Ongoing Investigations

Tag: data security law

  • Zoom’s Downsides in Regards to Privacy

    I’ll admit I’m a bit late in writing this blog post – classes have been going for three and a half weeks, we’re almost at the midterm point, and we’ve been on Zoom the entire time. But better late than never, I suppose.

    You may or may not have heard about people’s concerns when it comes to Zoom. There have been issues of hacking, security flaws, and sloppy design that have led to major privacy issues, causing many people to lose trust in the service. Zoom has put out some updates meant to address these issues, as well as made several public apologies. Additionally, their privacy policy looks extraordinarily transparent, at least at first glance (though it’s worth noticing that it seems to have last been updated in March). But what does all this mean for Carleton?

    Zoom’s fixed some stuff. There’s other things they need to look at. But what does this all mean for Carleton?

    What’s in the Past

    Meeting rooms have a number associated with them that people can use to join those rooms. If you have the number, you can use it. This is a problem if the number gets out, especially if you use the same number for every meeting of a certain type (which happens a lot for repeatedly scheduled meetings).

    There’s not a ton that can be done to stop this, since it’s the core concept, and people do need to know the number sometimes — but Zoom did fix a previous issue, where the meeting room number was displayed prominently in the video screen. This meant that any screenshot of the video chat would contain it, which made it way easier to get out. That’s over now. You can find the meeting number if you try, but it’s not visible by default anymore.

    The controversial attention tracker is also gone. Basically, Zoom had a feature where, when enabled, if the Zoom window was not your primary window for more than 30 seconds, it would alert the meeting’s host. This was bad from a general privacy standpoint, but also not particularly accurate for people who have multiple windows open at a time — say, to take notes during a work meeting.

    They’ve also included a note in the banner that says when a video call is being recorded by the host. It’s a small red light in the top right corner, next to the word “Recording” (though as far as I know, the only current ways to opt out of being recorded are to mute your audio and video, or to leave the call).

    Two new features introduced specifically to combat ‘Zoombombing’ (the sudden entrance of bad actors into a Zoom call through a leaked meeting ID or link) are automatic waiting rooms and the ability to prevent banned users from rejoining. Zoom waiting rooms make people wait to be admitted to the meeting, rather than letting them join whenever, and if a user is kicked out for bad behavior, there’s an option to prevent them rejoining entirely.

    Concerns about data being shared with Facebook are now addressed as well. Previously, Zoom sent analytics data to Facebook, even for users who had not logged in using their Facebook account. They made a comment addressing this, saying, “Zoom takes its users’ privacy extremely seriously. We originally implemented the ‘Login with Facebook’ feature using the Facebook SDK in order to provide our users with another convenient way to access our platform. However, we were recently made aware that the Facebook SDK was collecting unnecessary device data.” Since I can’t find updates about this in the past month, when other concerns such as the ones above have arisen, I’m going to give Zoom the benefit of the doubt and assume they’ve fixed the issue.

    Current Concerns

    At present, there are other issues. Some are my personal concerns, others could be major red flags.

    Personally, I don’t love the fact that hosts get to keep full logs of each meeting’s chat by default. There was misinformation going around that saved chatlogs include all private chats as well as public ones, but Politifact debunked that, saying, “If you send a private message to the person recording the meeting, it could end up on a transcript. If you send a private message to another person in the meeting — someone who isn’t able to record the meeting — those messages won’t end up in the transcript.” Still, while I get that it’s practical, it feels like something that should be opt-in rather than opt-out, and something which people should be notified about while in the call.

    Similarly, the notification Zoom has added to indicate when a call is being recorded is small and easy to miss. Since it’s part of the top bar (next to the encryption lock, sound controls and information button), it blends in with other settings if you’re not looking for it, and it fades away after a few seconds without moving the mouse or interacting with the screen.

    The biggest issue, though, is encryption. In its marketing campaigns, Zoom claimed its calls were all end-to-end encrypted. What that means, practically speaking, is that the information from your call is encoded, passed from you to Zoom, passed from Zoom to the other parties on the line, and then de-encoded. Zoom has no way of decrypting your messages or finding out what you’re saying — in theory.

    In practice, Zoom does not use end-to-end encryption, and its own custom encryption software has been criticized for not being up to industry standards. This means Zoom could decrypt your calls and, theoretically, so could other parties. Additionally, they’ve been taken to task for using insecure servers overseas in China to route personal call data, making it possible for foreign governments to access the Zoom meetings.

