An e-proctoring software used by Carleton University is under criticism by students who say it is intrusive and puts their personal information at risk of being hacked.
The software, called CoMaS, records random screenshots, webcam captures, network communications and the names of any documents open or opened during an exam to prevent cheating, according to documentation on the software provided by the university.
A petition calling for the university to stop CoMaS’ “intrusive” techniques has over 5,000 signatures.
“I would just like a choice,” said Ernesto Aleman, a second-year engineering student who wrote the petition. “To be able to say no, and to be able to be given an alternative to choose from if I don’t want to put that software on my computer.”
CoMaS, which was developed at Carleton, records the IP address of any domain the computer communicates with, but does not record the content of the communication, browser history, cache or cookies.
It also does not record any information while it is not running, according to an installation guide for students.
This guide, along with an additional guide on e-proctoring softwares and two internal memos, has been provided to the Charlatan by Steven Reid, the university’s media relations officer.
CoMaS also does not record the contents of any files or documents on the computer, according to the guide.
The information it does record—screenshots, webcam captures, network communications and the names of any documents open or opened during an exam—is stored in a CoMaS folder on the computer, in addition to being sent to a Carleton-based server.
Carleton prohibits the deletion or modification of any file inside the CoMaS folder during the exam on grounds of academic integrity. The files and software can be deleted after the exam.
After the exam, the data collected is compiled into a video and examined by authorized Scheduling and Examination Services (SES) staff, the guide said. The staff will compile a report containing the time of sign in and sign out, open documents, open webpages, loss of connection and if a phone was used during the exam. This report is then sent to the course professor.
The guide does not explain how the SES staff would know if a phone was used during the exam.
Students expressed concerns that CoMaS is intrusive in the data it collects, and that this data could be hacked once it is on Carleton’s servers.
“How as a student am I supposed to know that that data is secure anymore after it’s sent to Carleton?” said Jordan Wallace, a second-year aerospace engineering student. “It has a lot of identifiable data that people with less than good intentions might want.”
“You’ve got screenshots of someone’s computer, you’ve got pictures of their face, you’ve got network connections that they’ve made,” Wallace said. “If you wanted to keep track of someone, this software would be the perfect thing you would use.”
Carleton has a history of being hacked. In November 2016, the university was the victim of a ransomware attack demanding two Bitcoin, roughly $2,000, to regain access to university files. University administrators told students to stay off their Carleton web accounts and encouraged students to change the passwords to their MyCarletonOne accounts.
Last week, Proctortrack, an e-proctoring software used at Western University, Queen’s University, the University of Regina and other schools, announced a security breach but said that no student data, images or recordings were exposed.
The breach comes as a petition from Western students to stop the use of Proctortrack surpasses 10,000 signatures.
“Just because we’re in unprecedented times does not mean that the school should force us to use a software that is not proven to be safe,” said Emily Killeen, a third-year environmental engineering student.
Julian Nicolai, a second-year electrical engineering student, said that the concerns with CoMaS have been blown out of proportion.
“I think the solution that Carleton came up with was very, very reasonable,” Nicolai said. “People were very scared for reasons that they didn’t know a lot of the stuff they were talking about.”
Nicolai said he believes that CoMaS is actually more conservative in the data it collects than external companies and students shouldn’t conflate the privacy practices of companies like Facebook with the university.
“People put a lot of trust in other companies, but then all of a sudden when Carleton implements a … proctoring software that is, in my opinion, not really that intrusive, then they get all up in arms about it,” Nicolai said.
Killeen expressed concerns that her computer, which runs on Windows 8, will not be compatible with CoMaS. According to the installation guide, CoMaS requires an operating system of Windows 10, macOS 10.14+ or Linux Ubuntu 18.04. It also requires at least two gigabytes of free space.
The university said that e-proctoring services are being used for the 6 per cent of all courses that still require timed examinations. CoMaS has already been used for some midterm exams.
“The goal [is] to produce a system that mimics, as closely as possible, the in-person experience and upholds university regulations that govern face-to-face examinations,” wrote Jamie Carmichael, the associate registrar of SES, in an email to the university ombudsperson, Student Affairs and student unions on Oct. 14.
Carmichael said in the email that SES worked with the Carleton Privacy Office and Information Security while adjusting and improving the software.
“These systems have been used at Carleton for many years and are not intrusive AI-powered software or external service providers, but are ones with a focus on support and flexibility,” Reid said in a statement to the Charlatan.
“We are fully transparent in providing information about these e-proctoring systems to our students and are addressing their concerns before the examination,” Reid stated.
Professors can choose between conducting online exams with CoMaS, one of two university-approved options for e-proctoring, or allowing open-book exams.
“We expect, and continue to encourage, that most undergraduate course instructors will re-design their courses and/or assessments to address academic integrity concerns,” Carmichael wrote in an email to deans, associate deans, course instructors and departmental staff on Sept. 8.
Along with CoMaS, Carleton is also using BigBlueButton, a web-based conferencing platform, to conduct e-proctoring. Students using BigBlueButton are placed in individual breakout rooms and monitored by a live proctor.
While using BigBlueButton, students may be asked to show their workspace or to destroy used scrap paper after the exam, according to the student guide provided to the Charlatan.
Students expressed more confidence in the live e-proctor system through BigBlueButton than the automated data collection of CoMaS.
“I’d be overthinking whether I’d be making suspicious movements. That would really stress me out,” said Matt Burton, a second-year computer science student. “But it is better than CoMaS, for sure. [It’s] way less of an invasion of privacy.”
“Live proctoring would be a more secure, better option,” Wallace said. “Once a BigBlueButton session is done, it’s gone. Nothing is kept.”
Carleton has used CoMaS in previous years. Burton said for his e-proctored exam last year, he was given the choice of downloading CoMaS on his own computer or using it on a school computer.
The CoMaS installation guide says that students can ask their course instructor for an alternative method of proctoring if they aren’t comfortable with the software.
Perry Godse, a second-year civil engineering student, used CoMaS for an exam last week and said that his professor didn’t warn the class early enough for students to request an alternative.
Godse said that when he asked for an alternative, his professor said he could turn off the webcam but using CoMaS would still be mandatory.
Melanie Chapman, the university ombudsperson, said in an email that the university has been “very responsive” to student concerns with CoMaS.
Carleton Academic Student Government (CASG) president Matt Gagné said in an interview on Charlatan Live that he will bring up student concerns at the university senate meeting on Oct. 30.
The University of Ottawa recently came under fire from students for its use of Respondus, an e-proctoring software that can restrict what a student does on a computer and analyze webcam footage, including eye movements, with artificial intelligence to determine if a student is cheating.
Other Canadian universities, including Western University, University of Regina, University of British Columbia and University of Manitoba, have also faced criticism for the use of similar e-proctoring software.
