e-Literate

Present is Prologue

Tag: GDPR

  • Is Microsoft or Google your next LMS? The view from BETT

    Is Microsoft or Google your next LMS? The view from BETT

    The following is a guest post from Jason Cole, a longtime colleague and freelance consultant who recently moved back to London. Previously, Jason was Vice Chancellor for IT at the Peralta Community College District, and before that was CEO and Board Chair at Remote-Learner. [ed]

    I recently spent a day at BETT (formerly known as the British Educational Training and Technology show), the UK’s largest educational technology show. The show tends to skew towards the primary and further education market (k-12 and community college in the US), but there is also significant higher education presence. If you are looking for a US equivalent, its more akin to ISTE than EDUCAUSE.

    For those who haven’t been to BETT, it can be a bit overwhelming. There are over 34,000 attendees and 900 exhibitors from 138 countries. The massive show floor hosts everyone from national trade organizations from Denmark, Spain, UAE and Egypt to little ed tech startups that will probably evaporate in a few years.

    Everything is in one giant exhibition hall, with auditoriums scattered amongst the vendor booths. You can hear the noise of the conference space everywhere, even in the main event auditorium.

    For all of the activity, what was noticeable was the absence of the major LMS vendors besides Instructure Canvas. The company sponsored talks and roundtable lunches, but it didn’t have a traditional marketing booth. Their presence and sponsorship, however, meant they were the only LMS vendor anyone was talking about. D2L, Moodle, the UK Moodle partners, and Blackboard had no discernible presence. WebAnywhere is now focused on the SchoolJotter product and corporate Totara market. Synergy had small table in the back with one small Moodle Partner badge. Why – is BETT just a bad bet for lead generation and branding for the LMS providers? The large schools presence may mean less traffic for the higher ed (HE) focused LMS providers. But there are HE attendees, and Moodle had a strong schools presence. Some might argue the limitations of GDPR make lead generation difficult in European shows, but the presence of 900 exhibitors seems to imply there is some return on investment.

    On the other side of the spectrum, Google and Microsoft had large crowds in their large multi-plot booths. Each company had case study talks by users, how-to’s for teachers, and partner ecosystem mini-booths. Most of the hands-on presentations by these two tech giants were near capacity when I checked in throughout the day, as were most of the case study discussions.

    Every presentation in the Microsoft booth had real-time captioning displayed directly above the slides, and every presentation had real-time translation into multiple languages. Microsoft is obviously confident in both services, and from what I could see these services were remarkably accurate.

    It may have been the (AI-recommended) Microsoft Kool-aid ((Somehow an AI tied to a screen with a camera judged my reactions to three pictures, and estimated my age and gender and then labelled me an “Empowerer”. It’s recommendation was a rather refreshing apple cucumber drink with Spirulina distributed for free by two attendants. I have no idea why empowerers need cucumber, nor was there any falsifiable alternatives to getting a different flavour. Would the Innovator beverage make me more creative? Ah, the joys of inscrutable machine logic!)), but it appears Google and Microsoft are edging their way into the LMS space. Their presence at a K-12 focused show suggests they are finding traction at the younger grades. But as their education offerings grow in sophistication, and their ecosystem advantages start to accelerate, I believe a more concerted push in the higher ed space is inevitable.

    When Microsoft makes their push, the learning system won’t look like an LMS, but it will look like Teams. Teams is Microsoft’s central communication application for business, rolling in Skype and other business lines. There is an education version for teachers. Students with courses in Teams access their materials, communicate with the instructor and each other, and collaborate using Office and other tools online.

    View of Microsoft Teams demo

    The early indicator of Microsoft’s intent is their recently released Assignments for Teams for Education. Assignments gives teachers an easy to use tool to create either quizzes (using Forms) or submissions (using the Office suite). The student work can be graded using either a straight score or a rubric. Students see the results in their Teams, and teachers can download the grades for all the Assignments to Excel. It’s an interesting feature that signals a definite intent from Microsoft to meet the needs of teachers in the education version.

    Teams is not ready to replace or compete with the LMS yet, but it isn’t terribly far away. The Teams interface for classrooms needs some reorganization, it needs a centralized grade book that isn’t reliant on export to Excel, and it needs a slightly better authoring experience to combine the features together in learning modules. Teams and Sharepoint would also need a clear content strategy enable integration with publisher tools and content. But none of these challenges are impossible, and some Microsoft partners already have pieces of the solution.

