Recent news in Pennsylvania, from Lower Marion School District, has the school and officials under fire from parents and students claiming their expected privacy was compromised.  We have an opinion right in the middle of this controversy.

The school provided the students these laptops with the understanding they

courtesy of Geekologie

were to be used for school activity.  Whether or not an appropriate Acceptable Usage Policy (AUP) was created, is not clear.  It should have defined what was expected in usage, the monitoring ability and a clear line forcing the parents to sign and understand what AUP the school had created.  A mandatory meeting should have been help with the parents and kids outlining the entire process.

We deal with multiple school districts in the local area that all have controlled computers that sit inside the school and are taken home by teachers and students.  These computers all connect back through the school filters, firewalls and proxies to provide the safest environment possible.  Yet, it could not be perfect.  Any computer provided in this format, should reasonably expect some form of controls that will be installed.

The next step was the means of access and recovery the school distrcit utilized.  They school reguarly connected to laptops and took control or watched desktops for helpdesk operations and to assist in recovering in lost or stolen laptops.  However, the officials also activated the built in camera in the laptops, without warning.  This is where we offer our opinion to meet in the middle.

The schools should take one of two paths when issuing equipment like this to students.  One path says buy laptops with no camera installed, removing this possibility.  The other path is more complicated.  The AUP for the district should outline the possibility and also set some established hours that the camera may be activated, and only in recovery mode that is well documented when performed with some audit trail.

As we debated this, one point was raised that beared a bit of explanation in this thought path.  Most of these laptops would be forced to connect to district servers to get security and policy updates once they access the Internet.  If the laptop was stolen or lost, this might not happen till after normal business and school hours.   So if the AUP said they would only activate during normal hours, how would they act if the computer came online only at night and they wished to track it?

I don’t think there is reasonable expectation of privacy on the content you access with a school issued laptop, however there is one with the placement and timing of the camera itself.  Mainly when the AUP does not address or reflect the ability the district has to activate such features that interfere with expected visual privacy.  Internet access is just data flow and can be routed through anywhere and monitored.  But the physical setting anyone is in normally would have expectations of privacy involved.

The district was right in coming clean in what access and steps they take and also in immediately suspending this practice until the investigations and complaints are over.  However, every district and company needs a better defined AUP to address this immediately.