Cybersafety: new guide demystifies

It will come as absolutely no surprise to readers that statistics show young people to be accessing the internet with ever-increasing frequency, and continuing to move toward mobile devices as their hardware medium of choice. Neil Melhuish of Netsafe New Zealand, a member of the group behind the new guidelines – A guide for schools: Digital technology – safe and responsible use in schools – believes that interaction with the digital realm is now so intrinsic to our way of life that we can no longer make do with conceptualising the digital device as merely a handy tool.

“Increasingly, young people’s behaviour crosses online and offline boundaries, mixing communication from different sources and media to build a coherent experience that fuses what was once separate. This behaviour reflects the nature of the technologies they are using.”

Patrick Walsh, with Neil and others, led the development of the new guide. When not trying to translate the vagaries of top-level policy into something more useful to teachers, he is principal of Rotorua’s John Paul College. Patrick says that the ‘message’ of the guidelines is captured in the phrase ‘educative approach.’

“We’d all recognise that the use of electronic devices in school is useful educationally. But they also have a dark side. Schools were concerned about their rights and obligations in relation to devices, around confiscating them and searching them. This confusion led to the creation of the OSAG, and the new guidelines, which we think provide a great deal more clarity for principals, boards, and teachers in relation to what is lawful practice and best practice.

“They promote the idea that the use of technology is a good thing for learning, they help communication for one thing. There are risks however, and it’s important that schools employ a whole lot of resources that are available through a range of organisations in relation to cyber safety.”

Digital islands

A decade ago, schools were ‘digital islands’, with borders that were relatively easy to monitor and control. Students accessed the internet through the school’s hardware, so all digital traffic could be funnelled through a single point of entry and exit.

This meant that policy around cyber safety could be modelled in the same way as that for ‘traditional’ challenges: potentially harmful content could be blocked, and the school’s network effectively closed to the outside world.

In recent years, there has been a rapid move away from school-administered desktop computers – which can theoretically be easily monitored – toward the ‘always on’ approach, meaning that students are increasingly using their own devices as learning tools. As a result, controlling schooltime access to the internet becomes correspondingly more difficult. Then there’s the issue of whether it’s productive – or justified – to even attempt to control students’ interaction with such a ubiquitous medium.

Some schools opted to cling to this protectionist policy when mobile devices became de rigueur, for the very good reason that it worked. Schools simply banned students from using devices during school time, or from bringing them to school at all.
This type of policy has become increasingly untenable, says Neil. The recently published guidelines do not mince words: “In general, preventative approaches that rely on technical or other protections [in isolation] simply do not work.”

For a start, given that schools are partially responsible for preparing young people to meet the world, many are asking whether such policy has the effect of limiting opportunities for learning that digital devices can enable. Portable digital devices are just as ubiquitous in the ‘real world’ as they are among young people, and will undoubtedly become more so once the internet generation sets off into the workforce. Though it may be far less straight-forward, pretending that schools can function as they should and simply ‘shut the gate’ is probably anachronistic at best.

Though many schools running a BYOD (Bring Your Own Device) programme require caregivers to sign a declaration providing an assurance that their children will not use their device to access the internet except through the school’s own network, some students do not adhere to the school rules. How in practice does a school go about stopping a determined student accessing the internet using cellular coverage? What about free wireless networks? Particularly if you live in any of our larger centres, take a look at the number of wi-fi networks your device is picking up at any one time.

As with the more traditional concept of ‘stranger danger’, accepting that schools cannot hope to monitor all interaction with the world paves the way toward a focus on education: equipping young people – and educators – with the knowledge to make good judgements.

In recognition of the fact that good digital citizenship in a school context is, at the end of the day, a choice that students must make – and that it is the school’s responsibility to help enlighten that choice as far as possible – the new guide has been developed to support schools in developing their own policy around response to – and prevention of – unsafe digital conduct.

Pandora's box?

The problem scenario that schools face is the use of a student-owned digital device in the commission of behaviour defined by the Act as “likely to endanger the safety of others”; “likely to detrimentally affect the learning environment”; or is “harmful”. This last is defined by the Act as “posing an immediate threat to the physical or emotional safety of any person”.

When, for example, a teacher is reliably informed that a student has a knife in their bag, they can legally enact a search; this is a clear-cut instance of potentially immediate danger.

But what if the same teacher is reliably informed that a student has a video of another student getting changed on their mobile phone, which they have told other students they’re going to post to social media? Clearly, this scenario could be read as potentially endangering the immediate emotional safety of the student who is the subject of the video. Can a school refer to the same set of protocols?

