What Restrictions Should Student Laptops Have?

An anonymous reader writes "We're a school district in the beginning phases of a laptop program which has the eventual goal of putting a Macbook in the hands of every student from 6th to 12th grade. The students will essentially own the computers, are expected to take them home every night, and will be able to purchase the laptops for a nominal fee upon graduation. Here's the dilemma — how much freedom do you give to students? The state mandates web filtering on all machines. However, there is some flexibility on exactly what should be filtered. Are things like Facebook and Myspace a legitimate use of a school computer? What about games, forums, or blogs, all of which could be educational, distracting or obscene? We also have the ability to monitor any machine remotely, lock the machine down at certain hours, prevent the installation of any software by the user, and prevent the use of iChat. How far do we take this? While on one hand we need to avoid legal problems and irresponsible behavior, there's a danger of going so far to minimize liability that we make the tool nearly useless. Equally concerning is the message sent to the students. Will a perceived lack of trust cripple the effectiveness of the program?"

Comments

none

[QuantumG]

don't be a nazi.

Re:none

[magarity]

That's a great way to prepare them for the real world, isn't it, where corporate computers are locked down pretty hard. I think a better idea would be to survey some companies (larger ones with as many or more employees as there are students) in the local area and average out their practices.

Re:none

[Man On Pink Corner]

"Congress shall make no law... abridging the freedom of speech, or of the press."

Not much else to say on the subject. If you're using my taxes to purchase those laptops, you don't get to decide what content they can access.

Re:none

[againjj]

Especially since the statement is "The students will essentially own the computers." Given that that is the intent, then they need to be managed accordingly. That means minimal controls/intrusion, just enough to satisfy the requirement: "The state mandates web filtering on all machines." There is no way one can stop kids from doing things with the machines, nor does one really want to.

As far as lock down, security assumes no physical access. How do you handle someone who reformats the drive? And disk target mode? Resetting passwords with an install disk? Really, trying to stop someone from doing something to a laptop that they have most of the day every day is not going to work. Do the minimum and forget about it: don't ask don't tell. At home, parents can police. At school, they are watched already.

Re:none

[Nefarious Wheel]

Give them free rein as far as you can. Filter the legal minimum. Warn the users that if they stuff it up, they will be rewarded with a fresh re-image right down to the oxide. And sell them lots of data keys from the school shop.

Re:none

[yashachan]

The First Amendment pretty much does not apply to public k12 schools, though how much of those rights are removed is dependent on the state.

Re:none

[samkass]

I see this argument a lot to justify various technology decisions in schools. Your advice makes a lot of sense for a secretarial or vo-tech program. But generally, the mission of a school is very different from the mission of a corporation, and getting a solid education is about a lot more than how to "prepare them for the real world". Use the tool appropriate for the job-- don't take what corporations do and assume it will be what's best for educational needs.

Re:none

[Anonymous Coward]

In the real world employers don't and or legally can't force you to censor your personal PC's at home, where they are not paying for the Internet Service.

In this instance the State (via the Education System), is providing a PC to the student, the majority of these student's parents will not "see a need" to buy the student their own privately-owned PC, so essentially it's censorship via manipulation (if you can't filter the kids via the ISPs, do it by providing State-owned/Leased machines with the censorship built-in).

I wonder if the original poster is an Australian who's school is buying PC's under the Digital Education Revolution instigated by Julia "I'm a Socialist" Gillard

Anyway... the (clever) kids will bypass the filtering and remote management within a few hours/days of getting the machines, so the point is more or less moot.

Re:none

[calmofthestorm]

I've never used a computer with filtering in any of my schools or jobs and it's been very convenient. Generally you want to just adjust the monitor so it's visible from the hall. Solves a lot of problems.

Re:none

[Repossessed]

The law of freedom of speech applies to the people providing it; not necessarily accessing it.

SCOTUS rulings say otherwise, specifically school systems cannot censor libraries for non obscene materials.

Re:none

[Pantero Blanco]

That's a great way to prepare them for the real world, isn't it, where corporate computers are locked down pretty hard. I think a better idea would be to survey some companies (larger ones with as many or more employees as there are students) in the local area and average out their practices.

In the real world, the kids will have their own computers at home.

Trying to make schools resemble businesses isn't a good goal. Their business is to teach, not to make money.

Now, with that said, the kids don't need to be watching tentacle porn instead of doing their homework, on a laptop provided by taxpayers. They can get an old machine for ten bucks at a thrift store for that, assuming that they don't already have one. This has nothing to do with "preparing them for the 'real world'", which a school quite frankly cannot do.

Block sites that are only pornography (yes, the smart ones will get around this, but they probably already know whatever it is they're studying), leave political sites alone, and do whatever you want with the social networking sites. Err on the side of non-restriction if there's a question.

Re:none

[jcr]

That's a great way to prepare them for the real world, isn't it, where corporate computers are locked down pretty hard.

In my career (since 1982), there have only been two places I've worked where the computers were "locked down", and these restrictions were trivially bypassed. There were policies in effect at these companies, including one where you supposedly had to apply to your manager for permission to access each indivdual web site. In practice, it took about two or three days before any new employee or contractor was told the IP number of the unrestricted proxy.

-jcr

Re:none

[morari]

One of the purposes of a public school system is to assist in the successful development of children. Protecting them from potentially damaging information falls under that umbrella.

Successful development, huh? I think you mean systematic conditioning for conventional thought. The very fact that you would deem certain types of information as "damaging" shows just how well the construct worked for you.

Re:none

[davester666]

No, they have to learn how the real world works. So the IT policy has to seem completely arbitrary and stupid, as it is the result of group-think.

Maybe
-enable email and web surfing, but they can only use msn for searching
-block AOL and MSN but not Yahoo instant messaging
-block accessing piratebay.org (the dns entry), but not the IP address or aliases for it
-block nntp port, but not alternate ports

Re:none

[Darkness404]

One of the purposes of a public school system is to assist in the successful development of children. Protecting them from potentially damaging information falls under that umbrella.

What in the world? "Potentially damaging information"? Isn't that what China tells its citizens its great firewall project or golden shield thing prevents? Honestly, wow, a kid can access porn, that isn't damaging, they are going to find out what a naked person looks like eventually. Wow, a kid can access MySpace/Facebook/Whatever other popular networking site and talk to their friends, so damaging. Haven't people realized that porn and gossip spread before the internet? Before it was some guy who managed to sneak a Playboy into class and people passing notes, did that include "potentially damaging information"? This "potentially damaging information" is what anyone would call "censorship by an oppressive government".

If parents don't mind their children accessing MySpace then they are within their right to allow it on a home computer. School systems however, are not required to assume that all parents allow it nor should they be expected to do so themselves.

So wait, can we now say that because no parents have expressly approved the use of Google we should ban it? Whitelisting sites like that is honestly, is an idea that can only be expressed as "stupid" along with "retarded". Wait, but lets not stop with websites, lets now expect parents to approve all curriculum by the school! If parent's don't approve the teaching of prime numbers, lets stop it! And who knows where it would go with evolution, no doubt it wouldn't even be allowed to be taught even as a "theory".

As far as locking out installation of software, this should be fully supported. It can't be assumed that adolescents are capable of determining appropriate software to be installed and to avoid websites which could install malware. By locking down a system from a security standpoint will save energy in troubleshooting problems and performing maintenance.

