60% of school apps are sending student data with third parties without consent
me2ba.org
me2ba.org
Here is the report: https://me2ba.org/school-mobile-apps-student-data-sharing-be...
As an edtech founder, I 100% agree that there should be more time spent holding school apps accountable for the data that they sent out, but this report doesn't accurately capture the risks present and how to hold organizations accountable.
I also don't see how OkHttp[0] or Okio[1] are 'medium' risk. Are they secretly sending data to Square? The code is auditable on GitHub.
https://aws.amazon.com/service-terms/
The GDPR DPA does a good job of encompassing the entire extent of their data use:
> AWS will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order)...
Having worked on those products (and in some cases, written the terms), I'd say so.
That is just one example which was made public and was done intentionally. There's potentially plenty more cases where it's either done but concealed (because of how many factors go into ad targeting it's often impossible to categorically prove/disprove which data was used to target an ad) or done by accident from earlier code that just assumed all data is fine to use for ads (or that the new product which shouldn't share its data for advertising purposes was accidentally storing data in the same place as other products who do share data for advertising purposes).
Why should we trust companies that have a business incentive to break their promises? If Google's biggest revenue stream is ads and that requires personal data then I wouldn't trust any of their promises not to use some personal data unless I can 100% audit all the code myself and prove that it's indeed that code that is running in production.
Because the prevailing voices our country have spent the past half-century telling us that government is Bad, and business (and greed) is Good, and enough of us have bought into the idea that we've systematically dismantled enough of the systems that keep corporate greed from running amok and ruining people's lives that they now effectively run large chunks of government (eg, see ALEC).
Because too much of our society—especially in the tech sector, and more especially in the parts of it that are overrepresented on HackerNews—has come to worship wealth and the wealthy, and to believe that they should be allowed huge amounts of latitude to do what they want with their wealth.
> E.g. for protected government data, you have to run in amazon's govcloud.
Not really. Many .gov workloads are fine in commercial cloud. It depends on your compliance requirements. Sometimes there are downsides too - some services aren’t available. At one point, Azure Gov required separate credentials.
If I had to choose a stage of my life to become part of the public records, I'd definitely pick my childhood over my adulthood.
that doesn't sound sensible unless you are assuming at adulthood you would be out of public records, in which case sounds great! because your adulthood will hopefully be a lot longer than your childhood. On the other hand I don't think an advanced society would work with that model.
Secondly - why do children need a higher standard?
People at different changes of their life are not necessarily the same people, a man at 50 might not be very much like who he was at 20. Unfortunately our society does not do much to support such a concept. It does however support the very rudimentary concept that things you did as a child should not follow you as an adult - when you have different legal responsibilities and possibilities of action. So that is something that probably shouldn't be taken away.
Furthermore as a child is not fully developed in reasoning it is probably nice that things the child does is not part of their permanent record.
It’s presented as a contract mutually agreed between you and the service provider - you get the service; the provider gets the data. A legal contract.
But, in all systems of law that I’m aware of, you can’t make enforceable contracts with children.
This exists as a way of protecting children from making disadvantageous agreements that they don’t yet have competence to understand.
So, the service provider can’t use any contract as justification for handling personal data of children.
This leaves the service provider without legal justification and then calls their ethics into question.
In most (all, I think) US, contracts with children are generally legally valid, but voidable by the child. This means the child (or the child’s guardian) mau cancel the contract before performing any obligation. It does not mean that once completed, the exchange can be retrowctively invalidated, though.
1) School is a mandatory part of life for every child, therefore increased scrutiny and high standards are warranted. As an adult, you are free to go if you ever disagreed with your employer on ethical grounds. But if children were forced to participate in a dubious (in terms of privacy) online service, they really have no choice other than to accept it (going to another school in the same area is hardly a realistic option).
2) In general, it is understood that children might not be able to grasp all consequences of their decisions. Even if children had a choice whether to accept their school's mandatory online services, I don't think they can really give consent considering they might not understand the ramifications of their personal data ending up in the wrong hands.