To be clear, we’re not talking about searching for the electronic device itself, in a student’s bag for example, with the intention of confiscating it. This is a perfectly reasonable response to many different scenarios; schools are entirely within their rights to prevent or mitigate harm they believe is being (or could be) perpetrated using an electronic device, by searching for and confiscating the device.

But can teachers search the device itself, for the harmful electronic item? All things considered, the upshot is a resounding ‘no’, says Neil.

“In short, searching a device is simply not an option for schools; from a practical, legal, and technical point of view, except in the most extreme circumstances – outside agencies like the police need to be involved in these worst case scenarios anyway. Therefore, schools, parents and the community need to focus not on discovering and eliminating problem files or images or whatever, but on holding students to account when that device is used to cause harm, and on arming students with the knowledge to keep themselves safe.”

Reasonable grounds

A key construct of both the Act and the new guidelines is “belief on reasonable grounds”: that is, teachers must satisfy themselves that there is good reason to respond to an incident in such a way that it falls under the aegis of legislation.

Neil Melhuish says that teachers need to think carefully about this idea, but shouldn’t see it as cause for reticence; some might be concerned that this seemingly wide-open concept leaves them vulnerable to retrospective censure. Teachers exercise their good judgement every day of the week, says Neil, in myriad contexts. What teachers need to realise, he says, is that, to quote Digital technology – safe and responsible use in schools: “’Belief on reasonable grounds’ does not mean ‘absolutely certain.’ What is reasonable depends on context and on the nature of the item.”

Independent testimony from two or more students could be considered reliable enough to warrant a response, for example. The Act seeks to support the ‘good judgement’ of education professionals, so it’s not a matter of ticking boxes to satisfy any particular criteria. Digital technology – safe and responsible use in schools includes several detailed case studies that make for great analysis material in this sense, says Patrick.

“It’s about exercising professional judgement, but developing and maintaining robust knowledge of the issues around the use of digital technology is crucial too; when problems arise, teachers must use their knowledge to make sound judgements. From that point of view, the guides provide coherent and concise advice from a range of people in the school context, including leaders, teachers, and counsellors. They also outline a wide variety of resources that schools can turn to.

“I want to point out strongly that the guidelines emphasise the fact that internet safety isn’t just a school issue, it’s a community issue; it’s so important to have the involvement of parents and the wider community.”

Privacy

One of the glaring issues around responding to digital behaviour challenges is the risk that a student’s privacy could be breached inadvertently. Even where the law makes allowance for the searching of student possessions – as a response to an immediate threat – it would be next to impossible to search a digital device without straying onto legally shaky ground, says Neil.

Kathryn Dalziel of Christchurch’s Taylor Shaw Barristers and Solicitors specialises in privacy law – among other strands – and has more than 20 years’ experience behind her. As one of the consulting authors of the Privacy Commission’s 2009 publication Privacy in Schools, she is well-placed to provide perspective on how teachers and schools can avoid straying into a potentially problematic scenario.

“Where I see the issue becoming a bit difficult is in a BYOD context. The devil is in some of the detail of the Act. Schools are [increasingly] encouraging students to bring their own devices, but the problem is that if the device is searched, they will inevitably end up viewing private content.

“The problem is that searching an electronic device cannot really be equated with searching a bag. For a start, chances are that the school may need to involve highly specialised forensic IT people. A school may not have the resources to do this. Will this drive up the threshold at which schools will consider pursuing a serious breach of conduct?

“The inescapable fact is that the offending is likely going to have to be at the very highest end before it could realistically be expected that a school will take such a serious step.”

So, to all intents and purposes, a school cannot search a student-owned device, and in a situation of such severity that a search must be conducted, a school’s first call should be to the police.

Inappropriate or unlawful?

Arguably nothing has so quickly or irreversibly altered the human experience than the digital revolution, and this presents challenges for schools. Like the technology itself, any policy that commits too heavily to the here and now runs the risk of obsolescence in a frighteningly short space of time. This is why, Neil explains, A guide for schools focuses on concepts, rather than simply delivering schools from the application of sound judgement with an ‘if, then’-style blueprint.

Neil says that this shouldn’t be cause for anxiety. We can start by defining the challenging behaviours we could encounter, by their potential for harm. The means by which harm is caused will change, but their effects won’t.

Digital challenges can broadly be defined as
(from A guide for schools: Digital technology – safe and responsible use in schools):

Cyber safety: Involves conduct or behavioural concerns.

Examples include cyberbullying, smear campaigns, accessing inappropriate content, creating spoof websites or sexting.