Riiiight, like you know, all the parents who click the banner ads wanting the free screensavers featuring kittens do. On most matters, a teenager knows a ton more about computers than the average adult. Secondly, this is talking about a Macbook, those things are just about immune to viruses. Yes, some forms of malware do exist, but I'm not going to get a virus just by going to a website like you can on a Windows box.

And on troubleshooting problems, just reformat the thing. It works 100% of the time, and takes off all viruses (well, unless you somehow have a virus in your BIOS or something like that, but those are unlikely). Secondly, school is going to teach people about the real world, if I manage to mess up a computer, my data is gone, it teaches students how to actually use a computer rather than just have a understanding of computers.

Oh, and by the way, I'm sure the Nazi Party and the Communist Party of China fully endorse your post.

Re:none

[Your.Master]

But they legally can and do enforce client-side restrictions on the employer's hardware that the employee has custody of at home. Which is what is being proposed.

That said, I think the restrictions should be minimal -- mostly for legal compliance. You can maybe justify blocking pornography, warez sites, and sites known to spread malware. Past that, everything has a high chance of getting in the way of education and a low chance of "corrupting the youth" or some such damn thing. Certainly social networking, youtube, and flash games should be allowed. In fact, social networking sites can be one of the biggest educational BENEFITS of a computer.

Re:none

[dmizer]

In the real world employers don't and or legally can't force you to censor your personal PC's at home, where they are not paying for the Internet Service.

Too bad you posted AC, that's worth some mod points.

Reality is, the school has no jurisdiction over what the student does off school grounds. Including what they do on their computer.

IANAL, but if you want to control what they can and can't do with the computers, you have to keep the computers on school property. Otherwise, I suspect you would be running into legal issues.

The above post is also right in recognizing that no matter what you do to try to prevent the students from doing certain things on the computer ... if they want to do it, they'll do it. Live CD's anyone? How about a dual boot?

Re:none

[the_womble]

Anyway... the (clever) kids will bypass the filtering and remote management within a few hours/days of getting the machines, so the point is more or less moot.

That is my objection to this.

Locking things down is futile without punishment for kids who work around it. Given the incentives, the punishment will have to be heavy to be effective.

By giving them their own laptops to take home, you are giving them a very strong temptation to break the rules. All the more so because they are now less likely to have their own PCs - an issue that does not apply to adults taking an employer's laptop home.

Another difference is that you are saying that they will "essentially own" the laptops. This is likely to make them feel that they have the right to do what they want with them.

It would be far better to do what employers do and say: this is our laptop, use it for what we say: if you want to do anything else, buy your own. I am assuming that letting them actually treat them as if them own them is not an option.

Re:none

[CatOne]

That's ridiculous. They are educational tools, they're not for collecting and surfing porn. Not to mention, in many cases, schools can be exposed to criminal liability if students do some classes of things. Some degree of control is necessary to limit this liability.

Also, if you just give the kids the computers, they'll fart around on them all day long and pay NO attention to the classes. It's often necessary to use something like Apple Remote Desktop to lock the students' screens so they'll actually pay attention during class.

I'm not convinced that a laptop per child improves the overall learning experience. But certainly if it does, it has to be managed to some extent.

Re:none

[tomhudson]

While I agree that the question of restrictions needs to be thought out, I also think that the whole "they will be able to buy it when they graduate for a nominal fee" is retarded, as in "Ain't gonna happen." Would you want to buy a 6-year-old computer that's been dragged back and forth between home and school on a daily basis, and is probably obsolete as all hell?

Also, why not just spring for cheaper linux laptops, and just give them for free at the end of the 6 years? You'll save more up-front than you'd ever get on the back end with a "nominal fee", you won't have to pay for an OS update at the 3-year point, and you can upgrade the hard drive, ram, and wireless card easily and cheaply.

Heck, buy Windows laptops and then ask for a rebate on each unused copy of the OS.

Re:none

[ceifeira]

That makes a lot of sense. In fact, while you're at it, why don't you beat up a few of the kids? You know, to get them ready for the real world, because we sure don't want them to get used to all the love. I think a better idea would be to survey some bullies (larger ones of course, one per student) in the local area and average out their practices.

Re:none

[Iamthecheese]

I, for one, hope they have very strong filtering methods that require some real knowledge to bypass. You will be pitting their desire to be lazy against their 14-year-old hormones and they will, completely by accident, end up with very useful knowledge about information security.

Re:none

[Klootzak]

You know, I've always wondered what would happen if the worlds armies and security forces were placed between a bunch of horny teenagers and their porn... there WOULD be a massacre, but I'm not quite sure it'd be the kids on the losing side. ;)

Re:none

[torkus]

Heck, how about a restore CD, hard drive swap, etc. etc. etc. Most people here know that physical access = compromised system.

And it's really that simple. The more rules and restrictions you put around this, the more you will make "criminals" out of ordinary students. If you make it a suspend-able offense to tamper, kids will truecrypt a dual boot partition, swap drives for 'inspection time' or any one of a number of things. I guar-an-tee-ee that the student body will break whatever restrictions are put on the systems. While it's a good lesson to get them familiar with the computers, i doubt it's the kind of lesson you intend to teach.

I know there are some legal restrictions - i would do the bare minimum to meet those. THEN, set the expectation that students are responsible for the content of their laptops. If a student is caught showing or looking at porn *on school time/property*, they should be punished severely. Similar for wares, etc.

But let's be honest... Give a 16 year old boy a computer and his first private action is going to be to look for porn. If you try to prevent that entirely you're 1) fighting the inevitable B) not dealing with the reality of the situation and iii) wasting everyone's time.

Re:none

[calzones]

"Don't be a nazi" is not just the most ethical advice, it's also the most practical.

Here's how to defeat any censorship attempts:

1) boot macbook while holding T key and it's connected to another mac via firewire
2) drag home folder / apps and files you care about off your macbook when it shows up as an external FW drive on the other machine
3) launch disk utility on the other machine and reformat the drive on the macbook
4) shut down the macbook and boot it back up using the Leopard install DVD
5) install Leopard
6) migrate your files back and enjoy your new computer

Here's how you REALLY NEED TO HANDLE IT:

IN THE SCHOOL
1) set up port and internet filtering as per state/local law and reasonable requirements. Block chat stuff.
2) walk around frequently to monitor usage
3) make restrictions and penalties for unauthorized usage crystal clear

AT HOME
Students are free to do whatever they want with the laptop but parents are on the hook to ensure the students don't do anything the parents don't want. It's not the school's responsibility anymore once it's at home.

Re:none

[calmofthestorm]

We had an understanding. We didn't steal or break any computers at the school, and we could do whatever we wanted with the laptops.

But it was OS 9 so that wasn't much. I really find it hard to believe /anyone/ used macs before OS X.

Re:none

[Opportunist]

I support this, but not on grounds of being "no nazi" but simply on grounds of common sense.

The more you restrict, the higher the chance that your pupils mess with your setup to circumvent your restrictions. I.e. the tighter you put the restrictions, the more maintainence will be required to keep the computers in a working state. You're not their employer. You can't fire them when they "accidently" break their computers time and time again. You can't even give them worse grades because it will backfire on you again when parents complain that you required those notebooks and now you even punish their precious little kid when your damn machines from hell don't work.

