Online test-proctoring: educational spyware that lets third parties secretly watch and listen to you through your computer




History is the worst set of reruns.


I wonder how ProctorU deals with the very likely case that a user simply doesn't own a webcam.

Or is pretending that anyone uses anything other than a laptop anymore just preposterously old-fashioned of me?


I had the darnedest time figuring out how the webcam on my new laptop worked - I figured I was missing the driver in the Linux distro I installed. It didn't even show up as a device on the USB bus. Turns out there's a keystroke combination that is intercepted by the BIOS (or whatever they're calling it now) and powers up the webcam. Until you type those keys, the OS has no way of knowing that there is a webcam in the computer.


"We’re a customer service business, so it’s really not advantageous for us to violate that trust because then we wouldn’t have any business.”

BUT the customer is not the student; it's the school or the teacher, so the above quote is disingenuous.


Heh. "ProctorU". How oddly appropriate as a name for the service.


"It's really the only way you can give exams on an online class," Feist said.

Rubbish. It's the only way Feist can give exams for an online class without going to the effort of tailoring the exam for the new environment, but it is NOT the only way to give exams. Two decades ago I had a lecturier who was trying to convince the University that he could run an open-book/open-laptop exam in a way that it didn't matter what we students brought with us, because he wanted to test concepts and understanding - rather than mere recall - and that meant that having access to reams of raw info was a disadvantage because there's no way we'd have time to sift through it looking for an answer. Not surprisingly he was stonewalled. Granted internet connectivity creates it's own problems with 'hive mind' behaviour possible, but again that simply means that the exam requires tailoring for that environment (not that I think that the tailoring itself would necessarily be simple).

But, what's wrong with old-skool styles? Everyone with an internet connection - i.e., everyone taking an online course - is near an education intitution of some description. Have the students nominate (or pick from a list) the location where they would like to sit the test, then have them go there and take the test. With a meatspace proctor in attendance. I've been taking extramural papers for several years, and this is exactly what they do, and it seems to work ok.

What problem, exactly, is ProctologyU supposedly solving?

(On the downside, the University I'm doing papers through does use TurnItIn, which I fucking hate. And I hate it even more that the only alternative is "well, don't do any papers then.")


It would only ever get installed on a VM for me. Let them rifle through a blank WinXP image running only the testing software all they like.


What a joke, if someone is going to cheat they are going to cheat.
In a college/higher learning situation this is just dumb. If a student is cheating at that level they really are cheating themselves. So they want to make sure students aren't opening other browsers/tabs to search for an answer.
It wouldn't be all that hard to run it in a virtual machine that would stop a program like this in it's tracks, the extra fun would come in from having it feed something from a camzone camera...something like


The reason this story is coming to you from SJSU is that they have been leading the way in trying to figure out how to offer college credit for MOOCs. However, finding a credible way to proctor exams for remote students is an old problem (predating computers) that has not yet been solved to everyone's satisfaction. ProctorU and similar services offer an interesting approach, but their privacy protocols do seem underdeveloped. They were the subject of an article last year in the Chronicle of Higher Education which has many more details about their operation and which provides a nice complement to the article linked here.


Turns out there's a keystroke combination that is intercepted by the BIOS

That key combination isn't intercepted by the BIOS (or UEFI, the modern equivalent). It's intercepted by the Embedded Controller, a small system-on-chip microcontroller that does almost everything that makes a laptop a laptop: onboard keyboard input, Fn key combinations, battery charging and management, onboard WiFi and Bluetooth RF kill switches, power control of auxillary onboard devices (like your webcam), screen backlighting (on older systems) and in some cases handles power management like the lid switch and power button.

As for this software, I wonder:
What it does when run inside a hardware assisted or T&E virtual machine,
What it does when run inside a true emulating VM like bochs or qemu,
What it does when run on a real machine with a hardware (ICE/ICD) or low level debugger attached,
What it does without a webcam or microphone (or when run on a system without any sound or multimedia service, like Windows Server),
What it does if your internet connection drops...