Reading your question again, I don't think children need a higher standard of privacy than adults - rather, I think the point is that regardless of the standard of privacy, children can only give limited consent.
I'm going to assume without being a lawyer, that sending out school data is a violation of Federal law.
https://support.google.com/google-ads/answer/6333536?hl=en
Linking Firebase to Ads requires conscious action on behalf of the developer, while the former only requires using any Firebase product.
Also, Google is in the online ads business, so I don't think it's surprising that they provide docs that show how to use Firebase data to target ads. That said, it's not the default, so it's not as shady as you're making it sound.
I have a (large financial institution) client that asks this question on their vendor due diligence and on-boarding and plans to phase out vendors who say yes and aren’t willing/able to change. They’re concerned about data privacy. Not just security, privacy. From Amazon.
If they want utility levels of trust they should get nationalized.
Because if Amazon retail, which sells stuff, is looking at sales in their channel, well, that's sneaky but the entire retail world is sneaky.
If Amazon AWS is caught snooping at private AWS data, which contains HIPPA-compliant health info, financial records, government data, and some of the most sensitive data imaginable ... then they are toasty-toast.
I think the same thing would apply to Google. GCloud is different than Search etc. if that firewall breaks down that business will crash.
Why? Says who? Who or what would make them 'toasty-toast'? The toothless regulators? Feckless IT managers who make purchasing decisions? Impoent developers whining on hacker news?
> if that firewall breaks down that business will crash.
Not sure why you're so confident about this.
a) GCloud is a distant 3rd place competitor in the cloud market anyway.
b) Google's real business is ads, and at some point the numbers might make sense to decide it's worth cannibalizing their dying cloud. (Especially if they're going to pull the plug anyway?)
c) None of the other data scandals has even slightly dented big tech.
Second, because IT managers and executives would freak out everywhere, with legit cause. Nobody on the planet running an SaaS would want AWS to be using their data.
Third, it's probably illegal, so there's that.
Finally, the PR fallout would be huge.
If Blue Shield had a major client leak of HIPPA info, and it was because 'AWS staff were looking at it' it would be a big deal for AWS. They would have to prove to everyone that it was just a few bad apples etc..
Most of the other scandals have not dented tech because they are not really scandals. If FB has a breach and some consumer email addresses get leaked ... well that's not so bad. If AWS is looking at BestBuy AWS data, then BestBuy will sue and drop them, and others will follow suit.
Remember when we though that whoever is in charge would be Toasty-toast it it turned out that Government was spying on innocent people without due process?
Or if an aircraft company knowingly produced unsafe aircraft and killed 300 people as a result?
For the past 10 years I have seen countless corporate or breaches and fuckups, and one thing they have in common, there seem to be no consequences for those in power
It's not 'we' thought the government would be in trouble if they were caught spying, it's 'some' people. Most people have more nuanced views. Especially in areas of national security most people accept some degree of oversight, so the issue then becomes a matter of details. What was the oversight? What are the material repercussions? Who is harmed? How? All of those things add up in complicated ways among the general population.
The Boeing issue is also complicated. These are not black and white decisions, and just because there was an Engineer 'who said something was wrong' doesn't always help, because there's always a person of credibility that disagrees with systems, many of them are safe. Boeing has paid a huge price for their screw up, with grounded fleets, cancelled purchases.
When Facebook does bad stuff - remember that consumers greatest power is the choice to not use Facebook. So either people continue to use it - or not. Apparently they are, so that's a measure of their real concern for their data given the breaches.
If HIPPA information was looked at by AWS, then there would be lawsuits immediately for example, there would be an investigation and if it was 'just a guy' then I think AWS would be ok, but there would be a lot of scrutiny.
But if there was a whistle-blower at AWS who said 'people are looking at sensitive data all the time' then it would be over for them. While individual consumers may not collectively have any real power to do serious damage, big companies do.
Put yourself in the shoes of an Exec running on AWS infrastructure: all of your most sensitive data leaked, possibly to potential competitors? So the issue is raised far beyond IT personnel etc..