    These security issues are among the many reasons why Zoom is no longer used by companies such as SpaceX and Google (which hosts a competitor, Hangouts), and governing bodies like the New York Department of Education, all Taiwanese government agencies, Singapore’s Ministry of Education, and the German Ministry of Foreign Affairs. The United States Senate and Pentagon have restricted or cautioned against the use of Zoom, though not banned it outright. The United Kingdom Parliament has elected to keep using Zoom to pass legislation (though only bills that are expected to receive near-unanimous support).

    In its privacy policy, Zoom claims to be compliant with the CCPA, the GDPR, and the US-EU Privacy Shield Act (check out my article on the CCPA here). As various countries start to distance themselves from Zoom, that’s looking more and more questionable.

    Carleton Usage

    Let’s start off with the obvious: Carleton is not a governing body. It is, however, an educational institute. Most of the concerns surrounding education have not come from questions of data privacy, but issues like Zoombombing, where people have joined virtual classrooms in order to expose themselves to children and teens, or shout and display racist or hateful messages.

    I have no idea how I would begin to assess the risk that this might happen to Carleton classrooms, particularly since the public reaction has sent Zoom scrambling to keep this from happening again. Additionally, Zoom has a number of features that make it very well-suited for Carleton’s usage: a Licensed account (available to all Carleton community members) can host meetings with up to 100 people for an unlimited length of time, customize meeting IDs or links, and other perks. This would suit pretty much any class Carleton offers, and allow for some more specific security options.

    The biggest question to ask (as a number of articles point out) is: is what I am doing over Zoom worth hacking? Government bodies, which deal in state secrets, are right to be worried, as are major corporations; educational departments dealing with minors are reacting to threats that have already been demonstrated. Telehealth and medical information is not advisable to be transmitted over Zoom, though many (including SHAC!) are doing it already. But for personal meetings or college classes, it would be better to ask, why would someone try this? Would it be worth the effort?

    So, basically: if any of what you’ve read above worries you, try investigating some alternatives (available in the sources). If you don’t think what you’re doing would tempt any bad actors, then it’s your call.

    Sources & Resources

    “Privacy Policy”. Zoom, 3/29/2020. https://zoom.us/privacy

    “Zoom Security: Here’s What Zoom Is Doing To Make Its Service Safer”, O’Flaherty, Katie. Forbes, 4/10/2020. https://www.forbes.com/sites/kateoflahertyuk/2020/04/10/zoom-security-heres-what-zoom-is-doing-to-make-its-service-safer/#6329003630fc

    “Private messages sent to Zoom meeting hosts could appear in their transcript”, O’Rourke, Ciara. Politifact, 4/13/2020. https://www.politifact.com/factchecks/2020/apr/13/viral-image/private-messages-sent-zoom-meeting-hosts-could-app/

    “Is It Safe to Use Zoom?”, Feldman, Brian. New York Magazine, 4/9/2020. https://nymag.com/intelligencer/2020/04/the-zoom-app-has-a-lot-of-security-problems.html

    “Zoom privacy and security issues: Here’s everything that’s wrong (so far)”, Wagenseil, Paul. Tom’s Guide, 4/28/2020. https://www.tomsguide.com/news/zoom-security-privacy-woes

    “10 free Zoom alternative apps for video chats”, CNet, 4/6/2020. https://www.cnet.com/news/10-free-zoom-alternative-apps-for-video-chats/

    “Top 5 video conferencing services to use with remote employees”, Reese, Hope. Tech Republic, 2/19/2020. https://www.techrepublic.com/article/top-5-video-conferencing-services-to-use-with-remote-employees/

    “Zoom security issues: Zoom could be vulnerable to foreign surveillance, intel report says”, Hodge, Rae. CNet, 4/28/2020. https://www.cnet.com/news/zoom-security-issues-zoom-could-be-vulnerable-to-foreign-surveillance-intel-report-says/

    “Using Zoom while working from home? Here are the privacy risks to watch out for”, Hodge, Rae. CNet, 4/2/2020. https://www.cnet.com/news/using-zoom-while-working-from-home-here-are-the-privacy-risks-to-watch-out-for/

    “Worried about Zoom’s privacy problems? A guide to your video-conferencing options”, Paul, Kari. The Guardian, 4/9/2020. https://www.theguardian.com/technology/2020/apr/08/zoom-privacy-video-chat-alternatives

    “How to Keep Your Zoom Chats Private and Secure”, Nield, David. Wired, 4/5/2020. https://www.wired.com/story/keep-zoom-chats-private-secure/

    “Is Zoom Safe and Is Your Privacy at Risk? Video Calling App Explained After Hacking Vulnerabilities Exposed”, Murdock, Jason. Newsweek, 4/2/20. https://www.newsweek.com/zoom-safe-privacy-risks-explained-video-calling-app-hacking-vulnerabilities-coronavirus-1495728

    “Is Zoom safe to use? Here’s what you need to know”, Hussain, Suhauna. The Los Angeles Times, 4/13/2020. https://www.latimes.com/business/technology/story/2020-04-13/is-zoom-safe-to-use-heres-what-you-need-to-know

    “Ethics Week 3: What’s the CCPA?”, Irwin, Pilot. Carleton DS Interns, 1/24/2020. https://ds.interns.sites.carleton.edu/digital-ethics/ethics-week-3-whats-the-ccpa/

  • Ethics Week 8: What Do You Do with Academic Software?

    So this week (and the past couple weeks, actually) I’ve been doing some reading on the legal policies of a company called Gradescope. While this isn’t a full write-up, more an extension of some annotation I’ve been doing lately, I thought it would make a good blog post.

    So, Gradescope. What is it? Who is it? What does it mean for us?

    What is Gradescope?

    Gradescope is a web-based subscription software that allows educators to organize and delegate the collection and grading of assignments, in order to allow them to better focus on the needs of their students.

    Or, simply put: it’s like Moodle (turn in your assignments online) but it also grades stuff if you ask it to and tell it how.

    They’re not giving it to humans to grade, either — they’re grading algorithmically, based on a rubric.

    It’s aimed primarily at STEM, econ and business classes, which makes sense, since quantitative classes would be easier to grade consistently by machine. But their website does boast that it handles papers, even if it’s a little unclear on what aspects of the papers it handles (collection, maybe grammar) vs what aspects are handed to the educator (style and content, hopefully).

    Who is Gradescope?

    Well, as of October 2018, Turnitin owns Gradescope. Turnitin is another web-based software company, this one oriented towards catching plagiarism and determining authorship of papers. They partner with large databases, including Crossref, Elsevier, Springer, Wiley-Blackwell, IEEE and Taylor & Francis, in order to check what percentage of a paper matches with other papers out there. In fact, they claim their content database includes “70 billion current and archived webpages”.

    But their plagiarism checker is a little concerning, missing 44% of plagiarized sources in a 2015 experiment at UT-Austin. Penn State University, in their online guide to Turnitin, outlined various ways to get false positives, none of which inspire confidence in Turnitin’s algorithms.

    • Any rough draft stored in Turnitin’s repository could come up as a false positive when the final draft is submitted.
    • Any copies of the paper submitted to Turnitin to check for plagiarism before the paper is officially turned in for class will be stored in the repository – which can generate a false positive.
    • Turnitin doesn’t check whether a student’s original work is being plagiarized, just whether their work matches with another source in the repository.
    • A paper that expands on/includes material from a previous paper on the same topic can also generate a false positive.

    It’s remarkably hard to find any information on Gradescope’s own effectiveness or practices, incidentally. Their terms of service and privacy policy mention third-party partners and third-party recruiters, but decline to elaborate on either. One can sign in with Google, making Google a third-party partner with access to their data, but I can’t find any clear indication of what recruiters might be present on Gradescope’s site.

    Additionally, though their privacy policy claims to comply with GDPR and Privacy Shield (an opt-in U.S.-E.U. and U.S.-Switzerland privacy rubric that allows members certain privileges), their terms of service were last updated in November 2014 — which means they predate GDPR (adopted April 2016), Privacy Shield (July 2016) and the CCPA (fall 2019), a California-based privacy law which they are also subject to. Their privacy policy was last updated in June of 2018.

    What does it mean for Carleton?

    At present, not much. I haven’t heard of any courses that use either Gradescope or Turnitin, which are subscription-based models that would need to be funded by whatever department chose to use them (or by the college at large).

    While Gradescope’s privacy policy and terms of service are mostly standard legal jargon, there are a couple of things I tend to sideeye – like, what happens if your account is deleted due to a false positive?

    The first of my major issues is that they’re not publicly forthcoming with their revenue streams. Of course they charge for subscriptions from the schools they work with, and their client base is obviously private, but as I said above, I can’t find out what third-party recruiters have access to their site. Nor can I find out how these recruiters get access — do they pay for it? Does Gradescope seek them out, or do they contact Gradescope? What sort of data do they get to look at, and how can users manage their privacy?

    The second is their grading methods. Since they’re owned by Turnitin, it’s very likely they use Turnitin’s plagiarism checker — which, as we know, is faulty, despite its wide access to databases.