And heavens forbid if they actually manage to break the security mechanisms. Because one thing is certain: Things go around at the schoolyard REALLY fast. If one machine is broken, it takes no week 'til all of them are. Factor in that the average 8-12 grader has a LOT more spare time to break the machine than you have to secure it. They have the internet and thus the tools, and they have no inhibition to use them both against you and your security mechanisms trying to keep them from using their machine the way they want to.

Then you're liable because you actually implemented security AND you cannot enforce it.

What I would suggest is that you brush off the blame to the parents. Have them sign a paper that their kids may only use the notebooks the way they are supposed to be used. If they can't enforce it, sucks to be them. But at least they won't come to you and blame you if little Jonny is looking at pron on the computer he got from you.

Re:none

[andy_t_roo]

why not just have a proxy which you have to log into to access the net and all the pictures that come in through it are plastered on a monitor in the staff room, along with the name of the user who is currently logged into that computer? - instant internet monitoring from a central location, with little effort to set up, although actual enforcement could be "interesting"

Re:none

[Jeff-]

You're talking to a group of people who mostly had regular access to internet pornography throughout their teenage years. I'd wager most managed to still become normal productive citizens. I bet a lot of them still did homework even. Not that I did, but it certainly wasn't due to porn. You can only wank for so many hours in a day, hormones or not.

Censoring kids just makes them sheltered and naive or criminals when they circumvent it.

Re:none

[heson]

Punishment? No! The filters should be there to encourage the kids to learn how to bypass them, in the process they will learn alot, and be highly motivated to learn alot.

Re:none

[Akatosh]

no need, looking at goatse is adequate punishment in and of itself

Re:none

[Blkdeath]

In the real world employers don't and or legally can't force you to censor your personal PC's at home, where they are not paying for the Internet Service.

Too bad you posted AC, that's worth some mod points. Reality is, the school has no jurisdiction over what the student does off school grounds. Including what they do on their computer.

Too bad they aren't the students' computers; they belong to the school until end of year/term when the students have an option to purchase. Only after the student has purchased the laptop should the restrictions come off but not before.

If the students want the freedom to do whatever they want they should purchase a personal computer and Internet connection, but shouldn't be at all surprised when the school forbids them to connect said laptops to the school network.

A lot of people are talking from a purely outside perspective on this issue which is totally understandable. OTOH, I was an administrator for a high school network so I understand the dilemma faced by the admins in this story. On one hand you have the notion that you just leave the computers wide open and trust in the maturity and good nature of the students and don't spend time and energy in finding and closing all the possible back doorways into the systems.

On the other hand you have a lot of immature students who feel a sense of entitlement with everything they touch. They "should" be able to use Facebook, MySpace, play all sorts of games, install whatever "cool software/screensaver" whatever that's recommended by their friend. This causes administrative headaches especially when little buglets come into the network and start wreaking havoc for the rest of the as-yet uninfected computers in the building/campus. Further, the laptops themselves become bogged down with popups, viruses, trojans and other malware and cease to be useful for the student to do the work for which it was intended and the admin find themselves in a situation where they need to devote time to diagnose the specific symptoms when they could instead be doing one of any number of more important tasks.

All our systems were tethered, desktop PCs. One of our primary tactics was to constantly find, diagnose, research and secure any/all holes discovered by the students, update our workstation image and re-image the entire school. That way if anything ever were to be installed/corrupted on one of the workstations it would be wiped atleast weekly so they'd have to try to do the damage all over again the following day/week. This also forced students to store all files in their home directory on the server (which was policy anyways) where we could quota the file storage (1000 students and 100 staff sharing a 50GB RAID array meant there wasn't too much to go around!) and investigate any delinquent behaviour.

The goals of personal freedom are all well and good, but when they're not reigned in with a deepened sense of the personal responsibility that should always accompany such freedom it's a dangerous situation. I venture to say that until most of you have been faced with administrating a network comprised almost entirely of immature students you should take and give advice with a suitable quantity of NaCL.

Re:none

[Anonymous Coward]

This is incorrect. I work for a school district that provides a 1:1 laptop program for the high school students. The students do not own the laptops, and instead are leased/lent them. They have to sign an agreement as to what they can and can not do on the computer.

As for live CDs/dual booting, we password the bios. The laptops do not have a removable battery for the cmos, so the only way to reset it and remove the password is to actually short out the mainboard.

We have the ability to run software audits on all of the machines, whether or not they have somehow managed to remove our remote management agent.

On the school network, we have the usual content filter, but it also does DPI, so even SSL proxies, SSH tunnels, and VPNs get blocked. Remote desktop, too.

The reporting system for the content filter also ties in AD usernames, and watches Cisco netflows, so we can monitor the network in real time and see which users are taking up more than their fair share of bandwidth.

We don't actually filter content at the student's homes, but I know of several districts that do - several of which are required to by law, as the laptop programs are publicly funded.

A student could swap the hard drive at home, but it would be completely unusable at school, so we don't really care about that. We just don't want them putting crap on the hard drives we issue with the machines. If they want to go through the effort daily, more power to them. But it would also certainly be possible to lock it down to where they couldn't do this, either.

Physical access means that it can be compromised, for sure. But it does not mean that it can be compromised without us knowing, especially in a situation where every day they have to come in and log on to the domain to use their machines. Students breaking the rules and either a) letting their grades slip, or b) adversely affecting other students by abusing the network connection are punished. Depending on the severity, all will have to pay a $25 reimaging fee, and after that, punishments can include in school suspension, as well as being given a laptop with no wireless card - Teachers have ethernet cables they can hand out, but no students are allowed to use them without teacher permission. This effectively cripples the students on these punishment laptops to only being allowed to use the net when a teacher specifically wants them to use it - to having their laptops revoked completely for the rest of the year.

Re:none

[Archangel Michael]

Their business is to teach

No. That is not what their business is, at least not any more. I work at a school, the goal of teaching is not third or fourth (or even further) down the list.

Primary goal is to get kids to the next grade level, while maintaining minimum standards. And by Minimum Standards, I mean MINIMUM. It has come down to lowest common denominator schooling.

Second goal is indoctrination of Liberal Progressive ideology. For example, while teaching on "Global Warming" it is taught as fact, that humans are the sole cause, and there is universal consensus by all scientists. I can go on, but it would be pointless.

Third Goal, graduate people who can work as automatons in service industries.

Fourth Goal, is to provide babysitting/child care service to working parents.

Education, true education, is about teaching people to love learning. To explore, think and learn. If one sparks this love of learning then the world will open up for the students. A master teacher doesn't teach anything, s/he allows his/her students to "discover" the material.

"Teaching facts" isn't teaching. A computer can spew facts out all day long, I wouldn't call it a teacher.

Real education cannot be mass produced in a one size fits all formula. Which is why our educational system is failing.

No offense...

[BorgAssimilator]

We also have the ability to monitor any machine remotely, lock the machine down at certain hours, prevent the installation of any software by the user, and prevent the use of iChat.

No offense or anything, but I wouldn't touch one of those with a 10 foot pole with those restrictions, especially with the "monitor any machine remotely" part.

They'll just use their own laptops.

[Anonymous Coward]

You can't put too many restrictions on them, or else they'll ditch the school-provided laptops for something else.

What Restrictions?

[Anonymous Coward]

They should not be allowed to use them during the time that they are supposed to be learning.

Re:What Restrictions?

