A Data Collection Project at GW Leads to Privacy Questions

Revelations that George Washington University launched a data-analytics pilot project last fall that monitored locations of students, faculty and staff without their knowledge or consent have raised new questions about data privacy on college campuses and shined a light on a project that deeply concerned many GW faculty members.

GW president Mark S. Wrighton apologized for the incident in a campuswide email sent Feb. 11. He emphasized that the university did not analyze individualized data and said all data collected as part of the project would be destroyed. Wrighton said the project was meant to test how data analytics could help GW officials assess building density and use. Wrighton said he learned about the data collection project shortly after he started as president on Jan. 1.

The project was spearheaded by the university’s IT, student affairs and safety and facilities divisions and collected data from Wi-Fi networks across GW’s campuses, Wrighton said. It was designed to help administrators better understand “density and use of buildings by students, faculty, and staff in the aggregate,” Wrighton wrote.

A George Washington University spokeswoman said via email that administrators sought the information to “inform operational priorities during the pandemic.” The pilot program was first reported by The Washington Post.

Isha Trivedi, a junior and the reporter who covered the story for The GW Hatchet, the campus newspaper, said students have told her they were surprised that GW collected data on students and felt that Wrighton’s email was unclear. She said many students also felt that Wrighton’s email lacked necessary context on the firm GW retained to collect the data and the company’s past work on campuses, particularly with helping institutions track students’ class attendance.

“I don’t think we know really to what extent this data was being used and what that means for students,” Trivedi said. “I’ve seen people online saying this is awful and shouldn’t be happening.”

Rory Mir, a grassroots advocacy organizer at the Electronic Frontier Foundation, said the ongoing pandemic has led more campuses to experiment with data analytics to track student and faculty locations.

“A lot of companies are pitching the schools, ‘Hey, we can track the locations of students for COVID safety purposes,’ and most of those claims are kind of nonsense, because you can’t really do contact tracing with Wi-Fi, which is what a lot of them are claiming,” Mir said.

Mir said data analytics are being used to track student behaviors in ways that are disturbing and which introduce potential bias. Students who are working off campus to put themselves through school might clock less time in the library or miss class more often, Mir said, making institutional reliance on metrics for how often they are present unfair.

Universities are “using this big data to track behavioral issues of students … like how often they’re going to the library and how much time they spend on campus and trying to associate that with how well they’re performing in class,” Mir said. “It’s a huge privacy invasion.”

Cristian Ponce, a freshman majoring in computer science at the California Institute of Technology and who has been active in grassroots data-privacy organizing, said he urges fellow students to be skeptical about data collection. He called the practice of data tracking for student class attendance “invasive.”

“It just sets up a structure that is far too controlled, where administrators have these details and students aren’t taking agency over their own lives,” Ponce said.

GW officials have emphasized that data collected during the pilot were “de-identified,” meaning identifying information was removed from it and the individual data were aggregated, or combined as a group of data. They acknowledged, however, that the campus IT department attached “descriptors” to the data, so they were not completely anonymized.

“I want to be clear that even though the technical capacity may exist to track individuals across our campus, such a capacity was not utilized nor contemplated in this pilot and no individualized data tracking or movement across our campus was ever shared,” Wrighton wrote. “Regrettably, however, the university neglected to inform members of our community in advance of commencing this analytical project.”

Mir said that even when de-identified data are aggregated, it is still possible to identify specific individuals in the data set.

“With enough information, these systems can re-identify individuals just given the granularity of what has been collected,” Mir said. “And the more precise this data gets, the bigger the risk of de-anonymizing the people in the data set.”

Mir said it is hard to know exactly how rampant this type of data collection is on college campuses, but that institutions are increasingly using Wi-Fi, key cards and other simple systems to track students, even if they are not relying on a system as sophisticated as what GW piloted.

Aaron Benz, founder and CEO of Degree Analytics, which partnered with GW on the data-collection pilot, said institutions usually work with his company to enhance student success initiatives or to understand building density and use. Benz declined to comment on the GW situation, saying he does not discuss the work he does with specific clients. The GW student newspaper the Hatchet first reported the involvement of Degree Analytics in the campus data-collection effort.

Benz said that since its founding in 2018, Degree Analytics has worked with about 25 colleges, about half of which have used the technology for more individualized data-collection purposes, such as tracking whether students are attending class.

“Most professors don’t take attendance, yet it’s the No. 1 predictor of persistence and success,” Benz said. “If a student stops going to class, that’s the earliest indicator that they may drop out or fail out.”

Degree Analytics offers a product it calls EnGauge Student, which its website says allows institutions to gather “student behavioral metrics,” which will allow them to “analyze more student behaviors that better align with student success.” Among the examples of EnGauge Student data-collection options listed on the website are class attendance, absence alerts, student participation, library time and academic time.

The EnGauge Campus product from Degree Analytics promises “billions of rows of data” and 6,000 location data points per student per day so administrators “gain usage insights to optimize facilities,” according to the company website.

Asked what he would say to privacy advocates concerned about the level of tracking his company offers, Benz said more higher education institutions should establish data-governance structures.

“My problem is that there’s no standard of governance to say what’s acceptable,” Benz said. “What is the standard? It shouldn’t be up to one person to try to make a decision. There should be some kind of governance structure so that each university can carefully look at the benefits as well as the consequences for any scenario.”

Benz said he has launched an open-source community on the Degree Analytics website to collect input from higher education officials, industry leaders and privacy experts to “help kick-start governance at universities.”

Better governance may only go so far, however. George Washington University has a data-privacy policy, which says individuals must be informed when information is being collected. That policy was violated when the GW community was not made aware of the Degree Analytics pilot project.

“The data processor must make available a privacy notice detailing how personal information will be used and who to contact with any questions or concerns,” the policy states.

Harald W. Griesshammer, a GW professor and faculty senator, has been working with university officials to understand what happened since Wrighton learned about the pilot program last month and immediately notified faculty senators. Griesshammer said university leadership was not notified of the project when it was underway last fall.

Griesshammer said he has been encouraged by how university leaders handled the episode, but he is concerned that the pilot project was signed off on by the university’s compliance division and the general counsel, especially since academic department heads made it clear they were not supportive of the project. GW Library officials told an information technology administrator that the data collected “would not be useful and it would be unethical,” Griesshammer said, but the warning went unheeded.

“The just really disturbing aspect is that there were clear signals from the academic side that you shouldn’t do it, and they did it nonetheless,” Griesshammer said. “This effort is against stated GW policy, and that is mind-boggling, because somebody needed to sign a contract on this … If we cannot trust that the administrative side of the university, the enterprise side of the university, follows stated university policies, then we have a huge problem.”

Griesshammer said the incident is also “disturbing,” because while the data were de-identified, “anybody who has half a brain could have de-anonymized much of the data relatively quickly.”

Mir, of the Electronic Frontier Foundation, said as this type of data collection becomes more pervasive, there is a real risk to higher education campus cultures.

“This surveillance creates a very hostile environment for students that I think reduces trust on campus,” Mir said. “And once there’s less trust, I think that creates a lot more issues … [with] students feeling watched all the time, and feeling like they are a criminal without doing anything.”