Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part:

- Following this advice and using a tone that even resembles the tone of the comment or the original post will make you look/sound crazy. School boards (government boards in general) are used to seeing vocal, crazy people and are good at not taking crazy people seriously.

- “spyware” is not something non-technical understand. Just invoking spyware is going to make people think you’re crazy, not motivate them to fix the problem.

- Normal people do understand things like ownership and consent (approximately, anyway). It might be better to highlight the fact that you own the laptop, your child cannot possibly consent to such monitoring/software being installed, and that you weren’t notified.

- Normal people understand things like subscription costs - why should the school district be paying a third-party service to monitor a device that they don’t manage. By installing management software on your child’s device, are they assuming ownership and _liability_ for how that device is used outside of school?

- The whole chromebook=spyware doesn’t really make sense unless the only comparison is Linux; and if your kid doesn’t understand privacy issues on a chromebook, they definitely won’t have a good time with Linux. The IT department could have just as easily installed similar spyware for Windows or macOS.

Realistically what probably happened here is they have slightly clueless people who installed standard-issue software without thinking to check if the student actually owned the chromebook, because they probably dealt with a hundred other District-issued devices that day. When you run into that kind of bad outcome from human frailty, it is better to treat it as such rather than complain to the board that the sky is falling.

Definitely don't use the term "spyware". Try to assume the persona of a reasonable, slightly conservative, and concerned person who is worried about data privacy why public money is being spent on subscriptions to companies who collect a lot of it, but are not local or accountable. Highlight that you understand that choices are difficult, but that the school needs to do better and be more accountable to parents and students, especially in an age where personal data has become so important.

Ideally you can collectively find a workaround (start by emailing IT, as someone else suggested, if that doesn't work, maybe schedule a meeting with someone more influential -- either way, the aggregate wisdom of your parent group will come up with more creative solutions than us at HN). Once you have a solution, craft a flyer and send to all parents: "This is what we saw as a problem, and this is what we did about it. Contact us if you want help."

If all else fails, stand up together in the board meeting.

Democracy does not require permission.

Thank you. Also, please ignore every comment in this thread suggesting you lawyer up or go to small claims court. The laptop isn't ruined and can be reset whenever the OP wants (as they already established).

If you go in guns blazing to the school board, the school is going to go into full defensive mode. Once you've established yourself as the aggressive parent with an axe to grind, they're not going to be interested at all in working with you.

If you actually want to get anywhere with this, start with a friendly e-mail to the school's IT staff. Ask them how your child can do their schoolwork without putting the laptop under school control. If you go in with a reasonable approach, you might get a sympathetic IT person who will walk you through the situation and explain the options.

> Realistically what probably happened here is they have slightly clueless people who installed standard-issue software without thinking to check if the student actually owned the chromebook

That would be my first assumption. I would even guess that they aren't keen on having yet another license tied up on a student's device somewhere.

Don't immediately rush to assumptions of malicious intent, don't think that making a scene at a school board event will further your goals, and definitely don't take any of the suggestions here to lawyer up or otherwise waste a lot of time and money on a legal fight that you will surely lose.

I take it that it's fine that I install a microphone with a transmitter in your ceiling fixture so long as I do 't damage the fixture itself.

> Don't immediately rush to assumptions of malicious intent

Is there a good reason to doubt that the intended purpose for installing the software was to use its advertised functionality?

Best to establish the facts first.

Following that logic, the act itself does not seem malicious. However, the logic of seeing students as suspects is.

It’s why one of the highest offenses is to leave school grounds during school. Ditto for prison.

In that light, of course students are suspects. They’re already guilty of not being adults. They’re not allowed to have jobs, or to decide what they want to learn, or any of the other things that make adults human.

I don’t know what to do about it, but recognizing it seems step one.

You're being downvoted, but I often felt exactly this way throughout my school years.

Is it? I don’t think I know any high school student that hasn’t tried to muck with, or work around, the schools systems.

So if you're renting an apartment from me, I am right to spy on your children with my ceiling bug?

> It would be more like if the cops had a valid warrant to track a suspects car, but installed the tracker in the wrong car by mistake.

The school is not a police force; nothing warrants their privacy intrusive surveillance of my children without my consent in the first place.

Too bad! They can be voted out, or face lawsuits if a heated attitude is too much for them that they feel the need to ignore valid feedback regardless of the emotions involved.

I've heard the same argument used for angry minority communities in the past, so this very much applies here as well. Heated rhetoric school boards are seeing today are reminiscent of a body that isn't listening.

Do I care more about making myself feel better by airing my grievances in whatever way suits my fancy, or do I care about a specific outcome?

If it's the latter, then the best thing to do is to figure out who is in charge, and, critically, the right way to talk to them in order to get the response -- and hopefully the outcome -- I want.

