Scenario: I want to be spied on!

Carsten Trinitis, Debora Weber-Wulff

Kevin is a computer science student at the University of Erdingen, Germany. For the past two semesters, the Coronavirus has had him studying from home, and it’s starting to grate on his nerves. In particular, his math teacher, Katrin, is a stickler for maintaining high exam standards. While she doesn’t force you to come in to take them on campus, she still requires that they be completed under a strict time limit. None of the candidates can perform all the equations in the allotted time.

So Kevin writes Katrin, asking if she might make the exams less difficult by waiving the time limit—after all, she could proctor the exams using “Panopticom” monitoring software. Immediately following the outbreak of the COVID-19 pandemic, the university put Panopticom in place as a measure designed to ensure the integrity of online exams. The system uses AI to detect suspicious behaviors. No sooner had the company’s sales rep pitched the product than college administrators were sold on it and sealed the deal on a package that covered the whole school. Another reason they decided to go ahead with it without even consulting faculty was that the package deal was cost-effective.

Katrin adamantly opposes Kevin’s suggestion that she make the exam easier. She rejects his proposal to use Panopticom. She’s a staunch advocate for data protection, and in her response to Kevin, she meticulously outlines her reasons for saying “no.” She considers it a severe invasion of student privacy. Besides, not everyone has a quiet, child- and pet-free workspace at home. These systems are easily fooled, and you can never tell exactly which behaviors AI will classify as “suspicious.” So you can’t rule out the possibility that many students taking the exam will be subject to hidden disadvantages.

Panopticom is no substitute for human supervision, and—most importantly—Katrin doesn’t want to place all her students under suspicion from the outset. Besides, the video and audio data will be stored in a Cloud somewhere. And who knows what the company plans to do with that data or how long they intend to keep it. Finally, an online marketing agency is listed at the same address as Panopticom, and the extent to which the two companies work together is unclear.

Kevin shoots back, saying that “everyone” has a home computer. Katrin tells him: no, not everyone—many people share their devices and, above all, bandwidth with other family members. Not only that, but many of these machines are antiquated and don’t even have built-in cameras. In cities, where housing space is limited, students often share workspaces with family, cats, and dogs, not to mention housemates. The latter might just happen to traipse naked by the camera. She’s seen it all while cameras were running during her lectures.

Katrin also knows there are services out there that will solve math problems within minutes for a fee. Those are the reasons she refuses to minimize the scope of her exams and why she covers as much as she can in her lectures so she can better assess which topics have thoroughly been understood. So she’s sticking to her plan and keeping the exam as it is—difficult, on a high level. But still, everyone passes.

Nevertheless, one student files a complaint with the exam oversight board because he “only” got a C on the exam. He contends that if the exam had been less difficult and monitored by Panopticom, he’d have definitely scored a B or better. The exam board notifies the administration, and they, in turn, ask Katrin to comment.

Once again, Katrin outlines her reservations in detail. But the administration doesn’t agree—they want to be seen as a “modern” university that employs all the benefits of digitalization and AI so they can continue to offer high-quality education despite the pandemic. Her colleague Karl used Panopticom and busted forty percent of students taking his exam for cheating! That must mean that the technology performs perfectly. Especially in computer science, it’s unacceptable for a lecturer to be so staunchly opposed to using all the tools in the digital toolbox. The university administration issues a formal letter of reprimand against Katrin.

Katrin decides to call in Dirk, the university’s data protection officer. Her first point of contention involves privacy. “Yes,” Dirk says, “this involves the collection of highly personal sensitive data. But university bylaws stipulate that exceptions must be permitted during the pandemic.”

“But where exactly are these data stored?” Katrin asks. “The company is based in Serbia, which is not an EU country.”

“Oh,” Dirk responds, “I didn’t know that. Hmm. What do we do now that colleagues like Karl have already administered countless exams?”

Katrin argues that the instructors should decide whether they want to use remote monitoring. Above all, she thinks it imperative that students be informed beforehand about every aspect relevant to using the system. She believes that is Dirk’s responsibility as a data protection officer. But he disagrees: That’s the lecturers’ job, thank you very much!

But Katrin wants to avoid any more trouble with the administration. She’s not sure what she should do in the coming semester…

Questions:

1. Would it have been better for university administrators to have consulted faculty before purchasing the software? But wouldn’t this necessarily have slowed down the process?
2. Is it problematic for a marketing company to operate under the same address as Panopticom? Just because they have the same address doesn’t necessarily mean that they’re connected in any way. How much effort must the university invest to rule out any connection between the two companies?
3. What are the minimum job requirements for data protection officers at universities? Shouldn’t they be expected to have a checklist of questions to ask to better test and assess such systems?
4. Did the students already know that Panopticom was storing their data in a non-EU country? Would that have made any difference to them?
5. Whose job is it to inform students about which data is being collected, where it is being stored, and for how long? What activities or events are classified as suspicious?
6. What would you do if you were in Katrin’s shoes?
7. What do you think of the argument that the university implemented state-of-the-art technology to be seen as a “modern” institution? Is there an ethical dimension to this argument?
8. Is forcing students to agree to use such systems as Panopticom justifiable? Shouldn’t university students who don’t want to be spied on be offered an alternative?
9. Shouldn’t exams be made easier in exceptional times like the COVID-19 pandemic, with easier questions, more time, and no supervision? Or does that diminish students’ achievements? Would “COVID Degrees” be worth less than others?

— Translated from German by Lillian M. Banks