Michigan college is tracking its students with a flawed app | Hacker News Reader

Michigan college is tracking its students with a flawed app

techcrunch.com

90 pointswglb86 comments

Yeah, I’d just buy a $100 android phone and use it as my keypass whilst at uni. Don’t take it off-site with you - you’d have virtually unlimited freedom if you leave it in your room, or turn it completely off before leaving campus.

It is a straightforward response to a ridiculous request on user privacy: you can’t force me to use my personal phone how you’d like unless you provide it. You can force me to buy into an app that tracks the location of my device in order to enter buildings and such, but you can’t control which device I choose to use, nor force me to carry it in my personal life. The flaw in the underlying assertion (one-to-one phone/person relationship, location of a phone = location of a person) is not my problem.

> you can’t force me to use my personal phone how you’d like unless you provide it. You can force me to buy into an app that tracks the location of my device in order to enter buildings and such, but you can’t control which device I choose to use, nor force me to carry it in my personal life.

While I appreciate what you're trying to say, and agree that it's draconian. The assertion that they can't force you isn't quite true. The collage is private property, they can absolutely make entry conditional on using this app on your personal device.

If you don't agree with their measures, then you simply aren't allowed on the colleges private property. Just as equally they can make compliance a condition of providing your education (it's a private contract after-all). Again, don't like it, don't get educated.

Ultimately college education is a contract between private individuals, none of the protection you have against government overreach apply.

Contracts are only enforceable (a) if they are conscionable, and (b) if they exist.

Is there a contract saying the user must carry the tracking app everywhere they go?

Probably not but there almost certainly is the standard set of "industry standard" clauses that inevitably end up in any sort of consumer contract, basically saying "we can kick you out for any reason we want, what are you going to do, all our competitors have the same language".

I eagerly await legal challenges for this.

> $100

You don't need to go nearly that high. Right now, Tracfone has a sale for a SIM-locked refurb Android 8.1 phone for literally $5, and even outside of sales the low end is only about $20.

I bought one as a balloon tracker the other year (I didn’t realize this was illegal).

As soon as you connect it to a network (including WiFi) it will automatically download gigabytes of malware from the play store which will keep launching in the background and crashing things by using up all the ram. It was pretty eye opening to realize what people actually deal with if they can’t afford nicer phones and don’t know how to (or can’t) replace the firmware. Cheap android phones make cheap PCs look nice.

Also an emulator or container is $0.

What's illegal about it? FAA regulations?

I found this.

https://www.highaltitudescience.com/pages/federal-communicat...

I remember being a uni student, and an extra $100 outlay (plus a sim presumably to keep it connected to a network) for privacy was definitely not something I would have had the budget for. I was a fairly typical student, but I don't think at any point in my 5 years of uni I would have been free to drop $100 on something like that. I was very cash flow restricted the entire time.

If you were cost conscious, you probably didn't pay for a $50K/yr tier-3 liberal arts degree then.

And as a US student (the sort who think Albion is a good investment) you'd have loans to cover your cash flow.

You can even use an android emulator for this - some of them come with location spoofing too.

> students are expected to use the app or face suspension

How does this work in the contract the college has with the student? Is there a term in the contract that allows the college to unilaterally add additional terms — terms which can then lead to unilateral termination of the contract by the college with or without some kind of notice period?

Presumably “suspension”, while framed as a punitive measure against students, is legally just the college withdrawing from the contract under previously agreed terms?

I ask because I’m increasingly encouraging young people to recognize that they are legal adults when they go off to higher education, and they should politely resist any trend for colleges to infantalise them by reframing terms of contracts as silly rules.

As a university student (not attending the university mentioned however), I can chime in here. If we chose to come on-campus, we were given an addendum to our housing agreement to sign before we moved in. Simply put, no addendum signed = no housing (since they reserve the right to terminate one's housing for any reason). I imagine it's a similar situation for many universities nationwide.

Regarding your second point:

> Presumably “suspension”, while framed as a punitive measure against students, is legally just the college withdrawing from the contract under previously agreed terms?

The article addresses this: private universities have a lot more leeway on how they conduct business.

If you already signed a lease, you don’t have to agree to new terms for that lease. It’s already a valid lease that can’t easily be terminated, and Michigan has pretty good renter protection laws (I used to live there). Not a lawyer though, but a lease is a binding agreement that they can’t just arbitrarily change and force you to accept

Students don’t lease dorm rooms in the traditional sense of a lease

> they can’t just arbitrarily change and force you to accept

They can if "they" are the state.

"suspension" is was one of many terms schools use to intimidate students and create an illusion of power.

A tier-3 private liberal arts college has no power except what they trick students to giving them along with the $50K/yr (!!!) tuition.

>If a student leaves campus without permission, the app will alert the school, and the student’s ID card will be locked and access to campus buildings will be revoked

This seems so flawed and easy to bypass. Leave your phone in your dorm and sneak off campus, it's as easy as that.

>If a student leaves campus without permission

I know the system in US is different from those I have experience with, but do a student at a college really require permission to go off campus? Isn't college students consider adults who can make own decisions?

No, they don’t require permission normally. This is just covid panic.

I don't know why US schools and the government are trying so desperately to get people back on site. Its clear this isn't going to work and the only solution is remote education.

It's because no one wants to pay 50k for a online only liberal arts education. Without in person attendance, these schools are totally screwed.

Dr. Michael Munger of Duke was on EconTalk recently and talked about his 'Four Buildings' view of the university. I think that this lens is an incredibly useful way to look at the problem.

Briefly, the Four Buildings of the University are 1) The Clock Tower - It coordinates times for shared experiences, 2) The Stadium - It gives a shared tribal identity to a group of people, 3) The Student Union - A sorting hat for people that are 'in' and further subdivides interests, great for dating and close friendship, 4) The Admissions Office - Very important, tells the rest of the world this person was evaluated and found exceptional.

Note that The Classroom is not on the list.

Some of these buildings can be done remotely-ish (Admissions, the Clock Tower - maybe), but the others absolutely need to be in person (Stadium, Student Union, Clock Tower - mostly).

Justifying these Four Buildings, remotely, at $50k/yr, is a very hard sell, but a great idea for a social-Startup.

https://www.aier.org/article/after-the-virus-universities-wi...

https://www.econtalk.org/michael-munger-on-the-future-of-hig...

It's probably a combination of hopeful optimism and financial desperation. It's too early to know for sure, but I bet a lot of small, private colleges are hurting and need to do everything they can to have students on campus. Students not paying for housing, meal plans, etc. is a big deal.

Sure it could work. The virus is fairly harmless for college-age people. But it can’t work because people are irrationally afraid.

College age healthy people are prone to unintentionally spreading it to people with weakened immune systems or older people, directly or indirectly. The more it spreads among the healthy population, the higher the risk that the more vulnerable will be infected. That's hardly irrational.

Unless you had the young people on some kind of campus, away from their family for months.

I remember reading about a curious unintended consequence for drivers licenses issued to california drivers under 18 -- they may not drive the car with other passengers under 20 years old.

So... Trunking.

That's what you do when you don't want to get caught with an underage passenger... you put them in the trunk.

Or if you want to sneak them in for free to the drive in theater! See there's nothing new under the sun ;<)

Police don’t check if it’s a relatively short trip and you don’t break any laws. Source: Don’t ask...

I believe police cannot pull someone over just because they look to be a certain age.

But police can pull you over for a dozen other fairly mundane, unverifiable reasons so it's really a moot point.

On android, you can easily spoof gps data with apps, no root needed. You don't even need to get another phone or leave it behind.

Couldn't you simply revoke data access to the app when you plan on leaving campus?

Not necessarily. IIRC GPS functions in airplane mode, and they _could_ have coded the app to record infractions and only notify your prison guard when you later re-enable data access.

The T&C most likely require students to grant data access all the time.

If the app detects permissions are revoked, the student might face some consequences.

> Leave your phone in your dorm and sneak off campus, it's as easy as that.

To do... what? Without a phone, many will have no means of transportation. They won't be able to sync up with friends or use GPS.

It's absolutely unimaginable that a large number of college students will leave campus without a phone. They're much more likely to have a separate phone to put the app on.

Don't you have old phones laying around? Install the app on one of those and keep using your main phone.

Read the fifth sentence of my comment, where I proposed exactly that.

I was responding to someone who proposed leaving campus without a phone.

If you’re not going to use it as a phone, it neither needs to be good nor have a data plan. Literally the cheapest phone available would do the trick.

I agree. I was responding to someone suggesting students leave campus without a phone. It makes much more sense to have a decoy device than to leave your phone at home.

You can get a refurb Android phone for literally $5 from Tracfone right now, for example.

Amazingly enough, people managed to get by before smartphones were the norm.

I rarely if ever go out of the house without my phone on me, but I reckon it wouldn't be that difficult to get a small group into a car and just drive out, maybe writing down the way beforehand. It would be annoying, but they'd manage just fine.

> maybe writing down the way beforehand

Google maps street view (satellite if not available) is far preferable. You just need to remember landmarks to turn at.

I'm curious about the interplay of (a) this app/policy vs. (b) other measures the college will take. E.g., mandatory social distancing, masks, dorm occupancy, etc.

I could see how implementing (a+b) might yield lower infection rates than just (a) or just (b).

But if having (a) in effect lulls the college into relaxing (b), and some students subvert (a), then I could see how it's a recipe for an outbreak.

The rate of infection may be lower, but that doesn't necessarily mean fewer people will be in infected -- it means the spread takes more time.

This is insidious. What kind of college dean or president would think that this is OK?

With such a low level of regard towards young people and with only potential for gross abuse, if the staff's leadership refuse to apologise and withdraw the app's obligatoriness then they should be sacked without delay.

I know this is a strong opinion but I'm really on board with that petition.

If you're not sure the answer, it's almost always money. The school wants their $45,000 tuition bills paid

After a certain point is it just better for everyone to keep an old burner smartphone for these ‘required’ apps

In this case, I disagree.

This is a private school, and its students are customers. Their school is forcing an app on them that violates their privacy far more than is necessary for contact tracing, and it was developed by a non-software firm with no understanding of security.

The solution here is to petition and protest the school, not just work around the app.

I think you are both correct, but since there is no guarantee about the timeline and success of the "petition and protest" approach, I'm all for the burner phone strategy in the meantime.

I can't read the article (no js = blocked) but why not, when asked, hand over an ancient no-internet dumbphone and say "this is my only phone"[0] - what are they going to do, ban you, buy you a smartphone with their money?

[0] in my case that would be true

They will just tell you to buy a compatible phone or you will not be allowed on site. Its a private school so if you are too poor for a $50 android phone then you wouldn't be able to go to the school anyway.

I bet you could make the school buy the phone, these kind of places desperately need the money.

I attended a very small liberal arts school right after the great recession. If you were paying your way (50k/yr), they were desperate to have you. The number of scholarship students who got expelled for drugs or alcohol were many, the number of full tuition students, zero.

It is very disturbing that Nucleus ignored and stiffed the security researcher who pointed out their obvious issue with AWS keys. They should not expect cooperation from the security community in the future and I hope this will have a severe impact on their ability to attract and retain customers.

IMHO: Don't bother with college. All information anyone could possibly need is available from libraries and the internet. If you learn what you need to know and prove that you know it, people will hire you.

If only colleges' sole purpose was to impart knowledge.

I think they're a great place to meet like-minded people, form friendships, find potential co-founders, grow your network, get inspired by people some of whom are likely to be world's best at what they do.

Another thing is colleges force you through a rigid system of semesters, courses, and exams that takes most of guess work out of the learning. Besides, I'd wager one needs a disproportionate amount of patience to be disciplined enough to follow their own curriculum of learning regardless of accessibility and availability of content.

I am not saying the current system is the best humanity can do, but: https://en.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fence

I like my surgeons like I like my women: with a formal education.

In my experience, people who are self taught can be quite competent in a very narrow area (like frontend web development), but have vast, gaping holes in their knowledge when it comes to the big picture. I'm talking about really fundamental stuff like what an algorithm is, what memory is and why it's useful etc.

University is such an important part of development overall that it really shouldn't be skipped. It's a shame that they've become overrun with stupid SJW/feminist nonsense these days, but I think it's still overall extremely valuable. You can't replicate the university environment at home.

Not only that, you'll be looked over for many opportunities when compared with people with degrees. This isn't entirely unfair, given the justifications for university above, but it is a little. Unfortunately that's just the way it is, though. If you can't beat 'em, join 'em.

Yeah well unfortunately the HR department that screens resumes doesn't agree.

Covid apps using Bluetooth are useless.

If you want a chance for it to work, this might.

This is what a lockdown is. Taking huge risks, be it loose APIs or destroying parts of the economy, all to stop a huger risk.

If you want to understand why Republicans protest the lockdown, look here, this is the beginning of the creep. Republicans mightn't understand what they are protesting but they at least can see the fear, which Democtatz can't.

Given what the media, politicians and the public in general say, everyone just doesn't seem to understand either risk or it's magnitude.

I'll admit I'm not an expert in this area, but why are apps using Bluetooth useless? Because people turn Bluetooth off?

On the iPhone it just goes to sleep.

This is a killer.

But it's not the end of it. Bluetooth can't measure distance well, it's totally not in it's design. Every phone model is different, I think including software version.

So there are databases of phone models to try and fix this. But it's still far from perfect since it's still not in the Bluetooth design.

Measuring time of exposure is hard with Bluetooth.

Now Apple and Android released frameworks to try and fix these issues. But governments had already invested in the old solution and it's not clear if the new framework will fix much.

To do what they want to do with Bluetooth would be pretty amazing. It's basically Geo Location using beacons using existing phone tech. That's fucking cool, yet for some reason it's never been done before this, Covid solves all technological issues it seems?

GPS tracking works really well. You will also know where. So you can see if it was inside, outside, walls between them, all things vague Bluetooth apps can't do. Lot's of context with GPS.

So, what do we think governments will do when Bluetooth has been shown not to work, but this privacy invading app works really well, which it should.

Measurement-Based Evaluation Of Google/Apple Exposure Notification API For Proximity Detection In A Commuter Bus https://arxiv.org/pdf/2006.08543.pdf

"We find that the attenuation level reported by the GAEN API need not increase with distance between handsets, consistent with there being a complex radio environment inside a bus caused by the metal-rich environment... Applying the rule used by the Swiss Covid-19 contact tracing app to trigger an exposure notification to our bus measurements we find that no exposure notifications would have been triggered despite the fact that all pairs of handsets were within 2m of one another for at least 15 mins"

I wish they would've tested more distances. If the threshold is 1.5 meters or even 1.0 meters that's still better than nothing at all. No one is touting these apps (or masks, or social distancing) as the ultimate solution to the spread of SARS-CoV-2, it's all just things we can do to reduce the risk.

> I wish they would've tested more distances.

Bluetooth is 31 years old. What is there to test?

> No one is touting these apps <snip> it's all just things we can do to reduce the risk.

The app does not reduce risk, even if it worked. It's for contact tracing. This is importantly different.

You seem confused, which I might guess is because the app was touted incorrectly in many countries. Masks and social distancing do reduce risk. Although most Western countries told you otherwise to begin with on masks. And told you incorrectly how to wash hands, and also incorrectly said it reduces risk (considered unlikely). I'll add being outdoors also probably reduces risk, not sure this is commonly touted yet.

I mean risk at the societal level, not individual. Maybe there's a better word. Anyway what I mean is that the risk of the virus/disease spreading faster than our healthcare systems can handle is lowered by effective contact tracing. Not that I personally am less at risk of being infected if I install the app.

Ok, some politicians etc were calling the apps a condom or sunscreen.

All evidence since March has been boots on the ground for contact tracing is what's important. Not tech.

But the Bluetooth apps, which we know can't work well also don't try for behaviour change, they might even increase risk. This app at this college is trying for positive behaviour change.

Reply on news.ycombinator.com