's defacto position of seven years of OS support, and with the extension for education customers to align with the Windows 10 2019 LTSC 10 year support period it seems pretty reasonable to me. There shouldn't be an e-waste issue this year, and by 2019 our non-windows 11 computers would be 12-15 years old. I have also seen talk that Windows 11 Iot Enterprise LTSC might be an escape hatch for some, though restrictions apply at this time.

So no representation of the EduKey products such as classhcharts/provision map etc? https://www.tes.com/for-schools/now-tes

Didn't go, but from what I have seen in the last six months, for the first time in 12 years I am of the opinion that the next gen of sims might be less than five years from being a viable product. Previously it was clearly *at least* five years away. But since this is basically their third go at it, and each time something derails their plans, I suspect/fear that this time around it will be the precipitous decline in customers that derails its development. I say fear because IMO the market needs three products to remain competitive.

*tiny violins*

Doesn't Brave's efforts to be privacy focus sit in opposition to the oversight required by KCSIE?

That looks very promising. How many deployed? Any macbooks in play? Do all your laptops have the USB-C on the same side? Have any failed?