ACLU urges digital privacy safeguards for students

Massachusetts students are never far from an Internet connection. The state's public schools have embraced digital tools to enhance teaching, lending students iPads and laptops, and the vast majority of teens are tethered to their smartphones. 

But while the state's classrooms are fully connected, few schools have policies that inform students – or their parents – about their expectations for online privacy.

In fact, the prevailing view among Massachusetts districts is that students must check privacy at the door when it comes to using the Internet in schools, according to a study by the American Civil Liberties Union of Massachusetts. Many schools reserve the right to monitor students' Internet traffic and e-mails, and sometimes search students' personal devices.

In two-thirds of the 13 school districts that provided documents for the ACLU study, district policies allowed schools to inspect school-provided devices without any notice or consent of either the students or parents. Likewise, students often don’t have an expectation of privacy even on their smartphones or tablets.

Sweeping policies like these set a dangerous precedent because they normalize surveillance, said Kade Crockford, director of the ACLU of Massachusetts Technology for Liberty Project.

"These kids are going to be adults someday," Mx. Crockford said (Mx. is a gender-neutral title). "If they have learned in schools that they are not to be trusted, that they have no right to privacy ... on the Internet or on their iPods or laptops or phones, they may very well believe that this is how things work [in adulthood].”

In the Burlington School District, for instance, students have no privacy rights when using devices provided by the school – and some school officials say that's how it's supposed to be.

"It’s not their device," said Burlington superintendent Eric Conti. "Are we monitoring or filtering your use? Yes," Mr. Conti said. "We’re providing the device, and you’re using content we’re delivering through that device."

From the district’s perspective, Conti said, it’s a policy meant to ensure safety and help students understand proper behavior online. He likened it to teaching driver's education.

"We have high school kids driving cars," he said. "Those are pretty dangerous technology as well, and we try to give them the tools to drive carefully and monitor that.”

This is among several areas where Conti and the ACLU's Crockford diverge. Both agree that schools play an important role in safety on campuses. But whereas Conti sees it as the school's responsibility to step in and monitor school devices and Internet use because of a perceived danger, Crockford doesn't consider either "dangerous," putting a greater focus on minimizing surveillance and enhancing transparency around the practice. 

"Computers are not like cars," Crockford said. "Cars actually kill people, they are dangerous weapons. But an iPad is not going to kill a child.”

Laptops are hardly the only technology in today's schools. About 14 Massachusetts school districts, including Burlington, use Google Apps for Education, a free toolkit Google offers schools. The service, which includes apps like Gmail and Google Drive, promises no ads. It also includes Google Classroom, which is a platform for teachers to create and keep track of assignments and feedback and communicate with students. Five schools, the ACLU’s report found, require that students sign up for a Google account to use the technology programs at school.

The apps aren’t free of privacy issues, either, according to the ACLU. Until a lawsuit last year prompted the tech giant to stop, Google scanned e-mails of students who used Google Apps for Education. Students and teachers in a northern California district court filed the suit, arguing that Google could use the practice to create advertising profiles of the students.

The more controversial third-party apps, however, are the monitoring software at least four Massachusetts districts use on school-provided devices. According to the ACLU’s report, eight districts use software loaded on school devices to gauge appropriate Internet use. One district, West Springfield, uses a software called GoGuardian that the ACLU described as “invasive."

GoGuardian previously allows schools to track devices’ location, store their keystrokes to capture everything typed on the device, and remotely activate webcams. But according to the ACLU, the company recently halted its webcam monitoring and keystroke logging features, citing an “ongoing commitment to student privacy.” 

Crockford said the ACLU does not want to take away schools’ ability to keep campuses safe. Rather, the ACLU is calling for greater transparency around what kind of information schools are collecting about students, what information they are sharing, and for what purposes.

The ACLU recommends that administrators be mindful about the kinds of devices and apps they choose, urging them to put privacy first and "ban all use of student data for advertising." Their report also calls for districts to involve the community for feedback about any practices that affect student privacy. Parents, it recommends, should scrutinize consent requirements, request a list of third parties with access to student data, and push for more transparent surveillance policies.

For lawmakers, the ACLU is calling for a comprehensive student privacy law that offers strong protections for student and parent confidentiality. Legislators, the ACLU said, might look to a California privacy law to start, which bans selling student data for advertising purposes. 

“Technology has moved very quickly,” Crockford said. “And the law needs to catch up.”