Cambridge Spies On CPS Students

Illustration by Annie Zhao for VICE magazine

Many kids in the Cambridge Public Schools (and elsewhere in the Commonwealth) still don’t know that if you’re using a school-issued Chromebook, the school is monitoring whatever you browse, down to deleted draft emails, whether you’re at school or not.

This is through a browser add-on called “Securly.” CPS has an agreement with Securly that all school-issued Chromebooks will have this add-on.

What’s more, wittingly or not, CPS is lying to the City Council about whether student data gets shared. Let’s show you how.

In the Annual Surveillance Report submitted to the City, Cambridge Public Schools cites to the language of its Data Privacy Agreement with Securly, insisting, “This data is not shared with third parties” (Annual Surveillance Report, p.67). However, the DPA actually allows the sharing of data with third parties – specifically, but not limited to, the cops. Law enforcement is allowed to contact Securly to get data on students, and Securly is allowed to disclose that information without waiting for a warrant or evidence of involvement in illegal activities, and without telling either CPS or the student:

II. 4. Law Enforcement Requests. Should law enforcement or other government entities (“Requesting Party(ies)”) contact Provider with a request for Student Data held by the Provider pursuant to the Services, the Provider shall notify the LEA in advance of a compelled disclosure to the Requesting Party, unless lawfully directed by the Requesting Party not to inform the LEA of the request.

Since Securly can tell the cops without telling CPS, there’s no way CPS can truthfully guarantee to the City Council that your “data is not shared with third parties.” It might not be. But they can’t know for sure.

Beyond that, Article IV of the DPA goes into great detail about the circumstances under which Securly may share both personally identifiable student information and de-identified student information, for a variety of purposes. Again, it might be that, despite the DPA allowing them to, Securly is not in fact sharing CPS student information onwards; but we suspect that they are doing whatever the DPA currently allows them to do.

CPS also insists that Securly is being used only as a “Web Filter”, to block various kinds of disagreeable content. The material they have provided to the City Council focuses on students accessing gun-related content and suicide-related content.

But Securly’s Web Filter product not only blocks; it also shows to teachers and to admins what URLs are being blocked, offering what Securly describes as “Complete online visibility … monitor[ing] for signs of bullying, self-harm, gun terms, and violence”, with “AI-based context analysis … for signs of bullying, self-harm, gun terms, and violence across social networking and web searches. If a student is suffering or looking at concerning content, you’ll know.”

It is legal for students to search for content that includes violence, graphic imagery, and guns, and it’s hard to envision how they could research, say, Russia’s invasion of Ukraine without encountering such content.

It’s not clear that school monitoring software in general works. VICE reports, “The few published studies looking into the impacts of these tools indicate that they may have the opposite effect, breaking down trust relationships within schools and discouraging adolescents from reaching out for help—particularly those in minority and LGBTQ communities, who are far more likely to seek help online.” It is evident in places where school monitoring software is in use that students and parents are often contacted, inflicting harm, without administrators or teachers first examining the context of the flagged material. At a minimum, the City Council should find out what terms and sites are being flagged in Securly’s system, in order to evaluated whether there is manifest prejudice going into the selection of those terms and sites and whether each instance is being reviewed by the student’s teacher.

What Securly’s system appears to do is to monitor everything, and then rely on school officials’ discretion to determine whether what gets flagged is really cause for worry. Monitoring and disciplining students for accessing such content places the school district on dangerous legal ground. In last September’s ruling in Mahanoy School District v. B. L., the Supreme Court explained that students’ off-campus speech may be regulated only in cases of  “[1] serious or severe bullying or harassment targeting particular individuals; [2] threats aimed at teachers or other students; [3] the failure to follow rules concerning lessons, the writing of papers, the use of computers, or participation in other online school activities; and [4] breaches of school security devices, including material maintained within school computers.” Securly’s systems envision monitoring students’ off-campus speech in a far larger set of circumstances than provided for in Mahanoy.

My master’s thesis was on blocking and filtering technologies, and their potential for discriminating against the provision of LGBT-oriented information. I was also bullied in school, for years. I understand why schools want to track students’ access to gun- and suicide-related imagery. But public schools have to adhere to the Constitution in the surveillance they conduct of students. At most, considering the rights protected by the Fourth and First Amendments, schools are only be justified in starting to track out-of-school browsing behavior of a particular student on a school-issued device if they have probable cause to believe that the student was engaged in or is the target of one of the four kinds of conduct envisioned under Mahanoy. This technology goes far beyond what the law and the Constitution permits. We believe that the City Council should not approve the use of this technology.

This is part of a series on the surveillance technologies the City of Cambridge is reviewing. The City Council has referred consideration of these technologies through to the Public Safety Committee, which will hold a hearing and then report back to the City Council with recommendations. Email us if you’d like to testify at the Public Safety Committee. Now is the time to weigh in on whether you want to see this technology deployed in your community!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.