From math games to study skills, the potential use of educational online applications has exploded in schools鈥攂ut so has the potential for problems if school staff members don鈥檛 read the fine print on the service agreements.
The industry-analyst firm at a compound annual rate of more than 28 percent through 2020, to nearly $6 billion. A 2016 survey by the Consortium for School Networking found nearly all its members (mostly school district education-technology officials) are using or plan to use digital open educational resources in the next three years, but fewer than half have clear policies on how apps are selected and used to safeguard students鈥� privacy and teachers鈥� intellectual property.
鈥淔or a lot of districts, [app security] hasn鈥檛 come up yet,鈥� said Steve Smith, the chief information officer for the Cambridge, Mass., public schools. 鈥淚f they are not thinking about data privacy and they are being pushed to use a lot of free online resources, there is potential for a lot of student-data leaks.鈥�
The 22,000-student Green Bay district in Wisconsin became aware of the challenges in 2014, as it began to integrate tablet- and cloud-based software into classrooms. Diane Doersch, Green Bay鈥檚 chief technology and information officer, said that within a few years, she found herself combing through 10 to 15 app service agreements every month鈥�"It was taking forever; every review of a terms of service agreement was taking two hours"鈥攐nly to find other apps being used informally.
Many districts have lists of approved apps for teachers or students to use, Smith said, but they often have been vetted by educators or curriculum experts for their pedagogical quality, not by technology or legal experts analyzing terms of service. Even in those districts that do vet apps holistically, it鈥檚 tough to keep on top of changes and updates in approved lists of hundreds or thousands of apps.
A 2016 study led by researchers from Carnegie Mellon University compared the written privacy policies of nearly 18,000 free apps targeted to children to the actual computer code that ran the applications. It found that out of more than 9,000 apps that had a privacy policy, more than half had conflicts between what the privacy policy said the app did and what the code revealed that it actually did.
Among the most common sins were those of omission: companies that collected location or time-on-task data without disclosing that information. For example, more than 40 percent of the apps collected location information, and 17 percent shared data with other companies without saying so in their privacy policies.
鈥淚t鈥檚 great to have innovative schools and teachers taking advantage of all these tools, but they have to know what they are getting into,鈥� Smith said. 鈥淎 lot of free applications are free for a reason; they are not just doing it out of the goodness of their hearts, they want that data.鈥�
Jim Flanagan, the chief learning-services officer for the International Society for Technology in Education, an industry group, agreed: 鈥淣othing is totally free. You are for sale; that鈥檚 the cost of free.鈥�
鈥楲ike the Wild West鈥�
Jason Kunze, an intellectual-property lawyer with Nixon Peabody LLP, who reviews and studies software terms of service agreements, said the educational-app field is still new enough that there isn鈥檛 a lot of standardization, and there are many policies and legal precedents from the real world that don鈥檛 translate well to the virtual space, such as whether a provider can create a profile about students based on their geographic location or whether a teacher retains rights to a lesson plan she developed on an app.
鈥淚f I want to publish a website or create an app, I don鈥檛 need a factory. A lot of people can get into this space very quickly,鈥� he said. 鈥淚t鈥檚 good in that it allows for rapid innovation, but the downside is [it鈥檚] a bit like the wild, wild West.鈥�
Doersch said the district had always been able to leverage its regular software contracts to make sure vendors stayed in line with district policies and the federal Family Educational Rights and Privacy Act, but, 鈥渨e were finding with the rise of cloud-based and [open educational resources], we didn鈥檛 have the leverage to say, 鈥榃e鈥檒l pay you when you sign this.鈥� The providers would say, 鈥楩ERPA? What鈥檚 that? Why should we care? Oh, we signed the privacy agreement, we鈥檙e fine.鈥�
School districts are starting to push back. Green Bay and Cambridge both helped found the Student Data Privacy Consortium鈥攁n alliance of districts in California, Connecticut, Florida, Maine, New Hampshire, Massachusetts, Oregon, New Jersey, Rhode Island, Tennessee, Virginia, Washington, and Wisconsin. The consortium drafted a model contract and questions for districts to use when working with app providers. Other districts have partnered with the nonprofit Common Sense Media to develop a privacy yardstick to evaluate apps.
鈥淗istorically, educators could be isolated, but they can鈥檛 be anymore,鈥� ISTE鈥檚 Flanagan said; because there is no single list of safe apps that educators can consult, reaching out to colleagues is even more important. 鈥淏efore you start a new app, see what your peers think of it.鈥�
More than 300 companies have signed a 12-part 鈥溾�� to adopt safer practices in their education apps, including providing clear lists of the data a company will collect on students and not selling student data. The pledge is voluntary, but the Federal Trade Commission has sued companies like Snapchat and Yelp for collecting data on users鈥攑articularly on children鈥攃ontrary to their public statements about safeguarding privacy.
But even developers with a strong commitment to data security can run into trouble in the K-12 space. The most secure log-in systems use complex passwords, for example, but Doersch said such systems break down in the early grades.
鈥淲e鈥檙e asking kids to make a combination of numbers and letters they don鈥檛 even know yet, and when you add in upper- and lowercase letters, it鈥檚 just too much; it takes a whole day to get them logged in,鈥� she said. Facial-recognition systems can be an alternative, but even there, a 6th grader who hits a growth spurt can throw off the software.
Green Bay now uses key cards to let young students log into programs securely, and teachers go through training on how to assess an app鈥檚 educational content and privacy concerns. The district approves new apps only during a 鈥渧etting window鈥� at the start of each semester, and both staff and students learn to recognize signs of an app or website that could contain malicious code, like a keystroke collector or virus.
Regardless of whether districts use model contracts or write their own, try out new free apps, or stick to subscription services, Smith, Doersch, and Flanagan agree that it鈥檚 important for districts and app providers to work together.
鈥淭here are great opportunities, but ... we need to be careful both as consumers and producers of data,鈥� Doersch said. 鈥淲e have no idea, 20 years from now, what the digital footprint of a 2nd grader will mean for his future.鈥�
