1

This might sound broad -- but it has to be considering the details are truly unknown.

Context: Our university (and many more) have begun rolling out mandatory webcam recording for certain portions of the course. This has been sprung on us mid course (and we have no exit option; we must either comply with some of these records examinations/assignments or now fail the course.)

We have been presented with no transparency reports, retention times, constitution of who will handle the data except "administration" or details on how the data will be transmitted.

It's seemingly sound the universities want to protect academic integrity -- but I feel like the amount of data with very little policy being distributed is concerning.

Probing, hacking, debugging or touching the software is grounds for academic misconduct, as it would be counted as tampering.

So, at worst: what should us students worry about with our data? It seems obvious the data could leak. How can we keep ourselves safe and our privacy the best we can given the abysmal circumstances?

(It's worth noting but off-topic that many students do not care about this.)

  • I think you should add the country where this is happening (looks like US-style legislation). I'm quite sure doing things that way (all of a sudden, no usage information, no way to oppose, etc) would be illegal on a number of European countries. – Ángel Nov 3 '14 at 21:00
  • Is the hardware provided by your university? Otherwise, how can they ensure that you have the required hardware? What if your system doesn't have a webcam (or it is broken)? Will the university pay a new one for you? It would be easy enough to sabotage (eg. by uninstalling the drivers) an embedded laptop webcam and request the university to buy you a new laptop. Are external webcams allowed? They would be trivial to fool (the laptop is recording the real guy, but it is attached to a different computer, in which the fraudster is doing the test) – Ángel Nov 3 '14 at 21:09
  • This is a Canadian university, for what it's worth. You are obligated to provide the hardware yourself. It is last minute, so you are expected to pay for one that will provide "adequate clarity". There are many ways to "game" this but I'm more interested in the privacy aspects. – Vaughan Hilts Nov 3 '14 at 23:39
1

So I am not exactly I sure I understand the question because you mention this video feed is over unknown applications. So this is what I think is happening and sorry if I get it wrong. The University wants you to video yourself taking tests and working one certain material. This feed should be sent out through a known application, although it may not be known to you, to the University in order to ensure your roommate was not typing in the work.

There are always security concerns, however taking proper precautions should be fine. For instance I have heard of hackers using a web cam to spy on people however in order to do this they need the physical device connected and when I had to do the same as you for online tests I would connect it, all other times I would disconnect it.

It is important to realize however that if someone has control of your web cam there is a good chance they have control of your computer.

As far as sending the video to the University there probably should not be any sensitive information going to the University, well anything anyone but the University would want.

0

It depends of if webcam recording is triggered by you or the University. I guess the computer is owned by you, and its simply that you have to install a mandatory webcam software to do the course.

If you then have to push a button "Start streaming", then its no danger at all. It does not matter if anything is transmitted unsecurely or unencrypted. It does not matter if the server lack any encryption - when talking about YOUR privacy.

The reason is, that if you itself trigger the webcam monitoring, then you ought to not start recording if you doing sensitive things (eg when you are not working on your academic Project), and only start it when you do nonsensitive things (eg just sitting in front of computer and Writing). Then its also your responsibility to make sure theres no sensitive things in background.

I guess its simple as this: if there is a recording, then you pass the test, if theres no recording, you fail the test, even if you have done the test correctly. And all the software does is to ensure you do not stream a prerecorded file or something like that. Thus you are allowed to turn on or turn off the webcam software, but not "tamper" with it.


There is a second possibility, and that is that the webcam software is started by the University, and the University simply start the webcam software when "exam time" starts. Then its a bit worser. If the authentication protocol for the "Start" signal is bad, then a hacker could send a start signal, and force the software to record lets say embarassing things, that would get your teacher to put a failure on you or such things.

However, a authentication protocol simple as the webcam software polling a HTTP server for a start signal would be secure enough, since if a hacker is in a position to be able to modify YOUR network traffic, then you have worser problems (leaked passwords etc) than the hacker has the possibility to start your webcam.


Then we have a third problem, that applies to BOTH if the camera recording is triggered by you, or University. And this is not about privacy, this is more about DDoS/Sabotage. If the stream is not propely authenticated, it can be possible for a sabotager - lets say your classmate does not want you to succeed the test.

If he is able to spoof your identity, he could transmit a recording of his friend sitting in front of a webcam, under your identity, causing you to get accused for cheating even that you did not cheat.

But that does not have any privacy concerns.

  • If the webcam software does connect using plain HTTP and the signal is not otherwise protected (the easiest being using HTTPS), then it would be perfectly possible for an attacker to still trigger the recording in eg. a public/compromised wifi (hopefully, that will only be possible on a semi-public place). – Ángel Nov 3 '14 at 20:57
  • Even if the is fully in charge of when the recording happens (best case), there are still privacy risks, such as what will happen with the videos. I guess they only want them to be seen by the professor and get them deleted after the course finishes, but for all we know, they could intend to include them in an advertisement video. – Ángel Nov 3 '14 at 21:15
  • Yes but public wifi = attacker is in position to modify the signal. However, in that case the attacker could aswell film you with a hidden camcorder since he is in the same location as you. As your second comment, what would be "privacy risk" in someone sitting and typing on a keyboard? Privacy risks is more of if its possible that the student's sex act with his wife could be recorded by a malicious user, or sensitive things in the background, like the wall hangings that he dont want everybody to know about. If the student is in full charge of starting/stopping,then he have full responsibility – sebastian nielsen Nov 3 '14 at 21:45
  • to make sure the scene does not contain something that the student dont want to leak out, Before starting recording, and Before starting to do on the academic work. And about storage length, normally such videos are stored X years after course finish, where X is the number of years somebody could report someone for cheating. After X, then the grades are "written in stone" even if they was gained by cheating. – sebastian nielsen Nov 3 '14 at 21:47
  • Leaving aside the fact that hidden cameras are not common and it may be easier/riskier to spot someone phisically recording you, there is a big difference between being in the same place regarding the wifi place signal and a camera recording: walls. The obvious example being a hotel (or the residential dorms) with a public wifi. – Ángel Nov 3 '14 at 22:02
0

If the university requires you to download software, there could be vulnerabilities or even a slight chance of a trojan horse in that software that could have bad privacy implications. Hopefully the software has been thoroughly reviewed though. This is a risk you take with pretty much any system / software though. If you are concerned about misuse of the camera (e.g. recording when you don't want it to), you could put something over the camera when it is not in use to avoid potential unwanted recording, or turn off / unplug your computer when it is not in use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.