Psychology, Cybersecurity and Collaboration in Educational Technology

We were beta testing Field Effect's state of the art Cyber Range online cybersecurity training system this week in our grade 10 TEJ introduction to computer technology course.  Our skill levels in that open class range from two students who are top ten in Canada in the CyberTitan student cybersecurity competition in their respective disciplines, to students who have never owned a personal computer at home because their parents thought a series of gaming consoles would adequately prepare them for life in the Twenty-First Century.

The challenges of keeping students with such diverse skillsets engaged in a single classroom aside, I'd agreed to beta-test this software because it offers a way past one of the biggest blocks to schools entering the Cyberpatriot/CyberTitan competition.  To participate in the competition you need a desktop or powerful enough laptop computer being run by an operating system that can do more than just browse webpages through a single corporation's lens.  Virtual machines are whole computers that can be simulated in a single window, and they offer a valuable tool in examining cybersecurity issues without putting your school network or computers in peril (installing a virus to see what it does on a school computer would produce obvious headaches).  If things go wrong in a virtual machine you just shut the window.

The Field Effect remote software ran fantastically well on our DIY student built classroom desktops and would work equally well on something as simple as a Chromebook,though trying to do this through a single, tiny 1366 pixel wide monitor would be a headache.

Once we got everything up and running I reminded students that they were manipulating a remote, virtual computer stored on a server in Ottawa.  When you're aware of what's happening behind the screen, seeing what we can do on networks with enough bandwidth, like the one we now have at school, is mind blowing.

The cybersecurity gurus at Field Effect didn't muck about when they set up this virtual online image.  When you first boot up the compromised Windows 10 image you're met with a full screen warning with flashing lights and a locked screen telling you that you've been ransomwared.

Even though students had been repeatedly prepared for this and I'd explained what a virtual machine was and how whatever happens in it doesn't hurt anything, this threw half of them into a panic.  The responses ranged from randomly mashing buttons to giving up, sitting back and loudly commenting on how stupid everything was.  That's in an optional course full of students who have demonstrated an interest and willingness to learn computer technology.  The vast majority of students (and staff) in education don't get nearly that much training, yet they're all still increasingly depended on digital technology in every class they're in.

The psychology of the attack was interesting.  The flashing warnings and countdown timer did what it was supposed to do with anyone lacking in digital skills (which is a startlingly large number of people in Canada in 2020).  Cybercriminals depend on this technical illiteracy.  My CyberTitans and many of the other digitally savvy kids in the room right clicked on the flashing screen and exited 'full screen' mode, which brought them back to a desktop, which some then got lost in:

This 'geek prank' fake WindowsXP desktop was also on 'full screen' behind the ransomware fullscreen warning, but even when others showed students trapped by the ransomware screen the same F11/exit full screen way out of it, many had already succumbed to frustration and had given up (again).  Several spent long minutes in the fake XP desktop trying to do things even when it said 'fake XP simulator' right on the screen.  Being unresponsive to what a computer is telling you when things aren't working right is a common response in weak users.

The digitally skilled CyberTitans were past the two blocks in seconds and were figuring out how to secure this hacked Windows 10 laptop and restore control for the proper user on it.  More than 70% of the class were stuck in two hacks that were so easily resolved that I was left wondering how we could back things up and restore their mangled pride.  Many of them, only a few days before, had done "my-experience-with-technology" presentations where they'd described themselves as digitally savvy, on Thursday morning this was in tatters.

The actual work of a cybersecurity operator in a case like this is not just to return things to normal but also to diagnose and identify the attack vector.  In an administrative user account that shouldn't have been on the machine there were files and instructions for how to run the malware, and even some background in downloads and browser histories that explained why this other employee had done what they did, but many of the students - including the quick movers, quickly deleted the evidence instead of forensically examining it.

