Hacker News Reader

Comment by quadrifoliate | Hacker News Reader

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in...

This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks.

The correct solution here is not technological at all. Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Emphasize stories of previous data breaches involving educational companies [1], and show officials that they are putting students' sensitive data at risk. (Edit: See the important point in the reply from 'n8cpdx below about the correct tone to use in your comments – don't repeat my words verbatim!)

The technical details don't matter too much to educational officials – as soon as the "Chromebook = bad spyware" label sticks and they think that a fuck-up here could cost them them bad press, they will allow their IT department to make more privacy-respecting technology choices even when those choices cost a little more. If no one speaks up, it's a race to the bottom driving us closer to the fiction in The Right to Read [2].

----------------------------------------

[1] https://techcrunch.com/2021/11/22/smarterselect-exposed-mill...

[2] https://www.gnu.org/philosophy/right-to-read.en.html

View on HN

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this.

Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part:

- Following this advice and using a tone that even resembles the tone of the comment or the original post will make you look/sound crazy. School boards (government boards in general) are used to seeing vocal, crazy people and are good at not taking crazy people seriously.

- “spyware” is not something non-technical understand. Just invoking spyware is going to make people think you’re crazy, not motivate them to fix the problem.

- Normal people do understand things like ownership and consent (approximately, anyway). It might be better to highlight the fact that you own the laptop, your child cannot possibly consent to such monitoring/software being installed, and that you weren’t notified.

- Normal people understand things like subscription costs - why should the school district be paying a third-party service to monitor a device that they don’t manage. By installing management software on your child’s device, are they assuming ownership and _liability_ for how that device is used outside of school?

- The whole chromebook=spyware doesn’t really make sense unless the only comparison is Linux; and if your kid doesn’t understand privacy issues on a chromebook, they definitely won’t have a good time with Linux. The IT department could have just as easily installed similar spyware for Windows or macOS.

Realistically what probably happened here is they have slightly clueless people who installed standard-issue software without thinking to check if the student actually owned the chromebook, because they probably dealt with a hundred other District-issued devices that day. When you run into that kind of bad outcome from human frailty, it is better to treat it as such rather than complain to the board that the sky is falling.

I agree one hundred percent with this commenter. They are absolutely right – don't use the tone that I'm using on HN! I did not structure my HN comment from the point of view of how to present it for public comment; and the tone if used verbatim will mark you down as "tinfoil hat crazy person who we should ignore", as the parent correctly points out.

Definitely don't use the term "spyware". Try to assume the persona of a reasonable, slightly conservative, and concerned person who is worried about data privacy why public money is being spent on subscriptions to companies who collect a lot of it, but are not local or accountable. Highlight that you understand that choices are difficult, but that the school needs to do better and be more accountable to parents and students, especially in an age where personal data has become so important.

Even better, contact other parents ahead of time and see if others are concerned. Expand your group of concerned people by following their natural networks and start collaborating on a joint proposal.

Ideally you can collectively find a workaround (start by emailing IT, as someone else suggested, if that doesn't work, maybe schedule a meeting with someone more influential -- either way, the aggregate wisdom of your parent group will come up with more creative solutions than us at HN). Once you have a solution, craft a flyer and send to all parents: "This is what we saw as a problem, and this is what we did about it. Contact us if you want help."

If all else fails, stand up together in the board meeting.

Democracy does not require permission.

> Following this advice and using a tone that even resembles the tone of the comment or the original post will make you look/sound crazy.

Thank you. Also, please ignore every comment in this thread suggesting you lawyer up or go to small claims court. The laptop isn't ruined and can be reset whenever the OP wants (as they already established).

If you go in guns blazing to the school board, the school is going to go into full defensive mode. Once you've established yourself as the aggressive parent with an axe to grind, they're not going to be interested at all in working with you.

If you actually want to get anywhere with this, start with a friendly e-mail to the school's IT staff. Ask them how your child can do their schoolwork without putting the laptop under school control. If you go in with a reasonable approach, you might get a sympathetic IT person who will walk you through the situation and explain the options.

