the impending student data crisis
TRANSCRIPT
November 5, 2015
The Impending Student Data Privacy CrisisBy: Andrew Campbell (@acampbell99)
Critical Thinking at an EdTech Conference?
An angry father walks into Target in Minnesota…
The store manager investigated…
Shopping habits are extremely resistant to change, except….
…immediately after a major life change (e.g. moving, marriage, birth)
Andrew Pole, Sr Mgr, Media/DB Mktng, Target
•In charge of predictive data analysis for Target
•Send families with children christmas flyers with toys
•Tasked with predicting when women are pregnant
•Discovered that many pregnant women buy same 25 products at end of 1st trimester
•e.g. unscented lotion, vitamins with zinc, cocoa butter, cotton balls, etc.
•Predicted due dates for tens of thousands of women, within a few days.
Pregnancy Score
•23 years old & lives in Atlanta •March bought cocoa-butter lotion, a purse large enough to double as a diaper bag, zinc and magnesium supplements and a bright blue rug.
•87 percent chance that she’s pregnant and that her delivery date is sometime in late August.
•If she receives a coupon via e-mail, it will most likely cue her to buy online.
•They know that if she receives an ad in the mail on Friday, she frequently uses it on a weekend
•If they reward her with a printed receipt that entitles her to a free cup of Starbucks coffee, she’ll use it when she comes back again.
Fictional shopper, Jenny Ward
This is the world our students live in
A world where every detail of their life is observed, recorded, stored & analyzed
And educators are complicit in this.
“Cybersecurity will eclipse terrorism” FBI Director Robert Mueller (March 2012)
Digital Privacy is one of the defining issues of our time
Canada Data Breaches
•36% of Canadian businesses •89 per cent of the Canadian respondents: sensitive or confidential data stolen
•Average total cost of a data breach in Canada is $5.32 million
60,000 Canadians
Huge Canadian Data Breaches
900 SINs by 19 YO from London, Ont
Avid Life Media, Toronto, Ont
Are Schools and Students at Risk?
BC Education Data Breach3.4M student records containing
"Psychological assessments, describing in-care status, substance abuse, family problems” (September 22, 2015)
Why Are Schools Now At Risk?
“K-12 communities have been slow to adopt the strict
kinds of security standards that a retail or banking
customer has had for many years,” Maggie Hallbach, VP Verizon
“…student data are “highly sought after” on the black market…”
Threat of Data-Privacy Litigation Fuels District Insurance Purchases. Education
Week, October 19, 2015.
Schools Are Waking Up to Cyber Security“The Dothan City, Ala.,
school board on Monday allocated $25,000 to purchase
cyber liability insurance to cover the board in case a cyberattacker
gains access to district information”.
September 22, 2015
Given all this, shouldn’t we be discussing Student Data Privacy?
So What About The Classroom Teacher?
Ontario: Who’s Responsible for Learning Materials?
7. (1) The principal of a school, in consultation with the teachers concerned, shall select from the list of the textbooks approved by the Minister the textbooks for the use of pupils of the school, and the selection shall be subject to the approval of the board. R.R.O. 1990, Reg. 298, s. 7 (1).
Ultimately, Educators are responsible for the Education Resources used in the
classroom.
Are you fulfilling your responsibility to your students?
When it comes to learning resources…
Teachers are most likely to use free online resources when they need new learning resources. (P4E, Digital Learning in Ontario Schools, 2014)
Technology in the Classroom
$344 Billion$382 Billion$483 Billion
$31.31 billion (2013)
$59.90 billion (2018)
+13.9%
EdTech is BIG Business
($3-6 billion in Canada (estimated))
EdTech Companies Collect A Lot of Data About Students
“The amount of data being collected (by EdTech apps) is staggering. The most adept are scooping up as many as 10 million unique data points on each
child, each day. That’s orders of magnitude more data than Netflix or Facebook or even Google collect on
their users.”
‘The big biz of spying on little kids’ POLITICO, FALL 2014
“if a marketer knocked on your door and asked to spend several hours
secretly observing your child, recording everything he or she was doing and
saying for secret purposes, you’d probably tell them to take a hike. This is
happening every day with very little resistance.”
Sara M. GrimesUniversity of Toronto, Faculty of
Information
Why Do EdTech Companies Collect So Much Student Data?