This brought up the opportunity to talk about how much of what information security professionals do in our very networked world is more like a detective than a traffic cop.  It isn't just a matter of making sure every user complies with expectations, it's also vital to understand how the system was compromised because this will guide future security defensive settings.  It's things like this that have me wondering why there are no cybersecurity courses running in any Ontario high school, or no mention of cybersecurity in Ontario computer technology curriculum.  Any mention of security in the curriculum is rooted in 20th Century ideas of passwords or at best wifi encryption, the world has moved on.  The cloud-based networked world we're all leveraging in every classroom in Ontario goes unmentioned.

Once we got past the opening chaos, many students got into the detail work of repairing settings deep inside Windows, restoring control to the correct user and locking down firewalls that the ransomware had opened up.  If this all sounds greek to you it shouldn't, you're using all those things right now to read this.  And you and your students are using them every time you have them login to a cloud based service.  We're all offering an 'attack surface' to cybercriminals whenever we go into the cloud, but pretty much everyone is blissfully unaware of it.  People (users) are part of that cyberattack surface.  Not addressing cyber-illiteracy means you've just opened up opportunities for bad actors.

The problem then became all the wounded male pride in the room.  The students who struggled and gave up were also the ones who adamantly refused to get up and collaborate with the other people in our mono-gendered morning cohort.  Fragile male pride means you can't be asking for help - or collaborating, especially in a subject where you've convinced yourself you're an expert.  The more gender balanced afternoon cohort was constantly communicating and hive-minded their way through the infected image so effectively that most of them actually finished it with a perfect score.

The opening hacks were a source of laughter rather than long faces in the afternoon group.  The lack of collaboration in the morning cohort and then the negativity that descended was something I'm thinking about as we proceed into our violently crushed quadmester.  I've encouraged collaboration in face to face computer tech classes as no one works alone in modern tech jobs, yet the boys seem at a distinct advantage when it comes to creating or engaging in collaborative work, though even a small population of girls changes this dynamic.

This is an even bigger problem in my conservative country school where girls are peer and system pressured out of taking technology courses.  I'm lucky to have 10% female participation in my junior computer technology courses.  In senior courses we're lucky to have a single girl in any of the classes of up to thirty-one students.  The is problematic beyond our classroom.  Women are least engaged in engineering and computer science where the most lucrative careers currently are.

At the end of the day many students got their first glimpse into cybersecurity and a number of them are curious, which is good because we need to open up this pathway to students.  My original intent in giving this a try was to give students an opportunity to demonstrate their technical skills, but a surprisingly large chunk of the class, including students I thought would dig through it more effectively, were startlingly quick to give up and get pwned by some pretty simple hacks.  This is making me wonder how Ontario students are doing in our half elearning face to face and fully remote learning courses during this pandemic.  I fear our level of technical fluency is so shallow that unless online teachers are all doing simplistic, repetitive tasks that require no actual digital fluency, they and their students are unable to effectively engage.  This goes a long way to explain poor online engagement.

From the latest attempt to encourage Ontario
Educators to integrate cybersecurity into their
practice, especially if they're putting children
on hackable online devices.

I realize that cybersecurity scares the daylights out of most people (I've spent the past 3 years trying to engage Ontario educators in it to poor effect), but if we're going to be putting more and more of our education system into digital spaces then we're all responsible for raising digital fluency to the point where everyone can demonstrate resiliency in the face of unexpected outcomes.  At the moment, throwing up your hands in the air and giving up seems to be the solution for too many people.  Hopefully things like ICTC's work with Field Effect will help spread a deeper and more resilient tool for improving cyber-fluency.  Everyone working in the cloud needs this.

Surveillance Capitalism and Educational Technology

I'm currently finishing Matt Crawford's third book, Why We Drive.  His first book, Shop Class As Soulcraft arrived just when I was transitioning out of years of academic classrooms into technology teaching and it helped me reframe my understanding of my manual skills that are generally seen  as less-than by the education system I work in.

Why We Drive looks at how we're automating human agency under the veil of safety, ease of use and efficiency.  But in examining the work of the technology companies providing this technology, Crawford ends up uncovering a nasty new version of voracious surveillance capitalism at work in the background.

In an education system that can't get into bed with the masters of surveillance capitalism quickly enough (we're a 'Google Board' full of 'Google Teachers'), this makes for particularly uncomfortable reading.  Crawford makes persuasive, well researched arguments for why we shouldn't be leaping into Google's brave new world.  Meanwhile I'm watching public education indoctrinate children into feeding the cult of Google.

Crawford comes at this from the point of view of driving because Google and the other attention merchants are very excited about moving us to driverless cars in the near future, and Crawford is skeptical about their motivations for doing this.  From Shop Class As Soul Craft to The World Beyond Your Head and now in Why We Drive, Crawford has always advocated for human agency over automation, especially when that automation is designed to simplify and ease life to the point where it's obvious we're heading for a Wall-E like future of indolent incompetence in the caring embrace of an all-powerful corporation.

Situated intelligence is a recurring theme in Crawford's thinking and he sees it as one of the pinnacles of human achievement.  He makes strong arguments for why surveillance capitalists aren't remotely interested in human agency and the situated intelligence it leads to, and he fears that this will ultimately damage human capacity.  Among the many examples he gives is that of London taxi drivers:

Google isn't the only target in this book.  Tesla's misleading manipulation of crash data in self driving cars and Uber's manipulation of markets using its capitalization to dismantle existing industries that were providing a service within market forces are also targets.  Uber and Tesla's goals align with feeding the Google engine more human experience (that's where the money is), though this is often hidden behind marketing around safety, ease of use and efficiency closely tied to unarguable issues like climate change .  The quote above describes the difference between a London cabbie who has to commit to years of 'deep cognitive accomplishment' in order to become a driver in the city.  Uber's thinly veiled attack on an otherwise viable career by using untrained, underpaid and ultimately disposable drivers to break that livelihood before replacing them with automation is damning.  What 'tech' companies say seldom aligns with what they do.

'Free' means something different in surveillance
capitalism.  Note the accessibility and simplicity,
a common idea in edtech marketing, because
learning digital tools doesn't mean understanding
them, it means learning to consume on them.

I can't help but see parallels with educational technology.  We recently had another technology committee meeting where it was decided that once again we would buy hundreds of Google Chromebooks: "simple yet powerful devices with built-in accessibility and security features to deepen classroom connections and keep user information safe"   Notice the hard sell on safety and security, like something out of Tesla and Uber's misinformation marketing plans.  The reason your student data is safe is because Google is very protective of 'its' data, and make no mistake, once you're in Google's ecosystem, your data IS their data.

These plug in to our 'walled garden' of Google Education products that keep iterating to do more and more for students and staff until they're sending emails no human wrote and generating digital media automatically, all while saving every aspect of user input.  Board IT and myself argued for a diversity of technology in order to meet more advanced digital learning needs, but advanced digital learning isn't what we're about, even though we're a school.  Digital tools now mean ease of use and cost savings (though this is questionable), they are no longer a tool for learning as they increasingly do the work for us.

As Crawford suggests, the intention of these tools is ultimately to automate our actions and direct us towards a purchase.  That fact that we're dropping millions of dollars in public funding at best familiarizing students with their future consumer relationship with technology is astonishing.  As big tech gains access to increasingly personal information, like your geographic location, patterns of movement and even how you ergonomically interact with a machine, personal data gets harder to anonymize.  The push is to get into all aspects of life in order to collect data that will serve the core business... 

Crawford offers example after example of technology companies that offer ease of use and accessibility under the unassailable blanket of safety, ease of use and efficiency.  This too has crept into education technology, where instead of taking personal responsibility for our use of technology we surrender that critical effort to the inscrutable powers that be.  One of the intentions of the new normal is to produce people that do not question authority because a remote, cloud based authority is unquestionable.