> Realistically what probably happened here is they have slightly clueless people who installed standard-issue software without thinking to check if the student actually owned the chromebook

That would be my first assumption. I would even guess that they aren't keen on having yet another license tied up on a student's device somewhere.

Don't immediately rush to assumptions of malicious intent, don't think that making a scene at a school board event will further your goals, and definitely don't take any of the suggestions here to lawyer up or otherwise waste a lot of time and money on a legal fight that you will surely lose.

> The laptop isn't ruined and can be reset whenever the OP wants (as they already established).

I take it that it's fine that I install a microphone with a transmitter in your ceiling fixture so long as I do 't damage the fixture itself.

> Don't immediately rush to assumptions of malicious intent

Is there a good reason to doubt that the intended purpose for installing the software was to use its advertised functionality?

If they thought the laptop was school property, then comparisons to wilful intrusion into someone’s house is hyperbolic, and no it wasn’t malicious. It would be more like if the cops had a valid warrant to track a suspects car, but installed the tracker in the wrong car by mistake.

Best to establish the facts first.

Installing monitoring software (spyware) on a laptop that is owned by the school is legit only if you consider the student exactly that: a suspect. In that sense, your comment is spot-on.

Following that logic, the act itself does not seem malicious. However, the logic of seeing students as suspects is.

I have a sort of extremist take on this: students are literally prisoners. The job of a high school is to keep students from harming each other, feed them, and occasionally teach them something.

It’s why one of the highest offenses is to leave school grounds during school. Ditto for prison.

In that light, of course students are suspects. They’re already guilty of not being adults. They’re not allowed to have jobs, or to decide what they want to learn, or any of the other things that make adults human.

I don’t know what to do about it, but recognizing it seems step one.

> students are literally prisoners

You're being downvoted, but I often felt exactly this way throughout my school years.

> However, the logic of seeing students as suspects is.

Is it? I don’t think I know any high school student that hasn’t tried to muck with, or work around, the schools systems.

And "solving" that "problem" is not a good thing.

That's fair, I'm not saying they are right to do it in that sense.

> If they thought the laptop was school property, then comparisons to wilful intrusion into someone’s house is hyperbolic

So if you're renting an apartment from me, I am right to spy on your children with my ceiling bug?

> It would be more like if the cops had a valid warrant to track a suspects car, but installed the tracker in the wrong car by mistake.

The school is not a police force; nothing warrants their privacy intrusive surveillance of my children without my consent in the first place.

> If you go in guns blazing to the school board, the school is going to go into full defensive mode. Once you've established yourself as the aggressive parent with an axe to grind, they're not going to be interested at all in working with you.

Too bad! They can be voted out, or face lawsuits if a heated attitude is too much for them that they feel the need to ignore valid feedback regardless of the emotions involved.

I've heard the same argument used for angry minority communities in the past, so this very much applies here as well. Heated rhetoric school boards are seeing today are reminiscent of a body that isn't listening.

The question I like to ask myself in instances like these, when I'm pissed off at what I see as unreasonable attitudes and processes, is this:

Do I care more about making myself feel better by airing my grievances in whatever way suits my fancy, or do I care about a specific outcome?

If it's the latter, then the best thing to do is to figure out who is in charge, and, critically, the right way to talk to them in order to get the response -- and hopefully the outcome -- I want.

Sure, I could turn this into a crusade to vote out the school board and replace them with... who, exactly? The kind of people who are qualified and likely to get elected are probably pretty similar to the people there already: not too technically-inclined, and not willing to put up with an aggressive attack from parents. Even if I did manage to find and elect a school board that would take this kind of issue seriously without needing much prodding, by the time I went through this whole process, it'll be... a year? Two years? More? The ship will have sailed, and my hypothetical kid will have leaked all their private data to the school's nanny software already.

So hopefully I'd instead do the smart thing, approach the school board in a way that resonates with them, and get the outcome I want.

> I've heard the same argument used for angry minority communities in the past

I don't think this really applies here. Most "angry minority communities" are fighting for things that are systemically stacked against them, and often the "polite" approach doesn't work. But we're not talking about systemic oppression here; we're talking about an overworked, underpaid school IT department that doesn't have much choice in what they do, directed by a school board that doesn't understand the issues involved.

