School district apps: Concerns about privacy, transparency
Mark Hoffer Star-Telegram/Mark Hoffer
Data about students, parents and education is a hot commodity, raising privacy questions about how much information is too much.
Tens of thousands of Tarrant County parents, students, teachers, and community members use school district mobile phone apps to find out what is happening in their districts and on their campuses.
In the Fort Worth school district, 51,000 people use the district’s mobile app. Arlington’s app has 32,000 users. About 10,000 people are using the app for the Northwest district.
How much data is gleaned from people using the mobile apps? Experts say the information can fall into the hands of data brokers, marketers and others, despite efforts to keep it private. They also say there is a lack of transparency surrounding how the technology works.
“The average consumer would want to understand exactly what a particular company is doing,” said Sophia Cope, a staff attorney with the Electronic Frontier Foundation (EFF), a national nonprofit organization for digital civil liberties. “The expectations are even greater for parents with children in school.”
“It’s a transparency problem,” Cope said. “The companies are not, we believe, being totally upfront in explaining the technology. Districts don’t know what questions to ask before they sign these contracts, and they’re not informing the parents of what they’re doing.”
But school officials said they are confident the app developers they hired are neither gathering nor sharing information from users.
“They don’t have access to the data …,” said Clint Bond, a spokesman for the Fort Worth school district. “Basically, we can push information out, but there’s not a two-way exchange of information.”
School administrators said app developers they contracted with do not have permission to sell any data gleaned from the apps.
Randy Sumrall, executive director of technology for the Birdville district, said the district’s app contractor, Schoolwires, does not have permission to distribute or sell student information.
“If we found out they were doing it, we would stop using them,” Sumrall said.
Permission granted
Phone apps for the Arlington, Fort Worth, Birdville, Northwest and Mansfield school districts — like most apps — require users to submit to a variety of “permissions,” though just exactly what you’re permitting the app to do is unclear.
The permissions vary by district.
Upon downloading Birdville’s app, for example, permissions are requested for the device identity, the calendar, location, photos, media, files and the camera. Fort Worth’s app requests permissions for modifying or reading the contents of the SD (memory) card. Permissions for the Northwest district app include accessing identity, the calendar, phone call logs, and photos, media and files.
Some of the permissions are required for users to access all features of an app. But it’s not clear what else could be done with the permissions.
“Outside of these generic permissions, it’s hard to tell,” said Grayson Milbourne, director of security intelligence at the Colorado headquarters for Webroot, an international Internet security firm. “You’d have to do an analysis of an app at a code level.”
That requires an advanced knowledge of programming language that most people simply do not have, Milbourne said.
Apps that ask for access to areas such as phone storage or photos are concerning, especially if those permissions have nothing to do with the app’s stated purpose, he added.
“If you don’t need it, don’t put it in there,” Milbourne said.
How private are policies?
But even if information is not being accessed and shared now, wording in a privacy policy within Birdville’s app leaves the possibility open.
A Schoolwires privacy policy on the app states: “One instance in which personal information in educational records may be disclosed to third parties under FERPA is if the information is classified as ‘directory’ information by your educational institution.”
A privacy policy within Northwest’s app states: “By entering your username and password to access HAC (Home Access Center) or MSB (MySchoolBucks) you consent to the sharing ofSchool district apps: Concerns about privacy, transparency | The Star-Telegram:
