
Google, a ‘school official?’ A regulatory quirk can leave parents in the dark - opheicus
https://www.washingtonpost.com/news/the-switch/wp/2015/12/30/google-a-school-official-this-regulatory-quirk-can-leave-parents-in-the-dark/?postshare=2671451564669854
======
golergka
Yes, if you use software to work on some sort of information, this software
will have access to this information.

Yes, if you use SAAS software, this information will be processed by remote
servers.

Yes, if you use proprietary software, you will not know exactly how is this
information processed.

And finally, if you have someone who is willing to work as school clerk, given
how much do these jobs pay and how interesting they are, this person will
likely not understand the complexity of these issues and will be a little bit
lazy with their job, so she probably will not present parents with all the
relevant information.

Now, every single one of these facts seem obvious; how is combination of these
facts warrant an article in one of the biggest newspapers all of a sudden?

~~~
danieldk
_And finally, if you have someone who is willing to work as school clerk,
given how much do these jobs pay and how interesting they are, this person
will likely not understand the complexity of these issues_

I think that is naive -- the general population understands perfectly that
Google tracks users and uses that information to display ads. The GAFE apps
are covered by different terms of service that restrict the collection of
information, but Google draws the line in plain English in their GAFE/GAFW
copy:

 _We do not scan for advertising purposes in Gmail or other Google Apps
services. Google does not collect or use data in Google Apps services for
advertising purposes. The situation is different for our free offerings and
the consumer space._

I think the reason why schools go for GAFE is clear and simple: the choice is
between having personnel on staff for maintaining servers, computer labs, and
troubleshooting students' devices; or outsource it nearly for free to Google.

~~~
pdkl95
> for advertising purposes

Which neatly leaves out non-advertising purposes. The statement even admits to
collecting data _for other purposes_ in the negative - otherwise the would
simply say they "scan ... collect or use" the data at all.

This is just like the word-games the NSA likes to play when they insist they
aren't collecting data "under _this phone records program_ ".

Both Google (for collecting and aggregating data) and the schools (for giving
the data to a 3rd party) should be held liable for anything that happens from
this data collection.

~~~
michaelt
Well, presumably Google scans the e-mails for search indexing, for virus
detection, and for spam filtering; and collect the e-mails for when the user
asks to search or retrieve them.

~~~
newjersey
Exactly! I want to support stronger privacy but this just smells like someone
wants one big payout for themselves. IF it were found that Google were sharing
student information with anyone, including the government, things might be
different (well not the government anymore thanks CISA) but I could understand
if they were caught selling the information to others or snooping on their
users' emails and using that in a court case (looking at you, Microsoft you
can't undo that).

Articles like these hurts privacy because they cause noise where none is
deserved and people just get tired of hearing things like this that they
ignore legitimate worries like CISA.

~~~
kuschku
> IF it were found that Google were sharing student information with anyone,
> including the government

Well, Snowden has shown us exactly that. Google participating voluntarily in
PRISM.

------
MikeNomad
What I find far more... something than FERPA being described as "an obscure
law," is how brazen and obvious Google is about breaking it.

If Google is a "School Official," their FERPA obligations do not stop at any
point short of/when operating in that capacity.

Further, the idea that they can somehow "switch hats," and somehow maintain
discrete sets of both FERPA and non-FERPA behaviors is at best naive, and at
worst a conspiracy to commit various felonies.

The money shot of the article: EPIC didn't have standing when they filed their
lawsuit, not that they were wrong with regard to laws being broken. With that,
I hope entire school districts of parents with school age children file suit.

~~~
tamana
The judicial branch's abuse of "standing" to refuse to hear cases is one of
the great injustices in USA.

This was a huge deal in the USA PATRIOT domestic spying cases, where courts
refused to hear lawsuits about spying, because plaintiffs couldn't prove they
were being spied on before they won the right to collect evidence, because it
was illegal for libraries/banks/IT companies disclose the spying!

~~~
themartorana
I completely agree. In civil suits it may make sense, but when someone brings
up a possible violation of federal law by another party, they shouldn't have
to be harmed directly, they're helping prevent their fellow citizens from
being harmed by someone or something breaking established law.

It's really sad.

------
mikegerwitz
Related: [https://www.eff.org/issues/student-
privacy/](https://www.eff.org/issues/student-privacy/)

As a parent with a child entering Kindergarten this upcoming school year, and
as an avid privacy and free software advocate, I'm not looking forward to the
types of discussions that I'm likely going to have to have with our schools.
The reality is that these aren't systems that are easy to roll back---it costs
a lot of time and money to implement, and then you have vendor lockin.

So while I can hope for a receptive district, action is probably going to be
more difficult. My hope is that they haven't ddone anything too disagreeable
yet.

Does anyone else have any personal experiences working with their schools?

~~~
analog31
Is there anything that a kid could install on a school owned Chromebook, that
would protect their privacy? Tor?

~~~
userbinator
_school owned_

If it's the school's, then I would just say no. It's theirs, they can do
whatever they want with it. How about giving your chid a real general-purpose
computer instead, running completely free software:

[http://minifree.org/product/libreboot-x200/](http://minifree.org/product/libreboot-x200/)

Just as Google et al. are trying to get kids conditioned to their ecosystems
at a young age by pushing their product, those who advocate against them
should do the same.

------
rubyfan
I'm as adverse to reinterpretations like this as anyone but what might be more
interesting or actionable would be evidence of what data Google are collecting
and how Google are using this data.

~~~
timonovici
How is that gonna work? You can't just sniff the traffic between Google and
the students(SSL & stuff), and I very much doubt that Google itself will let
you take a look in their datacenter.

~~~
tombrossman
You most definitely can sniff traffic between Google and students, this is
widespread and completely normal behaviour at schools and also on many
corporate networks. School computers have a MITM certificate installed which
allows decryption and re-encryption, usually for the purpose of content
filtering and malware detection.

~~~
timonovici
Oh. I haven't thought of that :) Yeah, given that the school has root on those
laptops, they definitely can do that.

------
cs702
"Trust us. It's OK. We won't use it for evil purposes, because one of our
corporate goals is not to be evil."

------
Animats
All we want is your firstborn child.

