How Cloud Software Widens Student Access to Learning

As more school districts implemented one-to-one programs over the past few years, they were faced with a challenge. They needed a way to give students access to applications that could scale rapidly, be accessed from anywhere and seamlessly integrate with one another.

The solution? Software as a Service.

Cloud-hosted software has essentially become a default for educational applications, with districts largely opting for cloud-based versions of learning management systems, productivity tools, collaboration solutions and more.

“Without Software as a Service, the level of digital transformation in schools would be limited,” says Vince Humes, chair of the Consortium for School Networking’s network and systems design initiative. “Imagine if each district had to manage all the requirements to run tools like Zoom, Microsoft Teams or the learning management system. Without SaaS, we’d still be using Oregon Trail on CD.”

“It is mind blowing to think about the learning tools that are now available to students,” Humes adds. “That would not be possible without the SaaS model.”

Matt McGoldrick, supervisor for systems engineering and integration at Montgomery County Public Schools in Maryland, agrees. He says SaaS programs helped the district move to a more device-agnostic posture, seamlessly integrate different applications and give its 160,000 students access to a broader array of learning tools.

“The landscape has shifted quite a bit in the past five to six years,” he says. “Students are now expected to do work online outside of school hours as part of that flipped classroom model. Cloud-based applications made it easier to provide staff, students and families with a consistent experience across devices and form factors.”

“It’s hard enough being a classroom teacher,” McGoldrick adds. “We don’t want them to have to manage the technology as well.”

As a Chromebook district, Montgomery County Public Schools relies on Google’s suite of productivity apps and the Canvas learning management system for student work. McGoldrick says one of the crucial services that the district’s LMS and Google Workspace for Education accounts provide is single sign-on access to other cloud tools.

Canvas also allows teachers to incorporate resources from other cloud tools — such as content from Encyclopedia Britannica and other third parties — into their online lessons.

While SaaS applications are powerful tools, McGoldrick says, they are not without their challenges. He notes that it’s easy for districts to become “inundated” with the vast number of applications that are now available, and it’s a “constant challenge” to ensure that students are using all of these solutions appropriately.

“We want to maintain students’ attention, but we also want to keep them from accessing harmful content,” he says. “Digital citizenship has to be part of the curriculum. We’re teaching students about good password hygiene in the same way that we would teach them how to check out a book.”

“Kids are really good at using technology to consume information, to socialize, to interact with their communities, but they’re not always prepared to use these tools for productivity,” McGoldrick adds. “It’s about teaching them to  use YouTube as a student to better themselves or to solve a challenge in Minecraft.”

Demolish your device lifecycle woes. Get maintenance and management resources here.

Dr. Matt Kuhn, CTO for Volusia County School District in Florida, sees both benefits and downsides to Software as a Service. On one hand, he notes, cloud software is highly scalable and available remotely. On the other, cloud apps often introduce unpredictable pricing and are sometimes impossible to customize.

“They’re usually cross-compatible, which is a big deal. It didn't used to be that way,” he says. “When you had on-premises software, you knew it only worked on certain machines, but cloud-based software has to be cross-compatible and mobile.”

That is one of several reasons the district has come to rely heavily on cloud applications. Students and teachers use Microsoft 365 for productivity apps and file storage, the district’s LMS is hosted in the cloud, and teachers depend on cloud-based programs like the STEM app Gizmos for subject-specific learning.

“Technology is our students’ innate language,” Kuhn says. “It’s how they think, how they communicate and how they operate. You have to speak students’ language, and I think cloud software has helped us do that.”

DIVE DEEPER: How to make the most of Google Workspace for Education’s features.

When Kuhn came to Volusia County in 2022, he introduced a new system for software selection, which has streamlined and standardized how the district adopts new cloud apps. Anyone, including teachers, can make a request, but district leaders typically initiate the process. Requesters must provide basic information about an app. Then Kuhn and his team vet the software to make sure it offers adequate privacy and cybersecurity features, aligns with learning standards and doesn’t duplicate existing tools.

“We’ve approved probably 95 percent of the requests, but the system does its own filtering,” Kuhn says. “If people can’t answer the questions properly, then the request never even comes to us. If everything passes muster, then we move forward with plans for implementation, training and who is going to support the new software.”

While some software tools, such as online flashcards, merely replicate traditional learning, Kuhn notes that others provide students with experiences that would be impossible to access without technology. For instance, students in science classes use tools from ExploreLearning to simulate a 100-year forest lifecycle, adjusting variables such as precipitation to see the impacts on the ecosystem. “You have all of these conditions you can change within a one-hour class period, and you can learn quite a bit by analyzing the results. You can only do that with software.”

Rick Kelly Technology Director, Conneaut School District

Rick Kelly, technology director at Conneaut School District in Pennsylvania, says the district uses SaaS for “everything.”

Students and teachers in the rural district use a SaaS tool to annotate PDF files. In special education classrooms, kids use a different app to dictate written content and have passages read aloud to them.

“SaaS is embedded in everything we do, from our cafeteria systems to the kids looking at their own grades to our rostering system,” says Kelly. “It’s the majority of our applications, and the few things that aren’t yet in the cloud are on our radar to move into the cloud. The big drivers are the cost and expertise associated with making sure applications are up to date. Budget dollars are getting scarcer, and it’s just not sustainable for us to manage on-premises software.”

“Not only has cloud software allowed us to deliver a wider array of services to our staff and students, within budget,” Kelly says, “but also it’s given us peace of mind that the services are being delivered in a safe, secure and up-to-date manner. Those can be competing priorities when you’re working with a limited staff and budget.”

LEARN MORE: How K–12 schools can maximize their ROI as they spend their federal funding.

Years ago, Conneaut had a one-to-one tablet program, but the district has since switched to Chromebooks. The tablets students used then had 40 or 50 apps, Kelly says, but the district has since focused on a smaller number of learning programs to standardize instruction and streamline the cloud environment. The district uses both Google Workspace for Education and Microsoft 365.

”We try not to use the ‘app of the month,’” Kelly says. “We focus on the basics, and we focus on tools that will help teachers deliver the curriculum. Kids can get confused if you throw too many tools at them.”

“I often see districts put too many balls in the air at once,” Kelly adds. “My biggest advice is to stabilize before moving on to more innovation. Stabilize, then innovate. Then stabilize again, and then innovate. Make sure you have the proper training and delivery methods in place before you bring in the next thing.”

Photography by Ryan Donnell

Microsoft to update Office Pro Plus after Dutch ministry questions privacy

Microsoft plans to update its Office Pro Plus products by the end of April to address a series of privacy concerns raised in an audit commissioned by the Dutch justice ministry that flagged what the auditors called "high risks" to government users' privacy.

The update for many of the company's Office Pro Plus customers, which has been confirmed by Microsoft, will address concerns relating to a package of popular Microsoft programs — namely that they were sending diagnostic data from Europe to the United States without adequate documentation and user controls over what was sent.

Microsoft and the Dutch justice ministry agreed on the changes as part of an "improvement plan" with an April deadline. A ministry spokesman told POLITICO that if Microsoft's responses proved "unsatisfactory," the ministry could raise the concerns with European data protection authorities for further action that could include "enforcement measures."

In a statement, Microsoft's top privacy and regulatory counsel, Julie Brill, underscored that the Dutch ministry had commissioned the audit as a customer of Microsoft and had not sought regulatory action against the company.

“The ministry commissioned the report in its capacity as a customer to clarify how our services are run and we’re working with the ministry’s staff to share additional information and help resolve its questions as we would for all enterprise customers,” Brill said.

She added that the issues raised in the report, conducted by the Privacy Company, a Hague-based consultancy, relate to “diagnostic data in one product,” Office Pro Plus, and that the company is “confident this is consistent with Dutch law and GDPR,” Europe’s General Data Protection Regulation privacy law. Office Pro Plus includes a range of Microsoft programs.

“We feel good about what we’re doing to give customers transparency and choice on the diagnostic data they share with us, but we always want to do more,” Brill said. “In the coming weeks we will take additional steps to make it easier for customers to understand what data needs to go to Microsoft to run our services and why, and where data-sharing is optional.”

When Microsoft updates products, the update usually takes place worldwide for users of the product and the company gave no indication that would be different in this case.

Under the EU's data protection laws, the Irish Data Protection Commission is the “lead supervisory authority” in charge of making sure Microsoft complies with the rules. If the Netherlands chose to escalate its concerns, it could forward a request on the relevant issues to the Irish regulator. Meanwhile, any issues would be closely monitored by the European Data Protection Board, which gathers all EU data regulators, and the European Data Protection Supervisor, which may in turn start their own investigations that could lead to enforcement action.

A spokesperson for the Irish Data Protection Commission said it is “aware of this matter and its significance to companies using the Microsoft product in question. On becoming aware, the DPC immediately engaged with Microsoft seeking further information on the processing of telemetry data, in response to which Microsoft is providing detailed responses.”

The Privacy Company, a consulting firm that the ministry contracted to do the audit, said in a blog summary of the findings that “Microsoft systematically collects data on a large scale about the individual use of Word, Excel, PowerPoint and Outlook.”

It added: “Covertly, without informing people ... Microsoft does not offer any choice with regard to the amount of data, or possibility to switch off the collection, or ability to see what data are collected, because the data stream is encoded.” A major concern of the Dutch was that the company sends the data back to its servers in the U.S.

Microsoft doesn't agree with some of the assertions of the Privacy Company's report but is making changes to its products as it routinely does to accommodate customers. The company has previously disclosed to customers its use of diagnostic data.

The new focus on privacy comes as different components of Microsoft, one of the world's most valuable companies, have recently faced scrutiny for a variety of privacy concerns, especially LinkedIn, which Microsoft bought in late 2016 for $26 billion.

Nicole Leverich, a spokesperson for LinkedIn, said “member data is never shared with customers on an individually identifiable level, only in aggregate for ad sales.” Last November, Ireland’s Data Protection Commission found that LinkedIn used the email addresses of around 18 million non-LinkedIn members to target individuals with ads on Facebook all in an effort to grow its customer base.

The regulators noted that LinkedIn’s actions violated its protection standards, although the dispute was amicably resolved.

Leverich said the company “fully cooperated with the DPC’s 2017 investigation of a complaint about a European advertising campaign and found the global processes and procedures we had in place were not followed. We took appropriate action and have made the internal changes to help protect against this happening again.” In Brazil last year, federal prosecutors said Microsoft had violated local laws with its collection of Windows 10 users’ data without getting proper consent. In 2016, France ordered Microsoft to cut back its collection of user data and to halt tracking of the web browsing habits of Windows 10 users without getting permission.

Despite these privacy dustups, Brill touted the recent steps Microsoft has made to improve users’ privacy, including “new features in the Windows setup process, enhanced options for error data reporting in Xbox, a feature called Lockbox for Azure, and updates to our Privacy Dashboard including new tools for parents to manage their children’s settings,” she said.

Microsoft has been the subject of a number of complaints to the Irish Data Protection Commission, according to a commission spokesman, but none were serious enough to warrant a statutory investigation, and of the 16 open investigations into multinational tech companies, none are related to Microsoft. There have been 3,500 complaints to the commission in total.

Unlike other tech companies, like Facebook, that have drawn fire for privacy issues and problems spreading fake news, Microsoft has set itself up as a paragon of good behaviour, welcoming scrutiny into the company and the broader tech industry. Company leadership routinely highlights its proactive investments in privacy. Last year, the U.S. Supreme Court heard arguments after Microsoft challenged an American search warrant for a customer email that resided in Microsoft's servers in Ireland, and last May, the company announced it was extending the privacy rights that are at the core of GDPR to its worldwide consumer customer base.