Just like you'd ground your Boeing jets if there were a safety issue, you'd probably move away from AWS.
At least PCI-DSS certification (I don't know about HIPAA) further involves annual audits to make sure that certain proactive things are being done as well, specifically including things like data access logs. Those audits aren't as comprehensive as they ought to be, but they'd catch something egregious like marketing people looking into data owned by AWS customers.
I'm pretty sure (though much less than the above) that this would also be a de facto GDPR violation, meaning that nobody who wants to do business in Europe could safely use AWS anymore either. Amazon itself uses AWS and wants to do business in Europe, so that's a pretty good incentive.
We had to deliberately downgrade certain software to "approved" older versions and temporarily close some ports while they ran their scanning utility on our servers. After they rubber-stamped it, we re-upgraded and enabled whatever we needed to run again.
They certainly would not have been able to detect if data center technicians (this was pre-cloud) were accessing our data behind our back. Maybe some companies take the PCI certification process more seriously than my previous employer did.
In those cases they mostly looked at traffic volume, etc., not private customer data, but I don’t have any insight into which ethical lines they will and will not cross.
You should have picked a different analogy.
In the end AWS S3 is just distributed file storage.
Setting up your own servers was not a bottleneck to the generation of internet companies that preceded AWS, and time has only made hardware cheaper, bandwidth more affordable, and OSS higher quality and more plentiful. It is easier than ever to host your own services, AWS just makes it cheaper up front thanks to their massive scale.
Point being, people aren't choosing AWS because AWS solves a problem they're incapable of solving, people are choosing AWS for pricing flexibility and faster time to market.
So when you say "what AWS does was previously done by every single IT department at every company across the globe" yes sure but (1) it was done worse in many cases, with data loss or significant downtime, and (2) there were fewer such companies by magnitudes, because of the cost barrier.
What AWS did was take a costly process, done inconsistently and to varying degrees of correctness across the business world, and make it available to everyone at a very high quality, with a innovative pricing schedule.
S3 has eleven 9s of durability. That alone is bonkers. Sure, let's say you replicate that and staff it up to keep it working ongoing.
I didn't say "replicate S3", I said "replicate a significant portion of AWS". A lot of the value of AWS doesn't come from using _a_ product, there are alternatives for most of what they offer, it comes from having the whole ecosystem of tools integrated and available in one place.
So now you need to go build out a highly available, redundant queuing service like SQS that supports FIFO delivery and up to 20k inflight messages.
And a highly available, redundant notification service with integrations not only with the web/email/etc but also SMS.
And a geographically redundant database service with multi-master, instant snapshots, point-in-time restore, etc, etc.
And... well, pick whatever other handful of AWS services you're using in your specific use-case.
And wrap it all behind tools for management. And hire a whole wackload of ops staff to keep it all going. And pay 10x as much because you don't get the economies of scale that AWS does.
I'm not ignorant of the difficulties in setting up generation and storage for electricity. But I'm also not ignorant of the absolutely massive task it would be to replicate AWS if you're it for more than a really expensive VPS hosting service. I would 100% choose to work on off-grid electricity generation before rebuilding AWS.
You entire take is based on the idea that AWS replacement has to be superbly reliable and scaleable, while your grid replacement does not.
Lets compare like for like, your grid replacement has to have redundancy so that generators can be repaired without power loss, it has to support megawatt scale spikes in demand in case several friends with electric cars come to visit, it has to have mean time between failure measured in years, withstand extreme weather, and be renewable. Also you need to have black start capacity and logistics to replace equipment promptly when it fails.
How is the cost for that going to compare to using the grid?
What, you mean smart? A lot of data centers do exactly that. SevOne has at least five Bloom Energy H2 fuel cells that run the whole building because they can't afford any downtime.
And yes, what would XY-Analytics be other than stalking, put bluntly?
School apps should not involve ANY tracking, regardless of your opinion about the company.