Cybercrime: Involves illegal activity.

Examples include, sexual offending, accessing objectionable content or online fraud.

Cybersecurity: Involves unauthorised access or attacks on a computer system.

Examples include hacking into someone’s social media service account, launching a Distributed Denial of Service (DDoS) attack or loading malware onto a laptop.

The guide notes that schools are likely to be most concerned with cyber safety; and that these three broad definitions are points on a continuum rather than boxes.

A school’s response to digital behaviour that could fall at the unlawful end of the spectrum is reasonably clear cut: as with any potentially illegal misconduct, the best thing to do is seek the advice of police. It’s the harmful or inappropriate stuff below that line that has caused confusion.

Dos and don'ts (from a Guide for schools: digital technology - safe and responsible use in schools)

Teachers and authorised staff can:

• Ask a student to reveal a harmful item on a digital device.
• Ask a student to delete the item.
• Ask a student to surrender the digital device.
• Retain a surrendered device for a reasonable period. Retention of the device requires record keeping.

Teachers and authorised staff cannot:

• Ask a student to reveal anything on a device where they have not formed a reasonable belief that the device contains harmful material, or material detrimental to the learning environment.
• Search the contents of a student-owned digital device or online accounts.
• Ask for students’ passwords.
• Ask a student to download material they have stored on another device, on social media or other online service.

The above ‘dos and don’ts’ are by no means exhaustive, and teachers should consult the guidelines, as well as the Ministry-published Guidelines for the Surrender and Retention of Property and Searches for a more detailed examination.

Talk therapy

As with any other situation which could threaten the safety of a learning institution, the new guidelines labour the point that prevention is always better than cure. As has been proved time and again, education is the basis of prevention. The only way to stay ahead of challenges in the digital realm, that can appear so amorphously complex, is to keep talking about it.

Conversation prevents anxiety and confusion among staff, and when the community is involved prevents the sort of anxiety that can arise when parents feel they are excluded from their children’s lives, by a perceived technological barrier. A calm, reasoned and confident response is always preferable says Neil, and one of the best ways a school can achieve this is for everyone to know what their roles are in the event of an incident.

The bottom line is that schools should focus not on the means but the effects of harmful behaviour; this is something that will never change.

Netsafe advises that schools:

• Identify existing internal expertise and plan for ongoing professional development.
• Designate responsibility for developing incident management policies and processes.
• Create an online safety group or digital citizenship committee that includes young people and community members to advise on prevention and incident response.

Schools are for learning

Mark Quigley is deputy principal at Orewa College, on the Hibiscus Coast. Those following developments in digital technologies in schools may remember that Orewa was the first school in the country to introduce a compulsory BYOD programme in 2011. Again, predictably, media focused on the fact that parents were seemingly forced to pay for devices that many felt the school should be providing, but in the end, says Mark, the decision was taken because it was felt there was no other way to get anything meaningful out of BYOD.

“We had BYOD prior to that, but half our students weren’t bringing them [student-owned devices]. Teachers were saying to me that they can’t change their pedagogy, they can’t make the most of these digital opportunities because they can only teach to half the class.

“There’s a huge advantage to giving kids ubiquitous access to the internet in terms of teaching and learning, but no school can afford to buy 2,000 computers. Unless you’ve got that ubiquity ‘anywhere, all the time’ it becomes a wasted exercise I believe.

“Now there’s an imperative [at Orewa College] to adapt our practice.”

Mark says that during the lengthy community consultation phase Orewa College underwent, parents seemed more concerned with how their children would end up spending their time, rather than the potential for exposure to harmful content. This is instructional, says Mark: it demonstrates that parents realise that trying to shield students from the big, bad internet is not possible, even if it weren’t counter-productive. Education and mature digital citizenship therefore becomes the priority.

“Mainly they [parents] thought that kids would just be playing games all day every day. Our response to that was ‘they currently play games all day every day, if they want to, sitting at the back of the class, playing noughts and crosses, sending notes to each other or whatever. It’s up to us to monitor what’s going on in the classroom. Nothing has changed. BYOD helps to get teachers away from the front of the class. With ubiquitous internet access, the teacher is able to do that, they can walk around the room and see what kids are doing.

“Initially they did [muck around playing games], because it was a novelty. But if you come to our school now, and look at our bandwidth usage, there’s a big spike during period one, but interval comes along and it drops right back to next to nothing. That tells us heaps. Same with lunch time. You’ll ask the kids about that, and they’ll say ‘we have to use these things every period, why would we use them at lunch as well?’ We’ve managed to suck the fun out the iPad!”

