Proctoring Software Email Template
MSE Society - McMaster University
Dear McMaster University,
Based on the consideration of a proctoring software being used online courses, I would like to raise concerns that numerous classmates and I share over privacy and data security issues with some of the commonly used proctoring softwares, such as ProctorU, Examity, and Respondus.
Over the 2020 spring/summer, McMaster University has been pillotting use of proctoring software in an opt-in program which forces students to use the Respondus LockDown Browser at student’s privacy, security expense, academic, and mental health expense. Examity is listed as the partnered and current proctor for McMaster Community and Continuing Education courses (https://www.mcmastercce.ca/examity).
From ProctorU's privacy policy:
https://www.proctoru.com/terms-of-service
- "Neither ProctorU nor its vendors, affiliates, or any person associated with ProctorU makes any warranty or representation with respect to the [...] security, or reliability of the Services..."
- "Neither ProctorU nor anyone associated with ProctorU represents or warrants [...] that the Services are free of viruses or other harmful components..."
- "ProctorU will not be liable for any loss or damage caused by a distributed denial-of-service attack, viruses, or other technologically harmful material that may infect your computer equipment, computer programs, devices, or data due to your use of the Services."
"We require you to share your photo ID on camera and we use that ID in conjunction with biometric facial recognition software to authenticate your identity"
"Testing: During testing, we automatically track your keystroke pattern to ensure it matches the biometric profile created before the start of your exam."
The degree of information collected by ProctorU is extremely concerning, considering keystrokes, biometrics information, passports, disability information, academic records can potentially be collected by these programs.
From Examity's privacy policy:
https://examity.com/website-privacy-policy
https://examity.com/product-privacy-policy/
Some previous students that have used Examity noted that some examinations required showing your Driver's License (or passport if you don't have one) to the facilitators:
- "Information We Collect: [...] Information that you provide directly to us by filling in forms on our Website, including your name, email address, street address, telephone number, or other information." and "Age (40 years or older), race, color, citizenship, physical or mental disability, sex (including gender, gender identity, gender expression)." and "Education records"
Also collected: "A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number"
- "while we strive to protect your personally identifiable information, we cannot guarantee that it will be 100% secure. Your transmission of your data to our Website thus is done entirely at your own risk."
- "We may disclose your personal information to third parties if we are involved in a merger, acquisition, or sale of any or all of our business and/or our assets to a third party..."
From Respondus' Privacy Policy: https://web.respondus.com/privacy/privacy-additional-monitor/
https://web.respondus.com/privacy/privacy-additional-lockdown-browser/
Data recorded from Respondus Monitor in conjunction with the LockDown Browser:
- Facial recognition information
- "Keyboard and screen activity"
- Access to "applications and processes running on the computer or device"
- "The default data retention period for Respondus Monitor is five years."
From the Respondus Monitor Terms of Use:
https://web.respondus.com/tou-monitor-student/
Data Recorded from the Respondus Monitor also includes:
- Stored video and audio recordings which can be accessed by the university and proctors
- Student grades and photo identification
- "Random samples of video and/or audio recordings "... "may be shared with researchers (research institutions and/or biometric experts)"
- "Respondus does not warrant the security of any information collected using its services [....] Respondus shall not be liable if a security breach occurs, if the site malfunctions, or if information is misused or mismanaged in any way to your detriment or the detriment of a student or third party, whether by Respondus, your institution, or an unauthorized third party."
Computer Data and Connection Security:
Use of these softwares assumes that all student computers are private and connections are secure to send this level of data, and not using a shared computer or one that has unnoticed viruses. Some students have noted the inability to run such softwares on virtual machines, which would limit the amount of data that could be at risk. Unless McMaster University will be providing students with laptops to avoid risking their stored data, this cannot be allowed.
Job Security and NDAs:
Many students have signed a non-disclosure agreement with their employer in regards to confidentiality of information, and students who are forced to use proctoring softwares, which may gain access to files, computer processes, keystrokes, browser history, could violate their NDA and result in the loss of their employment, co-ops, and internships.
Accessibility:
Many of these softwares require a working computer, microphone, and webcam, which creates an inherent discrimination towards students who only have access to a tablet or smartphone to complete their test. This targets lower income students who may not be able to afford to purchase a computer.
Consent:
It is often required to use a private room during the proctored test, which for many students is not possible due to restricted access to internet, living situations, and use of public computers, for instance. Even if a student fully understands and consents to the recording, others may enter the recorded frame and create a consent issue for the recording’s usage and storage.
As per the collection of data for McMaster, there does not appear to be any requirement for
biometric data, or keystrokes, nor do I believe it should be in order to complete any McMaster-run course. I am calling for you to value the students’ identity and privacy most in asking for proctoring to be banned at the university-level.
https://secretariat.mcmaster.ca/app/uploads/2019/06/FIPPA_Statement.pdf
If not, an alternative needs to be offered if proctoring will be used, such as using a webcam to record the surroundings, and a screen recording program such as FRAPS or OBS to prove no cheating has occurred. Beyond this, requiring this level of sensitive data provides a major privacy and security risk.
Furthermore, notice regarding whether proctoring will be used or not in a course should be notified well in advance of the drop date for courses with a full refund, as students should know what privacy they will have to put at risk in order to complete the course.
Sincerely,
Concerned students of McMaster Universify