Beware of Privacy and Other Issues When Signing Up for Free Courses

Claude AlmansiBy Claude Almansi
Editor, Accessibility Issues
ETCJ Associate Administrator

Note: This post arises from my personal experience with one “free” online course for teachers provided by an Italian nonprofit association. Hopefully, other similar offers are managed with more care. However, in case not all of them are, here goes, as a cautionary tale.

Didasca’s course about “Google Apps Education”

Last year, the Italian Didasca association launched its first free online course for teachers about Google Apps for Education. If you know how to use an office suite to produce content, doing so with Google Docs or its version for schools, Google Apps, is a no-brainer. However, using such collaborative online tools with minor students presents some specific issues, in particular privacy issues, which I assumed the Didasca course covered.

Participants’ data in a public Google spreadsheet

In December, Didasca offered the participants an opportunity to recruit additional teachers for the next course. One of those new recruiters then sent, to a mailing list, an announcement about the course but mistakenly gave the URL to the Google spreadsheet gathering the info, provided by would-be participants when signing up, instead of to the URL for the sign-up form that feeds the spreadsheet.

When I told the recruiter about the mistake, he sent the URL for a form, where one of the required data was the participant’s fiscal code (tax payer’s identity code).  I filled it in, but I entered the very virtual and improbable fiscal code of Carlo Lorenzini, AKA Carlo Collodi, the author of “Pinocchio,” who died over 80 years before Italy instituted its fiscal codes, explaining in the comments that I had done so because I did not have an Italian fiscal code, and that if had one, I would not have entered it.

I was convinced that the recruiter had deleted the spreadsheet he had  mistakenly sent the URL for. Not so: it is still online, now with the data of all the people who signed up for the course and viewable by anyone who has the link and can, therefore, create a copy of it, download it, or send it as an e-mail attachment:

screenshot of the mentioned google spreadsheet, viewable by anyone who has the link, and with the data of 25 participants (masked except mine)

[fiscal code]@didasca.org accounts

In January, Ms Alessia Nera, the course coach, wrote all the people who had signed up that she had created for them accounts with “[fiscal code]@didasca.org” as user name and “didasca” as password for everybody. Moreover, these accounts were labeled with each participant’s name and surname.

My attempt to discuss via e-mail the privacy issues involved in such accounts and the still visible spreadsheet with the recruiter and Ms Nera ended with a “Don’t worry, be happy” message from the latter. So I claimed my [Carlo Lorenzini’s fiscal code]@didasca.org account labeled with my name and surname, lest someone else use it. As a result, I was enrolled in the “Percorso Gmail” course.

Auto-complete reveals other participants’ fiscal codes, names and surnames

When I tried to write a message from the Gmail part of this @didasca.org account, after I had typed the first letter in the “To” line, the autocomplete gave me a list with the addresses of people whose first name, surname or fiscal code started with that letter, like this:

screenshot of the list of other participants' accounts revealed by autocomplete (personal data are hidden)

Asking course participants to boost Didasca’s ranking

On February 17, 2009, Silvero Carugo, self-appointed rector of Didasca, sent the participants of PerCorso Gmail a message, requesting that they rank and review Didasca’s listing on the Google Apps Market Place.

Or more precisely, because things are never that simple with Didasca: Ms Nera sent  a “From the Rector’s Desk” message to the participants’ personal e-mail addresses, telling them to log into their [fiscal code]@didasca.org account to read the message from the rector. And  that message, instead of giving the direct link to the listing, pointed us to the “Off Track #08” Il Google Apps Marketplace tutorial. Why “#08” is a mystery, considering this was the first “Off Track” tutorial we received. Anyway, the reading consisted of nine A4 pages describing a particularly longwinded way to find the page for the listing and how to rank and review it.

A few of us gave low rankings, due to the cavalier way Didasca had created our [fiscal code]@didasca.org accounts without asking us first. So Ms Nera sent a first message to our personal addresses asking us to change at least our ranking “in melius,” with a link to a video tutorial explaining how to do it. Then she sent all participants a second e-mail telling them to enter our @didasca.org accounts to read a message from the rector on the same subject.

In this message, he thanked those who had given good rankings, pointed out that a low general ranking would mean problems with the sponsors, and announced a competition in March to select the best reviews, with the 10 receiving the most votes getting a “Best Review Award.”

Donation-conditioned premium offers

Didasca’s  statute defines it as a nonprofit association. This means that it can legally charge members for services and goods delivery without having to pay value-added tax. However, many course participants are not members of Didasca so, for them, there are donation-conditioned premium offers:

Premium @didasca.org accounts: On February 24, participants in the PerCorso Gmail course received a message from Ms. Nera, entitled “A grande richiesta…” (roughly, “in answer to great demand”), offering them a premium version of their @didasca.org account. In the message, she pointed  to the “Off Track #09” L’ account @Didasca.org tutorial for further info.

In essence, the 5-page tutorial explains that people who are unhappy with their [fiscal code]@didasca.org account/address can get an alternative [name.surname]@didasca.org version by donating €25 to the “Fondo Pro Schola” via PayPal. A tutorial on how to make that donation was also included.

Interestingly, in the “A grande richiesta…” e-mail – but not in the tutorial – Ms Nera gives a link to the Google Apps Privacy Page [see its English version], which says:

Google Apps is offered by Google in conjunction with your domain administrator and that administrator may have access to your account information including your email. Specifically, subject to your domain administrator’s privacy policies, your domain administrator may: (…)

  • Change your account password, suspend or terminate your account access and your ability to modify your account;
  • Access or retain information stored as part of your account, including your email, contacts and other information; (…)

Will many people pay €25 for an account where Didasca has this kind of control?

Advanced My DIDASpedia: My DIDASpedia – https://sites.google.com/a/mydidaspedia.it/mydidaspedia; framed version http://www.mydidaspedia.it – is modestly described as:

‘Il libro di testo digitale gratuito adottato dagli Insegnanti dalla mente acuta’
[the for-free digital text book adopted by sharp-minded teachers]

Priceless Knowledge @ No Cost

After clicking twice on Forward to move through some more promo in the same coy style, you get to a page with a Come ottenere My DIDASpedia in versione Avanzata [How to get MY DIDASpedia in advanced version] link. And that page says that you can get it, again, by first making a donation via PayPal to the same Fondo Pro Schola as for the premium @didasca.org account, but this time of €50.

Then the page says that there is a second step towards getting this advanced version: filling a request form that can be accessed by “clicking on the button below.” Except that there is no button below: whether a mistake of omission or of commission I am not sure.

DIDASpedia, DidasKnol and DidasFarce

DIDASpedia: Whether there is a connection between the above mentioned My DIDASpedia and DIDASpedia is not explained. Anyway, DIDASpedia’s site – http://sites.google.com/site/didaspedia/home – explains that it is:

  • a platform enabling capable and willing Teachers, together with their Colleagues, Students and Relatives, to create digital text-books that can also be used for free by all stakeholders of the Italian school”
  • made of a set of Google Sites, whose pages are made with Google Docs and Google Knol.
  • is part of the educational materials made by the  DIDASforce – Task Force for Innovation in Education in the context of the 5 ‘C’ action plan: Comunicare e Collaborare per Creare e Condividere la Conoscenza [Communicate and Collaborate towards Creating and Sharing Knowledge] promoted by DIDASCA – The First Italian Cyber Schools for Lifelong Learning.
    (my translation)

Some “Didaspedia”  pages were created by Ms Nera for participants in the PerCorso Gmail course, for instance:

Though both are meant to be used for  copies of existing online texts  in the public domain, Ms Nera put them under a http://creativecommons.org/licenses/by-sa/3.0/deed.it license. I pointed out that Creative Commons licenses are copyright licenses and that a work in the public domain cannot be put under a copyright, therefore neither under a CC license. Ms Nera apparently misunderstood that because she then added to them a “disclaimer”:

The above artefact is the product of a collaborative academic exercise made by teachers and students which, by its nature, entails the use of copyright-protected material.
(my translation)

adding that this was done under “fair use” (a concept that does not exist in Italian copyright law, where there are only specific copyright restrictions allowing specific uses) and giving a contact address in case right holders want to object.

Both pages also  link to a form would-be collaborators have to fill: a Google form, of course, which asks for even more detailed info than the one for the PerCorso Gmail course:

  • @didasca.org e-mail address
  • name of the school of the would-be collaborator
  • school location
  • province
  • role (school direction, teacher, student, other)

Hopefully, few teachers would ask their students to give such data to a concern like Didasca in order to collaborate with them in an online project when there are heaps of other more secure solutions.

The DidasKnols – project description in http://www.didasknol.it – do not present the same privacy issues. As explained by Mr Angelo Nera of Didasca’s “Consulta degli Esperti” in a comment to this one, they are just Google Knols published together in a “DK” category. There is no way to force people to give the above-mentioned data to Didasca. Some are simple arithmetic problems; others are well-researched presentations of a topic, which is what knols are meant for.

However, many are straight or patchwork copies of other people’s texts under a Creative Commons licence. As knols are not meant for that, when you click on the citation link on top, the bibliographical reference that appears only mentions the knol’s creator as author, thus violating the CC license of the original authors.

In the case of Ms Nera’s Programmare con Python, this automatic attribution issue is compounded by her using text images made from the textual PDF file of Aurora Martina, Angelo Raffaele Meo, Clotilde Moro and  Mario Scovazzi’s “Passo dopo passo impariamo a programmare in Python” (downloadable from http://linuxdidattica.org/polito);  as she never mentions their names in textual form, they cannot even be indexed by search engines.