    The ecosystem around Teams and Office will give Microsoft an increasingly interesting story. Microsoft is rapidly integrating service platforms for email, calendar, business logic, business intelligence, AI, device management, and cloud services into the Teams platform. There is enormous potential for educational organizations to leverage these capabilities to deliver a unified student experience. The “learning management” features move into the background, while students interact with a single application and message flow.

    While the potential is there, there are a few hurdles on the way. Moving into the learning and teaching side of the HE market requires a different channel strategy than the current focus on the productivity and infrastructure side of the house. Microsoft relies on a combination of direct account management and partner sales in a complex selling process. The Microsoft partners who would need to engage in the sales process and own customer relationship tend not to have academic sales experience, nor do they have the brand recognition of Canvas, Moodle, D2L and Blackboard among faculty. Given the sales costs and margins, a higher education focused Microsoft partner would have difficulty achieving scale. I would watch for more bottoms up adoption, pressure from students coming to HE from Google and Microsoft schools, and adoption outside of the traditional HE context as early indicators of a market shift.

    Other observations:

    • By sheer number of vendors, apparently every school in the EU is going to have a robotics lab and a maker space in the next few years. Lots of Arduino, 3D printers, and so… many… robots.
    • A few VR and AR vendors were making a splash (and inducing large scale motion sickness) with headsets and learning simulations.
    • Newton Rooms, modular, pre-packaged hands on science learning rooms, designed in Norway are one of my new favourite things.
  • Ed Tech Cybersecurity: Suppose they gave a data breach and nobody came

    Ed Tech Cybersecurity: Suppose they gave a data breach and nobody came

    It has now been four weeks since Chegg announced a data breach compromising personal information of up to 40 million users. Cue the crickets because the only coverage in ed tech press thus far is from EdWeek, which focuses on the K-12 market. That’s a shame, because if ed tech companies want a case study to help understand the implications of FBI warnings or the European Union’s new Global Data Privacy Regulations (GDPR), this example from Chegg should be illustrative. The same goes for institutions.

    As a recap, Chegg discovered on September 19th a data breach dating back to April that “an unauthorized party” accessed a data base with access to “a Chegg user’s name, email address, shipping address, Chegg username, and hashed Chegg password” but no financial information or social security numbers. The company has not disclosed, or is unsure of, how many of the 40 million users had their personal information stolen. On September 25th Chegg notified the SEC about the breach, focusing on guidance for company financials. The company then started notifying users and “certain regulatory authorities” on September 26th.

    A “hashed password” is a typical process where the entered password is converted to random-looking cryptographic characters not intended to be decrypted. Subsequent password entries use the same hash again and software compares not the passwords but the hashed passwords to see if they come out identical. While this practice of one-way hashes is well-known, there are far too many web sites (including in ed tech) using plain text, reversible hashes, or poor cryptography schemes.

    This 2016 article in Wired gives a good overview of hashing and data breaches and notes that the level of compromise depends on the details.

    In theory, no one, not a hacker or even the web service itself, should be able to take those hashes and convert them back into passwords. But in practice, some hashing schemes are significantly harder to reverse than others. The collection of 177 million LinkedIn accounts stolen in 2012 that went up for sale on a dark web market last week, for instance, had actually been hashed. But the company used only a simple hashing function called SHA1 without extra protections, allowing almost all the hashed passwords to be trivially cracked. The result is that hackers were able to not only access the passwords, but also try them on other websites, likely leading to Mark Zuckerberg having his Twitter and Pinterest accounts hacked over the weekend.

    By contrast, a breach at the crowdfunding site Patreon last year exposed passwords that had been hashed with a far stronger function called bcrypt, the fact of which likely kept the full cache relatively secure in spite of the breach.

    What is problematic with the Chegg data breach is that no further information has been made public and there has yet to be any interest from the broader ed tech press to dig up answers. We have no idea how serious this breach is, and I do not believe that the users with compromised personal information have had any updates since the initial email blast and associated post.

    Less than one week before the Chegg discovery of the data breach, the FBI put out a warning about ed tech and K-12 schools, but the details could easily be applied to higher education.

    The FBI is encouraging public awareness of cyber threat concerns related to K-12 students. The US school systems’ rapid growth of education technologies (EdTech) and widespread collection of student data could have privacy and safety implications if compromised or exploited.

    EdTech can provide services for adaptive, personalized learning experiences, and unique opportunities for student collaboration. Additionally, administrative platforms for tracking academics, disciplinary issues, student information systems, and classroom management programs, are commonly served through EdTech services.

    There is also the GDPR angle described in the EdWeek article.

