The below post expresses concerns that are widely shared by parents throughout the country whose children are using programs like Zoom and Google Classroom that have not been thoroughly vetted for privacy and security protections.

by Joel Schwarz, Esq., CIPP

To say that 2020 has proven to be a challenging time for everyone would be an understatement.  Nowhere is this more true than in the education space where, with little time to plan , school systems around the country were required to convert in-person programs into remote educational programs, all the while wrestling with ensuring that children who rely on in-school meals still receive them, children’s special needs requirements are still met, etc.

Overall, school administrators, parents, and students alike have risen to the occasion in admirable fashion and deserve our gratitude and appreciation. That said, as the parents of students in the Montgomery County Public School (MCPS) (Montgomery County, Maryland), we’ve grown increasingly concerned about some of the technologies deployed to assist in remote learning. Two (2) companies in-particular stand out: Zoom and Google.

Our concern with Zoom stems from the fact that Zoom was never designed for the student/school setting, where there are special sensitivities relating to student privacy and data sharing, as well as FERPA and COPPA requirements.  While Zoom bombing (hijacking Zoom’s virtual meetings) has certainly been the most prominent issue in the press, other significant security and privacy concerns with Zoom include:

• Zoom misrepresenting the encryption it uses, claiming to use “end-to-end” encryption, which Zoom later conceded was untrue (in an April 4 interview in the Wall Street Journal, Zoom’s CEO conceded that he’d “messed up on security,” but would begin working on true end-to-end encryption). Notably, in May 2020 Zoom announced its purchase of Keybase, a company that specializes in encryption solutions. This doesn’t solve Zoom’s lack of end-to-end encryption, however, as it’ll take time to integrate Keybase’s technology, during which time Zoom will still lack end to end encryption;
• Zoom’s custom encryption is predictable, weak, and is vulnerable to cracking by hackers;
• Zoom’s encryption keys may be retrieved from servers in China, giving rise to a risk that the Chinese government can (and may already have) forced Zoom to share all Zoom communications;
• Zoom’s collection of information from students in excess of what is needed for purely educational purposes, potentially in violation of FERPA.

Interestingly, upon discovering problems with Zoom, a number of school systems walked back plans to utilize Zoom, including New York City public schools, Clark County Public Schools in Nevada, and schools in Utah, Washington state and beyond.  These actions were later followed by investigations into Zoom by Attorneys General offices of New York, Florida and Connecticut, to name a few.

Naturally, as parents of MCPS students, we raised similar concerns with MCPS.  Despite our requests, however, MCPS did not take action, nor were we provided with a look at the contract between Zoom and MCPS, or Google and MCPS (although we were given the option of opting out Zoom calls for our children).

We later learned that school districts in upstate New York had obtained more favorable terms and conditions from Zoom for their students, which any school district in New York can choose to opt into, including an agreement by Zoom to “delete any student, teacher and principal data it had collected or stored when the contract expires later this year.”

It seemed reasonable to us that Maryland students deserved the same protections.

Google also presents significant concerns for us as MCPS parents, because Google has been completely unresponsive to privacy requests made by MCPS regarding our children’s data. Specifically, last year the Montgomery County Council of PTA’s Safe Technology Subcommittee and MCPS initiated a “Data Deletion Week,” which required, among other things, that ed tech providers certify the deletion/purge of certain student data at the completion of the school year. Several other ed tech providers promptly complied, but Google failed to do so, and has continued in this failure for almost nine months now.

But Maryland parents are not alone in concerns about Google’s handling of students’ personal information.  The New Mexico Attorney General’s Office filed a lawsuit against Google in February 2020 for deceptive trade practices, alleging that once Google collects student data, it shares that data across all of its business segments “for its own commercial purposes” despite having promised to use it only for educational purposes. Likewise, privacy-focused Internet browser Brave filed a lawsuit with the Irish Data Protection Authority on March 16, 2020, alleging that Google fails to fence off data collected by its different services, sharing data widely across all business lines in what Brave refers to as “Google’s internal data free-for-all.” This is eerily reminiscent of the concerns raised by the New Mexico Attorney General.

Our concerns escalated further when, due to COVID-19, student use of, and reliance on, Google Chromebooks and Google Classroom increased exponentially, turning the small spigot of information that previously flowed to Google into a virtual fire hose, compromising the privacy of hundreds of thousands of Maryland students.

As a result of our concerns with Zoom and Google, we wrote to Maryland State Attorney General Brian Frosh, seeking his help and intervention.  Specifically, we requested that Attorney General Frosh’s Office take immediate action to ensure robust protections for student data acquired by Zoom and Google, including:

• Publicly posting the Zoom and Google contracts with MCPS so that we have greater transparency into the privacy and security protections (or lack of them thereof) for our children;
• Securing binding public assurances that Zoom and Google will secure and protect our children’s data, by:
  • segregating personal information and usage information from all of their other lines of business;
  • ensuring that all student data, communications and encryption keys remain inside the U.S.;
  • committing to not sharing or otherwise using student data for any purpose other than purely educational purposes; and
  • purging all student data and related information at the end of the current school year, or the end of the pandemic, whichever comes first, and then certifying this in writing, under oath.

To date, we have yet to receive a response from Attorney General Frosh’s office (our letter was sent on April 17 and was received on April 20). We nonetheless remain hopeful that progress is being made behind the scenes, as we’ve heard from individuals inside MCPS that the Maryland Attorney General’s office has engaged with them.

So as the old saying goes, hope springs eternal. In this case, we’re hopeful that Attorney General Frosh will eventually revert to us with positive news regarding our requests, because it’s only through AG Frosh’s intervention that we will ensure greater protection of our children’s data, and greater transparency for us, as parents, allowing us to make informed choices about our children’s education and personal information.

If you’re interested in staying abreast of our progress on this and other related issues and you live in Montgomery County, Maryland, please join the Montgomery County PTA’s Safe Tech Listserv by emailing safetech@mccpta.org.

And if you’re interested in hosting an online meeting, webinar or virtual coffee on this topic or related Ed Tech topic, contact your PTA President and then contact us  at safetech@mccpta.org, as we’d be happy to arrange a guest speaker(s) from the Safe Tech Committee to discuss these topics.

HR 6172, the USA FREEDOM Reauthorization Act, would reauthorize portions of the Foreign Intelligence Surveillance Act governing the intelligence agencies’ search and surveillance activities. A critical privacy amendment introduced by Senators Wyden and Daines failed by only one vote in the Senate last week that would have prohibited the government from spying on private citizens’ internet searches without a warrant, as well as their phone and computer histories.

Please send a letter to your Representatives in Congress today, asking them to support an amendment to FISA with similar language, to protect your privacy and that of your children under the Fourth Amendment against the government surveilling your family’s internet searches and phone and computer histories without a warrant.

Since the Wyden-Daine amendment failed, a bipartisan coalition of more than 60 groups wrote a letter to Congress saying that the FBI should not be allowed to to spy on Americans’ internet activity without a warrant.   More on this in Roll Call.

Especially in these times of students being required to use the internet for remote learning, let your House members know that the protecting privacy and civil rights of your family and all Americans are important to you.

thanks!

Cheri Kiesecker and Leonie Haimson

Co-chairs, Parent Coalition for Student Privacy

We have received many questions from parents and teachers  over the last few weeks concerned about the privacy practices and policies of the various ed tech tools and programs being adopted hurriedly by schools and districts in the wake of the coronavirus crisis.  One of the most widely used programs, even before many schools were shut down, was Google classroom or G-suite.

We just received a copy of the model G-suite contract that upstate NY administrators negotiated this fall with Google that complies with NY State’s student privacy law, Education § 2-d.  Because of the relative strength of this law, New York state received a B-, the second highest grade of any state in our state privacy report card, .

Parents in NY and elsewhere should ask their districts for a copy of their contract with Google Suite to see if it includes the same or similar privacy-protective provisions.  If not, ask why, and whether their district could negotiate a similar contract, or if in NY State, simply opt into this one.  If your NY district refuses to make available the contract upon request, you should remind them that they are required to post all contracts online that allow for the disclosure of student data, according the regulations promulgated by NY State Education Department in January.

BOCES model contract with Google – G Suite 19-20

BOCES district Opt-In – Erie1 9.3.19

by Cindy Eckard, reposted from Screens and Kids

Some basic measures could help protect your family from avoidable aches, strains, eye health impacts and sleep disruptions while using the schools’ digital devices at home. Some of the following suggestions also relate to the potential for these devices to cause fires. Be careful.

This is not to be construed as medical advice. Consult your device manufacturer for explicit safety warnings and instructions.

However, the following suggestions have been culled over several years from a variety of professional sources identifying a broad number of associated health risks:

Princeton Univ. (ergonomics; eyestrain)
HP’s health & safety warnings
Dell’s health and safety warnings
The Sleep Foundation (blue light & sleep)
Johnson & Johnson Vision (myopia)
Prevent Blindness (blue light)
American Heart Assoc.  (kids’ screen time)
World Health Org. (gaming disorder)
OSHA/NIH (ergonomics checklist)
Oregon OSHA (improving work spaces)
Cornell University (children’s ergonomics)

Hewlett Packard’s information is extensive, and includes helpful videos – it’s a very good resource.

According to Dell (a Chromebook manufacturer) laptops were never designed to be safe full-time workstations – they require modification to make them ergonomically safer.

1. The screen should be just below eye level. Depending on the height of the user and the relative height of the surface the device is resting on, it’s likely you’ll need a monitor stand to raise the screen to the proper level.

OSHA/NIH Graphic

This lightweight, inexpensive, adjustable, folding monitor stand can be found on Amazon. It easily adjusts to the height of any user.

2. Once the monitor is raised to the correct height, the keyboard is at an awkward angle, so an external keyboard is recommended, along with a mouse (not a scratchpad).

There are many options available – here is a lightweight, inexpensive external mouse and keyboard.

Now your laptop can be used in a manner that experts suggest might help you and your child avoid discomfort or injury.

DO:
1. Sit up straight at a table or desk, with feet flat on the floor
2. Keep arms at 90-degree angle
3. Adjust the device so that the top of the monitor is just below eye level
4. Keep monitor at least 15″ from the face
5. To prevent glare, set up workstation perpendicular to windows (remove light sources from directly in front of, or behind, the monitor)
6. Blink. Keep blinking. Remind your kids to blink.
7. Take frequent breaks – stretch, get a drink of water… dance!
8. Turn off devices around sundown
9. Remove all devices from bedrooms at night
10. Consult your device manufacturer’s health and safety warning documentation

DON’T:
1. Use devices on laps, or place on beds or cushions
2. Have screen closer than 15″ from face
3. Look down at screen, or use device lying down on bed, couch or floor
4. Sit on feet, or sit slouched over device
5. Work for more than 30 minutes without a stretch/water – or dance!- break
6. Stare into monitor without blinking
7. Allow young kids to use devices without supervision, or rely on devices to keep kids occupied
8. Stay on devices – or allow kids to – close to bedtime
9. Put light source in front of or directly behind monitor
10. Allow or require kids to use devices without offering alternatives

As we all face unchartered waters in the coming days and weeks, it’s especially important that our children have the benefit of every health and safety protection we can give them.

Cindy Eckard
@screensandkids