VTDigger is posting regular updates on the coronavirus in Vermont on this page. You can also subscribe here for regular email updates on the coronavirus. If you have any questions, thoughts or updates on how Vermont is responding to COVID-19, contact us at coronavirus@vtdigger.org
Parents, staff, and students at Burlington’s Sustainability Academy were startled Wednesday morning when their virtual community assembly, held over the popular web conferencing app Zoom, was crashed by a prankster.
A marker suddenly appeared over the slides presented by Sustainability Academy staff, and then a picture of what looked to be white powder on a table. The marker drew the word “cocaine” before school employees quickly shut down the stream. The meeting resumed soon after without disruptions.
Russell Elek, a spokesperson for the district, said that the code to connect to the meeting had been inadvertently shared on social media. The stream was restarted with additional restrictions on access, he said, and school officials are at work on guidance to help staff avoid similar incidents.
“Principal (Nina) Oropeza has addressed this with her community and has already taken action to ensure this cannot happen again,” Elek wrote in an email.
SA’s meeting had been “Zoombombed,” a phenomenon that on Thursday derailed a Vermont Senate committee hearing, and earlier this week prompted the FBI’s Boston office to issue a warning on the matter.
“As individuals continue the transition to online lessons and meetings, the FBI recommends exercising due diligence and caution in your cybersecurity efforts,” the agency wrote in a bulletin Monday. The FBI suggested users adjust certain privacy settings when using the platform to mitigate the risk of such pranks, which exploit a screen-sharing option on the app.
The key thing to keep in mind, said Duane Dunston, an assistant professor of information security at Champlain College, is that people organizing teleconferences need to make sure only intended participants have access to dial-in information.
“They should not be sharing information with other people about meetings, because those meetings might contain pin numbers or passwords,” he said.
Zoom has recently attracted the scrutiny of the New York Attorney General’s Office for its privacy practices, according to the New York Times. But the hijacking of its teleconferences in school settings also underlines the broader crash-course in tech, privacy, and security educators are receiving as they flock to online platforms amid the coronavirus pandemic.
Cybersecurity concerns are particularly sensitive in the context of education, where officials must also contend with federal student privacy laws, particularly the Family Educational Rights and Privacy Act, or FERPA.
“Moving to distance learning, particularly online learning, raises a lot of privacy issues and children’s protection concerns that we haven’t had to deal with before,” Jeanné Collins, president of the Vermont Superintendents Association.
The Rutland Northeast Supervisory Union, Collins’ district, already belongs to the Vermont Student Privacy Alliance, a chapter of the Student Data Privacy Consortium. The nationwide collaborative allows school districts to share contracts with technology vendors that have already been vetted for compliance with state and federal privacy laws.
And, like several Vermont districts, the RNESU had decided early on in the crisis it would not use certain platforms – including Zoom – for any interactions involving students.
But this period has still presented unexpected challenges. The district quickly realized, for example, that it needed to control settings so students couldn’t congregate in Google Hangouts without teachers present.
And the Vermont Superintendents Association has also put out guidance recommending that if teachers record lessons so that students may access them later, students not appear in the videos themselves, unless parents explicitly consent to them doing so ahead of time. These recordings will be considered an educational record, the VSA said, and be subject to FERPA.
Prior concerns about education technology tools – including around privacy and data-mining – are certainly heightened in this moment, said Amelia Vance, director of Youth & Education Privacy at the Future of Privacy Forum.
But Vance said she’s particularly worried about all the online tools not originally built for schools that are now being aggressively marketed to – and widely adopted by – educators across the country as schools shut down. That includes social media platforms, as well as webinar tools.
“These products are not privacy-protective by default,” she said, and many likely violate FERPA.
Vance also thinks schools should discourage teachers from requiring students video-conference into classes. That could be invasive, and also catch other people in a student’s household unawares.
The federal Children’s Internet Protection Act also requires schools to filter content on school district devices, which means that the Chromebooks and iPads being sent home with students to help bridge gaps in connectivity are all being monitored to some extent. Many devices are outfitted with software that scan student chats, emails, and browsing habits to alert administrators if students misbehave or show signs of distress. Vance said it’s important parents know that.
“They need to make sure to be entirely transparent with parents and students about what is being monitored and how it is being monitored, and how it will be used,” she said.