This! The most important thing I'm asking myself: What do I want to achieve? Does "yelling" at people rises my chances in achieving this? Later on, when my immediate goal is achieved, I can decide do I care enough to follow up or not. First things first - sort out your priority.

>Too bad! They can be voted out, or face lawsuits if a heated attitude is too much for them that they feel the need to ignore valid feedback regardless of the emotions involved.

Only the world doesn't magically grants wishes to Kens and Karens, just because they feel strongly about something and how right they are. The person taking that board to court or trying to vote them out could just as trivially lose.

They can't be voted out by you alone though. And what he wrote about the school is just as true for the majority of other parents.

> Following this advice and using a tone that even resembles the tone of the comment or the original post will make you look/sound crazy. School boards (government boards in general) are used to seeing vocal, crazy people and are good at not taking crazy people seriously.

I agree with the general point of your comment but this is simply not true any more. I’m not sure it was ever true, but recent coverage of school boards and environmental review public consultation throughout the United States demonstrates that it certainly isn’t true in 2022.

Totally agree with you in every way except your last point. IIRC, the administrators of a Google Workspace domain have almost complete control of the accounts created under it. For example, they're able to make sure that each account comes with preset Chrome Web Store extensions or they can limit or completely disable your control over your account. So, unless the school board locked down the Chromebook itself, (which I don't think they can unless they actually own it) these restrictions and the spyware would've been automatically "installed" on OP's kid's account and shouldn't be active/installed when you're logged into a privately owned Google account. All in all, the way Chromebooks work is unconventional and sometimes very annoying.

If I recall, the language that's used in situations like these is something along the lines of "Personal electronic devices will be governed under this policy when such devices are attached to the CPS network." So .. it's a "as long as you're going to connect to the CPS controlled network / resources, you must have software protections / controls in place".

Except it sounds like the spyware is still installed even if they log in with their personal account? The isolation principle is violated. It's a huge security hole.

I have a huge smile reading this comment. Thank you. Far too often the tech community gets totally lost in their own world. A world that 99% of people don’t inhabit.

> “spyware” is not something non-technical understand. Just invoking spyware is going to make people think you’re crazy, not motivate them to fix the problem.

It's also vague. Make sure parents know exactly what data is being gathered, and who gets it. And point out that this is being kept hidden from both children and parents - if the spying is above-board, then why doesn't the device give a big "All your chat messages and internet activity is being monitored by XYZ, even outside school hours" notice at log-in?

Was the existence and extent of this spying communicated in any clear way, by the software or by the school, or buried deep in a click-through agreement?

The biggest thing is that if you are calling to complain, then you will IMMEDIATELY be discredited. They don't have any reason to keep you happy, so complaints mean absolutely nothing. You cannot come with complaints - you must come with a solution, already prepared, such that it is easier for them to implement the solution than to not. People will always, 100% of the time, take the path of least resistance - actually make the path not resistant at all and it's the only way you can convince anyone to do anything.

It seems like the path of least resistance here is “only use school equipment to access school accounts”, create the kid a non-school Google account, and only use non-school accounts (his and others) on the private Chromebook.

I find it annoying but acceptable that my work account doesn’t function on my non-work computer.

I find the behavior as implemented entirely unacceptable. My work has Google apps and that caused a Chromebook I was using to immediately jump to managed by the company as soon as I logged in with my work account despite having no intranet/etc and no one intentionally configuring anything. It would never allow me to do regular processes for the chromebook's management even after full resets.

The whole point of a restricted boot environment is to have multi user with proper separation where one user can't accidentally compromise the system. If an org is still unhappy mixing with other accounts or being on user provided hardware they should be able to block that. Stealing hardware and implementing anti-theft rules that should apply to verified org provided hardware on first login is a crime.

Years ago, I debated Chromebooks as a solution for older relatives. Now I shudder to think what would have happened if I had and one of their nieces/nephews or grandkids had something to show them from school.