From Shop Class forward Crawford has been critical of the 'peculiarly chancy and fluid' character of management thinking, which also falls easily into the safety/automation argument being provided by the richest multi-nationals in the world.  That system managers fit in well with system think shouldn't be a surprise, but for anyone left in the education system who is still trying to focus on developing situated intelligence, it's a completely contrary and damaging evolution.  I shouldn't be surprised that the people running things want to cut out the complexity in favour of safety and ease of use (even if that isn't what's really being offered), but any teacher thus focused has lost the plot.

Google and the rest don't 'give' software to education any more than they 'give' software to the general public.  All of their instruments 'serve its core business of advertising'.  Andrew Campbell has long had an eye on this, not that any critical analysis has stopped Ontario's educational management from hopping into bed with Google and the rest as quickly as it can.

And how do you automate people?  Get them in the system as soon as possible and make it familiar.  Forcing children to learn corporation specific tools instead of offering them platform agnostic access to educational technology is a good starting point.

There are still questions around how student data is used by Google. Crawford highlights how location data can't be anonymized (it's like a finger print and very individually specific), so even if your corporate overlord isn't putting a name on a data set, they can still tell whose data it is.  Location data is a very rich vein of personal information to tap if you're an advertising company, which is why Google is interested in developing self-driving cars and getting everyone into convenient maps.  Unless you're feeding their data gathering system they don't lift a finger.

Towards the end of the book Crawford leans heavily on Shoshana Zuboff's (Harvard Business School Professor Emeritus in case you're questioning the validity of this research)  Surveillance Capitalism, which came out in 2019.   Zuboff makes multiple appearances in Netflix's The Social Dilemma, which explains how surveillance capitalism has developed as a cancer immune to society's protective processes because it goes after something that has no legal protections:  our digital/cloud based data.  As an economic weapon, a US law from the late nineties that absolved social media companies from responsibility for what appears on their sites under the name of 'internet freedom' has done untold damage around the world.

Crawford goes so far as to describe this as a new kind of colonialism that we're all under the yoke of, but passive analysis isn't the end goal.  He shows experiments like Pokemon Go (created by Google) as a test in active manipulation.  The goal isn't to create a new level of advertisement based on predictive algorithms, it's to build an adaptive system that can sublty manipulate user responses without them even realizing it.  In doing so he also explains why so many people are feeling so disenfranchised and are making otherwise inexplicable, populist political decisions:

Google's mapping projects are situated in colonialist intent (empires make maps in order to control remote regions).  By mapping the world and giving everyone easy access to everywhere, local knowledge becomes worthless and a remote standard of control becomes a possibility.  Smart cities are shown in this light.  The language around all 'smart' initiatives from edtech to smart cities all follow the same ease of use/efficiency/safety/organizational marketing language.  This language is unassailable (are you saying you don't want efficiency, safety, ease of use and organisation?)  This thinking is so ubiquitous that even trying to think beyond it is becoming impossible.  Though tech-marketing suggests that ease/efficiency/safety is the intent, the actual point is data collection to feed emerging markets of predictive and influencer marketing; digital marketing is Big Brother.  Orwell was right, but he couldn't imagine a greater power than centralized government in the Twentieth Century.  The Twenty-First Century produced the first world governments, but they are corporations driven by technology enabled mass data gathering that are neither by nor for the people.

There is no way out of the endless cage Google is constructing.  Self-driving cars and driving itself are the mechanism by which Crawford uncovers an unflattering and insidious form of capitalism that has already damaged our political landscape and looks set to damage human agency for decades to come under the guise of safety, efficiency, ease of use and security.

Any criticism of this is in violation of the cartel that supports and is supported by it and results in a sense of alienation that leads to anger and populist resentment.  Governments, including public education, can't tap into this 'free' technology fast enough, but of course it isn't free at all, and what we're giving up in the pursuit of easy, efficient and safe is at odds with the freedom of action it takes from us.