[Anonymous Coward]

I'm the Mac tech in an elementary school with a one-to-one MacBook program and the kids take them home. We filter Internet content via the network at school, but not at home. We leave that up to their parents. However if someone brings something inappropriate that they downloaded at home, the computer will be taken away.

Can of worms.

[Anonymous Coward]

What are kids going to to do when they break these things taking them home very night? I wouldn't want my kid carrying around one of the schools computers every day.

Re:Can of worms.

[JWSmythe]

    I was going to reply to the OP, but you asked the magic question.

    Traveling moderately with laptops, mine have had a life expectancy of about 1 year. I've been lucky with my current one (a HP zv6000) which has passed about 3 years or so. I always treat my laptops moderately well (carried carefully, avoided dropping them), yet something fails.

    One dropped dead after passing over the rollers at an x-ray machine at an airport.
    One dropped dead after running in a warm room for one night.
    One got the screen cracked when a helpful stewardess shoved someone's luggage into mine in the overhead storage bin. Ahhh, gotta love airplanes.

    Hmmm, I can't remember the others, other than the life expectancy was only about a year.

    I know I'm not alone. I've worked on countless office laptops. Those that survive a year are real troopers. The best survivor other than my own was a 3 year old Toshiba tablet. It lost the hard drive and touch screen. Replacement parts were cheaper than replacing the unit, so I fixed it.

    I'm talking about grown adults, who like (or depend) on their laptops for work.

    Now, a bunch of 8th to 12th graders running around with laptops? Besides mishandling on their own behalf, what happens when the bully makes a frisbee about off the little kids laptop? What happens when they spill a drink on it? Put their books down hard on the top and crack the screen? Oh, the scenarios I could list, and they'll still never account for the all the real possibilities.

    With proper handling you may get a year, with improper handling, I'd see replacing hordes of them monthly. I feel sorry for the IT department who's going to handle the problems, but I feel worse for the taxpayers who are going to foot the bill.

What Restrictions Should Student Laptops Have?

[djupedal]

How about ....n o n e...?

Given that most students will need little time to work around any restrictions in their way. Use the program as a way to demonstrate trust.

Re:What Restrictions Should Student Laptops Have?

[hkmarks]

It seems like blocking at least some websites is necessary.

But that should be done at the server/router/whatever point. Put no restrictions on the laptops themselves.

If Facebook ends up causing problems, I'd recommend blocking it (while at school only!), but setting up a school forum (vBulletin or something) and allowing students to interact, collaborate, and plan events there. Moderate it to prevent bullying and bad behaviour, but not too harshly.

...What?

[AnonGCB]

Why on earth are you choosing macbooks, aren't there better options for your school? Off the top of my head, the asus eee 900 line would be great, the 900A or 901 would both be great and can be loaded with linux easily, or leave the xandros that comes with it on and it'll work fine. I doubt the students will have the know how to hack linux.

Re:...What?

[AnonGCB]

As a 10th Grader in the US, and a linux observer, I do realize that, however, going by the kids I have seen in the local public schools (Thankfully I don't have to go there!), The majority are too stupid to do it subtly enough that the local admin wouldn't notice, and then their privileges are revoked.

Re:...What?

[Kalriath]

There are arguments in favor of the asus as well (cheap, moderately usable, teach the kids about free software, cheap) but don't act like using a mac for education is so ridiculous.

It is so ridiculous. There is no way taxpayer money should be used to purchase something as ridiculously overpriced as a bulk load of MacBooks (a few for school use, fine). This school board needs some serious management changes if they're greenlighting this sort of purchase when there are much cheaper options.

Myspace? Facebook?

[slack-fu]

Judging from practically every computer with a body in front of it at my local community college, these are the only 2 reasons to even have a computer.

Academic vs personal

[Anonymous Coward]

If you express your goals as "Academic" then restrictions are seen in a different light.
In the scenario you described, "they practically own" the computer yet there need to be so many restrictions for the School to be happy, you have a conflict. You can't have it both ways.
Web filtering is a yes, in my opinion. Any legitimate website with real content does not need to be grouped with trashy websites. Meaning if you block all friendster's you aren't actually blocking anything that's "A useful must have" because if it were it wouldn't be grouped with myspace (which everyone basically views as a portal to idleness).
Block certain protocols as well, p2p, etc. This gives you deniability ("We didn't give students the ability to pirate software/media, they achieved that by bypassing our reasonable protections).

In a nutshell you need to iron out the goal of these computers. They can't be both personal and school only computers at the same time.
That's my opinion.

What's the goal here?

[modestmelody]

Why are students each getting a laptop? What's the goal? Is it to have a single environment with a single set of software that students can all work on commonly to assure instruction can make use of computers effectively? Is it simply to ensure students have computer literacy and/or access to computers for those who do not? How are you going to use these laptops day to day that is unique to what can be done from a home computer or library computer or computer cluster? These are the questions you have to ask before determining how much you want to limit student use. My initial inclination is that limiting the ability to mess with these computers is a huge mistake. It makes students less likely to learn about the machines they're using and less likely to use these machines. It makes these computers a hassle and something used solely for class assignments that cannot be done any other way and a paper weight the rest of the time. The only limitations should be use of anti-virus software and other protections so that they cannot hurt the network at the school when attached to it. Blocking ports for instant messaging services and internet filtering while in school is appropriate to ensure the integrity of the network, but crippling the computers is not necessary or advantageous. Are students really going to be expected to use a single machine bought in 6th grade through 12th grade? Are you going to be able to remove these restrictions, and be willing to go through the work to do so, when students buy their computers out right when they graduate? That could be a ton of work. Protect the network, block stuff from coming in that can affect other machines, but don't cripple the computers themselves. You'll only assure their limited use/usefulness. But honestly, before spending all that money, there need to be some good answers as to why your curriculum has unique needs that require each student have a laptop.

Re:What's the goal here?

[kklein]

I am a teacher. I am a techie geek. But these are the same questions I had.

Here is what happens in education: Some idiot thinks up a sexy idea like giving laptops to all the students. He or she runs around squawking about it until it gets to the ears of the person controlling the money (or maybe it's a grant). Idea goes forward.

Then people ask what they should be doing.

No one knows, so a bunch of people who don't know anything about computers or video cameras or whatever it is that has been purchased try to incorporate them in their lessons, because they are there. It's not clear why they need to be in the lessons, but they feel like they are wasting something if they don't use it.

Totally simple, straightforward things that were meant to teach, say, research skills, now become a byzantine mess of dealing with people's crappy PowerPoint skills, printing out webpages, stammering, and teachers trying (and probably failing) to address technical issues (and then coming to my office for me to sort them out).

You know how many computers I use in my classes?

None. And I eat computers for breakfast, lunch, and dinner. I just don't think they offer much in the way of education. They have revolutionized what kind and how much research we can do. They have made it very easy to write academic prose (in the old days you literally had to cut and paste, and then re-type). They allow you to move information around quickly and easily.

They are tools. That's all. Learning does not magically happen the moment you crack open a laptop.

Design the curriculum first, then get laptops if it calls for them as necessary.

But, speaking from experience, it probably doesn't.

Good lesson in black market economics

[vanyel]

The geeks in the classes will make a killing doing clean installs for those who can't figure out how to do it themselves. It will also install a very healthy antipathy for authority, what isn't already created by the school officials' other, similarly misguided, actions.

