33 ms·

Tell HN: My kid's school installed spyware and I can't remove it

• Glyptodon 5y ago
  Is your son's Google account a school account rather than a personal one?
• djantje 5y ago
  If the school wants monitoring spyware, they should provide that, for example a computer to take tests or exams. Not taking over and control your own equipment. Talk to a lawyer and see if you can file a (digital ownership) theft report to the police.
  • op00to 5y ago
    I’m sure the Chicago PD will jump right on your “digital ownership” theft. They have the boys in the crime lab working shifts!
• imduffy15 5y ago
  My bet is you could remove the user. Do some DNS messing about either on your router or hosts file to drop all communications to goguardian and then resign into your sons account. The end result will be that the school management scripts will still run but they’ll be unable to fetch and install goguardian.
• IYasha 5y ago
  Holy shivers... That is something of a 1984-esque level! I can't give any recommendations, but, at least, I thank you for reminding us to NOT to buy things we won't (be able to) own!
• AnimalMuppet 5y ago
  You're not going to get prosecution. You might get somewhere with a civil suit, though. (For that, talk to an actual lawyer, not random commenters on HN.) You also might get somewhere talking to the press. Be careful on this route, though, because it might get you sued by the school district...
• car_analogy 5y ago
  > I bought him a Chromebook for schoolwork, but also for other private things. When we logged in, the system installed GoGuardian monitoring software on the Chromebook without notice or permission. Can you give more details? Logged in to what? I don't know how Chromebooks work, but I take your description to mean logged into a webpage, which allowed it to install arbitrary software on your computer - this sounds like a vulnerability in Chromebooks. Edit: On rereading the post, I suppose you mean logged in to Google Classroom.
  • ev1 5y ago
    This is similar to MDM. Sign in to a school .edu Google account that force auto provisions the device.
  • i_am_jl 5y ago
    >Edit: On rereading the post, I suppose you mean logged in to Google Classroom. Oh, if only. They mean logged into ChromeOS with a Google account. There is an option to log in as a Guest, but the machine is so unbelievably gimped in Guest mode I can't imagine anyone actually using it like that permanently.
    • toast0 5y ago
      > There is an option to log in as a Guest, but the machine is so unbelievably gimped in Guest mode I can't imagine anyone actually using it like that permanently. My mother in law was using her Chromebook in guest mode for a while [1], and the only things that didn't work were saving passwords (including wifi passwords, but her home wifi is open). But she only use Chrome OS to use Chrome. I'd guess the play store doesn't work in guest mode, and wifi passwords might get annoying, but what else is missing? [1] trouble with passwords, with a side of chrome os owner account was @ymail.com, but also an alias for @gmail.com and chrome os/google changed at some point so that logging in with either would login as the @gmail that wasn't the device owner... but fixing that didn't fix the underlying problem that someone likes to change her password rather than find her password book, and then her password book is out of date.
• jeffal 5y ago
  Good lord, just call the CPS IT helpdesk. Problem solved.
  • ccleve 5y ago
    Didn't know they existed. Just called them. They said "no, it cannot be removed". They suggested signing in with a different account, but when I do that, I get the error message "This account is not allowed to sign in within this network."
    • hunter2_ 5y ago
      Do you get that error if you try using a different account (non-MDM, for example a personal Gmail account) after a factory reset, never using* the MDM account post-reset? * Feel free to use it in a third party browser such as Firefox or Brave, as another commenter suggested. Just don't use it for an OS login.
    • fswd 5y ago
      Ask them for an administrative hearing. 99% chance they won't and will just remove it.
    • plussed_reader 5y ago
      From your description it sounds like when your child signed in with the student account, one of the Ok's they hit for GoGuardian put your device on the schools managed account(cps.edu). If you're powerwashing and it's automatically pulling cps.edu managed policies as soon as it gets online then the school district IT needs to release your device, and then powerwash it and setup again without the cps.edu policies. Be aware if you want your child to do any official testing or use their student accounts on your personal device the district may require this arrangement.
      • iso1631 5y ago
        Sorry, are you saying it's impossible to completely wipe/factory-reset a chromebook that's been adopted by an MDM?
• wmf 5y ago
  What happens if you have two accounts on the Chromebook? Ultimately spyware has to be unremovable to do its job so you're not going to get anywhere by contacting anyone. You have to decide to use the account or not.
• dddnzzz334 5y ago
  Easy, wipe the system and install Linux on it.
  • wanderer_ 5y ago
    Another little push in the right direction: you'll have to go into developer mode to expose the shell and flip the write-protect bit.
    • jiffygist 5y ago
      Could it possibly be impossible to enter developer mode? If so, could it be possible to somehow flip the write protect bit "by hand"?
      • sp332 5y ago
        Some Chromebooks do have a physical switch, like in the battery compartment. I don't know of any Chromebooks where it's actually impossible to enter developer mode.
      • livueta 5y ago
        Every Chromebook model I've ever had has had a physical switch or screw that can be removed/toggled somewhere on the motherboard to unset the write-protect bit. e.g. https://joshuawoehlke.com/wp-content/uploads/2018/07/dell-3120-wp-screw.png https://joshuawoehlke.com/wp-content/uploads/2018/07/dell-31...
        • wanderer_ 5y ago
          Oops, I had forgotten about that. I was doing a bit of ...research a while back to apply to my own school machine.
  • throwawybllion 5y ago
    Probably need to log into the school account on chromeos So run another chromeos in a VM and just shut it down to switch to personal
• throwaway413 5y ago
  Nothing gets “installed” in the traditional sense on a chromebook. When you login to the chromebook, you can log in with any Google credentials. The credentials the school gave your son are managed by them. If you log into that account, it configured the user session per the management of the account, so this will start a “managed” session for that managed user. If you use a personal Google account, none of that should happen. It’s not a managed account, it’s a normal one, and there shouldnt be any additional provisioning. You should be able to switch between them and use both independently. However, if you are saying that is what you are doing, and the spyware isn’t respecting the config between users, then that is definitely a problem.
  • secabeen 5y ago
    This. My kids have chromebooks, and they have two accounts active on their devices, on at their .k12 for school stuff, and one for their gmail that is open.
    • autoexec 5y ago
      Do you actually trust google not to be collecting data on both accounts and link them together somewhere? When I was in school we used to get told that bad behavior would end up in our "permanent record" which would follow us for life, but while that was a lie we all have a permanent record now and nearly every action no matter how mundane or benign gets saved to it. When I got my cell phone the default keyboard was sending everything I typed to a 3rd party whose privacy policy stated they were collecting data for everything from market research to trying to understand my intelligence/cognitive abilities. I replaced the default keyboard. I can't imagine the wealth of data Google could be collecting form children, their test scores and their associations with other children. They may claim not to collect and store data on your kids, but there are no regulations and nobody is checking. Only a whistleblower could tell you what Google is actually doing. I haven't seen much reason to trust them.
      • drivebycomment 5y ago
        > I can't imagine the wealth of data Google could be collecting form children, their test scores and their associations with other children. This is...funny, given that apparently the OP's child's school is using Google Classroom - which means Google is the provider and the system for storing/giving/recording/managing test scores, so of course they store test scores since they are paid to provide that. Likewise, on Google Classroom, kids can interact with each other and of course Google stores those.
• dervjd 5y ago
  Why did you buy him the Chromebook versus the district?
  • throwawayboise 5y ago
    Yes. The district should supply the Chromebook for school work. They will manage that as they see fit. If he wants to do other stuff with a Chromebook, he should have a separate Chromebook and separate Google account. Ultimately that's easier and safer than constantly logging in and out of two different accounts on one machine anyway.
    • don-code 5y ago
      I am not a parent, but this seems like a good practice to get a child in the habit of, anyway: separating out your devices for work and school. Much like I wouldn't log into personal Slack groups on my work laptop (I learned that lesson!), I wouldn't try to conduct personal work on a school laptop.
    • twright0 5y ago
      > The district should supply the Chromebook for school work. They will manage that as they see fit. I haven't been a student for a while, but the closest analogous technology they had when I was in high school was my graphing calculator for math classes. The school district mandated individual students each obtain a specific graphing calculator, which was a fully programmable computing environment (the TI-83). But the teachers/administration could and would wield a lot of power over those devices (which the the families owned in the legal sense) - looking through it, requiring students to wipe its storage with no warning, etc. Requiring families to buy a Chromebook and still use a school-managed account with invasive management on it feels largely analogous. Buying a separate personal laptop is the correct workaround, but unfortunately I don't think the "the school should supply the schoolwork computer" line of reasoning holds up. The hardware/software has become more powerful in the graduation from TI-83 to Chromebook but the principles are the same.
  • deleted 5y ago
    [deleted]
• icsa 5y ago
  You use ask for a reasonable accommodation. E.G. Access to assignments via email. The Department of Education mandates such accommodations.
• lappa 5y ago
  You might consider small claims court for the value of the laptop. Whether you would win depends on the context which you've mostly left out.
• donohoe 5y ago
  Have you tried to see if the Small Claims Court would work? https://ag.state.il.us/consumers/smlclaims.html https://ag.state.il.us/consumers/smlclaims.html Get the cost of the Chromebook, some money for your time, and then donate the Chromebook to the school since its deadweight at this point. My guess is that no one from Dept. of ed will show up and you'll get a summary judgment.
  • MrWiffles 5y ago
    Good idea; IMO, probably the only way the OP is likely to get any "justice" (if you can call it that) here...
  • mhb 5y ago
    Unless someone from HN is mediating, it seems pretty unlikely that there will be an award for the value of the computer in small claims court.
  • steffanA 5y ago
    The Chromebook isn't ruined. Just do a factory reset and do not log into the school account. I know it doesn't help the op's kids who needs the CB for school, but there is nothing being done that a factory reset can't fix.
  • iso1631 5y ago
    Looks like you read it the way I did originally -- that even a factory reset still leaves the GoGuardian software on the machine. From the gist of comments of people more familiar with chromebooks than me, it actually looks like the factory reset does completely wipe the machine (as you'd expect from "factory reset") and there's no software installed that survives this process (other than the default chromebook stuff)
• turtlebits 5y ago
  Powerwash/factory reset it and don’t sign into the school account. Ask for the school to provide a device.
  • tragictrash 5y ago
    I think it's now a managed device and that won't help. If he power washes it, I believe it's still locked down to the school, I could be wrong thought.
    • fn-mote 5y ago
      There's a separate provisioning process for the "very locked" state you're talking about, not just signing in on the device.
      • tragictrash 5y ago
        Ah neat, thanks!
    • steffanA 5y ago
      Factory reset and not logging into the account again, should fix the issue.
  • colinmhayes 5y ago
    Yea I graduated from Chicago Public Schools and they gave out chromebooks starting in 8th grade. I think that was the first generation of them so maybe CPS get some deal, but through high school the chromebook system only seemed to expand. I imagine it's possible for OP to get one from school.
• summm 5y ago
  Why did you buy a device that's patronizing you in the first place? You bought a device that is even advertised as not being fully under your control, then it turns out it's actually not under your control. Meh. Put Linux on it and next time buy an normal PC.
  • vinceguidry 5y ago
    You are completely failing to grasp the level of tyranny here. Schools these days often will not accept non-Chromebook devices.
    • dhzhzjsbevs 5y ago
      Probably shouldn't go round accusing Linux users of "failing to grasp the level of tyranny" when it comes to people forcing the use of Apple, Google or Microsoft operating systems.
    • savant_penguin 5y ago
      I'm curious on how they enforce that
      • kube-system 5y ago
        Presumably, the same way they enforce any other supply requirements.
      • wildzzz 5y ago
        Simply by using some application for things like online test taking that only works on ChromeOS. If you can't afford to buy a Chromebook, you may be eligible to receive one free from the school. Even in college, we had a freshman year computer requirement where we had to have a Tablet PC. Freshman engineering classes all used a Windows-only handwriting application for class participation. The Tablet PCs they sold at the time were expensive and crappy. Luckily the application worked in Wine somehow and you could get by using a cheap Wacom tablet so that's what I did. I sold the Wacom to another freshman so they could do the same. Eventually I bought a used Thinkpad tablet PC because I actually liked handwriting my notes and homework but I hated the fact I was almost forced to.
• js2 5y ago
  It seems like you should be able to sign out of the CPS managed account, then use "Add Person" to add a non-CPS managed account: https://docs.google.com/document/d/1r7xOL4U9lL0qyqMIVl4eH2EMPNWCTyuRILlEC3IcRXs/preview https://docs.google.com/document/d/1r7xOL4U9lL0qyqMIVl4eH2EM... https://support.google.com/chromebook/answer/1059242?hl=en&ref_topic=3406211 https://support.google.com/chromebook/answer/1059242?hl=en&r... For school work, login to the CPS-managed account. Otherwise login to the personal account.
  • deleted 5y ago
    [deleted]
  • mperham 5y ago
    I believe the OP is concerned the Chromebook is rooted by the spy software and therefore using another account doesn’t solve that issue.
    • js2 5y ago
      Since this Chromebook is BYOD, I think OP is likely in scenario 2 described here: https://news.ycombinator.com/item?id=30912995 https://news.ycombinator.com/item?id=30912995
    • deleted 5y ago
      [deleted]
    • MatthiasPortzel 5y ago
      > I did a full factory reset, signed in to his account again I read this to mean that the software uninstalled after a factory reset, but signing back into the managed account re-installed it. I'm taking OP with a grain of salt here, but I think it's likely that OP doesn't understand their son's brand new Chromebook and that there's a technical solution that doesn't involve suing anyone.
  • MatthiasPortzel 5y ago
    This is the perfectly reasonable solution. But OP wants the operating system to be signed into an account managed by the organization without the organization having permission over anything, and since that's not the way ChromeOS works, they're going to sue the school board. Honestly, I'm disappointed in the HN that they're taking OP at their word and giving legal advice.
• anamax 5y ago
  If it's not too late, return it to where you got it. Then tell the school district that they have to pay for computers that they control. > Does anyone know how to refer these people to law enforcement for prosecution? You call the police. However, don't expect them to do anything and you won't be disappointed when they don't. You can then call the city/county DA and get the same treatment. The state's attorney will do the same thing.
  • willcipriano 5y ago
    > Then tell the school district that they have to pay for computers that they control. 100% on board with this. I would refuse to pay for a machine that is going to spy on my kid. I'd probably buy a chrome book, install Linux and then they can access the google suite via a browser.
  • emerged 5y ago
    ..and if those offices doing nothing to help you isn’t enough, there are plenty of other government agencies/services which will also do nothing for you you can also try contacting Google, who will bend over backwards to make sure not to do anything for you.
• splch 5y ago
  You could always install a different OS on your son's Chromebook since it would still have access to all of the school's software (through Chrome) and more. I'd recommend GalliumOS (https://galliumos.org/ https://galliumos.org/) since the drivers support audio and keyboard shortcuts better.
  • jmt_ 5y ago
    Ran GalliumOS all throughout college without any issue. A Toshiba i3 Chromebook + Gallium was easily one of the best laptops I ever had. OP - seriously consider this solution if it wouldn't agitate the school too much. Swap out the usually small (16GB or so) SSD that tends to come with Chromebooks, install Gallium, and you're off to the races. Might still be some weird compatibility issues/edge cases that are hard to predict; maybe run Gallium in a VM, log into your sons Google Classroom, and do some testing first.
• awinter-py 5y ago
  related support ticket from someone trying to log into device w/ work account without inheriting workplace MDM policy https://support.google.com/chromebook/thread/117916330/how-to-prevent-work-account-from-becoming-adminstator-or-owner-of-chromebook https://support.google.com/chromebook/thread/117916330/how-t... > Even if the Chromebook is your private device and your owner account is your private @gmail.com account, once you sign in with a managed account, even using a separate profile, the managed account polices become active. > This is NOT a bug. It's required to maintain security of the managed environment. Whenever the managed account is active, ChromeOS management and the policies set by your administrators pwn the entire machine. > Google promises bulletproof security to customers who license Chrome OS management, and having any instance of an active non-managed account available when a managed account and its resources are active is a potential security hole. not a chrome-os user -- I imagine you can access the G acct via a browser without signing in the whole OS? if 'signing into gmail signs in the OS', maybe can do it via crostini linux re law: illinois is the state that has the biometric privacy law iirc? you may be able to do a civil suit via that, if the device is sharing face images and you really didn't consent and you can prove it and the law was written with your situation and mind and CPS hasn't indemnified big G. my guess is you'd have to pay a few $k to a lawyer to evaluate the case and then many more $k on the suit, plus you probably have a TOS problem.
  • fn-mote 5y ago
    The ending of that post (trimmed above) is also important: > So you can boot into your personal account and do your personal business and then reboot into your business acount and do your business' business, but never the twain shall meet.
    • xg15 5y ago
      Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?
      • 5y ago
• yeetsfromhellL2 5y ago
  As a longtime armchair attorney who has closely read summaries of cases like this on Slashdot for well over the past decade (IANAL, BTW)...you could go the lawyer route but this basically amounts to your kid being a minor in school which means they don't have full legal rights, and the interpretation of 4A is likely up in the air here anyway. Constitutional rights don't necessarily apply at school or anywhere near school (see bongrips4jesus case), your kid is a minor anyway (another special case), and a school doing this for the sake of "preventing cheating" may not fall under the umbrella of unreasonable search. There was a PA school district back around 2009 that issued laptops to students preloaded with spyware that let school staff watch students through the webcam, while the students were at home and not doing schoolwork. Neither the students or parents were informed of this. IIRC the FBI got involved but nobody actually got in any real trouble, I'm not even sure they were fired. I wish things weren't this way. You could maybe use Wireshark and black hole anything the spyware tries to connect to at the router, or maybe add the addresses to the hosts file on the machine itself (not sure if ChromeOS lets you do this).
  • kaladin-jasnah 5y ago
    Nit: I think it's "Bong Hits 4 Jesus."
    • yeetsfromhellL2 5y ago
      Thank you, this one still makes me lose my damn mind.
  • salawat 5y ago
    Actually.... It's the poster's Chromebook. They has revoked authorization for the school to deploy $software on their machine. Next step is the public school supplying a spyware'd laptop and NOT imstalling spyware on said parent's chromebook, but also said private chromebook not being used for school stuff. If you want the district to not install spyware... Well... Lets just say, the poster is probably pissing in the wind in my experience.
  • filesystem 5y ago
• wanderer_ 5y ago
  I would do the factory reset again and then not use that account anymore. If you want, you can create a new local-only account and then (this is the important part) sign in to the school Google Classroom on another browser. Install Firefox, Brave, something, and use it for the school account rather than Chrome. Chrome allows extensions installed to it to run in the background and manage the system, but another browser cannot.
  • ananonymoususer 5y ago
    Good suggestion. If the school is requiring your child to have the chromebook, then they should pay for the thing. They don't have the right to infect any device that your child happens to log in with. So factory reset, don't log in. Then when the school complains that the child is not completing the assignments, tell them that he/she cannot do them unless the school issues a school-owned device. A better move would be to get your child out of Chicago public schools altogether.
    • selectodude 5y ago
      CPS does pay for the thing. OP wanted their child to use a fancier device and they're mad that it falls under CPS' MDM policy. Go get a free device from CPS, take good care of it, and return it once the child graduates. https://www.cps.edu/school-reopening/remote-learning/technology-devices/ https://www.cps.edu/school-reopening/remote-learning/technol... >A better move would be to get your child out of Chicago public schools altogether. I went to a Chicago Public School and I resent that comment greatly.
  • josephcsible 5y ago
    > create a new local-only account I thought you couldn't do that on a Chromebook.
    • trevcanhuman 5y ago
      i don't think you can. I had one of these chromebooks too, which I paid for. But my school did not want to remove the 'school policy' so now it's locked and even other accounts are 'watched' and managed by the school's policy. Last time I tried to create an account it wouldn't let you create it unless you provided an email.
• dragonwriter 5y ago
  > Does anyone know how to refer these people to law enforcement for prosecution? You can simply look up the phone number for any law enforcement agency you want and call them. None of them are likely to do anything, however; even if there was a crime involved, they have no obligation to pursue anything, and it's almost certainly not something that is on anyone 8nnlaw enforcement’s list of priorities. What you probably want to do is contact a lawyer and see if you have any civil law remedies. Even if they are things you will eventually pursue in small claims court, you absolutely can get advice from a lawyer on causes of action and what you need to do, but in general forcing a behavioral change—equitable remedies—are not available in small claims (which mostly just allows limited monetary recovery) and you'd need a lawsuit in a “full“ trial court to force that (or, of course, a settlement agreement.)
  • steffanA 5y ago
    Prosecute for what, though? It's very common for school accounts to take over a chromebook until you remove their profile/perform factory reset. This sounds more like a Google issue for allowing this behavior in the first place.
    • dragonwriter 5y ago
      > Prosecute for what, though? Both what and who are good questions, which is why I say: “What you probably want to do is contact a lawyer and see if you have any civil law remedies.” It's plausible that something in the combination of Google and school district practices violates some law of some applicable jurisdiction, but it's not obvious to me what law would be impacted.
    • nicce 5y ago
      It is not actually specific behavior to Google (while Android in general has the same property). History has seen many cases, even my old Nokia Lumia phone many years ago has similar properties when I logged in the organisational email and that granted them remote wipe and access rights. Also iPhones have ”organizational control”, which can be set by certain configuration profiles, to track users. Companies have had demand for these kind features and now they are there.
• sumthinprofound 5y ago
  What paperwork did you sign, and what did you agree to wrt computer policies? I'd start there.
• deleted 5y ago
  [deleted]
• duxup 5y ago
  > I did a full factory reset, signed in to his account again, and now the system is once again locked down. That’s by design though isn’t it? You logged in with a managed account and the policy was applied again? The account is his school account right? That’s pretty much how Chrome OS works. This might just be a good lesson that you want to maintain device / role boundaries.
  • trasz 5y ago
    A gaping security hole is fine if it’s been introduced on purpose?
    • duxup 5y ago
      > A gaping security hole What is that?
      • trasz 5y ago
        “the system installed GoGuardian monitoring software on the Chromebook without notice or permission.”
        • micromacrofoot 5y ago
          It's tied directly to the remotely managed account, that's how the account works. If you don't sign into the account, the software won't be installed. Students don't get to decide what software to install when it comes to logging in to school accounts. Generally the laptops are provided by the district, but it seems OP was trying to add another personal device to their system. You can't participate in their system without the software. So I guess the alternative would be to block personal devices from logging in like this at all.
        • duxup 5y ago
          When I logged in with my son’s school account on chrome OS it had some notifications about who owns the account and so on. I don’t think it is as much a mystery as implied. In the end there’s no getting around that mixing device uses like this doesn’t work. It works less and less as the history of computers goes on.
• deleted 5y ago
  [deleted]
• b20000 5y ago
  wipe the chromebook and return it and get him a normal laptop and put linux on it
  • monkeybutton 5y ago
    This is the correct answer.
• MrWiffles 5y ago
  I haven't used a Chromebook before because I've always suspected this kind of malfeasance is inevitable, but I wonder... Could you just rip out the disk device (nvme/etc) and shove a blank one in there? As long as you never used the backdoored Google account again, at least you could re-use the device for other purposes (albeit with a different OS most likely). Not optimal I agree, but could that be a viable option? Also, is it possible to virtualize Chrome OS, feasibly? Might be an option for anyone with the skills to firewall/isolate that malware when usage is compulsory.
  • barbacoa 5y ago
    >Could you just rip out the disk device (nvme/etc) and shove a blank one in there? When I last owned a Chromebook the storage was soldered on the motherboard.
  • wildzzz 5y ago
    Its been a few years since Chromebooks have had swappable disks. There used to be some high priced models that supported user upgrades but then the OEMs figured out that no one wants to spend a fortune on a Chromebook so everything is soldered in now. Since what is being installed isn't actually malware but just some enterprise spyware, the easiest solution is to just wipe it, log in as a user unassociated with the school, and then add the school account. The spyware won't be running on the unassociated account. Kids have always had their 4th amendment rights encroached upon in schools and clearly this school district is extending that to their devices in this manner, for better or for worse.
    • Dylan16807 5y ago
      > There used to be some high priced models that supported user upgrades but then the OEMs figured out that no one wants to spend a fortune on a Chromebook so everything is soldered in now. It can't be that simple because I had a pretty cheap model a few years ago that had a replaceable sata m.2 drive.
      • toast0 5y ago
• awinter-py 5y ago
  woof also goguardian has a prediction model for the 'active planning' phase of suicide which monitors all text + web activity https://www.goguardian.com/admin https://www.goguardian.com/admin good in theory I guess, but 1) is it EBM and 2) not sure this plays well post CTL / loris snafu their privacy policy is nonsense https://www.goguardian.com/privacy-information https://www.goguardian.com/privacy-information, they don't sell 'private student information' but this is shrunk to be just PII. no details about non-PII categories of data
• steffanA 5y ago
  If you login with a different profile, is the GoGuardian software still running? Or is it only running on the managed school account?
• CodeWriter23 5y ago
  Organize other pissed-off parents and persist at school board meetings until they change the policy. You’ll likely be labeled as terrorists for seeking redress with your public officials but stand strong, read up on laws and the board’s bylaws. Let them enter a trap (like ignoring you) where the law/bylaws say you can petition for removal of board member(s) on that cause. You’ll likely have to take it to court. But parents are prevailing and board members are being removed, for example in Pennsylvania over schools imposing their own mask mandates that do not align with public health.
  • duxup 5y ago
    Considering the range of protections a school is required to provide and that school IT is usually poorly staffed, paid, funded awkwardly… tons of different motivations for various policies. I wouldn’t expect these policies to change. Best bet is to not mix school administrated accounts with personal devices.
    • mbubb 5y ago
      “this is my rifle/ this is my gun/ this one’s for fighting/ this one’s for fun”
    • spacemanmatt 5y ago
      > Best bet is to not mix school administrated accounts with personal devices. I feel like this is the obvious solution which is not fair or practicable to everyone, and so this whole post is about solutions that don't involve ceding an entire device to spyware distributors.
      • duxup 5y ago
        > so this whole post is about solutions that don't involve ceding an entire device to spyware distributors I wonder if the school already provided a device. My son’s school does.
• mfreydavis 5y ago
  I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things. 1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices. 2) You're logging in with their CPS account. Once a person logs in with their managed account it can deploy user level policies that include everything you described: extensions, filtering, and blocking signing into another account in the browser. You'll also find some random pages are blocked to keep students from bypassing the restrictions. That you can wipe the machine makes me think you didn't enroll it - if you wipe an enrolled device it will prompt/force you to re-enroll. You should be able to reboot the device so you land at the login screen and hit "Add Person" down at the bottom. From there sign in with a different Google account and it should be completely unaffected by any policy the school is deploying. Unless you enroll it, the policies are deployed to the Google account, not the device. Its likely the CPS Help Desk Staffer you reached doesn't have the power to fix things for you if you've enrolled things - that usually requires permissions that are restricted to a few admins. Feel free to shoot me a message via the email in my profile - I'm happy to give you some of the inside perspective and help you figure it out.
  • londons_explore 5y ago
    So, it sounds like the best advice to OP is to create another 'home' account for their son, on the same device, which won't be monitored or affected by anything the school does. The son can decide which account to log into based on what they plan to do that day.
    • alar44 5y ago
      No, at this point they probably can't. It's locked down the way it is to specifically prevent that sort of thing. It should be removed from enrollment, the IT dept doesn't want that on there any more than OP does.
    • toast0 5y ago
      Probably better to login (or not) to the chrome OS device as a personal account, and then login in the browser (private mode perhaps?) to the school account to do the classroom stuff. I don't think logging in to the school account in Chrome the browser will trigger the same behavior as logging in to the school account in Chrome the OS. You may need/want to powerwash the device again.
• andrewmutz 5y ago
  I think if you log in with any other google account, you won't have the GoGuardian stuff running. So I would recommend setting up a personal account for your child and telling them to log in to that whenever they want to work on something unrelated to school (or just want privacy)
• evilotto 5y ago
• JonChesterfield 5y ago
  It is early to learn to separate work (school in this case) from home by using separate hardware but it's a good lesson to learn. Get a second laptop, school spyware nonsense goes on one, non-school stuff on the other. It's annoying and generally a waste of resources so feel free to argue with the school at the same time. Corporate IT won't remove spyware from my work computer, school sounds likely to be similar.
  • jay_kyburz 5y ago
    Upvote. My kids use Chromebooks as well, and we were asked to buy them ourselves, but I always assumed they would be heavily locked down and monitored. We bought very cheap ones and they are only used for school work at school. They take forever to boot up and load google docs, but once there they are fine. The kids know the teachers can see and read everything and anything that happens on that machine. I kind of assumed they would be dropped or beaten up, and was expecting to buy a new one every tear, but the eldest is still in perfect condition after 2 years. Quite proud that they are looking after them.
• jancsika 5y ago
  Possibly related-- does the Church of Satan hold an official position on vendor lock-in? :)
• faangiq 5y ago
  Sorry bub, but this is America. We don’t have rights and other commie nonsense like that.
• voidfunc 5y ago
  You are going to spend a lot of time and money to address this. Better solution is to buy a second Chromebook only for school or personal use snd explain to your kid that their government hates them.
  • sreevisakh 5y ago
    Better yet, ask the school to provide a Chromebook if they want to spy on and control it. The owner should have the ultimate authority on what the device does - so the school should spend money for the power they demand.
    • voidfunc 5y ago
      My solution is a pragmatic one, yours is a dead-end most likely, the point was to paper over the issue and move on unless OP wants to spend a lot of time and money on lawyers fighting it.
  • natch 5y ago
    Or buy a real laptop.
• deleted 5y ago
  [deleted]
• vorpalhex 5y ago
  Did you ever consent to the GoGuardian monitoring of your student? I'd probably wireshark it and see if it's sending out data - especially on other users than your kid. That moves this from "The school installed invasive but allowable anti-cheating software" to "The school is monitoring my family without consent" which is a more interesting avenue.
  • op00to 5y ago
    100% guaranteed the parent signed something before the kid could do anything with a school Google account.
• Ansil849 5y ago
  > I did a full factory reset, signed in to his account again, and now the system is once again locked down. > So now I'm in the position where I have to ask permission from a local government entity to please let me install stuff and don't monitor the computer I bought and paid for. I don't understand, this sounds like an issue with the account, not with the Chromebook. Does this spyware persist on this device even if you sign into a different account? If you look at third-party apps in the account settings, can you delete this one?
  • sreevisakh 5y ago
    > I don't understand, this sounds like an issue with the account, not with the Chromebook. While it does sound like an issue with the account, the unusual part is that Chromebook hands over the control of a device you own to someone else, just because you logged in to some account. Call me old fashioned, but an OS or device that does this is a vulgar anti-consumer design. I get it that consumers should accept it as a feature of the product. But this was an unacceptable proposition a decade ago. There is a gradual erosion of consumer rights and we aren't fighting back enough. Another factor is that even tech savvy users are caught by surprise. This means that this drawback is not sufficiently highlighted in the product description. The platform may not have become this popular if it was.
    • platinum1 5y ago
      The "control of the device" hasn't been handed over to anyone. If you log into another account, or go into guest mode, GoGuardian will not be present. In fact, you couldn't find out if GoGuardian was installed on another account you aren't logged into, because every account has all user data encrypted. The school won't be able to see anything about non cps.edu accounts - they don't know if they exist, what the email addresses were, etc. There is no concept of installing or running programs outside of a login on ChromeOS. There is also only one form of device ownership, and that is device enrollment (which is not what is being described by OP), and the set of policies that are applied to enrolled device. Logging into an account cannot apply device policies. cps.edu is who's enforcing that while you use a cps.edu account, you have to use their software (only while logged into that account or browser). BYOD devices are still yours and you can remove the account with a press of a button.
• jwalton 5y ago
  If you want to be even more upset, if you log into Chrome with this account on a “real” computer, I bet it will download and install a bunch of Chrome extensions without asking, too. It certainly did on my daughter’s PC when we were using it during the pandemic.
  • freetime2 5y ago
    Wow that's annoying. Especially the "without asking" part!
• uncomputation 5y ago
  Not entirely familiar with Chrome OS but if you log out of the school account and into a personal one instead, does this monitoring persist? Regardless, this is pretty much the perfect example that RMS was extremely prescient about free software and the distinction between freedom and free beer (or a Google account in this case).
• quadrifoliate 5y ago
  > I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution here is not technological at all. Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Emphasize stories of previous data breaches involving educational companies [1], and show officials that they are putting students' sensitive data at risk. (Edit: See the important point in the reply from 'n8cpdx below about the correct tone to use in your comments – don't repeat my words verbatim!) The technical details don't matter too much to educational officials – as soon as the "Chromebook = bad spyware" label sticks and they think that a fuck-up here could cost them them bad press, they will allow their IT department to make more privacy-respecting technology choices even when those choices cost a little more. If no one speaks up, it's a race to the bottom driving us closer to the fiction in The Right to Read [2]. ---------------------------------------- [1] https://techcrunch.com/2021/11/22/smarterselect-exposed-millions-student-data/ https://techcrunch.com/2021/11/22/smarterselect-exposed-mill... [2] https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
  • girvo 5y ago
    Sadly, my cousins' school forces them to have Chromebooks. Its required. So I ensured they know to never use it for their personal stuff, it's purely a school work device. Such a waste, but oh well. I gave them both Pi 400s for them to use for personal things instead
  • ocdtrekkie 5y ago
    It's also worth noting that Google is almost undoubtably violating childrens privacy laws, and other states are already investigating this... it's very possible what CPS is doing here isn't even legal. There's a lot of reason that the agreements schools are making to bring Google's platform in should be dragged out into the light. Source: https://www.theverge.com/2020/2/20/21145698/google-student-privacy-lawsuit-education-schools-chromebooks-new-mexico-balderas https://www.theverge.com/2020/2/20/21145698/google-student-p...
• imchillyb 5y ago
  If the software were removable at all then students, who are more technologically literate than their parents would simply remove the spy software. Student removal would defeat the purpose of the spy software.
• 0000011111 5y ago
  OP you got to realize that what ever device you child logs into with his school issued google account will log all sorts of fun stuff.
• michaelmrose 5y ago
  You should strongly consider a freedom of information request on what personal data they school has collected on your kid.
  • dragonwriter 5y ago
    Digital sunshine laws (FOIA and state and local equivalents) generally exclude personal data other than certain information about public employees, and definitely records covered under specific privacy regulation like FERPA. You would need to request those records under different laws relating to parent access to private records of students (in this case, the parental right to inspect under FERPA, probably), not sunshine laws. Quite possible there are whole different request channels for private vs. public records.
  • deleted 5y ago
    [deleted]
• modeless 5y ago
  To be clear, you can and did remove it. The factory reset worked. You just can't login to the school account using the built-in Chrome browser. But I bet you could by installing a different browser using the Play Store or Crostini/Linux, just like you would on a PC. So try that before suing people.
• heavyset_go 5y ago
  Take them to smalls claims court for hacking your computer and making it useless. Just the threat of getting lawyers involved will make the school and district blink.
• cmiles74 5y ago
  If it was me, I'd write the Chromebook off as now being solely for school use. Your child needs to log into it with their school account in order to participate and complete their schoolwork, I don't see any way around this. As soon as the school account logs in, I believe the machine is then enrolled as a managed device of your school district. Maybe you could get the school to supply you with a Chromebook, if you really want one. Where I live this is how it works (the school supplies the Chromebook).
• fredgrott 5y ago
  My I suggest a nice one page letter from your attorney to the School Attorney and cc the School board and local police department. It runs a foul of 1990s computer law, at least in the USA as the firm producing the software did not have your permission to break computer security safeguards and access guards. Oh and make sure to save a copy of the local newspapers. Then submit story to channel & i-team at: https://abc7chicago.com/contact-i-team-submit-story-investigate/1519522/ https://abc7chicago.com/contact-i-team-submit-story-investig...
• huffmsa 5y ago
  Is your child logged in with a CPS managed email address?
• deleted 5y ago
  [deleted]
• evilDagmar 5y ago
  The real question isn't whether or not GoGuardian is installed--because the Chromebook is going to be subject to the school's policies while the student is logged in, assumedly doing classwork. The real question is whether or not it's being disclosed to you when you initially login to the school's domain that this software is being installed. Installing something you were given a chance to read the EULA and disclosures for is fairly reasonable, because you would have the opportunity to decline (and then they probably wouldn't be able to login to the schools network). The school using MDM to install the monitoring software _without disclosing this to the user_ would likely fall afoul of the law, because yeah if you paid for it you are the owner and what you say goes. Third parties are not allowed to install software on equipment you own without explicit permission. Additionally, to be even remotely ethical, this needs to be disclosed clearly and the first time the school login is used and the software installation is about to occur--not buried inside a school handbook somewhere. If the school has been so bold as to ignore the need to disclose that they're installing something that records and reports all web browsing activity (which GoGuardian is designed to do), or if this software applies to other logins on the system which will be used by people who did not consent to being monitored, then the school needs to start hiring _competent_ people to administrate the network, because doing this with minors involved is just really begging for a judge to slap the school system hard. The school system can (and should) make that policy only apply when the kid's school login is being used--so if they try to fob you off with that silly excuse, feel free to go ahead and start talking to lawyers. Google would not be amused to find some rinkydinky school administrators making claims that the attested environment used by ChromeOS may be trivially compromised by other users and thus justify installing the monitoring software to be in play all the time. Rather a lot of work has gone into creating that environment.
  • Jon_Lowtek 5y ago
    Here in Europa we have a requirement for companies and institutions to provide what is called a "privacy policy" which explain to the user, in common language, which personal data is processed, for what, by whom and why. Many lawyers are doing these wrong and try to sell an unintelligible mess of legal text, while the law actually demands that the user can easily understand it. The european laws are especially serious about that, if the users are children. A school in europa would need to explain GoGuardian both to the children and the parents. Things like "monitoring all browser history, social network activity, logging all keystrokes, accessing all files and remotely enabling cameras and microphones" should raise some eyebrows and have parents ask unpleasant follow up questions. Also the "for what and why" parts are enforceable limits, any undisclosed processing is illegal. In contrast, Illinois has pretty much no data privacy laws at all, with PIPA being one of the worst globally. Talking to the school, local and regional governance about data privacy concerns can help, but US citizens need to think bigger and amend the constitution with a right to data privacy. Surveillance Capitalism is already deeply entrenched in schools, showing an EULA is a start as it creates awareness, but misses the bigger problem. The tech companies selling to these schools will claim that a friendly teacher sometimes looks what the children are doing, as they should, and then collect every bit of data they can access. They will claim their big brother algorithms will help teachers support pupils with their individual problems, that they improve education and enable students, and yet society isn't becoming enlightened, it is turning into a dystopia of surveillance capitalism and gamified control. There is something wrong at a fundamental level, the USA was the bastion of liberal philosophy, individualism and human rights, and yet it is now at the forefront of data enabled neo-authoritarianism.
• system2 5y ago
  "When we logged in, the system installed" What login, which system. What are you even doing.
• thethimble 5y ago
  GoGuardian CEO here. Lots of misinformation in this thread. Chrome extensions are attached to your Google account. Your son logged into his Chromebook with his CPS account which in turn installed the GoGuardian chrome extension. The simplest solution here is to just log on to your Chromebook with a personal account. No enterprise policy will be applied.
  • Dylan16807 5y ago
    > They suggested signing in with a different account, but when I do that, I get the error message "This account is not allowed to sign in within this network." https://news.ycombinator.com/item?id=30911927 https://news.ycombinator.com/item?id=30911927
  • natch 5y ago
    >Lots of misinformation So post some clarifications? Sound like they tried what you suggested and it didn’t work.
• 1970-01-01 5y ago
  CPS gives out Chromebooks. Ask CPS for a loaner Chromebook. Keep two Chromebooks. Chromebook A is for private things, Chromebook B is for school things.
• harikb 5y ago
  Our school (Bay Area/South Bay) uses GoGardian as well. The middle school also forces MITM-ed certificates via securely to monitor all traffic to anyone who wants school WiFi (student, volunteer, or staff) But I am not panicking though. The companies we work for make such software (list any “enterprise” security company here). You might own the machine, but they will force the machine to be “managed” if you want to access their network. Btw GoGaurdian also gets installed if you access the school “Google Suite” account from even your own PC or Mac, not limited to Chromebooks.
• Melatonic 5y ago
  So do not sign into his school account? That sounds like they are requiring an MDM be installed on all devices used to access school resources. This is standard security practice. When you do a full reset (there are multiple types on Chromebooks) it should remove everything. If you sign back into that school account, however, it will re-add it. If you create another account (not your school) then it should work as normal. You would need to contact the IT team at your school to find out if they setup this as a full device MDM (and if your chromebook is enrolled or not) or if it is just MAM mode and monitors things when using the school account.
• aaomidi 5y ago
  This might be helpful: https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...
• rodw 5y ago
  Isn't this a pretty typical bring-your-own-device policy? I.e., if you want to use your personal device to access the organization's private network or resources, they are going to insist on having control over that device, or at least they are allowed to. Or in this case I assume that CPS "owns" your son's account and probably has a terms-of-service-style document somewhere that makes GoGuardian or similar a condition of using that account. If you don't want their software then you can't use "their" account on that computer. I don't love that policy, but it sure seems like something they are allowed to do.
• mulmen 5y ago
  > I bought him a Chromebook for schoolwork, but also for other private things. Sadly we do not live in a world where this is a reasonable expectation. School is effectively work. There should be separate hardware for both. If you have more than one kid they shouldn’t share hardware. Don’t use your work laptop for anything personal. Don’t set up corporate email on your phone. Don’t log in to your personal iCloud on your work laptop. You bought your son school supplies. Back in my day my parents donated Kleenex boxes and other classroom supplies. This isn’t really any different. The school owns that device now.
  • autoexec 5y ago
    > Back in my day my parents donated Kleenex boxes and other classroom supplies. This isn’t really any different. Except for the fact that this Kleenex box can cost costs hundreds if not thousands of dollars and most families don't even own a Kleenex box or they only have one. Just like how it's no problem for most people to buy enough pencils and paper for every member of the household so picking up a little more for school supplies isn't a big deal but if the school expects a kid to use a laptop or a Wacom Cintiq Pro not every parent is going to be able to afford that and nobody is donating them.
    • mulmen 5y ago
      I’m not defending it, just explaining how it is. I wish OP luck with the lawsuit.
• yakorevivan 5y ago
• indymike 5y ago
  I fought this with a suburban school system in Indiana and won. The spyware was installed on Chromebooks I bought. Before contacting the school, I monitored network traffic for about 1 HR and found a an ad fraud click bot and logging being sent to India. When I contacted the school my ask was they remove the spyware from my Chromebooks. The first answer was, no. I asked again via the superintendent, and got a call from their IT director. I shared with him what my traffic monitoring found and a few days later I get another no. My last try was simple... I paid a lawyer to write a simple letter demanding to have the software removed or be shown the warrant giving the school the right to install surveillance software on my laptop. The next day I get a call from the districts lawyer who wanted me to confirm the software had been removed, and it had been.
  • Root_Denied 5y ago
    That's great for your situation - what about the rest of the people in your district? Did you reach out to other parents and make this problem known publicly, along with your solution, so that other parents could decide for themselves (individually or collectively) what their response should be? Seems like this would be a slam dunk of a local news piece for some newspaper/website.
    • amatecha 5y ago
      Yup, stuff like this should be on the local news. While most parents will go "ehhh I trust the government and if my kid is doing something bad I want to hear about it", the ones who actually care about their kids' rights will raise a huge stink and the district is more likely to not only be more upfront about this stuff but also probably make opting out easier.
    • indymike 5y ago
      I shared what happened with other parents. Most did not care or even understand.
• deleted 5y ago
  [deleted]
• Epiphany21 5y ago
  >Does anyone know how to refer these people to law enforcement for prosecution? Or, you know, you could just call the school during active hours and ask them politely to unlock it. They'll probably be more willing to accommodate you if you act older than your shoe size.
• bsuvc 5y ago
  > Does anyone know how to refer these people to law enforcement for prosecution? This is quite an overreaction. Prosecution? Besides, would this even be a criminal offense? I'm thinking it is more likely to be a civil case, if anything. It's not like the police are going to go into the school and perp walk the IT technician out in hand cuffs because your child's laptop has monitoring software installed on it.
• novok 5y ago
  IMO the account settings are acting like the chromebook is the school's property, and thus should be purchased and owned by the school, not the household. Otherwise it's another form of tuition charge. I don't think public schools charge for textbooks either correct?
• throwaase4na 5y ago
  Practical advice? Forget it, move on. The system has far more resources and time than you, it costs them nothing to ignore you and by taking no action. Any potential "win" from you can be delayed by them almost indefinitely -- they have salaried legal teams that can deal with any legal action taken by you. It is possible some kind soul may find it in the budget to settle this for $50 and admit no wrongdoing. Would that be satisfying? Some rather hard experiences have taught us that the system is structured to deal with complaints in a fairly standard way. That is its genius. It's just a laptop, nothing more. You're lucky.
• homero 5y ago
  Anything for work or school should be a separate disposable device.
• enriquto 5y ago
  > I bought him a Chromebook It wasn't the school who started giving spyware to your kid. It was you.
• hatware 5y ago
  > Does anyone know how to refer these people to law enforcement for prosecution? Where can I vote for you?
• mise_en_place 5y ago
  I have bypassed many similar spywares in my youth, typically anticheats when I wanted to poke memory addresses with certain values. Have you tried rooting the chrome book? You'll need some way to observe the network activity of the spyware agent, and then reverse engineer the agent to see how it phones home (probably valgrind or gdb will suffice, assuming they didnt pack the agent). From there you can either inject your custom code with LD_PRELOAD or write a simple shared library injector.
• joe_g_young 5y ago
  Goguardian is an chrome extension that is installed by a policy configuration of the district. It only works on chrome divides and not the chrome browser.
• pmarreck 5y ago
  If this was my son's computer, I would have a lot of fun defeating it
• teeray 5y ago
  It would be interesting to see if measures like this would violate CFAA. Like, was there any click-wrap prior to the MDM? Is the spyware isolated to only the data managed by the school? Eventually we’ll probably get some court cases, and I look forward to following them.
• issa 5y ago
  Based on comments, I am apparently in the minority in that I could not care less what my kid's school does to my kid's school computer. I understand that the OP purchased their own computer, but that seems immaterial--Schools give/loan free ones, so there is always the option to just use a school computer and not sign in with your personal chromebook. Am I just not paranoid? Am I not paranoid ENOUGH? I just don't see the big deal--my kids are at school, in classrooms, for 30 hours a week. Their time online doing school work seems like the least concerning thing as far as being under the control of school.
• bluSCALE4 5y ago
  My son came home with a Chromebook and I'm trying my hardest to make him hate it by talking as much shit about it every chance I get. I made sure to get him a desktop with games, dual boot windows and ubuntu and stress that if there's anything he wants to do, we can do it.
  • mike_d 5y ago
    Since he is basically going to have a Chromebook for the rest of his school career, and likely part of his professional life, why not help him to understand it and set him up to be successful? Even if you have a personal dislike for something, your job is to enable your son to be prepared for his life ahead.
    • bluSCALE4 5y ago
      I see what you're getting at but there's really nothing Chrome OS offers that can't be replicated on x86 and M1 machines. If he really wants to use it, I'll just VM Chrome OS, get him a touch screen monitor and call it a day. Chrome OS and iOS for that matter are garbage through and through by design, not by nature and I'll never stop preaching that... basically, if I took your stance, I'd be putting my son at a huge disadvantage the more I think about it.
      • mike_d 5y ago
        This is like people who think they are vegan so their pets should be too. At no point in the future is your kid going to say "wow dad thanks for teaching me how to stand up to the corporate overlords and opening my eyes to what shit iOS is!" Instead the conversation is going to be "Dad can you loan me money for rent this month? I replaced the proprietary freedom hating operating system on the cash register with an open source alternative and corporate had to fly someone out to fix it so they fired me."
        • bluSCALE4 4y ago
          You keep thinking that. At the end of the day, if you understand an OS, you can figure out mobile OS in a weekend. Try to setup a web server and write a React application using CI/CD pipeline. While it can be done, it takes hours on mobile and minutes in a Desktop OS. If anything, the tablet will be cannibalized by the Desktop OS as we're already seeing so arguing that I'm doing harm is a moot point.
• TedShiller 5y ago
  Don't use Google products. Google makes its money based on user surveillance.
• vorticalbox 5y ago
  Should the school not be providing the chromebook for your child to use?
• xg15 5y ago
  I tried to google OP's setup (because I was curious), but all resources I found so far were about managing/enrolling an entire Chromebook before use. However, the situation OP (and others) seems different: They are using a managed account on an unmanaged Chromebook, which already had private accounts set up. So I guess you could talk about a "half-enrolled" Chromebook. Are there any official Google resources which describe this particular state and how it interacts with the data that is already on the device? Edit: This post explains more: https://news.ycombinator.com/item?id=30915710 https://news.ycombinator.com/item?id=30915710
• aaron695 5y ago
• amatecha 5y ago
  I find this stuff so disheartening. It's like, "how early can we indoctrinate kids into being comfortable being watched and having their every move tracked?" I don't even care what the justifications are. Preventing cheating? Before everyone had personal computers and the internet, people could just copy each others' work. This kind of crap is fundamentally a violation of students' right to privacy. They deserve to grow up in a safe environment away from the prying eyes of crappy adults. I mean, to that point, how secure is GoGuardian? Who has access to the administrative tools/etc.? What APTs have gained access to its systems? A system breach of any online system is effectively inevitable, or at least impossible to rule out. Do you think everyone with a Verkada camera thought hackers around the world are going to be tuning into their video feed?[0] Anyway, stop buying tech that force you to give up your right to privacy to use it. You don't have to go 100%, but at least start looking at these kind of things before you shell out your hard-earned dollars. [0] https://www.theverge.com/2021/3/9/22322122/verkada-hack-150000-security-cameras-tesla-factory-cloudflare-jails-hospitals https://www.theverge.com/2021/3/9/22322122/verkada-hack-1500...
  • rand49an 5y ago
    Primarily these types of software's are used for safeguarding purposes. For alerting teaching staff about children who are being abused, bullied or at risk of self harm etc. I think a better lesson would be here that if you use an account that's not managed by you, it may be used to install software that you disagree with. This is a good lesson for using IT in the workplace. OP shouldn't expect his son's school provided account to maintain privacy when he's using it, because schools have statutory responsibilities to look after the safety of their students.
  • mjbeswick 5y ago
    The problem is that schools and teachers are at risk from more liability than ever. If a student is groomed online whilst using a school device of login, who do you think is going to get blamed; not the parents but the school. If a child is bullied online or radicalised, then again is will fall back on the school. You can't have privacy and expect a school to be responsible for what a child does online. Privacy doesn't create a safe environment; and when it comes to crappy adults, out of any group of people parents are the by far the most likely to abuse or neglect children. This idea of "stranger danger" is a myth, as the real danger in most cases is closer to home.
• raldi 5y ago
  Even if you send your kid to school with a paper notebook, the staff has always had the legal power to seize and read it. If anything, the school shootings era has expanded that authority even beyond the broad latitude it was granted before: https://www.ascd.org/el/articles/the-right-to-search-students https://www.ascd.org/el/articles/the-right-to-search-student... (Before replying, please note that I'm not expressing any opinion about whether this is good or bad; it's just how it is.)
  • spacemanmatt 5y ago
    That authority has always stopped at the sidewalk, too. Taking computers home has altered the scope of potential overreach, particularly with personal computer use at home and the potential school control of camera and microphone devices.
• robertlagrant 5y ago
  Can you have more than one account on there? Can your kid have separate accounts for school and non-school?
• d1sxeyes 5y ago
  Don't use the CPS provided account. CPS policy is quite clear: https://policy.cps.edu/download.aspx?ID=203 https://policy.cps.edu/download.aspx?ID=203 > I. Applicability. > This policy applies to all students who use CPS Computer Resources and/or access the CPS Network (“Students”). Personal electronic devices (e.g. personal laptop) are subject to this policy when such devices are connected to the CPS Network or Computer Resources. > IV. Privacy and Monitoring. > A. Privacy. Students have no expectation of privacy in their use of the CPS Network and Computer Resources > B. Monitoring. The Department of Information & Technology Services (ITS) has the right to access, search, read, inspect, copy, monitor, log or otherwise use data and information stored, transmitted and processed on the CPS Network and Computer Resources in order to execute the requirements of this policy [...] ITS reserves the right to: (1) access and make changes to any system connected to the CPS Network and Computer Resources to address security concerns.
  • nybble41 5y ago
    Sounds like CPS is due for some major policy changes. Schools should not be teaching students that this sort of intrusive infringement of their privacy is something to be tolerated.
    • d1sxeyes 5y ago
      I'm not sure I agree that this is an infringement of their privacy - or more accurately I think this is a reflection of the fact that there's no reasonable expectation of privacy in a public space (physical or virtual). It is perfectly normal in working circles that your activities on company owned devices or devices connected to a company network are monitored. If the school required everyone to purchase a private device and then install monitoring software on it, then I think it would be reasonable to argue that if they want to control it, they should pay for it. However, there was no such obligation here, OP simply bought a private device and expected to be able to connect it to a service someone else is paying for (yes, I know OP probably pays their taxes, and so is paying indirectly). They expected to take advantage of all the services provided by CPS without checking what the prerequisites for that might be.
• kkfx 5y ago
  Being not from US I can't answer the legal part (here in France it's illegal and you just need to file a formal complaint) however: why you choose a Chromebook? People needs desktops, not modern dumb terminals/endpoints acting as WebVM bootloaders, so learn them from the start help kids a lot in both practical skill and pedagogical ones (they learn different things exists, strong and weak point of anything and they have comparisons terms), I mean Classroom works on GNU/Linux desktop I suppose, so why not just give you son a GNU/Linux desktop well configured and dedicate a bit of time aside to teach him basic and less basic usage?
• witx 5y ago
  Stop buying crapware. Is there a chance you could do full install of a new OS?
• coldtea 5y ago
  >Does anyone know how to refer these people to law enforcement for prosecution? Like, filling a lawsuit, or reporting them to the police? I mean, how else would that happen?
• tom899 5y ago
  Send them a copy of "1984" or, i am not familiar with chromebooks, set a bios/boot-password or something so if they want install anything, they have to ask for permission. I kinda find it helpless to monitor kids activities instead of talking to them, explaining where the dangers are.
• teekert 5y ago
  My wife used my laptop for her work as a teacher, all of a sudden the system forces her to change her password! And I'm like what? That's not Krebs approved! Turns out is was her school's sys admin using some o365 settings (or at least I assume it was.) I told her to tell her director that this type of control over personal hardware is not acceptable, and this year they got school issued laptops, so that is nice.
• dncornholio 5y ago
  > I did a full factory reset, signed in to his account again, and now the system is once again locked down. Sign in with another account, problem solved.
• MarkusWandel 5y ago
  This is probably a dumb question, but can't you just log into the school's system using normal Chrome (or even Firefox) on a normal computer? This worked for my (very young) children when COVID made them stay home for a while. The school board issued very nice Chromebooks, but we were afraid of them getting broken, so we just logged in at the computer stations they have anyway, no problem. You could even spin up a VM image with a very basic Linux install in it for further privilege isolation.
• amelius 5y ago
  Install Linux and never look back.
  • BatteryMountain 5y ago
    For those interested: GalliumOS.
    • amelius 5y ago
      Apparently you can also install Ubuntu and even NixOS.
• servytor 5y ago
  Open a $100 bank account for him, login, and then take it to small claims court so you can buy a better laptop for him.
• smeej 5y ago
  After you reset the device but before you sign in with a school Google account, can you use a separate profile to install chrx or some other dual-boot Linux option? Or at least make sure the device has more than one Google Profile it can sign into? At least then you'd be able to know the spyware profile wasn't running all the time. You son could use it only for the specific homework that requires it. It's obviously still not OK that they can monitor everything he does while he's doing his homework, but it's an improvement on being able to monitor everything he does all the time, and (as much as I hate this) it might be an important lesson about what to expect when he's dealing company-provided devices in the future (though obviously a company controlling its own property is more justifiable than a school controlling your property).
• spacemanmatt 5y ago
  Collect the evidence and report a criminal computer intrusion. You have been violated entirely outside of the permission may have granted the school.
• dsugarman 5y ago
  >Does anyone know how to refer these people to law enforcement for prosecution? Your best bet is probably to contact the office of the Illinois State Attorney General.
• senectus1 5y ago
  I've had no experience with chromebooks but this sounds VERY much like Autopilot on windows/intune or Knox MDM enrollment on samsung android devices. Ring the school again and talk to their IT, prompt their memories with the words MDM enrollment. I bet one of them will have "AHA!" moment.
• Sporktacular 5y ago
  This post is showing up in grey text for me. Does that mean it's being downvoted? I can't imagine why.
  • sillysaurusx 5y ago
    Nah, all Ask HNs do. It was written that way by pg to discourage people from using HN as a blog.
    • Sporktacular 5y ago
      Ah, so good to know this stuff. I don't know where it's explained for newcomers. Thanks a lot.
• xaedes 5y ago
  I think the worst thing about student surveillance software is that it teaches a whole generation that it is normal to be and work under surveillance.
• hexo 5y ago
  After reading this it seems like only at least partialy feasible solution is qubes os and something like starting from previous snapshot so any installed spyware gets instantly wiped. Also, chrome is not allowed on computers in my home and will never be. I see no reason for chrome requirement by anyone. My main question is - when Chromebook is SO annoying. Why wouldn't OP just sell it and buy more sane pc and use sane os. I'm getting vibes like chromebooks are mandatory or what (which would be so much not cool).
  • tawaypol 5y ago
    Chrome OS is the new Windows. Go to Walmart and look for a normal PC, you won't find one, just Chromebooks.
    • hexo 5y ago
      We dont have walmart here. i'm in central europe
• timcavel 5y ago
• prepend 5y ago
  I’ve had similar experiences with my school district. They used to use managed iPads with Google classroom. They now use managed windows Lenovo with multiple layers of spyware. I bought my iPad and don’t allow installation of any apps with system privileges. This required a sit down with the principal, vice principal, county school board rep, and “tech manager” (who was just a random teachers aide with no training or specialized education and didn’t know much about equipment). It was a real hassle, but they agreed to a personal device and they give out a school “loaner laptop” for exams. The loaner has goguardian and lots of other stuff installed. Some surprising things I learned: -the school principal chooses the technology without any real evaluation criteria. He said multiple times “I’m not a tech expert, I just do my best” and claimed to not know how all this stuff works -my child was threatened with expulsion if they didn’t comply with the policy and only got around the school policy through a loophole because it was me who wouldn’t sign the contract yet it was the child who was being punished (contract required me to maintain the laptop, pay penalties for any damage, even if accidental, assume liability for theft, pay for my own insurance through a single vendor negotiated by the school, and learn and carry out administration since the school didnt have trained admins and only had an 800 number for tech support) I hope they never make a competent policy because it is so kafkaesque and draconian. The standard laptop is completely locked down and monitored by the school by people who don’t have any training on when to access data, including video from inside my home. I have quite a bit of experience with hardware and software and it’s hard for me. I can’t imagine how typical parents are supposed to protect their kids’ rights.
• Randolf_Scott 5y ago
  In a BYOD organization, you must be in compliance with Mobile Software Management Rules in order to have access to organizational assets and resources.
• slackfan 5y ago
  Nope. This is the future you signed up for, enjoy!
• squarefoot 5y ago
  Take a look at https://mrchromebox.tech https://mrchromebox.tech If your brand/model is supported and you have no reasons to stay with Chrome OS, you can unlock your Chromebox/book and flash a full Coreboot/UEFI firmware, so that you can install whatever OS you want. Linux runs circles around Chrome OS just about in everything. I've "liberated" a good number of Chromeboxes so far and never had any problems.
• cowvin 5y ago
  What happens if you do a factory reset and don't add him again?
• KaliaGelman 5y ago
• nzkiwi 5y ago
  you could put linux over the top? Chrome books make reasonable linux laptops generally.
• nzkiwi 5y ago
  If I were you I'd just blow away the OS, and put ubuntu LTS with xubuntu or something which will perform well on low-spec laptops. Unless google has the boot loader locked down I've heard Chromebooks make reasonable linux systems as they come with an ssd etc.
• a-saleh 5y ago
  I have no idea how school/board/us/system/it/student thing works so I won't speak to 'how do I get rid of spyware' and 'can I call the police'. It is improbable you can. Like, where I work, if I want to use my work mail with my android phone, my IT mandates I have a remote-wipe installed ... I am hopeful, that the androids work profile keeps the work-it separate from my personal browser history, but I can live with it. What I would do, is give my kid their own google account. I assume they don't need 'shool-mamaged-chromebook', just 'a computer that can access Google Classroom'. Then, after running the chromebook with your own account, your kid should still be able to log in with the school account in browser, without handing over admin privileges.
• f4ncyp4ntz 5y ago