Health |

Porn, guns and racism: Days into the new school year, virtual classrooms have been disrupted by hackers and pranksters

The first Chromebook wasn’t working, so Valerie Carroll went back to the school and got a new one. The replacement worked, but the first week of remote learning, her daughter’s class at Chicago’s Nicholson Elementary was derailed by images of pornography and guns.

“The kids were in the class and all of a sudden you see porn, you see things that they shouldn’t see,” Carroll said. “They learned about porn, guns and threats, when they should have been learning about science, math, literacy.”

From what Carroll has gathered, someone with access to the Google Meets link was able to get into the virtual classroom and take over the screen. Similar incidents have been reported at other schools this fall in Chicago Public Schools and in the suburbs. In Downers Grove, kindergartners were sent to an “inappropriate” site from a link on their remote learning platform.

“They’re supposed to have this stuff on lockdown,” Carroll said of CPS. “That is something that kids are not supposed to be seeing. … What are you doing about it? How are you protecting your students?”

Disruptions in CPS, which is requiring teachers to use Google Education tools, have gone beyond “Meets bombing.” Last week, Chicago police were dispatched on a report that a student showed a gun on camera during a virtual class.

According to police scanner audio, a dispatcher said a student at a CPS high school on the Southwest Side “apparently … showed a gun” while participating in an online class. The dispatcher advised officers to check on the student at home.

A Chicago Police Department spokesperson confirmed there was a call for service matching the time and location given for the student’s address, but said no report was filed and provided no additional information.

CPS spokesman James Gherardi released a statement in response to a Tribune inquiry: “While CPS has had a successful launch of an unprecedented school year, the district has learned of a small number of disruptive incidents that occurred in virtual classrooms. The district has provided school staff with guidelines on how to prevent disruptions and is working with Google to expand functionality to allow for additional controls during class time.”

Rather than “hacking” that can compromise security systems, many recent cases have resulted from improperly shared links to virtual classrooms, according to CPS. They’ve been reported at schools on a full spectrum of grade levels, locations and engagement rates, from Nicholson, where 44% of students logged in the first day, to Walter Payton College Prep, where 98% of students did.

Similar breaches have been reported in the Chicago suburbs and all over the country as many districts begin a new school year online for the first time. Other schools nationwide have reported hacks that involve disturbing or inappropriate photographs, video or language, along with ransomeware attacks.

Last week, Downers Grove Grade School District 58 Assistant Superintendent for Technology James Eichmiller informed parents in an email that a link on a kindergarten activity began “automatically redirecting to an inappropriate video.”

“This was a result of an outside issue with the website ‘safeyoutube.net,’ which has been a trusted domain by school systems,” he said. “… Unfortunately, it appears that this service was compromised/hacked and began randomly redirecting to the video at some point today.”

No one at safeyoutube.net responded to a request for comment.

Downers Grove teachers stopped using the service, according to the email, which added that “we sincerely apologize to any family or student who viewed this inappropriate content.”

CPS officials did not comment on specific incidents, but the statement said student involvement would be handled according to the Student Code of Conduct and any safety concern would be referred to the appropriate department. They provided information on Google trainings offered to teachers and best practices for using the platform.

“To moderate Google Meet and ensure the meetings are secure, educators can turn off Quick Access, which will allow you to control who is admitted into the meeting,” according to the statement. “With Quick Access turned off, you can block dial-in access and restrict dial-out access to the teacher/moderator (‘host’) only.”

Yet in a technical glitch, with such restrictions in place, sometimes the message that appears on a teacher’s screen may label the person asking to join as “outside of CPS,” even if they’re logged into their CPS account. A CPS statement said the district is aware of the issue, and “Google is working to correct it.”

For teachers like Leigha Ingham, who chairs the science department at Walter Payton College Prep, the vulnerability of remote learning to online attacks is becoming a daily source of concern.

“I think so many teachers are just anxious about converting their classroom to a remote learning setting and just adding the fact that anyone can jump into my room if I don’t have the settings proper, and harm my students, further adds to that stress and anxiety,” she said.

Ingham said teachers don’t have a way to make new default settings, so every time they start a new session, they have to manually change each setting in order to secure their classroom. The main options are to add students individually or wait until everyone has joined the class and then change the meeting settings to restrict access, the method Ingham has been trying. Remote instruction is already more complicated without adding 28 students one at a time, she said.

If a student’s internet connection is going in and out, pulling them out of the classroom, they have to knock every time they need back in, she said. The process also makes it more complicated to set up virtual breakout rooms for small group discussions or move from small groups back to a full class.

“You would have to create a new Meet for every single breakout room,” she said. “If I were to do that, I would need to create a new Meet and let students in and change the settings to prevent people from jumping in.”

Ingham said at least five of her colleagues have already experienced virtual disrupters. Multiple classrooms on Friday were interrupted by people gaining access and making racist statements, she said. In some cases, the person was calling in rather than joining the Meet by video, making it harder to identify the source.

“CPS is constantly telling us that we need to protect our students, and now we are in a space where our students are being attacked for just coming to class and all the protection is falling on the educators,” Ingham said. “There has to be a way to change the settings so our students are protected and so our teachers are protected so we are not being attacked by people with racist ideology.”

Knowing people need CPS accounts in order for the link to work, Ingham said she’s had conversations with her class about respecting the room. But she has also thought about what she’d do if her class were targeted.

“From my understanding, a lot of times when it happens, people were shocked initially and the person continued saying what they wanted to say until they got kicked out,” she said. “My goal is to talk to my students and ask them, ‘Hey, what are some things we should do when this happens?’ and I think it would be really powerful in the moment to shout … ‘This is racist behavior, you don’t belong here, we don’t want you here.’ Rather than giving the person who jumped in the power, I want to empower the students.”

Though there were fewer opportunities involving schools over the summer, intrusions have not been limited to remote learning as the pandemic continues to push gatherings online. Unlike individual classrooms, local school councils need to make meeting links publicly accessible and often post them to a school’s website or social media channels.

During a virtual town hall on school police before a meeting of Mather High School’s council last month, someone joined displaying an image of Hitler and playing music that drowned out the other participants. The host repeatedly kicked the user out only to have them join again. At one point in the meeting chat, the user even wrote, “im hacker man,” along with messages such as “Hail Jair Bolsonaro,” the far-right Brazilian president. Ultimately, the host ended the meeting and emailed participants links to a new one.

Tribune reporter Jessica Villagomez contributed.

[email protected]