How to Ethically Monitor Student Behavior in School-Provided Technology

Monitoring student behavior is a bit like walking on a tightrope. If you lean too far one way, you risk jeopardizing student privacy. And if you lean too far in the other direction, student and staff safety could be at risk.

But, monitoring student activity is becoming increasingly important, particularly given the recent wave of attention around student mental health. According to Mental Health America, at least 2.3 million youth (age 12-17) are coping with severe major depression.

Toeing the line between privacy and security is no easy task, especially if you don’t have a safety net to catch you on the way down. Luckily, there is a way to ethically keep tabs on what’s happening in your cloud environment without overstepping student boundaries.

What is cloud monitoring technology?

School districts are likely familiar with the notion of monitoring student technology use, particularly school-provided computers, and tablets. In fact, 71% of teachers report that their school or district already uses student activity monitoring software on school-issued devices, per data from the Center for Democracy and Technology.

These types of monitoring software are more focused on the endpoint level. In other words, they monitor activity as it occurs on the device, such as a student’s search history or browser content. Notably, these types of software can monitor student behavior even when they’re using the device at home.

In contrast, cloud monitoring technologies are designed specifically to keep tabs on school-provided cloud services, like Google Workspace or Microsoft 365. Because cloud applications exist outside the school network and aren’t installed on school devices, traditional monitoring tools lack insight into the cloud environment.

Schools rapidly adopted cloud-based communication and collaboration tools in large quantities to accommodate remote learning during the pandemic. According to a recent report from the Future of Privacy Forum, this migration “generated large volumes of student communications and digital content.”

Even now that students have largely returned to in-person learning, cloud-based edtech tools are still used in the classroom by students and staff. In turn, that swarm of cloud data continues to grow.

For these reasons, cloud monitoring tools are becoming increasingly appealing to schools that seek to know how students are using their school-provided cloud applications.

Why monitor student activity?

It goes without saying that monitoring student behavior in any capacity naturally raises concerns about student privacy and hyper-surveillance (more on that later). But it’s also worth noting that there are many legitimate and compelling reasons to monitor student activity, especially in the cloud.

Fundamentally, cloud monitoring is about meeting two core objectives: legal compliance and protecting student safety.

Legal compliance

School districts are required to comply with the Children’s Internet Protection Act (CIPA). This law mandates you to take appropriate steps to prevent students from accessing online material that lacks educational value or may be harmful to minors, such as inappropriate, sexual, or violent content.

The second component of CIPA worth mentioning is data security. Under CIPA, schools are required to prevent the unauthorized disclosure of student data, as well as prevent students from engaging in unlawful online behavior, such as hacking.

Meeting these regulations is no easy task if you lack the proper line of sight into your cloud environment. A cloud monitoring solution can mitigate this challenge and identify previously unseen risks, including:

• Inappropriate content: Students often use cloud apps to share pirated movies or music, but also to “sext” their classmates. In other words, you could be unknowingly storing child pornography in your cloud. A monitoring solution allows you to quickly identify obscene material and mitigate the risk before it spirals out of control.
• Data loss: Many cloud-based threat vectors could expose student data to prying eyes, including third-party apps or malicious phishing scams. With the oversight of a monitoring system, you can rapidly identify a potential leak and patch your vulnerabilities.

Student safety

Compliance is certainly a mighty responsibility, but no more vital than protecting your students’ wellbeing. In recent years, it has become apparent that there is perhaps no graver threat to student safety than poor mental health.

In fact, per data from the National Alliance on Mental Illness, nearly three million youths had serious suicidal thoughts in 2020. And, believe it or not, they’re increasingly recording such thoughts in school-provided cloud services.

Students are using applications like Google Docs or Microsoft Word to share their feelings, confront problems, and chat with friends about lingering issues. Your cloud environment, in turn, may be littered with signals that could hint at a student in crisis. These may include:

• Self-harm: Students may be engaging in self-destructive behavior that puts their well-being at risk, such as cutting themselves or considering suicide.
• Cyberbullying: Cloud apps are often exploited by mean-spirited students to tease, mock, and bully their peers.
• Violence: Threats of violence are often shared through digital channels, including cloud-based chatrooms and email.

Fortunately, cloud monitoring can catch these signals before it’s too late. Take Hillsboro-Deering School District, for example. By taking advantage of a cloud monitoring solution, Chief Information Security Officer Neal Richardson was able to get ahead of the curve and mitigate previously unseen risks.

