Slashdot Mirror
Ask Slashdot: Explaining Cloud Privacy Risks To K-12 Teachers?
hyperorbiter writes "With the advent of Google Apps for Education, there has been a massive uptake by the K12 schools I deal with on signing students up with their own Google powered email address under the school domain. In addition, the students' work when using Google Apps is stored offshore and out of our control — with no explicit comeback if TOS are breached by Google. It seems to me that the school cannot with integrity maintain it has control over the data and its use. I have expressed a concern that it is unethical to use these services without informing the students' parents of what is at stake e.g. the students are getting a digital footprint from the age of seven and are unaware of the implications this may have later in life. The response has often been that I'm over-reacting and that the benefits of the services far outweigh the concerns, so rather than risk knee jerk reactions by parents (a valid concern) and thereby hampering 'education', it's better to not bring this stuff up. My immediate issue isn't so much about the use of the cloud services now, but the ethics over lack of disclosure in the parental consent process. Does anyone have ideas about defining the parameters of 'informed consent' where we inform of risks without bringing about paranoia? (Google Apps is just an example here, I think it applies to many cloud services.)"
This question needs a bit more detail. What *are* the implications of using these Google services? Is Google using the same boilerplate contract? Does it sweep emails for words and phrases to show advertising? Is it collecting anonymous data?
I think you probably need some school-specific clauses to address the particular privacy and safeguards but you haven't articulated any specific examples of areas where you think Google is falling short or why this might become a problem. Kids are going to have digital footprints as children. I might not like that very much, and as a parent I may try to limit it, but you can't stop it.
What gives you the idea that data is safer stored within the US? In reality, I think it is less likely to fall into the 'wrong hands' (someone who wants to embarrass or blackmail your child later in life) stored overseas.
If you can't articulate what the implications are of using Google Apps for Education, then at least one of the following is true.
1) You don't actually have sufficient understanding of the situation
2) You're the wrong person to attempt being the spokesperson for the "opposition"
You need to be able to articulate your specific concerns regarding use of the service - not just make hand waving statements. If its bad that students have a "digital footprint" from age seven, explain *why*. And, even then, be aware that others may not share your concern (or may have adopted a fatalistic attitude about the situation).
#DeleteChrome
We already have groups of people afraid of wifi, vaccines, and a host of other things that are non-issues. They are also disproportionately afraid that their child will be abducted (by strangers, or even by aliens).
Pretty much whatever you say will either be misunderstood by some subgroup, or deliberately misconstrued by another - and then a school faces the problem of providing a special exception* for some group of students that have been opted out.
* Note that I'm generally in favour of special exceptions in schools because children do have different learning styles and paces - but this would be a crazy addition
Obviously there are valid issues. The question is not IF we should teach them, but HOW.
Right now there are few ways to articulate the risk. There is the vague handwaving education of "bad guys will steal it".
Even when doing this professionally it is difficult to fully understand what the risks are, who exactly the "bad guys" includes, the kind of stuff they want to take, and the reasons they want it. The bad guys may include governments, vandals, corporate espionage, advertisers, news agencies, and more. The stuff they want may include not just credit card numbers, but also patterns of what you like, where you go, and who you are with. That stupid-looking photo may be cute today, but it may destroy your bid for public office two decades later. The fact that your facebook friends have some overlap with a suspected terrorist may put you on a watch list. Knowing the bad guys, and knowing the data they are looking for, is hard.
Then you have the difficulty of explaining it clearly. It is hard enough to explain to a teenager that their quick goofy photos (or much worse, sexting) might, twenty years from now, prevent them from getting their dreams fulfilled. Sometimes it is easier to point out that public stupidity can prevent them from getting a job in three years, but even that seems difficult to teach.
Since that wasn't quite asked, here's the evolved question:
HOW do you teach K12 students about the risks in the digital world?
//TODO: Think of witty sig statement
You have this belief of a boogieman in the closet, but have nothing that actually backs it up. But because you think you are so smart you can't possibly imagine that your beliefs aren't true and you are over reacting you expect us to back you up as surely everyone with half a brain must believe what you do.
In the cloud, or any other computer network, you have no privacy. What is there to explain, other than you voted for this?
“He’s not deformed, he’s just drunk!”
And what precisely are the implications and risks according to you?
What precisely do you think isn't being disclosed?
It is an interesting point...
Sugget you do some research, (look into the big G's T&Cs), and write down exactly what you think the issue may be.
Try and be balanced, then fire it off to yor boss.
Your duty is then done, and your ass covered.
Why is "bringing about paranoia" a problem? Where security is concerned, I generally consider paranoia to be a good default reaction to any situation until I understand it well enough to relax.
Explain the situation well and allow the parents and others to be as paranoid as they consider prudent. Don't try to manipulate them into being more or less paranoid just because you or the system think they should adopt a different mindset. You provide facts then it's their choice to make.
If, OTOH, you're excessively concerned about and wish to avoid creating paranoia you'll hamstring your efforts to be intellectually honest and technically accurate when you "define the parameters of informed consent."
It's easy to explain cloud privacy issues. We'll do it in terms of purses and wallets as those are common items of value that people understand can contain very private information:
Someone is doing the digital equivalent of asking you to keep your purse (or wallet) securely and have it available at all times for you. They won't try to steal the money or credit cards, etc in it (or whatever else of value if you choose to store it). Yes, there may be a security breach, but it's less likely than you dropping or forgetting your purse or wallet.
On the other hand, it means that if you put them in your purse (or wallet) they know how many birth control pills or condoms you kept in it and by when you used them what part of your menstrual cycle you're on or when you had a hot date that turned into an all night.
Now, extend that to your son or daughter that will have records on them from the time they enter grade school until, well... forever.
(In some ways it's not a big deal, but in some ways it is, and that rather graphic example gets across the level of info that can be mined from long term records.)
>The response has often been that I'm over-reacting
Because you are.
Allowing children under 13 to disclose identifying information online, without parental consent, is not only a bad idea, it is illegal. Read up on the Children's Online Privacy Protection Act. If these kids are using their real names, their photographs, or their email addresses online without written parental consent, then the school may find themselves in legal trouble. COPPA lays out some pretty specific rules, so if you are using the internet with kids under 13, you need to be familiar with that law.
If you can't articulate what the implications are then at least one of the following is true.
1) You don't actually have sufficient understanding of the situation 2) You're the wrong person to attempt being the spokesperson for the "opposition"
I very much agree with this. Unlike the IT worker in the headline I can articulate many of those implications. Unfortunately getting it through a child's view is difficult. Even communicating it to an ADULT is difficult.
We see these things on /. all the time:
* Goofy pictures as a teen, but as 47 year old fired from executive job due to bad public response.
* Seemingly innocent banter about being insane, Texas teenager in jail.
* Picture of children in a bathtub, ten years in prison for child porn.
* "Why would I want to live there?" to your friends, fired from Microsoft.
* Sexting images go public, lives ruined.
And those are the EASY cases.
On their surface none of them seem like threatening issues. I post pictures of myself, friends and, family. I publicly chat with friends. I hope that they never come back and bite me, but in this world even the smallest innocent thing can be taken out of context and destroy lives.
How exactly do you communicate rational responses (not just fear) for these actual risks that we read about daily without sounding crazy?
//TODO: Think of witty sig statement
You also need to be able to explain why "their cloud" is less secure than "your cloud". The data / work is being stored on servers somewhere, and if students can access it there is ALWAYS the chance for some misconfiguration or breach that exposes their information. So with that understanding, you need to justify why storing stuff in house would be more secure than with google-- and the truth is, a lot of the time, its not.
And where did you get that any of this was being done without the parent's permission?
From the summary.
Don't forget the bit about posting comments insulting religious or political views, and then potential employers not hireing you over it. The annoying thing is it can't be proven: If an employer looks you up and finds you've been insulting his religion, he isn't going to give that as the reason in your rejection letter - you'll just get a generic form rejection saying 'your application has not been successful on this occasion.' It probably happens all the time.
>The response has often been that I'm over-reacting
Because you are.
No he isn't.
See http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats
in at least four cases, Barksdale spied on minors' Google accounts without their consent, according to a source close to the incidents. In an incident this spring involving a 15-year-old boy who he'd befriended, Barksdale tapped into call logs from Google Voice, Google's Internet phone service, after the boy refused to tell him the name of his new girlfriend, according to our source. After accessing the kid's account to retrieve her name and phone number, Barksdale then taunted the boy and threatened to call her.
In other cases involving teens of both sexes, Barksdale exhibited a similar pattern of aggressively violating others' privacy, according to our source. He accessed contact lists and chat transcripts, and in one case quoted from an IM that he'd looked up behind the person's back. (He later apologized to one for retrieving the information without her knowledge.) In another incident, Barksdale unblocked himself from a Gtalk buddy list even though the teen in question had taken steps to cut communications with the Google engineer.
This space for rent.
'Why is "bringing about paranoia" a problem?'
Seriously. I do research with human subjects. If I don't have at least some people choose to decline participation at the point of informed consent, then I assume my consent isn't good enough - participating in any given research project is *always* not a good choice for at least one person.
Then again, you have the interesting situation that formal school-based education is not the correct solution for every single human; using google apps (or whatever cloud-based system a school is considering) is not the correct situation for every child, yet in both cases the benefits to society (shared childhood experience, guaranteed minimum education level; cheaper infrastructure) may wildly outweigh the relatively minor risks for the individuals.