Wrong forum

[Jeff Hornby]

You're really asking the wrong people about this. Most of the replies you're going to get on Slashdot will be no restrictions because I wouldn't want restrictions on my machine. This is true for adults but you're dealing with children, some as young as 11 years old.

The people you really should be talking to are the parents in your district. Ultimately what their children see and how they interact with the world is up to the parents. I imagine that you will probably have a number of views that you will have to synthesize. Perhaps even create a number of different user profiles and allow parents to choose which one their child will fit into. But the first stop is ask the parents. As an upside, some of the parents will have grappled with many of the same problems at work and will probably have some insights.

Re:Wrong forum

[QuantumG]

I'm so glad the C64 I had when I was 11 came with restrictions, otherwise I might have learned something.. oh wait.

None, because they will break restrictions anyway.

[TheSpoom]

See title. Have you been in a high school where students have access to computers that have such filtering? They get around it really quickly, and such information spreads like wildfire. And the fun thing with laptops is, you'll never know since they'll only do it at home.

Filtering just won't work. Trust the students a little. You can't expect them to just use the laptops for schoolwork... it's just unrealistic, and it's unnecessary.

You are not alone, others have done the same thing

[dmoorhouse]

I worked in a school district in British Columbia, Canada long ago. They were the second (?) district in BC to institute this same idea. In the end it was successful. You can find them at http://www.nisgaa.bc.ca/ (note the kids with macbooks on the main page). I'm sure they have a plethora of info on the do's and don'ts on the subject. Sorry Nisga'a school district for all the traffic I could be sending you ;)

Only at school

[Chaos Incarnate]

There should only be restrictions while the users are at school. There shouldn't be any restrictions outside of school—it's in loco parentis, not semper parentis.

As such, any filtering should be left on your network connection. If you want to block the ports iChat uses at school, go ahead. If you want to filter the web, go ahead. But there's no reason they shouldn't be able to use them at home.

Qs

[ImOnlySleeping]

Since when do grade 6 students get laptops at school? And what happens when students "lose" the laptops? And what student is possibly going to buy a 6 year old laptop when they graduate? If someone offered to sell you a laptop from 2002 right now, how much do you think you'd pay? So many questions.

Contradiction

[sheetsda]

The students will essentially own the computers, are expected to take them home every night

We also have the ability to monitor any machine remotely, lock the machine down at certain hours, prevent the installation of any software by the user, and prevent the use of iChat

These two statements are contradictory. The sooner you accept this the less expensive the lesson will be for all involved.

I'm a tech coordinator for a small district...

[Pollux]

...about 300 kids K-12. I'm a little surprised that you're asking this question. Are you a technology coordinator who is now addressing these concerns for a district who has never addressed them until now?

Most districts have access restriction policies that students have to agree to and sign. I'm sure about 95% of the Slashdot crowd's gonna scream to high heaven against restrictions, but it's a no-brainer. In short, four letters: CIPA. From the FCC's webpage:

Schools and libraries subject to CIPA are required to adopt and implement a policy addressing: (a) access by minors to inappropriate matter on the Internet; (b) the safety and security of minors when using electronic mail, chat rooms, and other forms of direct electronic communications; (c) unauthorized access, including so-called "hacking," and other unlawful activities by minors online; (d) unauthorized disclosure, use, and dissemination of personal information regarding minors; and (e) restricting minors' access to materials harmful to them.

These last two are really the biggest ones to consider when drafting an Acceptable Use policy, particularly the last, since "materials harmful to them" could mean practically anything.

Our district has taken steps to block MySpace, FaceBook, etc., because all these websites allow minors to publish themselves online. If students accessed these sites at school, and the child was kidnapped due to information posted on MySpace, districts may be found liable.

And banning MySpace will certainly not make these laptops useless. I'm surprised by this comment...it sounds quite ignorant. Districts didn't spend millions of dollars on these machines for students to post poorly-made self-portraits of themselves online. They (I hope) spent the money to grant students equal access to a tool that can be used to enhance learning. I would see a school-owned laptop in the hands of a student exactly the same way as any other computer at school. I'd restrict the hell out of it, because until they graduate and buy it for themselves, the district is responsible for what is done with that laptop.

Physical access

[jbolden]

You don't stand a chance. The kids have physical access and you need to be able to run mainstream software. That means any knowledgeable kid can get administrative access in a heartbeat . Then 11+ year olds will tell each other how. You are done. As for remote monitor, they are on their home routers. They phone / cable company firewall is not going going to accept a TCP/IP connection you establish which means you can't do it.

The first thing you need to do is get realistic expectations or start constructed a much more secure system, which is not going to be a macbook you are talking encrypted drives, TPM chips, access keys on some pager which need to be plugged in for the system to work.... trusted computing group website.

Schools aren't going to pay for that sort of stuff. What you do is you set expectations reasonably, lock the system down badly, filter the minimum and have an easy way to re-image and that's it.

And even if the kids don't mind...

[BorgAssimilator]

(I apologize for responding to my own comment, but this whole monitoring thing really gets to me.)

I can see how you'd want to make sure to block bad content for the kids, especially to maybe protect you from lawsuits of some kind (IANAL), but you can have filters and whatnot set up without this remote monitoring stuff.

But lets say that the kids didn't mind people seeing what they did on these machines; how do you think the parents would feel about someone being able to spy on their kid that extensively? I really don't see that going over well at all...

easy answer

[bcrowell]

Sorry, but the answer to this one is really easy. There's no evidence that giving laptops out to K-12 students has any positive effect on education whatsoever. Since their educational effectiveness is zero, the educational impact of any of these decisions that you make will also be zero. If you want to make absolutely sure you don't get sued by parents who are upset about how their kids were damaged for life by seeing porn, uncable all the hard disks before you hand out the computers.

Reality on line 1

[girlintraining]

My mom recently caught my kid sister (age 12) visiting some "inappropriate sites", and immediately went off the deep end, asking about filtering, auditing, locking the system down, the works. So we talked about it, and I let it sit for a few days, then invited my friend over and we had a "big sister" chat. And then I showed her how to delete entries from her browsing history.

Let me tell you right now -- there's no way to lock a system down. There's no way to filter, audit, etc., to a kid. Besides, kids are bored most of the time anyway and all you're giving them is a challenge. So the way I see it, you've got two options -- either you act as the gatekeeper, or you act as the guide. You can't be both.

The gatekeeper is the filters, the auditing, the monitoring -- in short, the parent. Is this a role you want to play as school administrators? Are you prepared for the legal responsibility? I know you're going to be catching flack from people like my mom who are going to throw a knipshit the moment their precious snowflake gets busted reading harry potter slashfic, or realize that google image search for hentai or eucci brings up cartoon-depicted sex acts. They'll be at your school board meetings, on your voice mail, and holding the ears of everyone they can get a hold of. Visualize that for a minute. The state of the art in filtering and monitoring cannot and never will fully succeed in its stated goals, if only because it's a shifting target and defining "appropriate for minors" is about as useful an excercise as re-arranging deck chairs on the Titanic.

Your second role is equally perilous. You be the guide -- which means educating those students. This is the computer equivalent of sex ed classes. You need to tell them what's online (and I mean what's really out there), what the risks are, and how they can protect themselves. You need to instill in them the ability to make moral and ethical decisions about their conduct online, with the explicit understanding that you can't stop them from going where they shouldn't -- only that they know what the consequences are (or could be). And here again, the parents are going to throw a knipshit and want your head over religious matters, etc., and flying spaghetti monster we go.

My advice is to offer some limited education to the students about what's out there, how to stay safe, and offer filtering and monitoring software for the parents to use. Ultimately you need to get the responsibility for how the students use these systems off your shoulders, or you will find yourself in a very special kind of hell that will do neither your school district nor your career any good. The key words here is "informed consent." You make a good faith effort to educate, cover your ass with disclaimers, and leave the final decision to the parents. Do not give these people any way to wiggle out of responsibility for their darling little crotch-fruit. It's blunt, but there it is -- you have to look out for yourself here first.

Depends on what you're trying to teach.

[Ungrounded Lightning]

Unless you're trying to teach them to circumvent computer security you give them a laptop with no restrictions whatsoever.

  - If you put ANY restrictions on it, they will immediately start trying to break them. You'll be giving them an early start on a life of cybercrime.
  - And if you punish them (the ones that get caught) for doing it, you'll also be giving them an early start on a criminal record.

Here's what I'd do in your place:

  - Include a standard load on each laptop.
  - Provide a backup facility on the school's network for those files they want to back up.
  - Have the standard load preconfigured to automatically back up a particular subfolder. Tell them to store their schoolwork (and anything else they want preserved) there until they learn how to configure it to back up additional folders.
  - Provide a facility for reloading the laptop with the standard load and restoring the backed up folder(s). No penalty for the kid to reload it to stock, even repeatedly.
  - Explicitly grant permission for the kids to experiment with their laptops, loading what they want, trying other op systems, etc. (Warn them about only loading stuff they have rights to: Purchased software, FOSS software, their own stuff, stuff they have the author's permission to load, etc.)
  - Let them try to run with alternate OSes, dual-booted, etc. (Warn them that the school personnel probably can't help them much with other configurations, but if they help each other or find help on the web that's fine.) Let them access the backup tools from alternate OSes if they can figure out how.
  - Do any government-mandated censorship on the school's network, not on the kids' laptops.

Then the kids can reconfigure their laptops all they want and experiment all they want. When (not if) they break the configuration they can go to the school's lab and restore it to a known starting point with the latest backup of their important files

THIS way, instead of starting them on a life of cybercrime, you'll start them on a life of computer literacy and skill. You'll quickly find yourself with a herd of little geniuses, with some of them running a computing club and most of them - even those whose primary interests are something other than computers - displaying exceptional computer literacy.

Asking the wrong crowd

[YrWrstNtmr]

..only partially

40% of the replies will be "do not filter anything, you Nazi!"
1/2 of those will be "Do everything in your power to circumvent the existing school board rules."
Another 30% will say "don't bother, because the kids will just go around your blockages."(thinking that all school kids are as adept as the ubergeeks here are)

You may get a very few replies about how you can actually do what your job requires.

Re:First rule

[HeronBlademaster]

I think you're confusing "laptop" with "girl".

... Oh.

No pr0n!

[martin-boundary]

Absolutely. The. Most. Important. Restriction. Is: block the pr0n sites.

There's just no way to appreciate them properly on those tiny laptop LCD screens.

It's a tool not a laptop

[Ritchie70]

My step-son just graduated from an "all laptop" high school. His father was paying and making decisions; if it were up to me, he wouldn't have lasted a semester before I pulled him.

They gave all the kids Thinkpads (OK, sold them Thinkpads - private school) and then left them unlocked. The step-son and all his friends installed every pirated game you can imagine and sat around in class all day playing. Not a lot of education happening as far as I could tell.

So my advice is this: Lock them down. Forget about "essentially own the computers;" if the laptop is school property, the laptop is school property.

Give them basic office apps, and whatever educational software they need. Don't let them install anything. Unless there's an educational need for it, no iChat. Sounds like a good way to cheat on tests to me.

If I weren't in IT at work, that's what my work laptop would be like. Because I'm in IT, I can get administrator rights, but pretty much nobody else can. Why should school be different?

It isn't your responsibility to provide a fun-time laptop; you don't care if they use it for anything except school work. The laptop is a piece of school property to be used for educational purposes, just like a textbook, or a desk, or a photocopier. It's a tool, not a toy, and once you realize that you'll feel better about the whole thing.

Would you say that students should be allowed unlimited access to the photocopier for personal purposes? Of course not. Same thing.

The network filtering is tougher, but again, I come back to "what's work like?" I have to go to some technical web sites at home that I legitimately need access to, because Websense won't let me get to them. It also won't let me get to porn, gambling (including the state lottery site) hacking or proxy avoidance information.

The same should apply to school - in spades. Maybe you should just have a white list based on lesson plans rather than trying to filter out the garbage.

Worthless endevor.

[LoRdTAW]

Why is everyone so convinced that giving students laptops will act as an educational magic bullet? Locking them down will only cause the students to try and work around the restrictions. Whats to prevent them from using a live Linux CD to browse the web as they please?

Laptops wont do shit to improve learning by any means. Teachers along with parents are the most important part in a child's education. And students today from what I have observed really don't value education. And that started at home. Too many students in one class who don't value education causes the teacher to literally give up. I grew up in a house where both my parents hold masters degrees. My mother and father always took me and my brother on educational family outings. Queens hall of science, Libery science center, Edison meuseam, Zoos, other museums etc. I was never a good student but my mother helped me through allot of my problems and made sure I got through school. My father ran the family business which was a machine shop, wood shop and also did entertainment. He would take me to machinery trade shows and all kinds of interesting places. He also let me play at his shop and imposed no real restrictions. He let me be as creative as possible even teaching me how to use some real dangerous machines like band saws, lathes, milling machines, bench grinders and table saws.

Bottom line is my parents created an environment that encouraged education and learning. They knew its value and made sure both me and my brother will be successful in life (This is a big part of Jewish culture, and no I am not Jewish). No computer will ever provide that. If you want to give them computers make them available for students to use in school computer labs or library's. They can do all the research they need and you wont have to worry about laptops being stolen, destroyed or hacked. Giving kids laptops will only distract them more. There is no magic bullet, if the parents don't give a shit then neither will the kids. And it seems to be a growing epidemic.

I just hope

[sentientbrendan]

That you leave root access on, or at least install the developer tools.

What the real tragedy is, is that when school's lock machine's down, they usually do it in a way that prevents the main goal of giving the kids access to computers in the first place: learning.

If the machine doesn't come with apple's developer tools, and the kids don't have root access so they can install additional *unix* software to /usr/bin, you have already totally failed in giving them the computer. Yet, this is usually the sort of things school's do.

What's the point of giving kids computers if they can't learn about them by tinkering with them?

As far as the protections you are talking about, I have to agree with everyone else when I say they are insanely draconian and kind of pointless.

No matter what you do, I can guarantee you within a month every kid is going to know how to get around them to look at porn on those things, and realistically that's the main thing parents would like to stop. I mean, do you really think that thousands of high school kids are going to be too dumb to figure out how to use a proxy? That not one guy is going to figure this out and tell everyone else? How dumb are your kids exactly?

This is part of the reason why public schooling in the united states is so utterly worthless. It's not because american kids are magically just dumber than kids in other countries, and it's not for lack of funding. The culture of the "educators" is the problem. I'm 24 now and have graduated from both high school and college, but I still remember high school well, and it's the patronizing and incompetent teachers that made it so worthless of a learning experience.

