How can we check for accountability of emails on student laptops?

D September 8, 2011
Pinterest Stumbleupon Whatsapp

Our school is going to use an internet accountability program for 1 to 1 student laptops. We will have the emails coming from each laptop to 1 account.

How can we check to make sure we are receiving all the emails we should without manually checking the account? Can we get a notification of missing emails?

FYI: the school is a Mac only environment.

Ads by Google

  1. Mike
    September 9, 2011 at 1:05 am

    I don't really want to go into the legal discussion. Usually schools have usage agreements that allows them to monitor usage (up to a certain point) for both computers property of the school outside their network and private devices within the schools network.

    From the little I know about accountability programs the email alerts work on system level not seen or influenced by the user and if they fail to send it should be within an email queue for later delivery. 
    So unless the students do have administrator rights to disable, reconfigure or delete the software or they disconnect the network they shouldn't be able to tamper with it on the device itself.

    One way to stop it from sending reports would be to put another device between the laptop and the network/internet which intercepts/filters out all SMTP traffic. But then again, someone tech savvy enough to set this up will also be able to circumvent any tempering detection you throw at it, don't you think?

    Option 1: probing e.g. a SMTP connection test from the laptop to your mailserver and if it fails X times within Y timeframe simply lockup the device ~ if it can't send reports to you the student won't be able to use it at all

    Option 2: simultaneous notification via TCP connection e.g. in addition to the email report open up a TCP connection to one of your servers basically saying "hey, you should get an email report now" ~ won't help if against filtering as mentioned above

    If the laptops are used inside the school network I would trust on the system you are using and in addition use some dedicated "gateway" machine with Wireshark, L7 filter or so to monitor the internet usage.

    One school I know of route all HTTP traffic through a Squid "box" which logs all URL's visited by the students. But then again this requires manual and/or active monitoring from the administrators.

  2. Mulder
    September 8, 2011 at 9:30 pm

    Hmmm…sounds like spying on students, which is legally dubious unless you have their informed consent and/or that of their parents if they are minors.

    Even so, there is no way to know whether or not you are receiving all the email you expect unless you manually check, and if the email is sent from the students' email account, checking it without their consent would be a federal crime. You don't want to be involved in anything like that, because you'll lose the legal battle.

    You can't get a notification of missing email, because that itself would require the computer to know that you haven't received an email, and there can be many reasons why you wouldn't get one. That's something you'd have to setup on your system.

    • Dusty Mack
      September 8, 2011 at 11:34 pm

      Let me try and clear this up, students and parents will be aware of the software. It is in our policy to make sure that the school's laptops are not being used inappropriately, and is there to reassure parents. 

      The program only reports questionable websites, similar to Convenient Eyes.  The reports will only be checked if there is suspicion by parents or principals.The software will be sending the email, and the reason we want to know if we got it or not is so we know if the students are tampering with this required software.

      • Mulder
        September 9, 2011 at 1:43 am

        Without a very specific and limited definition of "inappropriate" or "questionable" you're going to run into the issue of censoring perfectly legal content, which would be unconstitutional. Just because someone at the school doesn't think it's appropriate doesn't give them the right to make that decision for students or their parents.

        One would think that parents would want to be more involved in what their kids are doing at school instead of leaving it to overzealous administrators to arbitrarily decide what they can or can't do on the Internet. If you don't trust parents to decide what's okay for their kids, they have no reason to trust the school or their administrators.

        I would suggest you abandon attempts to monitor what students are doing; you should be more concerned with teaching and getting parents involved in the learning process so their kids can succeed.

        • Mike
          September 9, 2011 at 7:02 am

          Before this escalates into a legal debate:
          Under US law it is legal to fully monitor information technology systems if the usage policy put the users on notice about "No expectations of privacy".

          On example can be seen at the following link:
          http://security.tennessee.edu/login-banner.shtml

          This computer system is the property of the University of Tennessee. It is for authorized use only. Users have no expectation of privacy in any materials they place or view on this system. The University complies with state and federal law regarding certain legally protected confidential information, but makes no representation that any other uses of this system will be private or confidential.

        • Mulder
          September 10, 2011 at 9:36 pm

          It's legal only if the users have informed consent, and without that, it is illegal. If these students are minors, they cannot give legal consent, only their parents can.

Ads by Google