Having seen the absolutely atrocious screens in the school furnished chromebooks I half believe Vtech put higher res screens in their 90's kids laptops.

Bring this concern to the school board: Say your child is making homework all alone, in their room, total privacy. Is it true that the monitoring software can at that moment look at the webcam and listen in to the microphone's audio? If no consent was given, that should be pretty bad for the school board.

> The IT department could have just as easily installed similar spyware for Windows or macOS.

Just a nitpick here, yes school IT could do a remote install of spyware if the user was privileged and agreed to it. But a privileged user could also uninstall it. Which is not the case here. In my experience with MDMs the school has to physically have the laptop to install a permanent MDM or purchase the laptop and provision through an activation portal. My experience has been Intune Autopilot and ABM.

Google Work MDMs was notorious for remotely wiping personal devices which is why I never allow work to install MDMs on my personal items.

I've worked in IT support and had issues with parents who let their children use their work computers for school having the chrome browser locked down by the school.

The only fix that worked was exporting the logins and passwords, deleting them from Chrome, and then reinstalling chrome with a different login. I don't want my coworkers work data in the hands of their children's schools' IT dept, and I've let them know that this can count as a data breach (fortunately, so far none of them have been privy to any important data).

Suffice it to say, don't let your kids use your work laptops, and don't log into your child's school accounts on your work computer.

This should be really obvious but apparently it is not.

>- “spyware” is not something non-technical understand. Just invoking spyware is going to make people think you’re crazy, not motivate them to fix the problem.

Even if you say the school is installing stuff that allows them to monitor your child instead of using the term 'spyware' that may not be too compelling, I suppose a lot of parents will reflexively think - so, that's the school's job.

Thus the need to focus on how these things have been misused in the past, maybe say it's their job to monitor your child during school hours, but after school hours it's your job.

Also note how you bought the computer, it is your property, you can use it how you wish, if they want it to be otherwise they should buy the computers for children.

Use examples that help non-technical parents understand e.g. anonymous spyware employees can now potentially spy on your children while they’re getting dressed.

Brilliantly written feedback, I hope folks take it to heart.

The other thing is add is the only way to impact the school system is to create an alternative (private or charter) or get your own people on the school board. Or if you’re really rich, hire a lawyer, but that’s kind of an %sshole move because then the school district has to either cave to everyone hiring a lawyer, or fire the music teacher to pay for legal defense.

School choice would do a lot of get schools to compete and be the best possible.

Charter schools is something we use now. Hardly perfect but it’s a lot nicer.

Charter schools leave a lot of kids behind, especially if they have special needs.

Depends on the charter school. In New York the Special Ed kids at Success Academy outperform Gen Ed kids citywide.

Not the OP but: IME, in EU, being tough, not vocal, and being threatening legal actions with serious bases works very well, most institutions know they have skeletons in their wardrobe and they do not like to face someone who is not crying but very decided to hit with all legal means, especially if there are also ideological motivations.

Spyware is a very well generally understood terms: someone breach someone else privacy deliberately, witch means complaint, court and uncertain results for those who decide to spy. Surveillance capitalism is ignored by most, but known as evil so once someone talk about that pointing out the finger to a school, not a hyper-giant player, people arise likely. They imaging in their mind a naked child spied via the webcam etc in an instant. While they do normally not understand nothing about ownership and consent on "digital stuff".

Oh, BTW what "realistically happen" have exactly zero meaning: the possibility of doing so on not managed computers means a built-in RCE so big that such products must not be on the market. Remote control of desktops must be deployed on purpose not came pre-installed from factories because anyone can use a pre-installed system in place. If that's true at least in EU, there is room for legal action against the OEM, not only the school.

> When you run into that kind of bad outcome from human frailty, it is better to treat it as such

I take it, then that, you would not bother to do anything about the descent down the slope to uniformity controlled by MAMAA?

> Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account.

Nonsense. They were designed to implement required policies when someone logs into a managed domain. Unless you're logging into something like that (where disclosures have been made and consent has been obtained) then there's no "dystopian spyware" involved. Absent any domain management policies, Chromebook are basically fancy thin clients that make efficient use of web-based services.