Sure, I could turn this into a crusade to vote out the school board and replace them with... who, exactly? The kind of people who are qualified and likely to get elected are probably pretty similar to the people there already: not too technically-inclined, and not willing to put up with an aggressive attack from parents. Even if I did manage to find and elect a school board that would take this kind of issue seriously without needing much prodding, by the time I went through this whole process, it'll be... a year? Two years? More? The ship will have sailed, and my hypothetical kid will have leaked all their private data to the school's nanny software already.

So hopefully I'd instead do the smart thing, approach the school board in a way that resonates with them, and get the outcome I want.

> I've heard the same argument used for angry minority communities in the past

I don't think this really applies here. Most "angry minority communities" are fighting for things that are systemically stacked against them, and often the "polite" approach doesn't work. But we're not talking about systemic oppression here; we're talking about an overworked, underpaid school IT department that doesn't have much choice in what they do, directed by a school board that doesn't understand the issues involved.

Only the world doesn't magically grants wishes to Kens and Karens, just because they feel strongly about something and how right they are. The person taking that board to court or trying to vote them out could just as trivially lose.

I agree with the general point of your comment but this is simply not true any more. I’m not sure it was ever true, but recent coverage of school boards and environmental review public consultation throughout the United States demonstrates that it certainly isn’t true in 2022.

It's also vague. Make sure parents know exactly what data is being gathered, and who gets it. And point out that this is being kept hidden from both children and parents - if the spying is above-board, then why doesn't the device give a big "All your chat messages and internet activity is being monitored by XYZ, even outside school hours" notice at log-in?

Was the existence and extent of this spying communicated in any clear way, by the software or by the school, or buried deep in a click-through agreement?

I find it annoying but acceptable that my work account doesn’t function on my non-work computer.

The whole point of a restricted boot environment is to have multi user with proper separation where one user can't accidentally compromise the system. If an org is still unhappy mixing with other accounts or being on user provided hardware they should be able to block that. Stealing hardware and implementing anti-theft rules that should apply to verified org provided hardware on first login is a crime.

Years ago, I debated Chromebooks as a solution for older relatives. Now I shudder to think what would have happened if I had and one of their nieces/nephews or grandkids had something to show them from school.

Just a nitpick here, yes school IT could do a remote install of spyware if the user was privileged and agreed to it. But a privileged user could also uninstall it. Which is not the case here. In my experience with MDMs the school has to physically have the laptop to install a permanent MDM or purchase the laptop and provision through an activation portal. My experience has been Intune Autopilot and ABM.

Google Work MDMs was notorious for remotely wiping personal devices which is why I never allow work to install MDMs on my personal items.

The only fix that worked was exporting the logins and passwords, deleting them from Chrome, and then reinstalling chrome with a different login. I don't want my coworkers work data in the hands of their children's schools' IT dept, and I've let them know that this can count as a data breach (fortunately, so far none of them have been privy to any important data).

Suffice it to say, don't let your kids use your work laptops, and don't log into your child's school accounts on your work computer.

This should be really obvious but apparently it is not.

Even if you say the school is installing stuff that allows them to monitor your child instead of using the term 'spyware' that may not be too compelling, I suppose a lot of parents will reflexively think - so, that's the school's job.

Thus the need to focus on how these things have been misused in the past, maybe say it's their job to monitor your child during school hours, but after school hours it's your job.

Also note how you bought the computer, it is your property, you can use it how you wish, if they want it to be otherwise they should buy the computers for children.

Charter schools is something we use now. Hardly perfect but it’s a lot nicer.

Spyware is a very well generally understood terms: someone breach someone else privacy deliberately, witch means complaint, court and uncertain results for those who decide to spy. Surveillance capitalism is ignored by most, but known as evil so once someone talk about that pointing out the finger to a school, not a hyper-giant player, people arise likely. They imaging in their mind a naked child spied via the webcam etc in an instant. While they do normally not understand nothing about ownership and consent on "digital stuff".

Oh, BTW what "realistically happen" have exactly zero meaning: the possibility of doing so on not managed computers means a built-in RCE so big that such products must not be on the market. Remote control of desktops must be deployed on purpose not came pre-installed from factories because anyone can use a pre-installed system in place. If that's true at least in EU, there is room for legal action against the OEM, not only the school.

I take it, then that, you would not bother to do anything about the descent down the slope to uniformity controlled by MAMAA?

Nonsense. They were designed to implement required policies when someone logs into a managed domain. Unless you're logging into something like that (where disclosures have been made and consent has been obtained) then there's no "dystopian spyware" involved. Absent any domain management policies, Chromebook are basically fancy thin clients that make efficient use of web-based services.

That having been said, the OP either conspicuously failed to mention that such disclosures were made, or (and this I find to be much more likely) the school was dumb enough to think they don't need to disclose anything because like a lot of school systems, they have gotten the curious idea that they basically own the kids and that the kids have no rights whatsoever. Should that be the case I hope a judge spanks them soundly for it because yeah, they absolutely do need to disclose this stuff to the students or the first time there's a serious problem due to abuse of the monitoring system the school is likely to get very, very pantsed for facilitating child abuse.

The school is effectively making the computer a terminal into their system. Their system, their rules.

I know the OP won't like this answer but the OP should buy their kid another computer for their non-school activities. Of course they could also complain to their school/district to change the polices. Personally, I'm used to it. I have a personal computer for my own use and a corp computer that's managed by corp and is locked down. I don't complain the corp computer is locked down (except when it gets in the way of doing my actual job). For all personal stuff I use my personal computer.

I agree with this. If you had an rdp / citrix / ssh session to your employer you'd expect them to control what's on the other end. A Chromebook on which you're using a work/school account is much closer to that experience than a PC, but with the lines unfortunately much more blurred.

Has it been, in this case? If a parent says 'I do not agree to this', then what? Will the school district swap the system out for one that doesn't require end users to waive their legal rights? Has that ever happened when a parent objected to one of these EULAs, even once?

This reminds me of Asimov's Multivac home terminals where every user, in the comfort of their home, could dial in a query on their computer terminal and the massive infrastructure which is the continental-sized Multivac computer will respond with an answer.

In this case the student is not the owner of the Chromebook. They need to disclose this stuff to, and obtain consent from, the parents before taking control of the device.

It makes me cringe that this is an accurate assessment of how our educational system is run.

This is some bad advice. No need to escalate the situation. Simply contact the sons school and find out who the technologist is and ask them for help. Explain to them the situation and I'm sure they will understand. The computer is personal so they don't want it under mobile device management.

I have some experience with schools. The school is not intentionally installing spyware. Further most public K12 organizations have IT departments are not going to be as well staffed/knowledgable as your average silicon valley tech company. So they may not know exactly how to rectify this situation. No need to berate the school board over "spyware."

What is not reasonable is the very real possibility that they might have overstepped and made these policies active for all logins on the device, or that they failed to properly disclose what exactly happens when the user uses the domain login. That would then make what's been installed very worthy of the term "spyware" and would probably make both GoGuardian and Google upset with them because it's unnecessarily heavy-handed and pretty much guaranteed to bring bad press.

Part of the reason these things are so locked down is so that management policies can be applied to ONLY the logins that require them without impacting the entire device all the time. If someone tries to sidestep that by grabbing root access and messing with the trusted environment, when the user logs into the managed domain the machine is going to report that its environment has been tampered with and that should pretty immediately bring use of any domain-managed accounts to a halt. You wind up actually jumping through the same hoops (although more discretely and without involving logging/reporting of browser history) when you use your bank's banking app or have Microsoft Teams/Outlook installed on your phone. Both of these things absolutely require their data be kept separate from the rest of the user's data, and very carefully protected from the other apps on the device.

From my understanding if you setup a personal chromebook you can then login to Google Classroom via the Chrome browser and it should not enroll the chromebook in MDM. At least when I login to my chromebook it does not enroll my device.

Our highschool had a bunch of laptops. They were the firstish gen of mac laptops with built-in webcams. This was all very new.

These laptops would take a picture of the user at every login and then once an hour or so after that. I guess the principal wanted to know who was using each machine in case anything unclothe was done with the laptop. The pics were stored on an FTP server (not FTPS. Not SFTP. FTP.). The FTP account had RWX on the directory where all login pictures were stored, and the FTP server was exposed to the internet. A simple MiTM on any network where this laptop connected would give the attacker full read access to these login pictures.

The problem: these laptops could be "checked out" for an evening or weekend. So they got around. Hotels, restaurants, libraries, coffee shops, etc. But also student's bedrooms. This was in the days when most public wifi was just a commodity linksys router behind the register and you could more-or-less safely assume you were being MiTM'd when connecting to a public wifi network.

So, long story short, a principal with bad judgement and an IT admin with just enough googling skills were uploading pics of students in their bedrooms to an FTP server that was almost certainly hacked into by dozens of different people. Without consent or knowledge of the students or parents.

When I raised this issue, the principal suspended me. Getting the suspension reversed required going to central office, who were totally unaware of what was going on and were, obviously, appalled at the picture taking script.

School IT staff are often knowledgeable enough to be dangerous, and individual school administrators often demonstrate remarkably horrible judgement. I understand the "be kind" sentiment, but there really is a lot of inexcusable incompetence and poor judgement in K12. We should hold those systems to a much higher standard than we do.

Citation needed.