    Which brings me to my third point: Gradescope keeps student work, and makes it accessible to the third-party partners they use to do their work (like, for example, Turnitin). Turnitin keeps student work and adds it to their databases so they can check for plagiarism more expansively. This is a feature schools pay for.

    Or, put another way: schools pay for Gradescope and Turnitin to make money from other schools off of their students’ work.

    Gradescope has policies in place that comply with GDPR – meaning, any user has the right to be forgotten. You can write to Gradescope, ask them what information they have on you, and tell them to delete it, and they will do it (with a few caveats related to anonymized and group data).

    But, at the same time, their terms of service are six years out of date. Their privacy policy doesn’t mention the California Consumer Privacy act, and I haven’t been able to find any official statements from Gradescope on the topic. And, possibly most worryingly, it is very unclear whether their partners have the same policies in place. And even if they do, would requesting that Gradescope delete your information would extend to any party with whom they’ve shared that information?

    Sources

    “Turnitin Acquires Gradescope”, Zeligs Hand, Amanda, Turnitin, 3 October 2018. https://www.turnitin.com/press/turnitin-acquires-gradescope

    “Database Content”, Turnitin. https://www.turnitin.com/about/content

    “How Much Do You Know About Turnitin’s Content?”, Lee, Christine, Turnitin, 30 May 2019. https://www.turnitin.com/blog/how-much-do-you-know-about-turnitins-content

    “Optimizing the Originality Report”, Penn State University. https://turnitin.psu.edu/bestpractices/usingreports/

    “UT-Austin test results for Turnitin”, Schorn, Susan, University of Texas — Austin. https://utexas.instructure.com/courses/633028/pages/ut-austin-test-results-for-turnitin

    “Privacy Policy”, Gradescope, 25 June 2018. https://www.gradescope.com/privacy

    “Terms of Use”, Gradescope, 3 November 2014. https://www.gradescope.com/tos

  • Ethics Week 6: The Road So Far

    It’s midterms, and you know what that means. Time to review!

    … my work so far this term, that is. I’ve already taken my exams.

    I did a little inventory of my past blog posts, as well as some behind-the-scenes stuff, so today I’m going to be talking about what I said I’d do versus what I actually did, and whether there’s room to pick back up.

    What I Planned

    It’s actually pretty easy to see what I meant to do this term, because I wrote a blog post about it. It sums up a couple of the themes I was hoping to touch on and a couple of projects I was hoping to do.

    The executive summary of it all is thus. I had four major projects:

    1. look into different ways of organizing work, especially digital vs. analog systems
    2. study open source software communities for the Digital Scholarship Interns’ winter project
    3. investigate data security laws and how they affect college software
    4. develop my Ruby coding skills

    Did I do these things? Sort of!

    What I Did

    It’s a little hard to look back through my work the past couple weeks, because some of my blog posts are password-locked and I don’t write about everything I work on (it’s important to have focused, informative posts).

    That said, I have followed through on these plans in different ways throughout the term so far.

    First: Organizing Systems

    This is very solidly a behind-the-scenes thing. I’ve experimented a little with Google Keep, comparing it to my past experience with to-do lists in the Notes app and Wunderlist, plus bullet journals. No conclusive results yet, but this investigation is ongoing. Expect a recommendation report sometime in the future!

    Second: the Digital Scholarship Interns project

    My part of the project has been reshaped a couple times to better fit with what we’re doing. Our project is a revamp of the DSI blog (you may have noticed it’s a little snazzier than it used to be). But, since we’re focusing on blogging at Carleton, open source software didn’t really fit.

    Instead, I’m going to be doing an investigation of Carleton social media culture, comparing the Carleton Livejournal community (still up online, though not very active these days) to Facebook and how people at Carleton use it. This way, we can get a good idea of the common questions Carleton users ask, and what they look for in a platform.

    Third: Investigate Data Security Laws

    This has been a way bigger part of my term than previously anticipated. When I wrote my initial blog post, setting out my goals for the term, I thought digital systems of organization and the intern project would be my two major priorities, with some legalese on the side and a little Ruby to fill in the cracks.

    In reality, my term has focused a lot on rights management and data security. Week three had me looking into some new data privacy laws in the United States (this post was password locked, for internal use only); week four saw me thinking about what it means to safely store your work with different digital entities; and week five was all about reflecting on technology in the Iowa caucuses.

    And it’s going to keep going from there! The more digging around I do, the more stuff I find. Next week looks like it’ll see me looking through the Terms of Service and Privacy Policy of some scholastic software companies, to think about what control we have over our work at Carleton. Can’t wait!

    Of course, since I’ve been spending a lot more time than expected on this, that means…

    Fourth: Ruby Coding

    My Ruby plan for the term has shifted a bit, from coding up projects to investigating its uses. Ruby’s been used in some interesting archival projects, and one of my goals is to understand its affordances in that area.

    That said, because it has less practical ramifications in the here-and-now than understanding how we organize our work, investigating Carleton’s social media footprint, or unpacking the new laws around data privacy, this project’s been temporarily shelved.

    And frankly, I’m okay with that. One of the important lessons this term has been solid prioritizing.

    Where To Next?

    Honestly, keeping up what I’ve been doing. There are next steps for everything: writing up the different organization systems, putting together my content for the intern project, and decoding the mysteries of Terms of Service.

    I also have some new projects coming down the pipeline! They’re a secret for now, but might make an appearance in future blog posts.

  • Ethics Week 3: What’s the CCPA?

    This week I’ve been following up on looking into the CCPA, or California Consumer Privacy Act. Quick intro: the CCPA is a law that came into effect in California on January 1st, 2020, which addresses data security with regards to companies that collect and sell user data. There is a cheatsheet provided by the California government which summarizes the law, available at the end of this post.

    Essentially, what it boils down to is pretty similar to the GDPR, the European Union’s data privacy regulation which took effect in May of 2018. California consumers have the right to know what data is being collected, the right to have that data removed from records, the right to know what sorts of companies are buying their information, the right to tell people not to sell their data, and the right to not be retaliated against for exercising any other rights granted by the CCPA.

    The laws also only apply to certain businesses (specifically, ones that meet certain thresholds for revenue or user traffic), and they only apply to the sale of data. That’s caused some concern, since companies like Google and Facebook technically don’t sell their users’ data: they sell access to their users, based on the data they have on file.

    The laws also only apply to for-profit businesses, which means that non-profits which operate in California and might otherwise meet the CCPA’s criteria are not subject to those regulations; however, if they do business with for-profit institutions that involves user data, they may still have to comply with the CCPA.

    While I looked into the CCPA’s effect on for-profit institutions that work with higher education, such as ProQuest and Elseviere, I couldn’t find an official statement from those companies. I did, however, find a cybersecurity law report published by Elseviere. This report mostly touches on those facts already stated earlier, but also makes a point of emphasizing that the CCPA has defined ‘personal information’ in a much broader way than the GDPR, or any other current privacy regulation.

    Going forward, it’s not clear what the ramifications of the CCPA will be. Some people claim it goes too far; others are worried that restricting only the sale of personal information doesn’t go far enough, and won’t actually protect people’s privacy. California tends to be a trendsetter where state legislature is concerned, however, so I’ll be looking into other potential privacy bills and seeing where we’ll be going from here.

    References:

  • Ethics Week 2: Laying the Groundwork

    This being the second in a series of weekly blog posts, intended to edify the public on the various goings-on within the ethical strata of the Digital Scholarship community of Carleton, particularly with regards to…

    I kid, I kid. Here’s a quick catch-up on what I’ve been doing this week!

    The process of my work has been primarily logistical, getting up and running for the rest of term. I’ve been exploring various topics, deciding which ones are worth pursuing, and solidifying them into project ideas and questions to answer. I’ve determined four projects/areas of research, two major and two supporting, which I’ve outlined below and which feed into each other in various ways.

    After some exploration, my common question for this term will be regarding the tradeoffs between organizational affordances in the cloud, and data security. This will consist of testing various organizational systems, seeing what conveniences they offer and what drawbacks, and researching how this data is stored and what it might be used for. I will also be keeping an eye on project logistics and multi-person information/storage systems, because my major project will center around open source software.

    The Digital Scholarship Interns’ winter 2019 project will consist of revamping our website and, in the process, exploring the history of collaboration, accessibility and performance in web design. Part of my job will be examining open source communities and how they work with each other, as well as how that workflow affects the final product of their projects and designs.

    In addition, I will be following up on my earlier data security question by looking at some common sites used by colleges for logistical purposes, investigating their practices, and researching the laws being passed about data security which affect those sites. Some of the writeups on these topics may not be made public, but rest assured, I’m looking!

    And finally, I will also be engaging in a side project of mine, which is to develop my coding skills, particularly in the programming language Ruby. I’m hoping to learn more about Ruby on Rails, and possibly use it in order to build a web-based presentation of my research for the DSI project.

    Happy Week 2!

css.php