    One of the first to call attention to the Chegg breach was Hill, an education consultant and market analyst for the company MindWires Consulting who posted a blog and a tweet about the SEC disclosure. [snip]

    One of the more pressing questions is whether the breach will draw the scrutiny of data-privacy regulators, said Hill in an interview. He pointed to the new rules put in place as part of GDPR, the sweeping European data privacy regulation that took effect earlier this year.

    The European policy has come into focus recently with the admission by social media giant Facebook — which has a major presence in schools — that hackers gained access to 50 million of its accounts. European authorities have said they are investigating how many users on the continent were affected, and whether it would trigger GPDR enforcement.

    The Facebook breach was no doubt more problematic, as its breach exposed far more personal information as well as access to Facebook Login, thus compromising third-party platforms. But both data breaches involve consumer-based systems and similar numbers of users. In legal terms, however, GDPR is based on protecting citizens of the European Union. When I asked a Chegg spokesman about the GDPR-based notifications, they replied in general terms.

    We actually do have an office in Berlin. Chegg’s customer base is principally US-based, and the core focus of our business is the United States. We are providing notice to the particular regulatory agencies, in the US and Internationally- including Europe.

    GDPR has been criticized as creating impossible to fully comply requirements, and there are two aspects worth covering here – Supervisory Authority and Notification of Data Breach. This article gives a good summary and whom to notify – the Supervisory Authority.

    For most companies, choosing a GDPR Lead Supervisory Authority is a straightforward decision. A company based in Paris, France would appoint the supervisory authority in France as the lead supervisory authority. A UK-based company would choose the Information Commissioner’s Office (ICO), which is the supervisory authority for the UK.

    For companies that operate in multiple EU member states, the lead supervisory authority would normally be the supervisory authority in the country where the company’s headquarters is or where its main business location is in the EU. More specifically, it would be the Supervisory Authority in the country where the final decisions are made about data collection and processing.

    A U.S. company that does not have a base in an EU member state has a problem. If it does not have a base in an EU member state where data procession decisions are made, it will not benefit from the one-stop-shop mechanism. Even if a company has a representative in an EU member state, that does not trigger the one-stop-shop mechanism.

    The company must therefore deal with the supervisory authority in every member state where the company is active, through its local representative.

    In Chegg’s case, presumably the Berlin office allows them to use the one-stop mechanism of a lead authority. But smaller ed tech companies may not have this benefit and require interactions with many different country regulators ((Genius system – make the process much more difficult for smaller companies.)).

    What about notification requirements in the case of a data breach? The relevant section is Article 33 of GDPR where Chegg would be a “controller” [emphasis added].

    • In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
    • The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
    • The notification referred to in paragraph 1 shall at least:
      1. describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
      2. communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
      3. describe the likely consequences of the personal data breach;
      4. describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

    In this case, Chegg would have had to notify its Lead Supervisory Authority by September 22 the details described above. According to the SEC form, initial notifications to regulators beyond the SEC started September 26.

    Would there be a lawsuit based on this delayed notification? We don’t know yet, but one important distinction is that in the EU the process must go through the official data regulators. Article 77 of GDPR specifies these actions.

    Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

    In other words, a country regulator must decide whether it wants to pursue action against Chegg. In the US, similar complaints or lawsuits can be filed by individuals against the company with a data breach. The intention of GDPR is to go after the big tech companies – Google, Facebook, etc – and Chegg may be too low-profile to warrant close attention. Despite the large numbers involved of up to 40 million users, it is unknown how many are EU citizens.

    Will there be further fallout for Chegg than the initial flurry of financial news that helped drive down its stock price by 21 percent since the notification? It looks like the biggest issue is job security for US lawyers, as there have been at least four dozen lawsuits seeking class-action status filed with the general theme of the company not securing its systems properly or not notifying investors of the risks of data security. I have no idea if any of these will stick ((These types of lawsuits come out of the woodworks when stock prices drop.)), but Chegg’s initial focus on SEC and financial notifications seems well-placed.

    In the meantime, other ed tech companies would do well to view this data breach as a case study and opportunity to figure out how secure their systems are, and if they would be able to comply with GDPR regulations (or if they would be required to do so). More broadly, how many companies collecting personal information use adequate protection of hashed passwords? How many know what to do in the case of a data breach? Now is the time to find out and take action, before the next event occurs.

    I will repeat my call that Chegg needs to more fully disclose the details of the incident to the general public. There has been no new information shared by Chegg based on its investigation. I would add that this subject should get more attention from ed tech press.

    Update: Based on interaction with executive director of OpsecEdu, the description of common password security approaches has been changed to not state that most use one-way hashing.