Here is a counter citation: https://www.vice.com/amp/en/article/8xwze4/schools-are-using...

And here: https://amp.theguardian.com/commentisfree/2021/oct/11/us-stu...

Schools are doing this. They are intention into installing spyware and GoGuardian is one of the biggest offenders.

This should be brought up at the school board.

I recommend reaching out to your child's teacher, and ask to get connected with the IT team at the school to explain what's going on.

I don't think parent described 'frothing at the mouth', and furthermore the concept of "I shouldn't speak out otherwise I may paint myself as a target for child protective services" is so subversive and nu-speak like that I don't think I can ever support it. CPS is supposed to be a social service for the support of children; not a society control and opinion-steering organization.

If parent did something publicly that'd warrant the visit, sure; but creating public awareness of the situation for the parents can be done in an orderly and respectful way -- no one suggested otherwise.

Asking “Does anyone know how to refer these people to law enforcement for prosecution?” regarding a technical support issue is not respectful or orderly behavior.

> GoGuardian products allow teachers and administrators to view and snapshot students' computer screens, close and open browser tabs, and see running applications. GoGuardian can collect information about any activity when users are logged onto their accounts, including data originating from a student's webcam, microphone, keyboard, and screen, along with historical data such as browsing history. This collection can be performed whether students connect from school-provided or personally-owned devices.

I can only describe this as, well, spyware. No need for scare quotes. The OP has every right to be angry about this.

To describe this as a "simple technical support issue" is some blatant euphemism.

[1]: https://en.wikipedia.org/wiki/GoGuardian

And before anybody says, that things like these only happen in the movies, or bad crime TV shows... they do happen in real life as well. I remember a case here in Germany, where somebody had managed to install RATs on ~150 school-age girls' laptops, tho using some spear-hunting, and when he was raided, police found a large collection of videos he had recorded with the girls' webcams[0].

That there are sexually-motivated hacks should be clear to the wider public at least since the so called Fappening.

As for insiders, NSA staff spied on ex-partners, love interests and spouses[1], to a degree where they internally coined the term "LOVEINT" for it. If the paranoid NSA cannot "manage" their own people, then what chance would a GoGuardian or school have, I wonder.

[0] https://www.t-online.de/digital/sicherheit/id_42278570/hacke...

[1] https://www.reuters.com/article/us-usa-surveillance-watchdog...

> escalating a simple technical support issue into a rant about ‘spyware’

The right tactic for objecting to school officials was besides my point.

*Edit: sokoloff may be correct, and the spyware is not unremovable. Still, the analogy holds.

Do I have this wrong? I'm not from Chicago or Illinois, so that's quite possible.

That said, my advice here would be to keep it short and non-emotional. You can speak for two minutes, but you don't have to use all two minutes. Say what's wrong, what action you want the board to take, and how interested board members can get ahold of you.

I watch the board meetings in general because the subject matter is interesting and there are neat details in there that don't get widely reported. Recently they had some slides with security camera footage of someone riding their bicycle on the subway tracks. No idea people did that. Also, the point of the board meetings public is to provide the public with some oversight. If you don't actually watch them, then there is no oversight. (I guess we hope that "someone else" does this for us. Transit reporting is not what the best journalists necessarily end up doing.)

It should go without saying that you should be courteous and reasonable while presenting your concerns.

Spyware and children in the same sentence easily bring up unpleasant thoughts.

https://www.computerworld.com/article/2521075/pennsylvania-s...

https://abcnews.go.com/GMA/Parenting/pennsylvania-school-fbi...

And referring for prosecution is really going to go nowhere.

Best bet, contact the public service operation for one of the TV stations, maybe a newspaper, and maybe your city council member, to wake up somebody, either at your school or at headquarters downtown.

Prepare to be disappointed.

Source: https://www.theverge.com/2020/2/20/21145698/google-student-p...

I have intune on my personal ipad. And the idiots from our IT department accidentally wiped the entire thing. Just because I wanted to be able to read outlook mails. My iCloud was even blocked for a day or so. Despite their claims they can only manage the app itself and despite my protests that the fine print clearly indicates they could do so and that they should change their configuration.

At least I got an apology letter, but all these devices are desigend to be locked down by centralized IT departmens. Be it ChromeOs, iOS or Windows

Whole point of Chromebooks is that they are minimal devices that can easily be adopted for school work. What I find strange is that OP had to buy their own machine. Anyway even if you somehow convinced the school to change to a Windows based laptops all you'd achieve would be a tier more expensive machines for the kids to use. The school would still require same "spyware" to be installed.

I remember not so long ago when people were using this advice on health care issues;

Call into the school's board meeting during public comment, and make it loud and clear that the school is injecting your children with 5G mind control vaccines. Share your technical credentials and the method by which you found this.