SoylentNews is people
SoylentNews
The Danish Ministry of Education has developed a "digital exam invigilator" to be used by students in the equivalent of high schools ("gymnasiale uddannelser"). The purpose is to be able to detect cheating during written exams. The program:
- captures all keystrokes (keylogger)
- captures a screenshot every minute and whenever you switch tasks
- a list of all open webpages
- network configuration
- which programs are running
- whether it's is running in a VM
- contents of the clipboard
and sends this to a central server during the exam. The data is kept for 4 months.
The initiative is getting a lot of criticism.
- In 2017 there was 229 suspicions of cheating out of more than 200.000 students, so this initiative may be out of proportions.
- The program is only available for Windows and MacOS. No support for Linux or ChromeOS.
- It may be possible for a 3rd party to do a MITM-attack and take over the students' PCs.
- If a student is unable or unwilling to install the program he can perform the exam under "extended surveillance" (good old-fashioned humans watching) at the school's discretion. Some schools deny students this option and instead just fail them.
- The program will likely collect private information.
The schools do not provide computers for students because they cannot afford it. So its BYOD. On some schools (eg. some vocational schools) Linux is quite common. Some schools have trouble affording the extra human invigilators.
So soylentils: what would you do given the constraints? What do other countries do? Ignore the risk of cheating? Spend money on human invigilators?
All sources are in Danish as this news has not hit the international scene (yet). Sorry.
Danish Ministry of Education page on the program: https://www.stil.dk/uvm-dk/gymnasiale-uddannelser/proever-og-eksamen/netproever/den-digitale-proevevagt
Short analysis by security expert Peter Kruse: https://www.dr.dk/nyheder/indland/den-digitale-proevevagt-overvaagnings-kritiske-elever-faar-ministeriet-til-rette
A Reddit thread on the subject: https://www.reddit.com/r/Denmark/comments/avovqx/staten_har_nu_krav_om_at_vi_installerer_et/
A discussion on version2 (an EE and CS site): https://www.version2.dk/artikel/digitale-proevevagt-totalovervaagning-elevers-computere-midlertidigt-trukket-tilbage-1087609
(Score: 0) by Anonymous Coward on Wednesday March 06 2019, @06:14AM (3 children)
Some of these systems will check for signs of a VM and simply not allow you to start the exam if they suspect anything odd. There are many ways that to detect the possibility of running in a VM and they only have to be "mostly" sure to get suspicious and not allow the exam to start.
When looking into this not too long ago for a school, my first thought was to have paper notes on the floor and practice looking down without looking down. Perhaps even with a foot on a few buttons of an electronic device (much like devices that aid in card counting). These systems do use a webcam to watch you and ask you to move your camera around to check the room initially, but with some creativity it wouldn't be too hard to hide something out of view.
(Score: 2) by c0lo on Wednesday March 06 2019, @09:09AM (2 children)
Yeah, right. Like it's very hard to start the exam on the host OS and fire up a VM for "research" purposes.
https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
(Score: 0) by Anonymous Coward on Thursday March 07 2019, @07:51PM (1 child)
No. During the exam the invigilatior service monitors a real-time screen capture, your webcam pointing at you, and the software is constantly checking the process list and other information for violations. Any software that hasn't been pre-approved by the course instructor. Presumably one invigilator is monitoring several people at once and something small might slip through for a few minutes, but anything suspicious like a new process will be flagged immediately and shown as an alert to the invigilator.
Reiterating what I said before, the technical side is quite good because they can check for anything and prompt the invigilator to intervene, and they don't have to worry about false positives just to raise an alert. Any meatspace cheating is much more likely to succeed at home, and why I question how remote invigilator can be trusted.
(Score: 0) by Anonymous Coward on Friday March 08 2019, @04:33PM
I don't understand these weird ass solutions. What I'd do is make a loader and hook all these critical function calls to display a very submissive young person taking an exam... or send pictures of goatse instead of screenshots if I'm in that mood.