New study examines privacy and security perceptions of online education proctoring services

In a first-of-its-kind study, researchers led by Adam Aviv, an associate professor of computer science at the George Washington University, explored the security and privacy perceptions of students taking proctored exams. After analyzing user reviews of eight proctoring services' browser extensions and subsequently performing an online survey of students, the researchers found:

• Exam proctoring browser extensions use a technique called "URL match patterns" to turn on whenever they find a given URL. These URL patterns match a wide variety of URLs, most associated with online course content. However, generic URL patterns (e.g., any URL that has /courses/ or /quizzes/) can also activate the browser extension regardless of whether the student is taking an exam. As a result, the data collection and monitoring features of proctoring browser extensions could be active on a number of websites, even when a student is not taking an exam.
• Students understood they would need to give up some privacy aspects in order to take exams safely from home during the pandemic. However, a large number of students had concerns about sharing personal information with proctoring companies in order to take an exam. These concerns include the process of identity verification, the amount of information collected by these companies and having to install third party online exam proctoring software on their personal computers.
• When reviewing exam proctoring browser extensions in the Google Chrome web store, there was a noticeable increase in February 2020 in the total number of ratings combined with a sharp decrease in the "star ratings" for these extensions. This likely indicates an extreme dislike for exam proctoring services.

"Institutional support for third-party proctoring software conveys credibility and makes the exam proctoring software appear safer and less potentially problematic because students assume that institutions have done proper vetting of both the software and the methods employed by the proctoring services," David Balash, a PhD student at GW and a lead researcher on the study, said. "We recommend that institutions and educators follow a principle of least monitoring when using exam proctoring tools by using the minimum number of monitoring types necessary, given the class size and knowledge of expected student behavior."

"As many universities and colleges return to the classroom, students may be less willing to trade their privacy for personal safety going forward," Rahel Fainchtein, a PhD student at Georgetown University and a lead researcher on the study, said. "However, at the same time, online exam proctoring technology appears here to stay."

The paper, "Examining the Examiners: Students' Privacy and Security Perceptions of Online Proctoring Services," will be presented at the 17th Symposium on Usable Privacy and Security on August 10, 2021. In addition to Aviv, Balash and Fainchtein, the research team included Dongkun Kim and Darikia Shaibekova at GW and Micah Sherr at Georgetown.