Friday, February 19, 2010

School Spies Students Through Their Laptop Cameras

According to the Associated Press, "a suburban Philadelphia school district used the webcams in school-issued laptops to spy on students at home, potentially catching them and their families in compromising situations, a family claims in a federal lawsuit."

A lawsuit against the Lower Marion School district contends that "the school district can activate the webcams without students' knowledge or permission."

The plaintiffs in the suit allege that Lindy Matsko, an assistant principal at Harriton High School, informed them that their son had engaged in improper behavior at home. The lawsuit stated, "(Matsko) cited as evidence a photograph from the webcam embedded in minor plaintiff's personal laptop issued by the school district." Further, Matsko later confirmed to the plaintiffs that the school had the ability to remotely activate webcams in the school issued laptops.

According to Gizmodo, the school issued laptops come with Apple Remote Desktop which would allow administrators to remotely access the school issued Mac Books and to turn on the embedded iSight camera. Gizmodo's Jesus Diaz succinctly sums up my feelings about the Lower Marion School District administration writing "way to go, KGB-wannabe assclowns."

If you're going to give students laptops to aid in their academic pursuits dont effing us that same laptop as a tool of surveillance and repression. And no, I dont think im being too dramatic with my language. As Uncle Ben said to Peter Parker, "with great power comes great responsibility."

Hat tip to your classmate Oliver for originally referring this story to me.

5 comments:

MCGeckle said...

This is nuts! Though we have discussed the idea of Big Brother in class and the scary realization that it is possible and probable that the government and corporations use the internet to collect information about us, the idea that a school could activate computer cameras in order to spy on families is just downright scary.
Now, I know that in high school, the school's computers in the library were closely monitored in order to insure safety against viruses and in order to stop students from visiting "inappropriate" sites, but it never occurred to me that the same could be done with my computer at home.
If schools can do it, it follows that the government, the NSA, could do it as well-- and with their new Google alliance, who can stop them?
The Shadow Factory clearly indicates that the NSA has violated privacy laws in the past, with government and presidential approval, until they were finally caught out, so who would know if they start doing that now? Computers these days often come with built in cameras and with email providers like Google providing video chat to their users, there is no clear proof that the NSA will not spy-- maybe not with malicious intent, but the idea that an agency could remotely activate your computer's camera certainly puts a whole new spin on the idea of Big Brother watching you.

Meggie Michaels said...

My first thought after reading “School Spies Students through their Laptop Cameras” was of disbelief. If this accusation is in fact true; what were the school officials thinking? Did they not conceive that this could be construed as violating the Fourth Amendment? This is criminally wrong, similar to police search and seizure without a warrant. Just because the police may believe someone is guilty of unlawful behavior, they simply cannot invade one’s home or business on a whim.

I also was surprised that this case had not received more attention, as it so blatantly infringes on an individual’s civil rights. It definitely violates the right to personhood which Daniel Solove describes as “the protection of one’s personality, individuality, and dignity” in his “Conceptualizing Privacy.” If one knows that one is under surveillance, this might cause one to self-censor. If the school intended this as a means to control usage of their laptops to strictly academic use, then they should have informed the students of this surveillance. Yet, the school district superintendent admits that students were not notified of any security software. But meanwhile, the district’s website tries to shift blame by lamenting that nothing prevented students from covering the laptop cameras with tape!! The school district cannot have it both ways; if the students did not know about their surveillance, why would they cover their cameras? It seems the school district felt they had the “right” to “spy” on these students as the school provided these laptops.

Furthermore, this surveillance violates the right to intimacy or the “control over, or limited access to, one’s intimate relationships or aspects of life” (Solove). What appears to be the foremost problem is the lack of legal definition for a webcam’s use and intention. The article from the associated press states that “that webcams were remotely activated 42 times in the past 14 months, but only to find missing, lost or stolen laptops.” However, was that the original objective of these webcams? As these webcams undoubtedly were installed for the purpose of conferencing, I do not believe Apple had intentions of using their Mac Books as surveillance tools. Privacy violations are inevitable when technology is not kept to its original function.

