Universities Monitoring Student Emails: Ethical Or Unethical?

Universities have been known to spy on their students' emails and monitor their engagement with their studies. This is done through surveillance software that tracks attendance at lectures, library visits, and other metrics. While this may be done with good intentions, such as ensuring students are not falling behind, it raises concerns about the privacy and security of student data. Additionally, universities have access to students' school-issued email accounts and can monitor any activity within those accounts. However, they generally cannot access personal emails or data on personal devices unless the student is using the school's network or has installed school software on their device.

Universities can access school-issued emails and activity on school-issued devices

It is important to note that universities cannot access personal emails or monitor activity on personal devices, unless a student has installed specific university software on their personal device. In this case, the university may be able to access data on the device. However, universities generally only have access to data on school-issued devices that they own.

Universities may use surveillance software to track student engagement, such as attendance at lectures, library visits, and interactions with online learning platforms. This data can be used to identify students who may be struggling and offer support, but it also raises concerns about student privacy and the potential for overuse of surveillance.

To protect their privacy, students should avoid using their school-issued email accounts for personal communications and refrain from accessing personal accounts on school-issued devices. Keeping personal data off school-issued devices and accounts is essential to maintaining privacy.

They can monitor activity on their network, even when accessed from a personal device

Universities can monitor their students' activity on their network, even when accessed from a personal device. This means that any activity on a personal device that is connected to the university's network can be monitored. For example, if a student is using their personal laptop to access the university's Wi-Fi, their web browsing activity, emails sent and received, and even their location data may be tracked. This is possible because the university owns the domain and has administrative rights.

It is important to note that universities typically have access to a significant amount of data about their students, including their online activity. This data can be used to track student engagement, attendance, and academic performance. Universities may argue that this data is necessary to provide support to students who may be struggling with their studies. However, some students and privacy advocates have expressed concerns about the potential for this data to be misused or sold to third parties.

While universities have a responsibility to ensure the safety and well-being of their students, the level of monitoring and the lack of transparency around it have raised concerns among students and privacy experts. In the UK, for instance, at least 27 universities have been found to use surveillance software to track student attendance at lectures, library visits, and other activities. However, many of these universities have not provided clear answers about the limits of their monitoring or the consequences for non-compliance.

To protect their privacy, students are advised to use personal devices and networks for personal activities and to avoid consolidating multiple accounts into a university email account. Additionally, students should be cautious about the types of data they share with their university and the potential for that data to be accessed or sold by third parties. While universities have a legitimate interest in monitoring student activity to some extent, it is crucial that they strike a balance between student support and respecting their privacy.

Universities cannot access personal files or applications on personal devices

Universities have been known to use surveillance software to monitor students' activities. This includes tracking attendance at lectures, library visits, and the use of learning analytics tools. However, it is important to note that universities cannot access personal files or applications on personal devices.

Universities are bound by laws and policies that protect student privacy. They cannot arbitrarily access or monitor a student's personal device or their personal files and applications. Any form of monitoring or data collection is limited to university-owned devices and networks.

For example, if a student uses their personal laptop to connect to the university's Wi-Fi network, the university may log certain information such as device ID, connection times, and data usage. However, they cannot access the personal files stored on the laptop without a valid reason, such as a court-ordered warrant or a complaint against the student that requires investigation.

In the case of email surveillance, universities can monitor email accounts provided by the institution, such as cloud-based email services. This is possible due to the in-built features of these email products, which allow administrators to access inboxes. However, this access is restricted to the university-provided email account and does not extend to personal email accounts or other applications on personal devices.

To protect their privacy, students should refrain from consolidating multiple email accounts and avoid linking personal social media accounts to their university email. Additionally, using a Virtual Private Network (VPN) can enhance privacy by masking online activities, although some universities may restrict the use of VPNs on their networks.

While universities have legitimate reasons for monitoring student activities, such as ensuring engagement and providing support, it is important to maintain a balance between surveillance and respecting students' personal space.

Surveillance software is used to monitor student attendance, library visits, and engagement with learning analytics tools

With remote learning becoming the norm, universities are increasingly using surveillance software to monitor student attendance, library visits, and engagement with learning analytics tools. This software can track a wide range of student activities, including attendance at lectures and seminars, library visits, interactions with virtual learning environments, and engagement with course materials.

For example, the University of the West of England (UWE) uses a system called Solutionpath Stream, which monitors how often students log on to their virtual learning environment, click on any content, hand in work, take out library books, access journals, view reading lists, print or photocopy documents, and use university computers. If a student is deemed to have low engagement, they may be contacted by a student support advisor or receive automated emails.

Other universities employing similar surveillance practices include Nottingham Trent University, the University of Hull, York St John University, and the University of Buckingham, which offers a "trailblazer degree" that uses AI to monitor student engagement and performance.

Proponents of these surveillance practices argue that they can help universities identify students who are struggling and provide them with additional support. However, critics argue that these practices are intrusive and raise concerns about student privacy and data protection. There are also worries that the data collected could be used to make algorithmic conclusions about students that could negatively impact their long-term records.

Universities are vulnerable to phishing attacks, which target staff and students

Universities are vulnerable to phishing attacks, which often target staff and students. Phishing attacks are a growing concern for educational institutions, and universities must take steps to protect themselves and their users.

A report by security firm Barracuda Networks details how schools, colleges, and universities are being targeted by phishing emails, with over 1,000 educational institutions affected between June and September 2020. The shift to remote learning and increased reliance on email communication have made the education sector an attractive target for cybercriminals.

Phishing attacks on universities often involve scammers impersonating trusted officials or experts to gain access to sensitive information or trick users into taking action, such as sending money or providing login credentials. These attacks can have severe financial and security implications, as seen in the case of the Manor Independent School District in Texas, which lost $2.3 million due to a phishing scam.

Universities need to prioritize email security and invest in protection against targeted phishing attempts. Implementing security policies, such as the DMARC standard, can help flag, report, and remove outbound phishing emails. Additionally, educational institutions should focus on improving security awareness among staff and students, ensuring they can recognize and report phishing attempts.

It is crucial for universities to address these vulnerabilities and take proactive measures to safeguard their systems and users from the potential consequences of phishing attacks, which can include data breaches, ransomware, and fraud.

Frequently asked questions