Arguably the big question schools looking into BYOD must take a position on is filtering. At one end of the scale, schools could allow access only to sanctioned ‘educationally valuable’ sites. The other fully liberalised position is to place no filtration on access to the internet through the school’s network. Orewa College went with the latter.

“Our philosophical approach to start with was that ‘we’re not going to block anything.’ How can we teach responsible use that applies to the world that they’re living in any other way? They’ve got smart phones, they can walk to McDonalds and get access to a free network. If we create an artificial ‘walled garden’ environment around the school, they’re not really learning anything, and we’re not reflecting reality. We don’t just teach chemistry and maths, we teach how to be citizens of New Zealand. So unless we make the real world available, it’s not really adequate preparation for life is it?”

Echoing one of the main thrusts of the newly published guidelines, Mark and Orewa College saw that robust and transparent consultation and education – both at school and in the community – was the only way forward.

“Parents have become accustomed to the idea that there’s absolutely zero point in trying to police something that can’t be policed essentially, both at school and outside.

“We’ve run lots of parent evenings and lots of parent courses, on how the technology works, and what their kids are getting out of it. One of our staff runs a course over four Tuesday nights, which seeks to teach parents about the cool things the iPad can do, and also what to look for. We encourage parents, for example, to look at their child’s browsing history. If there’s a lot of private browsing going on, well there’s an opportunity for a family conversation, isn’t there. That’s the kind of support we need to give to parents.

“You hear this term digital citizenship. But who’s going to teach kids about how to be a good digital citizen? Their parents didn’t grow up like that. And that I think feeds into a bit of the panic that some schools have maybe experienced when trying to get BYOD off the ground. There’s a gap in knowledge there, and it’s up to us to fill it.”

Always on, always informed

Neil Melhuish at Netsafe reiterates the point that schools shouldn’t feel that digital technologies have made a school’s position on keeping their community safe anymore opaque than it’s always been. In fact, he says, schools should rather look at the opportunities technology engenders for better communication with all concerned.

“Schools are now embracing the ‘always on’ ethos. That means that schools are taking the position that if they’re to embrace communications technology, it can’t just be school-owned desktops. Schools are saying that in an age of ever-increasing dependence on digital technology, student engagement with that tech doesn’t start and stop with what they’re up to within the school grounds. They’re using it at home, they’re using it everywhere, and schools can rightly feel that they are fostering connections to home through the use of digital technology.

“The ‘not on our network, not on our time’ defence is being challenged by the technology itself. It simply becomes totally impractical in the face of increasing ubiquity [of digital devices] to exclude them from school life.”

The very good news is that trust in teachers to act in the best interests of students has now been enshrined by legislation. Some may have been dismayed at perceiving the Act as vague, on first reading at least; but given that everything it deals with flows from the concept of ‘good judgement’, maybe we should look at the Act as an acknowledgement that for any given scenario, teachers will likely know best. Ironically, plugging some kind of ‘if A then B’ programme into any old digital behaviour scenario just won’t cut it: a very human, nuanced response is required.

The working group is comprised of representatives from the Ministries of Education, and Justice, NZ Police, Education Review Office (ERO), Post-Primary Teachers’ Association, Secondary Principals’ Association of New Zealand, Netsafe, Office of Children’s Commissioner (OCC), New Zealand Association of Intermediate and Middle Schooling (NZAIMS), New Zealand Principals’ Federation (NZPF), New Zealand School Trustees Association (NZSTA), and Network for Learning Ltd. The office of the Privacy Commissioner consulted.

Tips from the guide

The guide Digital Technology: Safe and responsible use in schools(external link) is available for download.

Some of the advice for schools includes:

Develop a safe use strategy that works for your school. Effective prevention strategies guiding young people’s learning about acceptable use of technology.

As part of your safe use strategy, communicate widely about what’s expected with the use of digital technology in your school.

Your safe use strategy won’t necessarily eliminate incidents. If something does happen focus more on minimising distress and harm to the student and less on the technology itself.

Develop a response plan that can guide you in the event of an incident involving a pupil and the inappropriate use of digital technology.

Contact NetSafe or the New Zealand School Trustees Association directly for further help, advice and guidance if you are confronted with a problem. They can provide more detailed information about incident response and technical issues.

NetSafe

0508 NetSafe (0508 638 723) or queries@netsafe.org.nz
New Zealand School Trustees Association (NZSTA)
0800 782 435 or the Netsafe website(external link)

Tips for parents:

Visit the Education website for parents(external link)