Example software and policies are things like:
http://www.exam4.com/ (used by Harvard, George Washington, etc)
http://www.law.wisc.edu/help/for_students/securexam/
http://www.law.columbia.edu/academics/registrar/Laptop_Exams
https://www.law.umich.edu/currentstudents/registration/exams...
Most (all?) schools offer students the ability to take their exams on paper, but doing so is a substantial competitive disadvantage because examinations are usually timed and writing on paper is much slower, students are marked down for legibility and copy-editing noise, etc.
I don't have a citation studying it— but by all appearances it's only a small minority of students that opt out of using their laptops. ("Most Stanford Law School students take their examinations on laptops")
IIRC the California bar exam now also uses one of these spyware exam packages.
I'm mostly amused that we have a whole information-security critical profession who is nearly required to behave negligently wrt information security from day one. :P
(And then— some students do it anyways, because thats the only way to use it on their otherwise non-supported system or because of some other incompatibility. And nothing comes of it... I guess until something does. Better not make too many enemies)
It's certainly not the most secure thing to do, but they need to focus on studying law, not securing systems. I imagine that when lawyers are working on cases, they might end up using more secure devices than their old college laptops.
Do you have a specific case in mind?
schools often direct students to behave irresponsibly with respect to data security
Why would they do that? Reference?