•Tracking progress •Improvement •Advertising •Revenue
“Data is the real asset” Sal Khan founder of Khan Academy at an academic conference, Fall, 2014
•Tracks the academic progress of students 13 and older
•logs student location •Monitors student web browsing •Reserves the right to seek out personal details about users from other sources
•Builds profiles of their interests and connections.
•Sends them customized advertising (changed in 2014)
•May share personal information with app developers and other external partners
•name/address •email •date of birth •gender •country •interests •hobbies •lifestyle choices •groups with whom they are affiliated (schools, companies)
•videos and/or pictures •private messages, bulletins or personal statements
…may share information about users with consumer products, telecom, financial, military, market research, entertainment, and educational services companies according to its privacy policy.
Google Apps for Education (GAFE)
“Google said (data mining) didn’t apply to students using Google Apps for Education…Google now admits that it does data mine
student emails for ad-targeting purposes outside of school, even
when ad serving in school is turned off.” Jeff Gould safegov.org
Ontario students who use GAFE have their emails scanned and metadata collected. “Scanning is done on all incoming emails, is
100 per cent automated and can’t be
turned off”
Google spokesperson Jennifer Kaiser
#Onted GAFE
Two Types of Data
Personally Identifiable Data
“…data that could potentially identify a
specific individual. Any information that can be used to distinguish one person from another
Anonymous Data
“…data that by virtue of the method of collection can never reasonably be
connected with the person providing them”
There’s No Such Thing as Anonymous Data
Used the anonymous credit transactions of
1.1 million people and was able to
identify individuals in the dataset using
the date and location of just four of their
transactions
MIT scientist Yves-Alexandre de Montjoye
Riding With The Stars
Identified celebrities cab ride details by re-identifying public data from the NYC
public taxi database.
Class Dojo
•Behaviour tracking program •Used in 1/3 of all US schools •Saves data about children and their behaviour
•How is it secured? Stored? •What if it is sold, lost or stolen?
Remember: Online Services Aren’t Free
We are paying for learning resources with student data.
Cullen Hoback Director of”Terms & Conditions May Apply”
“Your data is worth $500 a year to Google. That’s a lot of money. If you had to make the choice of ‘Am I going to pay Google $500 or am I going to pay with my data?’, at least you’d understand how much your data is worth”
What Is Student Data Worth?
What Can We do?
What Can We do?
• Be aware of the risk & be proactive (read the TOS)
SMARTeacher Inc., Burlington, Ontario
What Can We do?
•Be aware of the risk & be proactive (read the TOS)
•Use services and apps that follow the PCC guidelines
Ganz Toy Company, Woodbridge, Ontario
On March 7, 2012, The Office of the Privacy Commissioner of Canada initiated a complaint against Ganz under subsection 11(2) of the Act.
In 2005 Ganz, a privately-held Canadian partnership, introduced the concept of web-enabled plush toys called “Webkinz” (“Pets”) and launched the accompanying ‘Webkinz
World’ website
RecommendationsMinimize the collection of personal informationPrevent the “inadvertent collection” of personal information (usernames)Deleting inactive accountsPrivacy practices must be understandableDefault Settings Should Be Private
What Can We do?
•Be aware of the risk & be proactive (read the TOS)
•Use services and apps that follow the PCC guidelines
•Develop effective privacy protocols in schools
A K-12 Primer for British Columbia Teachers Posting Students’ Work Online
(@jhengstler)1.Who does student work belong to? 2.What can be posted & how will it be identified?
3.Where will work be posted & audience?
4.Has INFORMED CONSENT been received? (alternate accommodation?)
5.Is there a plan to respond to an incident?
We MUST start educating students about data privacy
What Can We do?
•Be aware of the risk & be proactive (read the TOS)
•Use services and apps that follow the PCC guidelines
•Develop effective privacy protocols in schools•Start talking about Student Data Privacy
“One thing is clear: those who have the power to protect
student privacy will not do so as long as they can continue to subsidize the cost of public
education with student data.” Jessy Irwin. (@JessySaurusRex)
Grooming Students for A Lifetime of Surveillance
Meanwhile, back at Target…
Thank you for listening
Enjoy the rest of the conference
AndrewSCampbell.Com @acampbell99