If you start off assuming that your kids are too dumb to learn anything, to want to play with technology, the be able to get around the trivial restrictions you are talking about, then how do you expect to ever teach them *anything*? You won't, and so far testing indicates you *haven't*.

Re:Panasonic tough books

[Lumpy]

I have a 5 year old Toughbook that regularly get's tossed 20 feet into the bed of a pickup truck. sometimes I miss and hit the pavement on the other side of the truck.

It's great, freaks out contractors all the time.
"Wow cool laptop!"

yup, it's expensive, about 3 grand.

"wow!"

gotta go, hey watch this. Throw it at the wall, dump my coffee in the keyboard.

"holy crap!!! what are you doing????"

Trying to get the boss to buy me a new one...

Mine looks like it has spent 3 tours of duty in iraq. I get really wierd looks at starbucks with it sitting there with road rash and a dent in the corner.

Re:None, because they will break restrictions anyw

[Thiez]

Don't be ridiculous. When one person breaks the law, that person is wrong. When everybody breaks a law, the law is wrong.

Having a rule that you know many, many people will break (and get away with?) is a good way to make those people lose respect for any other (more important?) rules you have.

My kids' school has a laptop program

[CFD339]

My oldest had a school laptop for two years, and my middle daughter is on her second year with hers.

The middle schools provides them with low end macbooks. If you pay a $50 fee for the year to cover "insurance" the kids can bring them home, otherwise they stay at school. These have the same kinds of potential restrictions you mention.

They can be put onto home wireless networks, and can print to home machines. The kids do not have the ability to add software, and are prohibited by their signed agreement from doing all the things you'd expect middle school kids to try doing. Mostly, they don't -- or they do it carefully enough not to get caught. That is a valuable skill set itself, and the kids become comfortable with the machines.

More important -- the kids work with these machines in a fairly realistic way. They use Garage Band as part of their music class. They use keynote to do oral reports, and they use the word processor to prepare their reports -- and are expected to produce quality work with them.

The point is, the machines are well integrated into the teaching plan. If not, they're a distraction.

When my oldest moved on to high school, I wanted to get her a laptop of her own. She'd had a PC in her room for years, and had the school laptop from middle school before that -- A mac. I asked her what she liked better, a Mac or a PC. She just looked at me, and asked why she should care. To her, they're just tools. They both work, and she just didn't care much. Since I could get a pretty good PC laptop for about 300 dollars cheaper than a cheap Mac laptop, I offered to split the difference with her from her savings if she wanted the Mac. She thought that was a stupid waste of money.

My point is there, is that by 15 she's comfortable enough with the technology to be unimpressed by it, and to see it as just another tool. As to p0rn surfing? At school its reasonably blocked (I can get by, she can't) and at home she's on my network. She knows I have firewall logs, and reserve the right to forensically review her machine. I don't though. I really really really don't want to know her taste in p0rn -- and even my 9 year old knows better than to give out personal information on-line.

Past experience

[Troy]

I taught in a laptop school several years ago. The technology was JUST maturing then, but most of my problems were person-driven rather than technology-driven.

Here are my tips
1) Firmly establish who actually owns what, because that determines the scope of your reach. If the computers are still school property, you have a lot more reach than if the kids buy them up front or buy on an installment plan.

2) Either way, you're going to have to amend your Acceptable Use Policy to address issues brought up by the laptops. I would do some research into other laptop schools and download their AUP. In fact, contacting other laptop schools is probably a good idea in general. It's always better to make your first mistakes vicariously through someone else.

3) Partition the laptops so that user data is stored on a separate partition, and invest in a good disk-imaging system. You're going to be imaging a lot of laptops after a few weeks. No matter how hard you lock them down, someone is going to screw something up so royally that you can spend 6 hours fixing it or 10 minutes imaging the disk, and it will happen frequently (how frequently depends on school size). In fact, you may want to get clever and make 3 partitions. 1 main, 1 user data, and 1 unmounted that holds a local copy of your image file. Image your main partition only, copy it to your "hidden" partition, and image the whole thing for deployment.

4) Figure out a theft-protection mechanism. This will eventually become an issue. Laptop insurance/warranties will also be an issue. If 15% of the laptops begin malfunctioning near the end of a 4-year-run, that will be enough to make it difficult for teachers to rely on those machines for classroom exercises. Nothing it more frustrating than having a whole lesson plan come to a stand-still because 4 kids' computers won't work. I've had it happen to me plenty of times. These also tend to be the kids who don't need any additional distractions.

5) If these are school-owned laptops, then you have a great deal of latitude in locking them down. Remote monitoring is another issue, and I would consult your district's attorney. As far as locking them down, the guiding question should be "what level of security supports the curriculum." Most slashdot users will think of these laptops as computers, with all of the implied potential. Thus any lockdowns curb that potential, and in turn the student's freedoms and opportunity. While this is a valid mode of thinking for personal machines intended for personal purposes, it is the wrong mindset to have in an educational environment. For starters, most students will never come close to tapping that potential (they want to surf the web and IM).

These laptops are being purchased to augment your curriculum, and should be configured in a way that makes it a platform for your curriculum. This may involve lots of restrictions, or just enough to keep a kid from accidentally breaking something. While you'll probably learn as you go, you should already have some idea of where that line is. If you don't, I'd recommend more research and consultation/training your teachers before writing that big check.

With totally unlocked computers, it is likely that a significant portion of the machines will begin malfunctioning due to user-abuse: "I'm going to install every piece of crap software I find! Isn't it great?" While it won't be a majority, it will be enough to make it difficult for teachers to rely on the machines to function properly during an activity (see above).

my advice

[Eil]

These are more general points than some of the comments posted so far. Take them for whatever they're worth.

1) Go for the least restrictive options possible. If you treat kids like criminals, they're going to act like criminals. Public middle/high schools are enough like jails as it is already.

2) Some kids are going to figure out how to work around almost every restrictive measure you put in place, regardless of what you do. Expect that and when it happens, set the example and deal with it in a mature non-kneejerk way.

3) Related to #2, the kids are going to use the laptops for non-academic purposes. This should be encouraged because to do otherwise is running contradictory to the whole message of telling them to have this laptop and take it home. If you don't want them to use a general-purpose computer for general-purpose activities (communication, music, art, programming) then don't give them a computer.

4) Realize that 99.9% of the "problems" related to the use of the laptops are best resolved with non-technical solutions. If instant messaging in classes is an issue, have the teacher tell them to knock it off and pay attention to class. Don't just take away the chat program and leave it at that, because the underlying problem still remains. Cure the ailments, not the symptoms.

5) Above all, EDUCATE them on what's considered acceptable use of the computer and what's not. For the love of all that is holy, do not just give them the computer and then punish them for using it wrong. Kids have a natural tendency to explore their world and the things in it, don't help the school system destroy that inclination any further.

As a parent, I have to say

[SecurityGuy]

None. And I don't say that lightly.

The risk is that kids will get into places we'd rather them not. Honestly, there's a lot of total trash on the 'net that adults would probably be better off seeing.

The risk, though, is that we train kids to be subservient to authority, which is bad for them and bad for a free society. As we've seen so much recently, many, many people and groups are quick to claim authority illegitimately. I'd really rather have kids grow up believing it's NOT ok for big brother to monitor what they're doing 24x7.