“Unfortunately, there have been a couple of incidents flagged relating to suicidal language and violence issues,” Richardsons says. “But ManagedMethods was able to notify us so our school resources can get the student resources they need to address the problems they’re experiencing.”

How does cloud monitoring work?

As previously mentioned, cloud monitoring technologies exclusively set their sights on the cloud. That means they aren’t privy to the activities happening on a device or network level — only those that occur in your cloud domains (Microsoft 365 and Google Workspace).

ManagedMethods, for example, uses 1:1 integrations to monitor both Microsoft and Google cloud services as effectively as possible. Generally speaking, you can lump the types of content that this technology monitors into two categories:

• Applications: Cloud monitoring includes any school-provided cloud app, such as Google Drive, Google Docs, Microsoft Word, or OneDrive.
• Communications: On the other hand, monitoring tools also detect risks that exist in communications between students or staff, including email and cloud chat apps.

For either category, cloud monitoring allows you to rapidly identify red flags contained in text and image content through a few basic processes:

• Keyword scanning: At its most basic, cloud monitoring technology scans the cloud for keywords or phrases that might indicate self-harm, violence or cyberbullying. For example, it can identify instances of a phrase like “kill myself” and will flag it for further review. More sophisticated solutions will use regex — regular expression — to define a search pattern instead of a single word or phrase.
• Artificial intelligence (AI): With AI, you can take keyword scanning many steps further. AI understands the context around a phrase, as well as word negotiation, tenses, and spelling mistakes. Better yet, AI uses machine learning to improve itself, learn patterns, and optimize its ability to recognize safety risks over time.
• Automated alerting: When AI flags a potential signal, such as a student discussing violence in an email thread, it automatically alerts relevant security personnel in near real-time at any time of day. This allows you to quickly investigate the incident and set the appropriate course of action into motion before bad becomes worse.

Student privacy concerns

Unfortunately, not all cloud monitoring solutions are created (or used) equally. That’s why it’s only natural that parents, students, and staff are concerned about schools inappropriately or unfairly surveilling student behavior.

When executed poorly, cloud monitoring can leave devastating and counterproductive outcomes:

• False-positives: Students that are mistakenly flagged may face undue consequences if incidents are investigated properly by school authorities.
• Unfair treatment: Once flagged, students may be treated unfairly by administrators or their peers if their mental health status is improperly shared.
• Excess scrutiny: Students who are flagged for a mental health risk may face stigmatizing or alienating scrutiny from the school.
• Inappropriate disclosure: Unauthorized disclosure of mental health may invite additional stress or scrutiny from a student’s peers, not to mention violates their privacy.
• Undue punishment: A student may be needlessly contacted by law enforcement or social services, or even academically disciplined as a result of being flagged.
• Unauthorized outing: Flagging student behavior may result in their sensitive personal information — such as gender identity or sexual orientation — being revealed without their consent.

When used appropriately, cloud monitoring can be a force for good. But when performed without the proper guardrails, these outcomes actually undermine the purpose of monitoring in the first place by negatively impacting mental health.

Cloud monitoring best practices

When monitoring student behavior, you need to be careful that you’re taking the appropriate precautions and not overstepping your responsibility to protect safety and wellbeing. To prevent your school district from experiencing the negative outcomes listed above, it’s best to follow these best practices:

Plan ahead:
Ensure you have the proper mental health resources in place before you start monitoring student behavior. This allows you to quickly allocate resources once a risk has been accurately identified.

Establish a policy:
It’s important to develop a robust response plan and policy around how you’ll use your cloud monitoring solution to mitigate risks and protect students without violating their privacy.

Customize your solution:
The best monitoring tools will come equipped with out-of-the-box policy settings to get you up and running fast, but be sure to tailor them to your specific needs. Create policies around keywords and content that would reasonably indicate a student safety risk and won’t needlessly violate student privacy.

Choose carefully:
Above all, deploy an ethical cloud monitoring solution.

ManagedMethods, for example, provides a cloud security platform that doesn’t collect or store student or district information. Because we use deep API integrations, data never leaves your domain.

As a signatory of the Student Privacy Pledge, ManagedMethods is committed to protecting student data. That means we don’t sell personal information, disclose student data to advertisers, or build unauthorized profiles of your students.