All posts in Privacy

In a recent listserv conversation, a participant asked about the steps schools are taking to monitor student computer use. One question dealt with the frequency with which browser histories on student machines were parsed, not as part of any examination into any suspected incidents, but as part of routine supervision and oversight of students.

I've seen more threads like this than I can count. Much of the impetus behind the more intrusive forms of supervision comes from a good motive: the desire to keep kids safe. High profile cases power calls for more supervision, as do "consultants" who conduct seminars tailored for the fears of parents and administrators (as an aside, if I remember the research correctly, scare tactics have been shown to have limited effectiveness for a short time period with students at or around middle school age. Scare tactics don't do much for older students. If any of my three readers knows better info on this, please share it in the comments).

But -- as people who work in and with schools, as people who help kids develop the skills to make rational, meaningful decisions about the world in which they live -- when do we have a responsibility to push back against well-intentioned but misguided efforts that conflate security with supervision?

Within the last two weeks, there have been news stories about the FBI wanting access to geolocation data obtained from cell phones, and the FBI wanting to require ISP's to retain web browsing records for two years. As we have seen before, even access to anonymized search records show an incredible amount of information about an individual. In the recent past, there was some outcry against the government requesting borrowing records from public libraries, and the entire question of warrantless wiretapping raised some hackles.

But the outcry against intrusions on privacy takes place against a backdrop where it's normal to share a steady stream of details about your life. My concern is that, if we make our schools into places where "normal" means having your browsing history tracked daily, people will take that level of supervision for granted. For a child born in 2002, a government that uses warrantless wiretapping is part of the fabric of their lives.

As teachers, as parents, as people who run schools, as people who care about kids: how are we empowering kids to develop their distinct interests, to take informed risks, to explore freely, and to know that it's okay to have hopes, fears, and dreams that are private, and intrinsically theirs until they choose to share?

I was at Educon 2.2 a little while back, and at that meetup we spent a lot of time talking about what school can and should be. I have been working on a follow-up post about the session, but I sense that as I try to make some sense about what learning can be within a context where there is a growing tension between constructive guidance and overbearing observation, part of what we all need to learn is how to deconstruct the myth that being observed and tracked makes us safer.

Some thoughts after reading this piece in Wired (although this actual blog post could have been written anytime in the last few years).

Let's imagine that the US Government announced that they had started a web site. On this site, you needed to enter your personal information, including an address, and various interests. Once this was done, you could tell the government – via the web site – all about your day to day activities: what you read, where you were going, what movies you like, etc. Then, you could identify your friends, and upload pictures and video of these friends.

This is a small subset of what Facebook users do every day, by choice. Facebook is probably the single largest opt-in surveillance program ever seen. If any government ever tried to build a site like this – even with an ostensibly worthwhile goal, like mapping public services to people based on interest, geographic location, and perceived need – the outcry would be deafening.

Facebook's "services" – and I'm thinking specifically of Facebook Connect – extend that surveillance to what people do on sites outside of Facebook. However, Facebook's internal search – powered by their deal with Microsoft – will provide an enormous amount of raw data about what individual people want. Given that these searches will be conducted by people logged in to Facebook, the search strings used can be mapped to specific individuals. As we have seen before, even a little bit of information about search strings can lead to some awkward revelations.

When people get a glimpse of how much Facebook knows about them, they generally freak out. Yet, the freak outs subside, and people keep plugging away, adding more data into the system.

Okay, time to go. Need to update my status:

Adjusted my tinfoil hat. It had tilted precariously back, exposing most of my frontal lobe.

Over on his blog, Will Richardson has an interesting post on using the power of cloud computing. The comment thread also gets interesting; some responders conflate the idea of cloud computing with the more general notion of web-based tools and Software as a Service, but one of the other issues that gets either overlooked or undervalued is the issue of student and faculty privacy. It's also clear that in some cases, the terms and conditions of these services remain unread or ignored.

I left a version of this post as a comment on the blog, in addition to an earlier comment. As this comment has been caught in the gaping maw of spam prevention for the last 24-36 hours, I figured I'd post it here as well.

One commenter asks whether Google is liable for any data loss.

RE: "Do they (Google) have any liability for lost documents?"

No. See the Terms of Service

Two relevant sections:

"13. Warranty Disclaimer. CUSTOMER UNDERSTANDS AND AGREES THAT EACH SERVICE MAY CONTAIN BUGS, DEFECTS, ERRORS AND OTHER PROBLEMS THAT COULD CAUSE SYSTEM FAILURES. CONSEQUENTLY, THE SERVICE INCLUDING ALL CONTENT, SOFTWARE (INCLUDING ANY UPDATES OR MODIFICATIONS TO THE SOFTWARE), FUNCTIONS, MATERIALS AND INFORMATION MADE AVAILABLE ON OR ACCESSED THROUGH THE SERVICE, AND ANY ACCOMPANYING DOCUMENTATION ARE PROVIDED “AS IS” AND ANY USE THEREOF SHALL BE AT CUSTOMER'S OWN RISK."

and

"15. Limitation of Liability. IN NO EVENT WILL GOOGLE OR ITS LICENSORS BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, AND INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR INTERRUPTION OF USE OR FOR LOSS OR INACCURACY OR CORRUPTION OF DATA, LOST PROFITS, OR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, HOWEVER CAUSED (INCLUDING BUT NOT LIMITED TO USE, MISUSE, INABILITY TO USE, OR INTERRUPTED USE) AND UNDER ANY THEORY OF LIABILITY, INCLUDING BUT NOT LIMITED TO CONTRACT OR TORT AND WHETHER OR NOT GOOGLE WAS OR SHOULD HAVE BEEN AWARE OR ADVISED OF THE POSSIBILITY OF SUCH DAMAGE REGARDLESS OF WHETHER ANY REMEDY SET FORTH IN THIS AGREEMENT FAILS OF ITS ESSENTIAL PURPOSE; OR FOR ANY CLAIM ALLEGING INJURY RESULTING FROM ERRORS, OMISSIONS, OR OTHER INACCURACIES IN THE SERVICE OR DESTRUCTIVE PROPERTIES OF THE SERVICE."

The convenience of the service is also mentioned.

RE: "As soon as we go to Google Apps, all our students will have a similar conventional email address so all students will be able to use Docs, Calendar, GTalk, Reader, Sites, etc. in a collaborative way."

This type of comprehensive user experience makes an ideal terrain for data mining. One user ID can be tied to chat content, email content, various documents (both created and read) and links followed from all these documents. Additional mining can include looking at groups of students, and student surfing behavior based on time of day. This is advertising gold, and it gives some amazingly useful information about a coveted advertising demographic.

For a cautionary tale on privacy, see this post that goes over the recent Viacom suit against Google, and lays out some of the privacy implications. Imagine that a media company has detected copyright violations coming from within a district. Then, read the article linked above. Substitute "Google Apps for Education" for "youtube." Then, imagine your district's cost savings vaporizing faster than you can say, "I wish we had invested in our own infrastructure" as gaggles of lawyers flood your district. For extra fun, imagine the lawsuit involves students under the age of 13. Considering that you can sign into YouTube with your Google ID, it's conceivable that many students would use their school account for their personal video use.

Seriously, folks. Think long term, just for a second. We don't encourage our students to cut corners. We should have the same expectations for our critical infrastructure. Open source virtualization options exist; these options would deliver some of the same advantages of cloud computing, but without selling out student and faculty privacy as the price of convenience.

Update: My comment has been freed from the moderation queue, and the conversation continues.