School policies and regulations expose Massachusetts students to risk of serious privacy violations

BOSTON – Educators across Massachusetts are successfully integrating new technologies into classrooms and school administration, but the school policies and regulations that govern these new systems inadequately protect young people in the digital age. An American Civil Liberties Union of Massachusetts examination of 35 school districts across the state, released today, has revealed policies and procedures that put students at risk of serious privacy violations.

The wide-ranging investigation examined practices including the management of student information, school-controlled technology programs, and in-school physical and digital surveillance. For example, the ACLU found:

* Nearly all of the thirteen school districts that released data about the management of personal and sensitive student information contract with third-party corporations to handle this data;

* Districts almost universally deploy surveillance cameras on school grounds;

* Many schools use software with remote filtering, monitoring, and/or tracking capabilities. West Springfield, for instance, uses software called GoGuardian for its Chromebook laptops. As of April 2015, GoGuardian allowed real-time and historical activity tracking and screen monitoring, location tracking, keystroke logging, and even the remote activation of webcams when students take the devices home.

On October 27, 2015, the day before the publication of this report, GoGuardian called the ACLU of Massachusetts to say that they “heard through the grapevine” that the ACLU was about to publish a report that would discuss GoGuardian. The company informed us that its software no longer enables webcam monitoring or keylogging. We asked the company for the specific date on which they made this change; as of the publication of the report, they have not responded. According to Google cache, however, sometime between October 23, 2015 and October 28, 2015, GoGuardian added the following language to its website: “As part of our ongoing commitment to student privacy, GoGuardian no longer enables keystroke logging and remote activation of the webcam.”

Alongside our findings about these practices, the ACLU also discovered that governing policies often do not exist or are permissive.

“Privacy doesn’t mean secrecy—it means having control over your personal information and the right to decide how it gets used,” said Jessie Rossman, staff attorney with the ACLU of Massachusetts. “Educators are working hard to use new technology to students’ advantage, but this technology need not—and should not—come at the expense of student privacy. Unfortunately, current school policies and regulations in Massachusetts inadequately protect our young people in the digital age.”

Some communities did stand out positively in the report, “Back to the Drawing Board: Student Privacy in Massachusetts K-12 Schools.” Uxbridge provided a written policy limiting device searches to physical searches “when a problem is brought to the attention of the building administration.” The Mystic Valley Charter School reported that it does not share student information with private vendors. Brockton prohibits third parties from sharing student information with other corporations absent student or parent consent.

However, the most troubling findings spanning varying technologies and practices centered on a lack of transparency with students and parents regarding the collection, storage, and use of sensitive information:

* Two-thirds of the schools that produced policies governing school-controlled devices reserve the right to inspect these devices without notice or consent. More than half of these schools explicitly state that students have “no expectation of privacy” in school-controlled devices;

* Districts almost universally claim that students have no expectation of privacy when using the Internet at school;

* The vast majority of schools did not disclose surveillance camera policies despite the presence of cameras on campus. Only one school produced a policy in response to the ACLU request;

* No release contract conditioned a school’s disclosure of student information to a third party on parent or student consent, and only one district prohibited third parties from sharing information with other corporations absent parent or student consent.

“We are sending the wrong message to young people and their families when we tell them that they should have ‘no expectation of privacy,’ and that they should simply get used to this,” said Kade Crockford, director of the ACLU of Massachusetts Technology for Liberty Project.

“The Massachusetts student privacy regulations were last amended in 2006, before devices like iPads and iPhones even existed. Massachusetts needs a comprehensive 21st century student privacy law,” said Crockford. “The national ACLU has offered model legislation to help guide this process at the local level. In the meantime, the ACLU hopes that students, parents, and educators will use our findings and recommendations to advocate for robust transparency and stronger privacy protections in their schools. Given the importance of both education and technology to the future of the Commonwealth, Massachusetts should join the 17 other states that have modernized their student privacy laws in just the past two years.”

In addition to revealing policies and regulations that threaten student privacy, the investigation found that Massachusetts’ weak public records law makes it hard to even gauge the extent of the problem, and needs reform. One in five of the school districts we contacted effectively ignored ACLU requests or demanded excessive fees for basic information. Despite multiple contacts, school districts in Barnstable, Lynnfield, and Pittsfield never produced any records. Newton demanded $5,834 for all but a few records; Lexington asked for approximately $2,200; and Waltham estimated the cost would be between $1,020 and $1,360, plus the cost of making copies.

For a copy of the report “Back to the Drawing Board: Student Privacy in Massachusetts K-12 Schools,” as well as downloadable guidelines for better privacy at school and a copy of the ACLU’s model legislation, go to:

https://aclum.org/studentprivacy

For more information about the ACLU of Massachusetts, go to:
https://aclum.org