Employees of political science have become concerned after the publication of Mare’s article, which revealed that the cameras, called ‘classroom scanners’ by the university, can do much more than just count people.
Initially, their letter was intended for their own institute, says Hilde van Meegdenburg, one of the authors. But ultimately, 170 colleagues from the entire Faculty of Social and Behavioural Sciences signed the letter in just three days’ time. The letter was sent to Dean Paul Wouters on 23 November on behalf of all the signatories. He has not responded yet.
‘Through this letter, we express our concerns regarding this development’, the employees write, ‘and we ask the board for clarification on the compatibility with the strict rules of the General Data Protection Regulation (GDPR).’
Quite apart from ‘the fact that the installation was not communicated to employees and students and that the security of the privacy-sensitive data was poor’, the authors want clarification on the amount of data processed by the cameras.
‘I have to admit that I raised my eyebrows when I read the article’, said outgoing Minister of Education Ingrid van Engelshoven on Wednesday during a debate on cyber security in education. Peter Kwint, a Member of Parliament for the SP, brought up the issue of the cameras.
‘I have not yet been in contact with the institution to ask whether this is true,’ Van Engelshoven responded, announcing that she would do so. ‘I would like to be kept informed of this’, Kwint said.
The debate covers various aspects, Van Engelshoven noted. ‘Securing the systems so that people cannot access them, but also making sure that the data is used in the right way and that privacy is safeguarded.’
Institutions should work together more often with regard to these matters, said the minister, and learn ‘common lessons’. ‘I really want to stress this: learn from the mistakes of others. There will always be mistakes and data leaks. Don’t hide it, share it.’
‘Ethical hackers could be of great value here,’ she says. ‘I am sure there are students at universities who are up to such a challenge.’
According to the university, the sole purpose of the cameras is to count people. However, the privacy settings were configured in such a way that they analyse much more than just numbers of people. The university stated that the cameras were set to privacy level 1, but the data examined by Mare revealed that at least one camera, for which the login page was accessible via Google, was set to privacy level 0. This means that a live stream was showing.
The authors consider this highly undesirable. ‘Even at the stricter levels, the cameras analyse more information than just the occupancy. We find all the possibilities more than undesirable and think they should be restricted.’
There is also a lot of uncertainty as to who has access to the system. Who decides what data is collected, stored and analysed? Which data? Where? And for how long? Who monitors the university’s use of the system?
‘Considering all the possibilities of this system, we also want to know whether there will be independent audits of the use, implementation and data protection measures on a regular basis.’
Finally, the authors want to know whether alternative solutions have been considered for measuring the occupancy levels, and if so, what alternative solutions. ‘Why were the alternatives rejected?’
After the letter had been sent last week, the university wrote an e-mail to all employees and students explaining the situation. In this email, the board stated, among other things, that the privacy level of the cameras had been raised to 3, the highest level, and that an external audit will be carried out, ‘to dispel any concerns’.
The email contained several factual errors. For example, it turned out that some of the cameras could still be found on the public internet.
Students in The Hague are also planning to protest against the smart cameras placed near the lecture halls. On 14 December, they will briefly block the entrances.
Students have organised a walkout in Leiden on 7 December from 1 to 2 p.m., during which they will block the entrance to the Lipsius building to protest against the smart ‘classroom scanners’ that are installed in all the university buildings. A similar protest is planned one week later in The Hague.
Students in The Hague had also made posters to draw attention to the protest, but these were taken down ‘within one hour’, say the organisers.
On Monday evening, they arranged a meeting with about thirty students to talk about what action they wanted to take.
‘At first, we wanted to do it simultaneously, but we decided that we want to get as many students as possible to come to Leiden’, says Joris Wiebes, who organised the protest called ‘Unsee Us’. ‘That’s why we’re staging the protest in The Hague a week later.’
Wiebes gets the impression that the universitie is worried about the protest. The security department has contacted him, and they have a meeting on Thursday. ‘They say they are concerned about the safety’, says Wiebes, but he sees no reason for this. Moreover, the protest takes place outdoors, and on the Facebook page, the organisers urge people to wear a face mask and to do a self-test beforehand.
‘It’s a peaceful protest’, Wiebes emphasises.