Kids require special protection because they don't yet know how to function in the world and can't make informed decision about whether they want or don't want to be tracked and in fact for these kinds of apps, they are not even consulted or asked to consent.
Schooling is obligatory. I can make decision whether I want to use the internet or not and whether I want to be identified, but kids don't make that decision -- they are being forced to use the software provided by schools.
It’s supposed to prevent plagiarism, but it made me frustrated to be forced to aid in this system or fail.
Being a public school student in the US sucks most of the time - no power and miserable adults. It’s like being imprisoned with some of the dumber, less successful people from the previous generation in charge of you and they have a lot of discretion over your future success.
Some teachers are great obviously and make a huge difference, but many are truly awful.
If they’re requiring services like turnitin as a matter of policy it’s not a surprise other stuff would be poorly handling student data too. School’s don’t value it, and even if they did - they don’t have the technical capability to fix it.
But then realized you're not a high school student as you joined in 2009 and you're called 'fossuser'.
Bit of a lost cause maybe, but seriously, let the superiority complex go, it really doesn't help make you happy. I say this from experience.
HN and a lot of places online have wonderful people too.
The average American public school teacher? They’re not that bright and they can be petty. I usually didn’t have trouble because I was a good student.
Some examples:
- Teacher in health class said BAC wasn’t lethal until 40%, when I mentioned I think it was .4% she said I forgot to multiply by 100. On the final the multiple choice answers for lethality ranged from 10% to 40% BAC. She also had an obvious hyper-Christian abstinence only lean despite state law to teach actual sex Ed.
- Art teacher in elementary school called home and humiliated me in front of the class because I was talking about video games with another student while working on arts and crafts (this teacher hated video games).
- Middle school history teacher hated children, picked favorites, and was just generally mean, would bully kids in the class. She was worse than most middle school students.
It’s not a superiority complex, I had wonderful teachers too that cared about students and were kind. The incentives and pay of public schools are such that you get a lot of bad ones (and they’re impossible to fire).
When I tried to tell adults about what was going on they often dismissed it with condescending nonsense “oh it’s a tough age” - no some of these people you have in charge of us are legitimately crazy and should not be in charge of children.
Children have no power in school and it often sucks to be there.
Also reminded me of an older comment I wrote a while back that’s a little related (at least has some more absurd examples I had forgotten about).
“ Illegitimate (or at least arbitrary) authority is something schools seem to thrive on. Our school had a staircase you could only go up and one you could only go down and you got yelled at if you went the wrong direction. Naturally the building wasn’t made by insane people so the stairs were on opposite ends, this meant if you had to go downstairs but were near the “up only stairs” you had to traverse the entire building and would be late with 3min class change times (and you couldn’t run either).
We also couldn’t talk during the second half of lunch because it was too loud for the lunch monitors.”
They store a copy of the work, but I don't think anybody claims that copyright actually transfers from the student to TurnItIn.
Maybe it's true that FB don't own these right but they certainly did try. I recall a huge user campaign against Facebook who were brining out a new update to their ToS regarding photo ownership back in circa 2011. They ultimately backed down.
I can't find it after Googling though.
https://www.snopes.com/fact-check/facebook-using-profile-pho...
https://www.zdnet.com/article/turnitin-if-youre-a-student-al...
> want to pirate best-seller book
> create alt account in turnitin
> publish pirated copy of book in turnitin
> turnitin acquires permission to use book
> buy intellectual property of book from turnitin for cheap
> become millionaire selling IP of book.
In our (UK) system, there's no profit incentive because there's no bad customer service that will be enough for you to give up the economic signalling. So, despite being the most expensive thing I've ever paid for, I had less input into how it was done than I do for my coffee subscription.
I didn't have a bad experience with school before that but I still remember distinct occassions of cruelty or unfairness. At that age you're just less well equipped to deal with it, nobody trusts you and you have no freedom, so your world is smaller. So a minor thing has a major impact. Adults used to tell me that it's all downhill after 18 - did they forget what it's like to be a kid?
This is a key point. Many school administrators just pick tools to use and don't bother understanding them and do not have the technical staff to setup and maintain them properly.
We all work in tech related fields, I assume, so think about the most sought after positions, have those ever been at a university IT department or K-12? Probably not.
There was a thread a couple weeks ago on here where it was joked (kinda half serious) that a school IT department is where you can go and just "coast" with great work/life balance.
I was on vacation a couple years ago, and in some downtime I was just scanning PRs awaiting code review, because I am bad at work/life balance. Lo and behold, there was a PR ready to go that would have exposed students directly to a third party. A reputable third party, but a third party nonetheless. It had the requisite votes but the user had not merged it. I very quickly threw up a blocking review and called my boss.
I made quite a stink about it to my boss, but he didn’t seem to think it was a big deal. I went up the chain to his boss, and he also didn’t see what the problem was. At this point I call my bosses boss and basically beg him to talk to legal about it. He does, and they put the kibosh on the whole thing right out the gate. I’m sure I burned some political capital that day, but in my book at least it was well worth it.
Hanlon's Razor in full effect. Even then though, I know these people well and know they’re not dumb, the way the web is structured makes it really easy to expose people and not even realize it.
During a call someone mentioned they were looking at a provider who provides a full location history for debugging purposes, which was being looked on favourably (who doesn't want better debugging?) until I stepped in and pointed out we don't want to be anywhere near a full precise location history for our users. It provides basically no benefit to us other than debugging being a bit easier, and the massive risk that if someone's account for this service is compromised they've potentially facilitated stalking our users.
Then again, anyone who has location services on systemwide on an iOS or Android device is sending this log to Apple/Google anyway (because location services transmits all of the visible Wi-Fi APs to Apple/Google to improve location).
I logged in the day it was assigned.
Google Chrome immediately notified me that the login and password were part of a leak.
I contacted the school IT to let them know that the service they used seemed to be compromised ( other parents saw the same alert), but they seemed confused how I would know the logins were compromised...
Most school IT teams are woefully underfunded, and often aren't making decisions on what they use.
1. https://support.edmodo.com/hc/en-us/articles/115007376848-Im...
Because in that case Chrome was just telling you that "one of the many sites you use (where you used this pwd) has been hacked in the past"
Schools are also notoriously bad at security. My school force disabled Firefox updates, meaning every browser remained unpatched after multiple CVEs, one of which allowed websites to execute arbitrary code on the host's machine (sandbox escape).
Tell the kids not to use such devices for anything that can raise an eyebrow, let alone raise a concern.
Doing leetcode problems? Fine. Browsing Wikipedia? Fair enough. Watching educational videos on YouTube? Proceed with caution. Playing games? A bad idea, stop. Opening your private email / social network account / instant messenger? Please never don't do it again, and change your password just in case.
This of course, is hard for kids. For many of them, it's the only real computer they have a chance to put their hands on. Which is, of course, bad. But fixing that is not very expansive: a reasonable used laptop can be had for $200, an RPi + a reasonable monitor, for less than $100. I hope most US families with kids who are genuinely interested in technology can afford it. (Getting the parents interested is a different problem.)
I think many parents would be profoundly uncomfortable spending significant money so that their children can evade supervision and guidance by authorities they are meant to respect. My own parents were pretty liberal, and it would still creep them out.
And actually, it is important that we correct this situation in both directions right at the start.
In my opinion, the laptops should be treated more like toilets. Sure, they aren't your property and you should be a bit suspicious about "hygiene" (security, etc, in the case of the laptop), but I absolutely expect to not be spied upon and it should be a crime to spy on usage of a company laptop once they allow it to be brought home.
In fact, when an employer expects me to take the laptop home with me I generally reject liability for its physical security I would generally push for access to a secure locker on premises to store it. If I go to a bar after work, I don't want to be concerned with company property, I don't want to carry around anything more than my wallet and phone. There should be consideration for me taking care of the physical security of company property if they are unwilling to provide secure storage in the office. The bare minimum of such consideration would be the understanding that I can use it for (limited) personal use at home. I can make personal exceptions for limited times I have some kind of on call, but my general norm would be to leave company property on company premises.
So yeah, if you are going to issue laptops to students that you expect them to assume responsibility for, you should provide some kind of consideration over just the "opportunity" to do school work at home. Leave that for school hours. I do recall some teachers talking about how homework prepares one for the real world when the sad reality is you should be trying to find employers that can provide you with a better work life balance than that.
These are my norms at least, and I think they are reasonable. If the company wants to get something (me taking the laptop home) then they need to give something (absolutely forbid involuntary remote full administrative access, that is give me privacy).
The high school I went to (about 5 years ago) had a laptop program, and every year when laptops were given out to the new students one of the senior students would go around and teach everyone how to wipe them. Administration obviously weren't particularly keen on this, but what are they going to do, suspend the entire school? Confiscate over a thousand laptops every week to re-install their spyware? You just need to get buy-in from enough of the students to make any retaliation implausible.
I think this process was a lot easier at the school I attended as it was a very tech-focused institution to begin with, but kids are only getting more and more technologically-minded as time goes on, so getting that buy-in should be doable.
Isn't the fig leaf of "it's stated in the ToS that the user read and understood" the only reason such software is legal? Once you admit the student has no knowledge of it, how is it different than the RAT stalkerware people go to jail for?
Classing OkHttp as "Medium Risk" is ridiculous (especially since under the hood it's been the default HTTP library on Android since something like 5.0). That alone signals that the authors don't have the the skills or expertise to carry out this study.
It's a shame - since I bet there is definitely data being leaked places it shouldn't be in apps like these, and a proper investigation would be interesting.
Hardly a shocker. Google has been successfully pushing their classroom.google.com at school boards for several years. Schools of course don't ask many tough questions and (I suspect) when installing/setting up it's next-next-finish. Students (and parents) really don't have a choice if their school advocates using the service.
Glad my kids have long graduated so I haven't the need to fight to keep Google's hands out of (our) children's lives!
They're already Google, so are not a third party. In this case it's at least clear and obvious that Google is being trusted with student data. And being Google, they already have in-house services for ad tracking, analytics, and what not. You're still sending data to Google, but at it seems less likely it'd then be sent out to other third parties with unclear privacy policies.
Google's Ad unit should have no access to the data generated from the Classrooms sites.
Who are the worst offenders? How do I know if I’m affected?
This is also a baseline, not the endgame. Software freedom is a necessary but insufficient condition for user freedom. I wrote about other conditions as well. HN discussion: https://news.ycombinator.com/item?id=25982860
One of my email addresses somehow ended up as the main parent address for a random student at Institut Els Pallaresos, a Catalan school.
To be clear, I have no connection to this person, the emails just started coming out of the blue. I've chased the school to stop sending me emails; they said they'll update the email on the account, but nothing changed.
I currently receive timely updates about this child concerning the following:
* school events
* grades
* misbehaving in school
* missed classes (the kid skips a lot of classes btw)
* performance
I am also able to use my email to sign into the account on ieduca (the software platform the school uses) and see a bunch of personal information (e.g. home address).
I've repeatedly pointed this out to the school and they've done nothing about it. At this point I've resorted to sending all emails to spam.
Have you considered contacting the kid's parents about this?
Some people might think a non-cloud based solution for a school would be better, but would almost certainly be worse. Schools are terrible at IT, security, updates, provisioning, etc and very quickly, it would be hacked, if not by external people, than by one of their own students.
My biggest concern is that there is no mention of G Suite Education or districts using Google-branded products (e.g. Google Classroom, Google Meet, Gmail), presumably[1] with an agreement that limits data sharing. Without distinguishing these use cases, it is hard to take the article seriously.
If taken seriously, the graphs comparing Android and iOS apps (buried in the actual report, Figure 11) would be completely damning:
> Android apps are about 8 times more likely than iOS apps to include very high-risk SDKs. Android apps are 3.5 times more likely than iOS apps to include high-risk SDKs.
[1] Evidence that this does not exist would be interesting, but I would be very suprised to find out that large districts have no such agreements. Small districts? Sure, they are at the mercy of the vendor.
[2] EFF article from 2015 saying at that time information was shared for non-advertising purposes. https://www.eff.org/press/releases/google-deceptively-tracks...
I have worked for both a municipal government and school boards. The difference in attitudes is astonishing. At the government level, the agreement is not enough. Confidential data, including personal information, must be hosted on servers within the country in order to ensure the data cannot be accessed by a third party without legal recourse. For school boards, an agreement suffices.
So for as long as you're not sending PII, you're in the clear.
...However, it's actually allowable to send PII if the sending meets the following criterion:
- Provides a service or function that the school would otherwise use its own staff
- Be under the direct control of the school with regard to the use and maintenance of the PII from education records
- Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA
- Not re-disclose or use the education data for unauthorized purposes.
1: https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-...
The parents should know -the details- and consent. Every school district should be required to provide full details of at least: provider, data collected, anonymization status, all parties with access to data, and for how long. And District and parents must be notified of any changes in very short order.
That way the District must be aware of it. The providers and District should also be appraised of their possible lliabilities: 1) If they don't provide that information, 2) If anything goes very wrong. Which is quite likely.
This seems like an important conclusion because most schools do not use Android. I run and edtech startup and we don't even have an Android app. No school has ever asked for one (individuals have, but not enough for us to build one). Most schools use Chromebooks or iPads.
I don't remember all the details but I remember feeling alarmed by how much they can learn about you, and haven't ever used one since.
I think it would be great to look at some benign hypothetical software platforms, with students, and run through this same exercise to understand why data protection matters.
If you say "do not consent" can you still use the application in the same way? Can you refuse to use the tool? Without impacting career or school results?
I still don't get why this kind of data protection is not more common especially for things like education.
It seems irresponsible not to report what they reviewed clearly.
Full disclosure: I recently finished reading "The Age of Surveillance Capitalism." While I understood the gist of the situation, the book shifted my paranoia even further.
I would've expected this to be closer to 100%, honestly
I see a lot of sentences like this with wrong prepositions. It should be "sending ... to" third parties not "with" them. I see this error far more often than other errors and no one seems to object. "On accident" (it should be by accident) seems to be common parlance now.
Are we changing how prepositions work?
When I went to University a few years ago no alternative was offered for almost all programs we used, even third party. Online submissions and gradebook (hosted canvas), anti-plagiarism (usually turnitin), etc. All these critical or straight up requires services I had to agree to. Maybe if I had made enough of a fuss I could have got an exemption but there was no easy way.
I'd argue in privacy-related legislature like the GDPR students should be treated as incapable of consenting (to services used with their school), similar to how children are incapable of consenting to sex.
With such a weak regulatory environment, the result is fairly expected. GDPR and data protection is not just a Google and Facebook thingy. My privacy needs to be respected by both big and small players.
Basically the same options citizens have, but at a much smaller scale, meaning individual contributions matter more.
However, data that is not considered PII isn't an issue, so even if you chose to anonymize yourself, they can still use Google Analytics to track your behaviors and remain compliant.
https://blog.nucypher.com/todays-kids-need-end-to-end-encryp...
If the phrase "end-to-end encryption" means strictly from network interface to network interface, without regard to application layer concerns, then part of the conversation is already missing.
But then all you've got is unaltered human speech flowing from one human to another, with no data processing to chop it up, calculate on it, conditional logic based on it, nothing! It's quite a conundrum.
How can you possibly make such an assessment?
I don't think you have any idea whether any of these students has even tried to find harm; but, even if you do know that, the inability to prove harm is a legal standard, but it's a far different thing from no harm being done.
(I just recently read Rothstein's The color of law, which makes clear, for example, the situation in which people of colour today find themselves, where I think any reasonable person would agree that they have clearly been harmed by long-term racist policy-making in the US, but where there is no one person who meets the legal standard of having done them harm, and so no-one from whom they can seek legal redress.)