In addition, this case also demonstrates how violations of privacy can lead to misconceptions about others. As reported by the Associated Press, a school official “mistook a piece of candy for a pill” from webcam surveillance inside a student’s home. If this is indeed true; this is a prime example of how a breach of privacy can explode into something more, such as slander; and become a much larger offence. For example, through this same surveillance, the school might witness family discord which they in turn, might characterize as domestic violence.

Overall, if this case is legitimate, then it directly violates the Fair Information Practice Principles, especially the essential principles of Notice/Awareness and Choice /Consent.
Ultimately, this case is extremely problematic as there are few concrete laws about privacy policies, especially concerning technology. Perhaps now is the time to introduce a few.

Mary C. said...

This article hits especially close to home because I live in Lower Merion Township and if I had gone to public school I would have attended Harriton High school. Throughout the semester this class has exposed the dangers and threats to privacy computers and the Internet present, however this specific example of the manipulation of technology is exceedingly scary. So far I’ve learned about Google and how it saves and stores everything we ever search, visit, or email and then in The Shadow Factory I learned how the NSA does surveillance and finally understood how easily they can intercept information flowing through fiber-optic cables. Though most of this new knowledge was shocking, it did not resonate like the story about students being spied on through their webcams did. This is because for me, and I believe for most of my peers, organizations like the NSA, Google and the government seem removed and impersonal. We know that surveillance is an everyday occurrence but don’t feel violated or threatened because it is a computer in California that is collecting information about us, rather than the administrators and teachers at our school spying on us through webcams. Whose violation is greater? The NSA who can read any of your emails and listen to any of your conversations or the school who activated webcams in students’ Mac Books without their knowledge or permission? In theory one could argue the former is a more significant violation of privacy because of the volume and extent of its operation, but I personally believe the latter is far more threatening. This falls under the category of invasion of private life in Solove’s taxonomy and is a disgraceful intrusion on the part of the high school. Surveillance can certainly lead to self-censorship, but I think it is safe to generalize that most high school and college students do not censor themselves because of government surveillance; on the other hand, I am certain that if the Harriton students had been informed, as they should have, that their computers had Apple Remote Desktop they would firstly refuse the computer, but ignoring that option, they would definitely alter their daily life because of the intrusion, making this scandal one of the worst violations of privacy.

Anonymous said...

I have to be careful about posting on this topic, because of my job and also because I have an in-law who as a CISSP is involved in this case. I'm restricting my comments to my perspective as a former elected regional school board member, and a practicing CISSP.

I expect that the school grappled with the fear of public criticism about the possibility of students using those laptops inappropriately, viewing porn or sexting each other. It's one thing when they send sexy text IMs using their own cell phones, another if they use school provided laptops. So they probably felt a need for reassurance, for themselves as well as the public, by having monitoring capabilities - and using them.

Questions for you to consider: how can they enforce an appropriate use policy without any monitoring? What level of monitoring is appropriate?

So it seems a simple extension from having a monitor in study hall in school to having a monitor on school laptops at home, doesn't it? Thing is, once the monitor detects something, what do they do?

What happens once the school staff becomes aware of inappropriate, possibly illegal, behavior?

Can they ignore it? If they ignore it are they culpable?

If they act on it, the results are what we see.

Problem goes back to the decision to monitor. But that is rooted in the problem of preventing inappropriate behavior, and avoiding criticism for not preventing such behavior.

Seems like the only really good solution is not issuing laptops. Is that the best outcome? If not, how do you deal with the problems that ensue?

Just some food for thought...

Ned Moran said...

Anonymous,

Thanks for stopping by and commenting. I understand your perspective and agree that the school bears a responsibility to protect its students. However, the problem here was the school's failure to notify the students that they could and would use the embedded camera to surveil the students. I have no problem with the school wanting to create and enforce an acceptable use policy but the way in which they implemented their policies were terrible. There was no informed consent. This could have enabled students to opt-out. There also did not appear to be a clear understanding of when the school administrators should enable monitoring. The school said it was their policy to only use the cameras to locate stolen or missing laptops. If thats the case then why were they using to enforce potential disciplinary problems? Simply stated, the school screwed up.