Schools urged to ensure students' security and privacy when conducting classes online

As most parts of Canada are gradually reopening their economies following months of lockdown due to the COVID-19 pandemic, some provinces — including Ontario, Manitoba, Alberta and New Brunswick — have released plans on how they aim to allow students to return to the classroom in September.

But those school boards continuing with partial or fully virtual learning need to ensure measures are in place to protect students' privacy and safety when using video-conferencing platforms for online classes, a cybersecurity expert says.

"It's understandable that people want to get classes up and going during a pandemic," said Rebecca Herold, a data security and privacy expert based in Des Moines, Iowa. "But they need to think it through first and establish the guardrails around how those online classes are going to actually occur."

School boards across the country have been using a variety of software programs for online learning during the pandemic.

Schools in Surrey, B.C., and Alberta, for example, use Microsoft Teams, while those in Toronto have been using Google Classroom and Brightspace, which is available through an agreement with Ontario's Ministry of Education. The school board in Peel Region, northwest of Toronto, offers both Microsoft Teams and Google Meet, said Luke Mahoney, the board's co-ordinating principal of modern learning.

Meanwhile, British Columbia's Ministry of Education offers a province-wide Zoom licence for school boards.

Some of the programs were already in place in most school boards before the pandemic hit. But their use became more widespread after schools shut down and offered online learning to ensure physical distancing.

Regardless of the software that school boards decide to use, Herold said, schools should invest some time and effort to ensure that every student is set up with the appropriate program or app.

A grab bag of choices for schools

Schools within the Winnipeg School Division, for example, use GoGuardian, a software that allows schools to easily manage students' devices.

Radean Carter, a spokesperson for the school division, said the software helps filter and monitor students' online activity. GoGuardian uses security technologies such as HTTPS and allows school administrations to block some websites.

Winnipeg schools also use Google's G Suite for Education — which includes Gmail, Google Docs, Google Meet and Google Classroom — for most tasks, as well as Microsoft Teams for some meetings, Carter said.

She said the board has provided more than 3,000 Chromebooks and iPads to students, while for those who own their own devices, the software is automatically downloaded when they log into the school division's program.

"We actually took a bit longer than other school divisions to get our devices out to students," she said. "We didn't want to just put them out there without making sure we have [the software] loaded into them."

English Montreal School Board spokesperson Michael Cohen said while the board initially used video-conferencing app Zoom, it switched to Google Classroom and Microsoft Teams because it already had a licence for the programs.

He cited security and privacy concerns over Zoom that have been reported but said no breaches have occurred at the school board.

"We feel confident in these platforms," Cohen said. "We haven't had any issues. We've been using them now for a couple of months."

A string of "Zoom-bombings," in which outside users hijack screens to disrupt meeting participants, have been reported.

In April, Russ Klein, the head of a Jewish high school in Vancouver, told CBC News that a community gathering the school was hosting through Zoom was infiltrated.

'We're living in this new online reality'

Aside from including additional security features on devices and configuring privacy settings, some teachers take extra steps to keep students safe online.

Janette Hughes, a professor and Canada research chair in technology and pedagogy with the education faculty at Ontario Tech University in Oshawa, Ont., advises teachers to instruct students to mute their microphones and turn their cameras off as they enter the virtual meeting space. They should enable them when needed, such as when they're engaging in a group discussion she said.

"We're living in this new online reality, which means we have unprecedented access to students' homes," said Hughes, who has been conducting sessions with teachers and their classes since March to help with their transition to virtual learning.

"I am concerned about the privacy of not just the students but their families."

Herold said she also thinks privacy is at risk during live streaming. "You can see a person's environment. So that gives people a lot of information about their home," she said.

Hayley Werbeski, who is going into Grade 7 in the fall, said she's been concerned about privacy since classes shifted online in March.

The 12-year-old from Caledonia, Ont., near Hamilton, said she found it hard to get help and ask questions during live Zoom classes because she felt uncomfortable with her classmates seeing her in her home.

Hayley said chatboxes during Zoom calls tended to be "just gossipy" instead of helping students with their schoolwork.

"Each day, the teacher would have an online Zoom class where you could ask questions, but I never went on because it felt weird having people see inside my house, and I didn't want to have people staring at me," she said.

Her mother, Laurel, said her family put no pressure on Hayley to attend the online discussions.

"She did not like people who were not her friends 'virtually' coming into her home space," she said of Hayley. "It was a serious breach of privacy for her, so we did not force her to attend."

Herold, who has been providing information security and privacy consultation to schools, also advises participants of virtual meetings to make sure they don't have IoT devices, such as Google Home or Amazon Echo (Alexa), turned on in the same room while attending a virtual meeting.

Those devices "are always listening, and even if you don't say the trigger [or command] word explicitly, they're still there," she said.

Herold said students should also limit screen sharing to prevent others from seeing private information on their computers.

As well, limiting file sharing can help prevent the spread of viruses or malware on computers, she said.

"You don't want to get ransomware demanding you pay $500,000 to get all of your files back."

Deciding on which platform to use

Although some platforms, like Zoom, are easy to navigate, Herold recommends that school boards use well-tested platforms that provide documented information about how to use the security features.

"Even with the schools I provide advice to, I recommend to them that they not use a tool that's just making changes on the fly to address bad publicity, which it seems Zoom is doing," she said.

After facing a backlash when it announced it would only provide end-to-end encryption for its paying users, Zoom said in June it decided to enable such encryption, which enhances security, for all of its users this month.

Herold said Zoom is easy for schools to use, but what makes the platform easy to implement is what makes it insecure.

"There are so many other tools out there that have been available for quite a while and can certainly meet security and privacy requirements in ways that I have not seen Zoom address," she said.

She said GoToMeeting, Cisco's Webex and Zoho Meeting, as well as Microsoft Teams and Google Meet, are alternatives to Zoom for video conferencing.

"Spend a little bit of time up front to get it done right to begin with," she said. "And after that, it's going to be just as easy."