I've long held that understanding technology allows you to author it instead of it authoring you.  In the detailed Guardian surveillance capitalism article by John Naughton, Zuboff makes a point of stating that digital communications are not inherently monopolistic in intent which is something Matt hasn't done in Why We Drive (I get the sense that he doesn't like digital technology in any capacity):

"While it is impossible to imagine surveillance capitalism without the digital, it is easy to imagine the digital without surveillance capitalism. The point cannot be emphasised enough: surveillance capitalism is not technology. Digital technologies can take many forms and have many effects, depending upon the social and economic logics that bring them to life. Surveillance capitalism relies on algorithms and sensors, machine intelligence and platforms, but it is not the same as any of those."

There was a time when digital technology wasn't being driven by advertising.  The early internet wasn't the orderly, safe and sanitized place it is becoming, but it was a powerful change in how we worked together as a species.  I don't know that I buy in to all of Matt's arguments in Why We Drive, but his fundamental belief that we should be using technology to enhance human ability rather than replacing it is something I can't help but agree with, and any teacher focused on pedagogy should feel the same way.

Why We Drive is the latest in a series of books and media that is, after years of political and psychological abuse, looking to provide society with a white blood cell response to surveillance capitalism.  Rather than taking some of the most powerful technology we've ever created and aiming it at making a few psychopaths rich while enfeebling everyone else, my great hope is that our understanding of this nasty process will give us the ability to take back control of digital technologies and develop them as tools to enhance human capabilities instead.  We need to do that sooner than later because the next century is going to decide the viability of the human race for the long term and we need to get past this greed and short sightedness in order to focus on the bigger problems that face us.  We could start in education by taking back responsibility for how we use and teach our children about digital technologies.

***

I've long been raging against the corporate invasion of educational technology:

 

Thankless Jobs and Crooked Paths

Top to bottom in education. There's a
workplace stream 'beneath' vocational,
but that isn't worth mentioning?

The prejudice against manual skill is ongoing in Ontario education.  I was chatting with one of our auto-shop teachers the other day and we were both lamenting the abuse of our manual skills in the halls of academia.  A teacher who was musing on why students 'waste their time' taking tech courses the week before was begging this same auto-shop teacher to change her snow tires a week later, even though she knew he had no students available to do it.  He is a qualified automotive technician, but he isn't paid to be one when he's at school, he's paid to teach, but that doesn't stop people who only operate in the rarified realm of ideas to expect free access to the hard earned, hands-on skills he has taken years to develop.  He talked about how he was often at school hours after everyone else had left finishing automotive repair jobs for people who pay for his time and expertise with their earnest thanks and little else. He's still expected to do the make-work extra duties that the academics have worked out for themselves.

I'm in the same boat in terms of information technology skills. I spent years of my life and my own money becoming qualified as a technician.  I can fix pretty much anything, but that's not what I'm being paid for when I'm at school.  I've opened up access to in-school IT support because it gives my students an opportunity to develop genuine, experientially driven skills that widen the scope of their learning.  Last year, in spite of  my making numerous suggestions that would have kept computer science alive in the building (it's since been cancelled on-site) as well as keeping a senior computer engineering class available in each semester to provide needed in-school IT support, one of my senior sections got cancelled.  This hasn't stopped the expectation that I provide IT support in the school even when I'm being double doubled by an absurd schedule.  I'm able to help and the last thing I want to see is a colleague in distress because their tech isn't working, but asking for that effort  to be recognized is a step too far.

Now that I'm out of that cruel always on in two places at once schedule I asked if my hours of extra support work (I was the only teacher in the building still doing their usual extra duties) be acknowledged and was told they wouldn't - I get to do the same make-work as all the academics, just like our auto-teacher who is here for hours doing work for the school 'community' of which we are clearly not equal members.  The logic for this is that my extra duty work is equal to another teacher standing in the cafeteria watching teenagers eat lunch (what most teachers do as extra duty).  What I'm doing took years of training and numerous professional qualifications, what they're doing requires a pulse - except they aren't even doing that because no one is eating lunch in school at the moment, though everyone has doubled down on tech use and the support it requires.  Why is this the outcome?  Because in the minds of graduate degree educational management manual skills are treated as next to worthless.  This is a value theory decision.  Ignoring the value of expertise means you can treat it as a free expectation.

This happens to many technology teachers.  They get paid less because teacher pay is wrapped around academic/university achievement that the vast majority of the people running the system are products of.  My own experience in trying to apply my vocational experience even while already an academic teacher demonstrated this prejudice in startling clarity.  The College of Teachers can understand a degree with little effort, but show them a decade of industry qualification and experience and you can expect it to be dismissed out of hand.  Tech teachers make less but are expected give away the skills that make them qualified to do what they do in a way that other teachers simply aren't.  We go so far as to invent meaningless make-work extra duties (like cafeteria duty) so the academics can top up their time with minimal effort (and no chance of getting their hands dirty).

A few weeks ago my IT qualifications got dismissed by another administrator who equated years of training, experience and multiple industry certifications with watching a few hours of video and writing a multiple choice test.  Academic prejudice is real and everywhere.

I fired a Statistics Canada research piece on Canada's poor handling of women in STEM and particularly in engineering and computer science to our SHSM, guidance and administration, which prompted a good talk with our local SHSM head.  My argument was that academically focused girls are directed out of engineering and technology pathways toward more 'gender appropropriate' pathways (that are also usually far less lucrative) by peer pressure.  My experience at last year's CAN-CWiC Conference repeatedly told the story of women who regretted not pursuing technology related pathways in high school and having to expensively pivot later in life.  Sexism, under the guise of peer pressure and student choice, play a big part in this, but it also reflects a lack of appreciation for alternative pathways inherent to our academically prejudiced education system.

A teacher who got straight A's in high school, went straight to university and got straight A's there too and then went straight into teacher's college (straight A's again) before being deposited into yet another classroom for the next twenty-five years of their lives are going to carry academic prejudices with them because they know of no other experience.  Any student not on that straight and narrow path of 'excellence' is less than.

I frequently see the system make aggressive resource grabs to ensure academic courses run.  University bound sciences will run at less than 50% capacity while workplace and applied courses are frequently bundled together or cancelled and non-academic students are just dropped into academic sections because they are all that's available.  An example of academic protectionism are french immersion courses where academic students are protected in classes that are often a fraction of what they should load to because those students are special.  Everyone else has less to ensure system resources are focused on the academic streams even though these students are frequently the ones most capable of doing more with less.  My own school sports a higher than 50% graduation into the workplace statistic while spending the vast majority of its resources protecting university pathways.

Our SHSM head said a colleague of hers once described the route that students not on the straight and narrow academic route take as the 'crooked path'.  I've walked this path, unlike the majority of teachers.  I dropped out of grade 13, worked in an apprenticeship as a millwright, attended college then dropped out and then went back into summer school and high school in my early twenties to graduate before going on to attend university.  I then worked in the world for over a decade before becoming a classroom teacher - a job I never thought I'd be doing after my own negative experiences as a student in the same system.

That crooked path is seen as less-than by academics.  Students who would benefit from my M (college/university - essential doesn't run because it would mean reducing the number of students they can stuff into my shop) technology program are told not to 'waste their time' taking tech when they could take three sciences they don't need because they are more credible when applying to university.  That's backed up by backwards universities demanding irrelevant but 'difficult' courses to access their STEM program, ignoring TE even when it's a TE program!  Academic prejudices learned in universities trickle down.

Tactile skills training has always had trouble fitting into academic education.  The extra costs and safety concerns make rows of robots, I mean students, doing 'academic' (white collar office) work much cheaper - it's also cheaper to apply digital technology too as our recent school decision to buy nothing but Chromebooks even as board IT and I suggested differentiating our technology to meet specific needs (again - we've bought nothing but Chromebooks for years).  Whether you want to look at resource allocation, guidance direction or even just how teacher duties are assigned, the prejudice against hands-on skills is systemic.