Victoria’s Education Department took more than two weeks to warn schools not to use Zoom because the digital platform carried significant privacy and security risks, potentially exposing children to fraud, grooming and identity theft.
The rapid shift to online learning at the start of the COVID-19 pandemic led schools to use ‘‘non supported’’ digital platforms in ways that undermined children’s privacy and safety online, the Department of Education chief information officer Elizabeth Wilson said in a June 23 report, which has been released under freedom of information.
‘‘The most prevalent of these was Zoom,’’ Ms Wilson said in the report.
The department assessed Zoom’s free version as a ‘‘Medium/High’’ privacy and security risk on March 27, but did not publish advice telling schools not to use the platform until April 14, the documents show.
The department found there were risks from Zoom’s overseas hosting, data analytics, the ability to ‘‘hijack’’ webcams and meetings, and collect health information without consent.
When children’s information is shared online it can be misused, resulting in ‘‘spam, scams, fraud, unwanted contact and grooming or even identity theft’’, according to the eSafety Commissioner, an agency for online safety.
Victorian Information Commissioner Sven Bluemmel said children’s login details and school work will have been ‘‘uploaded onto a server somewhere’’ and could be vulnerable to misuse if steps aren’t taken now to ‘‘mop up’’ by archiving or deleting this data.
He said schools would have breached privacy principles during remote learning and fixing the problems should be ‘‘a priority’’.
A department spokeswoman said schools were advised to use department-provided platform Webex for video conferencing.
The department published internal communications on April 4, which did not mandate a platform for remote meetings but warned schools that the free version of Zoom had fewer protections and an increased risk of hijacking.
Yet 24 per cent of primary school teachers used Zoom during remote learning, according to a survey by the Victorian branch of the Australian Education Union (AEUVic).
Risks occur with schools use of department-provided and free digital platforms, when technology companies’ privacy practices do not meet state government privacy standards, the Victorian Information Commissioner has reported.
The department should provide greater privacy support to schools, as ‘‘numerous other responsibilities’’ and ‘‘high workloads’’ make it impractical for schools to effectively manage privacy risks, the report said.
Mr Bluemmel said free platforms were a particular concern, because they had fewer privacy protections.
When a platform is free ‘‘that’s usually a warning sign from a privacy perspective’’, he said.
He said the use of digital platforms in remote learning has been ‘‘one of the biggest challenges to privacy in the Victorian public sector context’’.
The state government’s Information Privacy Principles set minimum standards for how government organisations, including schools, manage and protect personal information.
A department spokeswoman said the department ‘‘strongly upholds the privacy and online safety of Victorian school students engaged in remote learning’’.
She said the department advised schools not to use new third-party technologies during remote learning due to challenges with managing privacy, security and safety.
AEUVic’s research officer John Graham said teachers were in a ‘‘survival situation’’ with a very short timeline to move to a ‘‘completely unprecedented’’ system of remote learning.
Mr Graham said the use of digital platforms ‘‘was so much greater than what it had been pre- COVID’’. AEUVic’s survey identified more than 25 digital platforms used by Victorian primary teachers during remote learning.
The most commonly used platforms were Webex (used by 66 percent of teachers), YouTube (54 per cent), Epic! (47 per cent) and Google’s G Suite for Education (44 per cent), the survey found. Others included Mathletics, Compass, Seesaw, Zoom and Facebook.
Department-provided platforms, such as G Suite, also posed privacy risks, the Victorian Information Commissioner’s report said, with data being transferred to the United States and other countries.
Zoom and Google did not respond to requests for comment.
This story is co-published with The Age.