“Having the scrutiny is actually good, I think,” CEO Satya Nadella told the Washington Post last October. He urged the tech sector to improve its behavior. “Anyone who is providing a very critical service needs to raise the standards of the safety of that technology and the security of that technology.”

The huge problems affecting Facebook have touched other companies as well, including Microsoft. The New York Times reported in December that Facebook gave Bing, Microsoft’s search engine, the ability to view the names of almost all Facebook users’ friends without permission and also had data-sharing arrangements with companies including Netflix, Spotify, Amazon and Yahoo.

“Bing did not maintain profiles based on Facebook data for advertising or personalization purposes, and we took significant engineering steps beyond what Facebook required to ensure this could not happen,” said Brill.

“We ended our contract with Facebook in February 2016 and data stopped appearing in search results.”

Office of Research Services

Sometimes as a researcher you may want to record a research session with participants, such as interviews or focus groups. Recording interviews means that personally identifiable information is being collected about a person—as their face and/or voice is personally identifying—and this enhanced risk to participants should be carefully weighed against convenience for you the researcher. If recording a research session is integral to the success of the research, Dalhousie IT recommends the use of Microsoft Teams for this purpose.

If you do not need to record the video for the research and audio will serve the purposes for the research, it is recommended to only record the audio. Always collect as little personally identifying information as needed for the research purposes and images of a face with a voice are more personally identifying than just a voice.

When collecting personally identifying information about a participant, researchers need to be in compliance with Dalhousie’s Protection of Personal Information Policy, and the Nova Scotia Personal Information International Disclosure Protection Act. This means that the personally identifiable information must not be accessible outside of Canada or participants need to give informed consent for their information to be accessible outside of Canada. “Informed” consent means they are informed about the security and privacy risks. It is the researcher’s responsibility to understand those risks and communicate them clearly to the participant.

Recordings taken using Microsoft Teams are securely stored in Canada. During recording, however, audio and video content are routed through the United States. This means that for the duration of the interview, personally identifiable information is accessible outside of Canada.

If Microsoft Teams is used to record research sessions (either with video or audio), Section 2.6.5 of the Prospective REB application form should be checked “Yes”, and an explanation should be provided about how compliance with the Dalhousie policy is being achieved. Typically, this means that participants are asked to give informed consent to having their personally identifying information accessible from outside of Canada. Researchers can use the following language in the consent form:

The researchers will use their Dalhousie University credentials for the Microsoft Teams meeting, which will ensure that the Teams meeting recordings are securely stored in Canada. During the live Teams meeting, audio and video content is routed through the United States, and therefore may be subject to monitoring without notice, under the provisions of the US Patriot Act while the meeting is in progress. After the meeting is complete, meeting recordings made by Dalhousie are stored in Canada and are inaccessible to US authorities.

If you choose to use another videoconferencing tool to record research sessions (such as Zoom, Skype for Business, Collaborate Ultra, etc.), you will need to learn if any of the participant data is accessible from outside of Canada at any time (i.e. during recording, or when stored afterwards). Ensure that consent information is clear about potential security and privacy risks of any technology used. If you have questions about the security and privacy risks of other tools, consult with Dal ITS at support@dal.ca.

Another option to recording using the videoconferencing tool is to record on a separate device like a hand-held recorder or smartphone app (use one that does not sync to the cloud). This way the recorded information is more secure as it is not connected to the internet.

Remember, the more sensitive the research, the more diligent you must be in ensuring rigorous privacy protection for your participants.

Note: The information provided here is correct as of March 2021. We will endeavour to keep this FAQ current. However, technology and Dalhousie’s recommended best practices may change without notice to the Research Ethics office.