In a comment to this DidasKnol, Ms Nera explains that its  goal  is to enable the  authors to prepare a revised version of their handbook. This is patently absurd since you cannot edit text images. And this  format  is also in blatant contradiction with http://www.didasknol.it/didasknol2.html about accessibility for people with sensorial disabilities, which claims that the DidasKnols will be offered  in DAISY (for screen readers) and BRF (for braille bars) formats. No way you can do either with images of text.

Primi passi con Knol – Creative Commons by Mr Giacobini  is textual, at least, and he does acknowledge one source of his  patchwork of copies. However he says nothing about at least three other sources (one of them is under strict copyright) he also copypasted from, which I listed in a comment to his knol.

In his comments to these two DidasKnols, Didasca’s rector Silvero Carugo enthused about them. About Mr Giacobini’s, he wrote:

Tutti noi della DidasFarce avvertivamo la necessità di questo didasknol !
(All we members of DidasFarce were feeling the need for this didasknol !)

(Could he have meant DidasForce? He registered the didasforce.it domain in 2009, but the website only contains a logo.)

Didasca’s expansionism

It would be nice if Didasca, DidasKnols, DIDASpedia etc. could simply be dismissed as a “DidasFarce.” The problem is the operation’s expansionistic views. The already mentioned L’ account @Didasca.org tutorial also says:

Al dominio Didasca.org si possono collegare 10 milioni di account, un quantitativo tale da poter soddisfare le esigenze di tutti gli utenti del Sistema Scolastico Nazionale.
(10 million accounts can be connected to the Didasca.org domain: a quantity sufficient to satisfy the needs of all users of the National School System).

Moreover,  Didasca also has a syndicate.

In its Chi sono i ‘figli di un dio minore’? (Who are the ‘children of a minor god’?) page, this Didasca syndicate first accuses school directors who refuse to do so of alleging specious motives for depriving their staff of the “advantages of the ‘GoogleApps @ Didasca.org’ operation.” And then, it offers these “deprived” teachers the opportunity to sign up individually – via yet another Google Form. This form, even though it is meant for teachers whose school directors object to the Didasca offer, also requires the indication of their school’s “codice meccanografico,” an alphanumeric identifying code.

As the mechanographic codes for all Italian schools can easily be retrieved online, e.g., via this query form on the website of the Italian Ministry of Education, it  seems absurd to require this data in this instance – unless the Didasca Syndicate aims at harvesting as much data as possible about schools that refused the Didasca offer for future use, e.g., if there is a new school director.

Conclusion

Whether the expansionist strategy of Didasca and its syndicate will succeed seems doubtful. While some teachers might get taken in by their “free” course  offers, it seems likely that school directors will continue to show more critical sense in examining them.

However, others might use the same online tools to pursue the same goals as Didasca. Should they do so in n a less blatantly obnoxious and blundering manner, they might be really dangerous.

2 Responses

  1. Claude, thank you for bringing this critical issue to our attention. As educators, we’re drawn to online seminars and workshops especially when they’re advertised as “nonprofit” and “free.” Most of us believe in open learning and make an extra effort to support these efforts.

    However, as you say, hidden dangers may be lurking. For example, those managing these events may not be as knowledgeable or concerned about security procedures and could make careless mistakes that easily expose private information provided by those who have registered for the seminar.

    Also, there may be “hidden” costs for participation that may not be obvious at the outset.

    Your experience with Didasca should serve as a warning that “free” can also be “costly” if we’re not careful. -Jim S

  2. Thank you for your comment, Jim.

    I was about to reply that in Didasca’s case, the main problem with their “free offers” was their exploitation of participants’ hang-ups about looking into gift horses’ mouths.

    But we participants in the current PerCorso Gmail course just received an invitation from Didasca’s “Rector” to a Cloud Computing – Google Apps nella Scuola e nelle Aziende (… at school and in enterprises) workshop next Saturday,
    He also gave us a link to Comunicare l’Impresa col Web, the description of the new set of Didasca 4 courses for small and medium enterprises he shall present at that workshop next Saturday:

    1. PerCorso Gmail 2. PerCorso Google Docs 3. PerCorso Google Sites 4. PerCorso AdWords

    Signing up for them, this time, will entail the usual “previous €50 donation” to the usual Fondo Pro-Schola – this time per participant, for each course. As the Didasca listing on Google Apps EDU and Business online Courses (which, as I wrote in the post, its rector asked participants of the “Percorso Gmail for teachers” to rate favorably to boost its ranking) says that this new program of courses “will address 50,000-100,000 Italian SMEs”, this could potentially mean a nice lump in “previous donations”.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: