EFFecting Digital Freedom

by Lindsay Oliver

Let's Call Remote Proctoring What It Is: Spying

The arrival of China COVID-19 has hit fast-forward on an already troubling and dangerous trend in the wider education system: the invasive advancement of surveillance software in educational environments.  Students were already subject to a wide array of monitoring techniques and capabilities, such as social media or device monitoring, among others.  But the pandemic has given proponents of this approach the excuse and cover to turn it up to 11 with one particular - and particularly egregious - tool: remote proctoring.

Remote proctoring covers a category of technologies that "watch" students as they take tests.  It has a simple purpose: to protect the integrity of an exam.  In practice, however, remote proctoring has a lot in common with bossware and stalkerware, and it subjects students to invasive monitoring much akin to 1984's telescreen: when students use the apps to take their tests, the apps watch them in return.

It has been deployed primarily in universities and colleges since schools have switched to remote learning models, though some high schools have begun subjecting their students to these Orwellian nightmares, too.

Through a variety of techniques such as face recognition and keystroke patterns, AI proctors decide whether the student taking the test is the correct one; gaze monitoring, eye-tracking, and behavioral flagging are supposed to ensure that students aren't cheating by looking away for too long or speaking to someone else off-screen; live audio/visual monitoring of a student's home environment by either a human or AI proctor is meant to ensure that the student doesn't leave the computer, and that no one else enters the room, either.

These technologies are a window into the personal lives of not only the students being compelled to use them, but into the lives of anyone who shares space with them.  They gather, retain, and in some cases share/monetize (sometimes with third-parties) massive amounts of sensitive data on students and their devices.  The data gathered can be unbelievably comprehensive: demographic data, disability and citizenship statuses, audio and video recordings of students' personal spaces, location data, browser activity, biometric data which can be used to identify students for the rest of their lives, and more.  This can include face, eye, and hand scans, and even behavioral data like typing patterns.  Some software even requires students submit video lap scans, which are then stored and accessible for an uncertain amount of time by professors, administrators, and, potentially, third-parties from or contracted by the proctoring company.  Most of these technologies use some form of facial recognition to identify test-takers, and this biometric data is sometimes compared to a government-issued ID or pre-submitted photos.  If this data is leaked, it can almost never be changed - you can't alter your face the way you can update a stolen password.

Once installed or enabled, many of these apps have nearly unfettered access to student device directories and file systems, and in order to use them, students have to grant broad permissions to the software.  These systems can give proctors what essentially amounts to a rootkit on student devices (and others if devices are shared amongst household members), with no ability for those affected to meaningfully consent or opt-out.

On top of this grotesque invasion of privacy, remote proctoring also reinforces systemic injustice.  These companies use "artificial intelligence" to attempt to determine if students are cheating, and they rely on data about how "typical" students take a test to do this.  But what this really means is that they are likely to flag students who don't fit the mold.  Additionally, their requirements ignore the realities of many students today.  Many people don't have access to a private room or time for an uninterrupted test if they are sharing limited living space with others.  Someone's toddler excitedly running into the room isn't going to understand that their presence could invalidate a test.  Penalizing students for their living environment or other factors they can't control is ridiculous and cruel.

And these proctoring platforms don't just require a high download speed - they require high upload speeds as well to monitor the webcams of students during exams.  Access to actual, real high-speed Internet is an issue not only for low-income students, but also rural students where high-speed Internet infrastructure has not been built out yet.  Many students rely on devices that don't meet the requirements to use these platforms, and some don't have Internet access at all.  If a student's Internet goes down even for a short period of time, it could result in a test being invalidated by either kicking the student off the platform entirely or by invalidating the test because the video feed was briefly interrupted.

In terms of accessibility, these systems are not set up to meet the needs of students with disabilities, and might especially penalize neurodivergent students.  These systems do not account for the breadth and depth of human behavior and coping mechanisms that students may display as they take their tests.  Some may talk to themselves, some may stim to help themselves regulate, some might have a hard time maintaining eye contact with the screen.  All of these behaviors are potential "suspicion score" flags, and unfairly subject the most vulnerable students to the most monitoring.  The horrible end result of the use of remote proctoring apps is that every student is forced to accept mandatory surveillance, and students who may already be struggling, or may need extra attention to succeed, will fall behind.

Thankfully, security researchers are diving into the features of these tools, their security measures, and their data collection practices, and finding significant problems.  More research will need to be done, but we're proud to see so much interest in ensuring students, who might otherwise have no choice, are not being thrown under the surveillance bus.  Students, too, are angry and fighting back.  Student activists have started hundreds of petitions demanding their universities ban the use of the technologies, and schools are starting to listen.  We are glad to see students refusing to give up their privacy and data security to these spying apps.  No one should be subjected to this level of compulsory surveillance just to get an education.