7 ms·

I went to a Dutch high school that used Google Accounts for email, and they once caught some students "cheating" on a group project (i.e. collaborating in large

• jeffbee 4y ago
  Yeah of course, gsuite administrators can access everything, and because gsuite admins are just modern-day instances of bofh-type obnoxious IT guys, there's no way you'll convince them to give up those powers.
  • deleted 4y ago
    [deleted]
  • ASalazarMX 4y ago
    I don't know about Google for Education, but the business flavor doesn't let you spy the email of your users, at least I haven't found it. There are ways that allow you to copy every email to an "audit" address, if you're persistent enough, but good luck managing that mess and liability. There's the option of quarantining emails that have specific keywords. That's the likely way to catch students discussing cheating, attachments and all. Edit: as the comment below has pointed out, this might not be true. Different editions have different tools, the one i use is not the most complete.
    • agentdrtran 4y ago
      You can view full email content in the investigation tool, use the APIs to download their mail via MBOX and read it there, or if you're feeling bold, just add yourself as a delegate to their inbox.
      • ASalazarMX 4y ago
        Probably our edition doesn't include the Security Investigation Tool, I'll have to check if the APIs are available anyway.
      • GauntletWizard 4y ago
        Or change their password and remove the mfa token. The instructions for how to do so are in my administration toolkit for account recovery - and they are just as valid for hijack.
    • operator-name 4y ago
      It's not as easy as Microsoft, but can be done via their API. Tools like GAM have been made to make this easier: https://sites.google.com/jis.edu.bn/gam-commands/services/gmail https://sites.google.com/jis.edu.bn/gam-commands/services/gm... Email routing is also an option, although far more heavy handed.
• digitallyfree 4y ago
  Even if it was personal email/social media I've see school computers continually log to disk a low-framerate screen capture of the student's screen. They could also watch it in realtime. My school also had keyloggers installed and while admin insisted that they would not use any captured usernames and passwords they certainly had the capacity to do so. I think there was some news in the past where some schools took this even further with webcam and mic access, though I didn't experience this. On a school or work computer that you don't control assume someone is watching behind your shoulder at all times, and reading every word you type. Whether if that's the case or not.
  • twiss 4y ago
    Yeah, that's also terrible. But this was an email account that we could access from our personal computers (they didn't give us a laptop) so at the time I didn't realize that they would be able to read it. IMO, it would have been good if Google had shown some warning or so, that that's the case.
  • inopinatus 4y ago
    I have worked for a MSP supplying internet services and groupware to institutions, and can tell you that the business and technical requirements for schools are almost indistinguishable from those of prisons.
  • elliekelly 4y ago
    Robbins v. Lower Merion School District: https://en.m.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District https://en.m.wikipedia.org/wiki/Robbins_v._Lower_Merion_Scho...
    • digitallyfree 4y ago
      Yep, that's the case I was talking about. I know some students refused to fool around or gossip in front of school computers after that incident in fear that the microphones and cameras might be recording.
      • 4y ago
• agentdrtran 4y ago
  If your're on a paid plan it's pretty trivial for superadmins to read your mail. It's logged, but they can.
  • spacehunt 4y ago
    It's really easy to impersonate any user using domain wide delegation, and subsequent accesses aren't logged. https://developers.google.com/admin-sdk/directory/v1/guides/delegation https://developers.google.com/admin-sdk/directory/v1/guides/...
    • agentdrtran 4y ago
      Yeah, it's not great. We had to add logging into our custom app to get around this. The only thing you'll see in logs when adding a delegate is the OAuth log entry for Gmail, which doesn't tell you a lot. As far as I can tell, adding a delegate or forward isn't even logged anywhere, and being able to see what a delegate is doing was added as a feature only a few months ago: https://workspaceupdates.googleblog.com/2022/03/gmail-delegate-logging-security-investigation-tool.html https://workspaceupdates.googleblog.com/2022/03/gmail-delega...
• dekhn 4y ago
  That admins can read the emails in their managed accounts is working as intended. School accounts aren't for privacy, period.
  • twiss 4y ago
    Maybe, but it should be disclosed, at least, and students reminded to only use these accounts for school-related stuff, then. And even then, I'm not sure that there should be no privacy in school accounts - what if you want to complain about a teacher? What if that teacher happens to be an admin and retaliates? Sure, there may be cases where having some oversight is good, but it's not necessarily clear-cut.
    • dekhn 4y ago
      All the examples you're giving existed before school-provided email accounts. https://xkcd.com/1494/ https://xkcd.com/1494/
      • twiss 4y ago
        I'm not disputing how things are, I'm giving my opinion on how things ought to be :)
    • spydum 4y ago
      Almost all schools have a acceptable use waiver the kids (and maybe parents) have to sign to use Internet and it calls out monitoring of internet etc. It's just nobody reads those terms.
  • hnaccount_rng 4y ago
    This is not what the law says. This why courts absolutely will rule against such practices. And this is why if some person goes to court against that, the snooping admin will get into quite some trouble. There is a big difference between being able to do something and being allowed to do something.
  • fulafel 4y ago
    Of course the right to privacy applies to children as well, and to messaging in school between peers, just like in civilized jurisdictions it's illegal for employers to read read email between employees.
• la64710 4y ago
  Europe is making it easy for Microsoft.
  • wonderbore 4y ago
    Yes but is Microsoft any better from a data privacy/ownership standpoint? They’re an American company too and they have an ad business. How is Microsoft different for Europe?
    • chrjxnandns 4y ago
    • candiodari 4y ago
      Outlook servers let admins read user emails ... worse than that, outlook has a built in API for filtering mails and chats that allow automated monitoring of what a user does. (I programmed a tool for it that stored a record for a callcenter company that associated chats with the current call a user was handling. The admins got a log that had a bunch of data on a per-call basis that listed who they chatted and mailed and what was said. They claimed it was necessary for some financial (this was a bank) compliance thing)
    • pelasaco 4y ago
      You have already a lot of solutions for that https://fortune.com/2021/09/08/germany-sovereign-cloud-google-t-systems/ https://fortune.com/2021/09/08/germany-sovereign-cloud-googl.... Azure has the same kind of services. If in Germany we could take this decision in a Federal level, you could have your gov sovereign cloud, and stand on the shoulders of giants to be able to accomplish the necessary school digitization at Scale.
    • deleted 4y ago
      [deleted]
  • amelius 4y ago
    Google is making it easy for Microsoft.
• BirAdam 4y ago
  Thanks for your work! Happy proton user here.
• Aeolun 4y ago
  It’s a good lesson for the real world :/ people in power will read anything you let them.
• e63f67dd-065b 4y ago
  I mean, of course the email admins can read your email? Maybe I have a skewed perspective as an old school sysadmin, but when I managed servers that had mail services running on them obviously root can just read everything on disk and we even had spam filters that scanned the email content which is impossible if we couldn’t read all emails.
  • underwater 4y ago
    An old (school sysasmin) or an (old school) admin? FWIW in a lot of SaaS companies having read access to production data for regular workflows is absolutely unthinkable. In my opinion the users who expect that their private communication is not read have it right.
    • tallanvor 4y ago
      Of course it's unthinkable for people working for the provider to have access to production data except in very specific, highly audited situations. But it's absolutely understandable that an organization has administrators that are able to access data for legal or other compliance reasons, and Google provides those tools as part of the service they provide. There's nothing sketchy about this from Google's side. The Dutch order is more concerned with whether or not data regarding students is being transferred to the US and processed in ways that it shouldn't be. --Which there's no indication that this is happening, as far as I can tell.
      • twiss 4y ago
        Regarding the last point, there is some indication that that is happening, given that Google's response (from the article) is: > Google has indicated that it plans to fix the privacy concerns by August 2023 which means that they acknowledge that the current situation is insufficient. If the data was stored and processed only in Europe, they would likely say so. Although even that would not be sufficient, because > American authorities can access data stored in the European cloud (by American companies), due to the CLOUD act. So the privacy issues aren't that easy to solve, which might be why they expect it to take >1 year.
• consp 4y ago
  If this wasn't too long ago you should report the case to the AP since it was likely illegal even before gdpr was a thing. Depending on how the email was offered this could be a major violation of privacy. Even in commercial employer/employee instances you do not have a carte blanche and in cases of students it's even more murky especially if it was done without adult consent.
• Ekaros 4y ago
  Thankfully in Finland that would be massively illegal. The contents of letters and by extensions by email is so strong that employer or school would need to get specific permission to even try to access the headers.
  • Blahah 4y ago
    It's illegal in many places, but happens everywhere. If the tools allow it, even if it's not the intended use for a feature, people will do it in the worst ways eventually. This applies for school staff managing student emails, startup founders managing cloud apps for staff, and Google employees... in general.
  • simonh 4y ago
    The problem is email is a plain text format end to end, so all those emails are just text files on disk. In various situations admins might end up seeing mail headers and contents even if they don’t want to just by investigating various issues. Acting on that content is a different question though.
• Fnoord 4y ago
  That's why you use public key cryptography, for example with a Precursor. Problem with ProtonMail is its JavaScript. If we want to use e-mail with public key cryptography (perhaps we shouldn't), we need to use standards which work in any MUA, and are completely FOSS. I believe we are better off with a protocol which has a FOSS reference spec, is federated, and from the ground up build with privacy and security in mind.
• nijave 4y ago
  Google has Vault https://support.google.com/vault/answer/2462365?hl=en https://support.google.com/vault/answer/2462365?hl=en Not sure if/what other admin tools they might have
• IG_Semmelweiss 4y ago
  i am a long time proton paid user but im in the process of moving business to fastmail. Here is why: - No autofwd. This is essential for any business Fastmail has this. - No imap/ POP (usecase: integrating with clickup email) - no iOS calendar app - recent pricing changes - pricing on a per domain basis Ive wanted to support proton and ive paid to so that for a while, but my understanding is that product releases are very slow. Ive come to believe that protons cadence of releases is not sufficient for a regular business that has to move faster to keep with competition. I was a big supporter of proton, but starting a business using the proton suite now is a poor and expensive business decision. i hope this changes in the future. My criticism is on the business plans. Personal may suffice for most needs. (Email search is a pain, but that is the sword you fall on, given encryption)