That's not really true anymore, since university isn't really about 'higher learning' for the majority of students. A degree is pretty much a requirement for most jobs now, and a fraudulently obtained degree potentially allows someone to get a job ahead of someone who obtained one honestly, 'cheating' the honest person out of a job.

What university education has become is, I think, a travesty, but it's no use denying that new reality.


Take note of the comments on the original article. Founder and CEO invites students to see the process. Importantly, the first reply calls for technical inspection. What guarantees do the students or university have that the data is secure? Especially with a driver's license being recorded!


All university software is hateful. All of it.


I've used ProctorU on two or three occasions as a student of Thomas Edison State College. I definitely prefer a real live tutor at my local library/testing center, but really the ProctorU service is not really that obtrusive, unless there's something I'm missing. It's kind of like those remote access programs for online tech support.

Yes, they watch me while I'm taking the test. They ask me to hold up my driver's license when I start. They ask me to pan the camera/laptop around the room to see my workspace. They ask me to hold up something reflective (like a mirror or a DVD in front of the camera so they can see if anything is attached to the screen (like a cheat sheet). Then, they pretty much just watch me while I'm taking the test. If I have a problem, I can just speak and they'll appear on my screen and troubleshoot. If I were to lose my connection and couldn't reconnect, I'd have to ask the school to let me re-take it (and per the honor code, I'm expected to be honest.) I didn't really feel like my privacy is being violated, because the camera and microphone are only active while I'm actually testing, for 2-3 hours.

As far as I know, they don't take control of my computer or monitor running programs or anything like that. And when I quit the program, they're gone, they're off. I'm not backdoored. The school isn't watching me while I'm studying. It's just like a video conferencing session I'm expected to keep open while I'm taking my test. The way that Cory wrote the article, I am wondering if they are secretly installing rootkits or something. (I've seen no evidence of that.)

I would probably use ProctorU again except that I think my school just does a better job with the pen and paper tests than their online tests.


Just read the post again and I'm even more confused. What third parties are secretly watching me? (There is the actual proctor who I am interacting with, but they are certainly not watching me in secret.)


This qualifier is important.


But without any indication that the software is doing otherwise, this is just speculative fear mongering. Could Microsoft Word be logging my keystrokes? Are Skype calls being recorded for the NSA? (Okay, bad example!)

I think the much bigger issue is that SJSU apparently doesn't allow students to opt out and take a test proctored by a human. A school of that size that already offers "meatspace" classes could certainly provide this, or allow third-party proctors. My local library charges me $10 and gives me a nice quiet room to work in.


It's not unusual for syllabi to dictate technical requirements these days. (Must have Microsoft Access, must have Visual Studio, must have OS X and XCode). I think a USB webcam is like $30, but it is kind of silly to make a student purchase it just so the school can outsource its proctoring.


I use ProctorU for my online exams, for a course I'm taking exclusively online. I don't have to use ProctorU - I could even use a member of the clergy (!) as a proctor and probably save a little money.

However, I can actually see the person who's proctoring my exam, I don't have to take it in a room full of people who are there for their Series 17 or FAA or dental technician exams, and the commute is pretty short.

To answer some of the questions - I use a desktop, not a laptop, and I had to buy a webcam to take the exams. Again, I could have gone to my local community college's test center, but didn't want to. I am the customer, not the University. The University wants me to take the test ethically, and ProctorU is one of the dozens of other options. The webcam is a requirement - in fact, there are a list of system requirements for the software, just like any other software. The remote access is for one reason - to make sure you don't have course materials open on your primary or other monitors. And if my Internet connection drops, there's an emergency number to call.

(lots deleted here to save time) For me, this works very well, but I grant that I'm a subset of total online students. I'll readily accept that this is an imperfect offering for all students. In fact, if it's the sole proctoring method for the SJSU students in the article, it needs to have alternatives. But the rest of it is incredibly innocuous, and I readily trade the 90 minutes of remote access (I scrub the software after every exam and disconnect my home network) for the massive convenience.*

*Yes, I know that makes me part of the problem.


The space gnomes in Cory's paranoid fantasies.