Zero lockdown, massive monitoring.

[goodmanj]

First, a general premise: kids of this age deserve respect, but are not yet given all the privileges of society granted to adults, because they have not yet learned enough to use those privileges responsibly. This especially applies to privacy. If you disagree with me on that, you might as well stop reading now.

--

Anyway, my solution: let's just use the same principles we used for schoolchildren *before* everyone had computers. No more, no less.

Dial the clock back to 1985. Did we search every student's book bag for pornographic magazines as they entered the school? No, but if a teacher caught 'em with it, they'd be frogmarched to the principle's office. Besides, kids are really creative about hiding contraband, you're not going to stop them if they're determined to bring a Playboy to school. But if a teacher heard giggling in the boys' room, he'd investigate. In 1985, did we hand out pieces of paper on a strict quota system to prevent them from passing notess in class? No, but the teacher would stop note-passing when she spotted it.

In an Internet world, this translates into not locking the laptops down at all -- let them access any sites they wish -- but monitor their Internet usage at school aggressively and proactively. And tell them exactly what you're doing.

Teachers should have a packet sniffer app running on their own machines that shows the destination and type of Net traffic occurring in their classroom in realtime. Distracting activities like online games, IM chat, e-mail, etc. should be red-flagged for the teacher to deal with as she sees fit. On a broader level, the principal's computer should have a packet-sniffing app that permits her to monitor for issues of significant disciplinary concern -- not simply iChatting in class, but say, reading up on bomb and drugmaking information.

Of course, all this network monitoring only works on the school grounds, but that's the limit of the school's jurisdiction. What the kids do in their homes is up to their *parents* to monitor -- and hopefully, the school gives the parents a similar application to use at home.

The laptops could also have software to search for and report highly suspicious stored files which make their way onto the computers without passing through the school's network. It's easy to do with Spotlight. You'd have to verify the integrity of the searching application to make sure it hasn't been tampered with, of course. This is more draconian than network sniffing, though, so I'd call it optional.

The nice thing about a monitoring but not disabling policy is that it allows you to handle edge cases well. Twelve-year-old girl reading the Wikipedia page on preteen lesbianism (assuming there is one)? The school can choose to ignore it, or maybe give some guidance. Eighteen-year-old boy reading the same website? Possibly a different action.

With aggressive monitoring, just like in 1985, teachers can choose to take action on what they see or not... the important thing is to give them the tools to observe what's happening in their classrooms.

Personal Experience

[sanosuke001]

My High School started a laptop program when I was entering my Junior year. They started with the Sophomores that year so I wasn't able to get one. However, I ordered myself a laptop to use in my own classes, but didn't have any "laptop" classes. My brother was in the initial class, though, and I knew a lot of his friends.

First, and foremost, if the school is fronting most of the money, don't get macs. They cost way too much. I would suggest either have the families pay for the laptop up front with subsidies for those who can't afford it or get something else. Acer is fairly reasonable as are a few other brands.

The one issue my school had was that they got them the shittiest laptops they could. Don't do this; nobody will purchase them upon graduation.

Second, stop buying dead tree books and find eBooks to run your classes on. It will save the school money and make upgrading easier. It'll also help the kids by not having to carry so much and they'll always have their books in class and at home.

Don't lock down the machines; they will find a way around it. Instead, lock any ports on the school's network you deem necessary and do any proxy blocking you can. If you see students using a proxy, ban the IP. It isn't as preventative as some more invasive tools, but it's a lot less trouble.

As for software, let them install what they want. If they bring it home, they should be able to do with it as they please. If they were school-owned and only used during class I can see restricting them, but they're not.

One last thing, the admin at my high school was incompetent. Find someone who knows what they're doing and for god's sake, backup their hard drives before you work on them or set up a network storage solution for kids' files. Our admin would just format and re-image when anyone had a problem for ANYTHING. The keyboard would break, reformat, just in case that was the issue before replacing hardware. A lot of my brother's friends stopped bringing their issues to the school because they would lose everything on their machines every time they brought it in.

Our program was ultimately shut down because the teachers weren't taking advantage of the laptops in class. This is the biggest problem. Use the eBooks, get software designed to augment their classes, and have teachers go through a rigorous computing course. If they don't know how things work, they won't use them.

Dilbert shows why it is pointless

[glamb]

http://www.dilbert.com/fast/1996-01-23/ On the other hand, if you enable internet filters to things like facebook you will very quickly expose your kids to the world of hacking, ssh tunnels and external proxies!

What are you trying to do?

[DragonWriter]

Important information that precedes any answer to the question you ask has either been left out, or not decided, and the description given is self-contradictory on some of the important parts that aren't omitted. For instance, you say students will "essentially own the machines" and then talk about their ability to purchase them after graduation, and state mandates for filtering on school machines. Neither of the latter two points are consistent with the former: student ownership means students don't need to buy them, and mandates that apply to school-owned machines don't apply to them.

Most importantly, you need a coherent idea of why you are spending the money to buy computers to give (or lend, as it seems from your description) computers to students. Once you know that, the uses and restrictions that are consistent with that will be much easier to determine, because you will actually have something to evaluate them against.

(Personally, I think once you know why students need computers, it might be better to decide on a common hardware/software platform that meets that need, communicate that it was required, and subsidize purchase and reasonable repair/replacement -- with a means test -- rather than the school buying computers for the whole student population and retaining ownership and responsibility for monitoring/controlling their use at all times, particularly if there are significant state mandates that apply to school-owned computers.)

---
We're a school district in the beginning phases of a laptop program which has the eventual goal of putting a Macbook in the hands of every student from 6th to 12th grade. The students will essentially own the computers, are expected to take them home every night, and will be able to purchase the laptops for a nominal fee upon graduation. Here's the dilemma -- how much freedom do you give to students? The state mandates web filtering on all machines. However, there is some flexibility on exactly what should be filtered. Are things like Facebook and Myspace a legitimate use of a school computer? What about games, forums, or blogs, all of which could be educational, distracting or obscene? We also have the ability to monitor any machine remotely, lock the machine down at certain hours, prevent the installation of any software by the user, and prevent the use of iChat. How far do we take this? While on one hand we need to avoid legal problems and irresponsible behavior, there's a danger of going so far to minimize liability that we make the tool nearly useless. Equally concerning is the message sent to the students. Will a perceived lack of trust cripple the effectiveness of the program?

built to suit both purposes

[cyberbian]

Having worked extensively with a private school in this situation exactly, we chose to have roaming profiles, which allowed the student to log in to each machine locally, but their work was synched to their class server next login on campus. While logged in on campus, all internet content is filtered, we use jabber and bonjour messaging locally and the kids love it, these services are not given wan access.

When the student is logged in off-campus they can make documents, and use the internet as their local administrator (parent/guardian) deems appropriate. In those environments, it is considered the responsibility of the parents/guardians to provide content filtering and/or monitoring of their child's internet use. As the students are just plain users, they have few rights with respect to system modification on their local accounts, any software that they wish to install is handled via a parental request form. Machine software images are netbootable so it's quite trivial to refresh each machine.

It's important to remember that if the student and their parents ostensibly 'own' the machines, they should be granted any leeway they request, yet not undermine the local regime. Well implemented network services can ensure that your local rulesets are followed.