That having been said, the OP either conspicuously failed to mention that such disclosures were made, or (and this I find to be much more likely) the school was dumb enough to think they don't need to disclose anything because like a lot of school systems, they have gotten the curious idea that they basically own the kids and that the kids have no rights whatsoever. Should that be the case I hope a judge spanks them soundly for it because yeah, they absolutely do need to disclose this stuff to the students or the first time there's a serious problem due to abuse of the monitoring system the school is likely to get very, very pantsed for facilitating child abuse.

Agreed, domain admins can also lock down Windows, iOS, Android, and MacOS.

The school is effectively making the computer a terminal into their system. Their system, their rules.

I know the OP won't like this answer but the OP should buy their kid another computer for their non-school activities. Of course they could also complain to their school/district to change the polices. Personally, I'm used to it. I have a personal computer for my own use and a corp computer that's managed by corp and is locked down. I don't complain the corp computer is locked down (except when it gets in the way of doing my actual job). For all personal stuff I use my personal computer.

That corp computer is owned by your employer. If instead you are a consultant who does work for several clients on your own machine, then it would be unreasonable for them to lockdown your personal machine. Instead, if they want you to use a more secure solution, they should provide the computer.

In my company setting up the office email on our personal phone is optional. But if we choose to do that, they install this entirely new 'profile' with work apps and controlling software on that in the name of security. I chose not to install it, but some would surely do it. Probably no case can be made against them as they don't force their employees to install mail on their phones.

I did that for convenience (though now I removed it), but the work profile seemed to be well compartmentalized from the personal part, and there was a strong emphasis on this fact before the installation process. If they were to wipe it, only the work profile would be affected. I fortunately never had to try it...

Right, but if you add your account to their organization so that you can get onto their network dont be surprised when they push policies.

No but if you add their MDM to your personal PC they can push policy to it.

"The school is effectively making the computer a terminal into their system."

I agree with this. If you had an rdp / citrix / ssh session to your employer you'd expect them to control what's on the other end. A Chromebook on which you're using a work/school account is much closer to that experience than a PC, but with the lines unfortunately much more blurred.

> consent has been obtained

Has it been, in this case? If a parent says 'I do not agree to this', then what? Will the school district swap the system out for one that doesn't require end users to waive their legal rights? Has that ever happened when a parent objected to one of these EULAs, even once?

Not to mention, consent can be revoked at any time in the future without reason. Giving consent once does not mean you have consent forever.

The school district should give the student a (locked down) computer. No waiving of legal rights is necessary.

One solution could be to setup the laptop with a personal email account and configure the school email address to forward everything.

If the student needs to use a Chromebook for school, that won't work. On my daughter's Chromebook, every app and website is tied to the account. It's not just a question of forwarding email.

You can have multiple accounts on a Chromebook.

As others have mentioned above, GoGuardian is at the device level, not the account level.

https://news.ycombinator.com/item?id=30915660

Yeah, I’m assuming a lot about the ability to do what you need to do without a school account.

Not really applicable with the Chromebook, but in general I guess the safest thing is to log in to the school stuff only from a VM? (At least that way the damage is limited.)

> Chromebook are basically fancy thin clients that make efficient use of web-based services

This reminds me of Asimov's Multivac home terminals where every user, in the comfort of their home, could dial in a query on their computer terminal and the massive infrastructure which is the continental-sized Multivac computer will respond with an answer.

> they absolutely do need to disclose this stuff to the students

In this case the student is not the owner of the Chromebook. They need to disclose this stuff to, and obtain consent from, the parents before taking control of the device.

> (and this I find to be much more likely) the school was dumb

It makes me cringe that this is an accurate assessment of how our educational system is run.

This is some bad advice. No need to escalate the situation. Simply contact the sons school and find out who the technologist is and ask them for help. Explain to them the situation and I'm sure they will understand. The computer is personal so they don't want it under mobile device management.

I have some experience with schools. The school is not intentionally installing spyware. Further most public K12 organizations have IT departments are not going to be as well staffed/knowledgable as your average silicon valley tech company. So they may not know exactly how to rectify this situation. No need to berate the school board over "spyware."

Oh no, there's no way the school system didn't know they were installing monitoring software. It would be fairly reasonable for them to require that in the context of students logging in to access and use school resources (i.e. lessons) and to keep them from just goofing off.

What is not reasonable is the very real possibility that they might have overstepped and made these policies active for all logins on the device, or that they failed to properly disclose what exactly happens when the user uses the domain login. That would then make what's been installed very worthy of the term "spyware" and would probably make both GoGuardian and Google upset with them because it's unnecessarily heavy-handed and pretty much guaranteed to bring bad press.

Part of the reason these things are so locked down is so that management policies can be applied to ONLY the logins that require them without impacting the entire device all the time. If someone tries to sidestep that by grabbing root access and messing with the trusted environment, when the user logs into the managed domain the machine is going to report that its environment has been tampered with and that should pretty immediately bring use of any domain-managed accounts to a halt. You wind up actually jumping through the same hoops (although more discretely and without involving logging/reporting of browser history) when you use your bank's banking app or have Microsoft Teams/Outlook installed on your phone. Both of these things absolutely require their data be kept separate from the rest of the user's data, and very carefully protected from the other apps on the device.

I agree. What I should have typed instead of "The school is not intentionally installing spyware." Is they probably did not intend to install the spyware on personal machines of students that logged in with their school Google account. Perhaps there is a management policy misconfigured or the student got confused and enrolled the device.

From my understanding if you setup a personal chromebook you can then login to Google Classroom via the Chrome browser and it should not enroll the chromebook in MDM. At least when I login to my chromebook it does not enroll my device.

GoGuardian is an extension tied to the user and installed at login. This extension only runs on chromebooks and does not know which device is owned by who.

> I have some experience with schools. The school is not intentionally installing spyware.

Our highschool had a bunch of laptops. They were the firstish gen of mac laptops with built-in webcams. This was all very new.

These laptops would take a picture of the user at every login and then once an hour or so after that. I guess the principal wanted to know who was using each machine in case anything unclothe was done with the laptop. The pics were stored on an FTP server (not FTPS. Not SFTP. FTP.). The FTP account had RWX on the directory where all login pictures were stored, and the FTP server was exposed to the internet. A simple MiTM on any network where this laptop connected would give the attacker full read access to these login pictures.

The problem: these laptops could be "checked out" for an evening or weekend. So they got around. Hotels, restaurants, libraries, coffee shops, etc. But also student's bedrooms. This was in the days when most public wifi was just a commodity linksys router behind the register and you could more-or-less safely assume you were being MiTM'd when connecting to a public wifi network.

So, long story short, a principal with bad judgement and an IT admin with just enough googling skills were uploading pics of students in their bedrooms to an FTP server that was almost certainly hacked into by dozens of different people. Without consent or knowledge of the students or parents.

When I raised this issue, the principal suspended me. Getting the suspension reversed required going to central office, who were totally unaware of what was going on and were, obviously, appalled at the picture taking script.

School IT staff are often knowledgeable enough to be dangerous, and individual school administrators often demonstrate remarkably horrible judgement. I understand the "be kind" sentiment, but there really is a lot of inexcusable incompetence and poor judgement in K12. We should hold those systems to a much higher standard than we do.

> The school is not intentionally installing spyware

Citation needed.

Here is a counter citation: https://www.vice.com/amp/en/article/8xwze4/schools-are-using...

And here: https://amp.theguardian.com/commentisfree/2021/oct/11/us-stu...

Schools are doing this. They are intention into installing spyware and GoGuardian is one of the biggest offenders.

This should be brought up at the school board.

Please don't follow this advice. Frothing at the mouth about spyware on your kids computer will immediately be dismissed as insane ravings, and possibly get a visit from your local child safety organization.

I recommend reaching out to your child's teacher, and ask to get connected with the IT team at the school to explain what's going on.

>Please don't follow this advice. Frothing at the mouth about spyware on your kids computer will immediately be dismissed as insane ravings, and possibly get a visit from your local child safety organization.

I don't think parent described 'frothing at the mouth', and furthermore the concept of "I shouldn't speak out otherwise I may paint myself as a target for child protective services" is so subversive and nu-speak like that I don't think I can ever support it. CPS is supposed to be a social service for the support of children; not a society control and opinion-steering organization.

If parent did something publicly that'd warrant the visit, sure; but creating public awareness of the situation for the parents can be done in an orderly and respectful way -- no one suggested otherwise.

Speaking out is not something that puts you at risk. Showing unstable behavior by escalating a simple technical support issue into a rant about ‘spyware’ at some board of Ed meeting tends to raise eyebrows though.

Asking “Does anyone know how to refer these people to law enforcement for prosecution?” regarding a technical support issue is not respectful or orderly behavior.

From Wikipedia [1]:

> GoGuardian products allow teachers and administrators to view and snapshot students' computer screens, close and open browser tabs, and see running applications. GoGuardian can collect information about any activity when users are logged onto their accounts, including data originating from a student's webcam, microphone, keyboard, and screen, along with historical data such as browsing history. This collection can be performed whether students connect from school-provided or personally-owned devices.

I can only describe this as, well, spyware. No need for scare quotes. The OP has every right to be angry about this.

To describe this as a "simple technical support issue" is some blatant euphemism.

[1]: https://en.wikipedia.org/wiki/GoGuardian

A pedo-criminal hacker's wet dream. If one manages to compromise accounts of some teachers, or worse, some school admin accounts, or is an insider at the school or GoGuardian itself...

And before anybody says, that things like these only happen in the movies, or bad crime TV shows... they do happen in real life as well. I remember a case here in Germany, where somebody had managed to install RATs on ~150 school-age girls' laptops, tho using some spear-hunting, and when he was raided, police found a large collection of videos he had recorded with the girls' webcams[0].

That there are sexually-motivated hacks should be clear to the wider public at least since the so called Fappening.

As for insiders, NSA staff spied on ex-partners, love interests and spouses[1], to a degree where they internally coined the term "LOVEINT" for it. If the paranoid NSA cannot "manage" their own people, then what chance would a GoGuardian or school have, I wonder.

[0] https://www.t-online.de/digital/sicherheit/id_42278570/hacke...

[1] https://www.reuters.com/article/us-usa-surveillance-watchdog...

Having a 'right to be angry' doesn't mean being angry is the tactic to further one's goals.

My point was that the parent comment was downplaying the significance of the problem and shifting blame on the victim with statements like this:

> escalating a simple technical support issue into a rant about ‘spyware’

The right tactic for objecting to school officials was besides my point.

Calling unremovable* spyware (the term is accurate, no matter how insane you think it sounds) a "technical support issue" is like calling surveillance cameras installed in your home an "improper furnishing issue".

*Edit: sokoloff may be correct, and the spyware is not unremovable. Still, the analogy holds.

Is it unremovable from the device, though? It isn’t clearly defined in the account above whether it was removed (and then reinstalled with the subsequent kid’s login).

Yes. It would be re installed at login

What is accurate or not in some platonic sense doesn't have much bearing on what tactic will yield the results you want in practice.

CPS does not really have a traditional school board and it’s not elected either (appointed by one of several mayors who ran on an elected school board and then reneged). OP can shout their complaints out over Lake Michigan for the same effect.

A few minutes of Googling showed me this upcoming meeting https://www.cpsboe.org/meetings/details/2329 on April 27th, 2022. It seems to be a Chicago Board of Education meeting, and seems to have options for public participation.

Do I have this wrong? I'm not from Chicago or Illinois, so that's quite possible.

You can indeed attend and raise concerns but it will likely be ignored. Nobody is worried about losing their seat if they ignore constituent complaints.

Yeah, I don't really know how the Chicago school board meetings go, but I watch the MTA board meetings. (The MTA is New York State's public transportation agency.) They have a public comment section where you get 2 minutes to say whatever you want. These rants are usually completely incoherent and I doubt any board member could remember a specific point from any one of the commenters. I watch them all and I certainly can't. The law requires that you be allowed to speak. The law does not require the board to take any action on your comments, or even remember a single point you tried to make. ("I've said it before and I'll say it again. Democracy simply doesn't work.")

That said, my advice here would be to keep it short and non-emotional. You can speak for two minutes, but you don't have to use all two minutes. Say what's wrong, what action you want the board to take, and how interested board members can get ahold of you.

Out of curiosity, why do you watch them all? Especially if you can't remember anything?

I watch the comments sections, even if they're silly, to see if anyone has anything interesting to say. Someone might, someday.

I watch the board meetings in general because the subject matter is interesting and there are neat details in there that don't get widely reported. Recently they had some slides with security camera footage of someone riding their bicycle on the subway tracks. No idea people did that. Also, the point of the board meetings public is to provide the public with some oversight. If you don't actually watch them, then there is no oversight. (I guess we hope that "someone else" does this for us. Transit reporting is not what the best journalists necessarily end up doing.)

He is probably not watching the public comment section closely, but the other parts.

It's Chicago. Unless you have $$$$$ to buy access, nothing will happen.

The next step would be to approach a local news station and have OP report what he found, again emphasizing his own credentials.

Spyware and children in the same sentence easily bring up unpleasant thoughts.

Reminding people of stories where the school district employees were remotely enabling cameras and microphones should also be referenced.

https://www.computerworld.com/article/2521075/pennsylvania-s...

https://abcnews.go.com/GMA/Parenting/pennsylvania-school-fbi...

The Chicago Public Schools is an immense agency. Good luck getting anyone to pay attention, even at a school board meeting.

And referring for prosecution is really going to go nowhere.

Best bet, contact the public service operation for one of the TV stations, maybe a newspaper, and maybe your city council member, to wake up somebody, either at your school or at headquarters downtown.

Prepare to be disappointed.

It's also worth noting that Google is almost undoubtably violating childrens privacy laws, and other states are already investigating this... it's very possible what CPS is doing here isn't even legal. There's a lot of reason that the agreements schools are making to bring Google's platform in should be dragged out into the light.

Source: https://www.theverge.com/2020/2/20/21145698/google-student-p...

If they activate the microphone and pick up a background conversation, they could be found in violation of state or federal wiretap laws. At least one party must be aware that they are being recorded. I hope everyone involved gets held responsible and prosecuted.

to be fair microsoft does exactly the same thing.

I have intune on my personal ipad. And the idiots from our IT department accidentally wiped the entire thing. Just because I wanted to be able to read outlook mails. My iCloud was even blocked for a day or so. Despite their claims they can only manage the app itself and despite my protests that the fine print clearly indicates they could do so and that they should change their configuration.

At least I got an apology letter, but all these devices are desigend to be locked down by centralized IT departmens. Be it ChromeOs, iOS or Windows

RMS(Richard Stallman) was way ahead. Like him or not. He is right.

This just seems so over the top.

Whole point of Chromebooks is that they are minimal devices that can easily be adopted for school work. What I find strange is that OP had to buy their own machine. Anyway even if you somehow convinced the school to change to a Windows based laptops all you'd achieve would be a tier more expensive machines for the kids to use. The school would still require same "spyware" to be installed.

I remember not so long ago when people were using this advice on health care issues;

Call into the school's board meeting during public comment, and make it loud and clear that the school is injecting your children with 5G mind control vaccines. Share your technical credentials and the method by which you found this.

Sadly, my cousins' school forces them to have Chromebooks. Its required. So I ensured they know to never use it for their personal stuff, it's purely a school work device. Such a waste, but oh well. I gave them both Pi 400s for them to use for personal things instead

You’re deeply overestimating how much schools and administrators understand stuff. They are paying for this spyware and want it installed because they think it’s necessary.

Drop the school and homeschool the shit out of him. Go off book and teach him solar panel installation, plants and anything you can find in prepper books.

Be prepared for the possibility that majority of parents are fine with it.

Reply on news.ycombinator.com