As K-12 teachers struggle to keep their hybrid digital/in-person classes on track and districts move to shield schools from increasingly frequent ransomware attacks, there’s a growing threat undermining both of their plans. Crafty students are using every trick in the book to punch through school filters and security for extracurricular entertainment during school hours.

While data shows that most of these students aren’t using these means for anything malicious – they’re mostly after movies and games – it leaves the door open for easy access to far more explicit and dangerous material. Schools are now faced with the challenge of outmaneuvering these young hackers if they want to keep their filters online, keep students on track and stop these frequent disruptions to learning.

Increasingly common tools among students are Tor Browser – an anonymizing web browser often used to access the dark web – and Psiphon, a censorship circumvention tool. While not inherently dangerous themselves, these tools allow students to digitally vanish from many typical forms of supervision, whether attending class remotely from home or even in-person. Worse yet, methods such as Tor Browser open them up to the dark web and risk exposing them to illegal and dangerous content.

Some particularly resourceful students may use regular school applications, such as Microsoft’s PowerPoint, as a means of smuggling in distracting material – for example, students have been caught uploading entire movies to a PowerPoint presentation, then import the slide deck as a means of getting around the school’s filters on video files.

As adoption of technology increases both in and out of the classroom, students are becoming ever-more tech savvy, and schools’ leaders need to recognize this if they’re going to keep up with their young learners’ resourcefulness.

When traditional forms of filtering and blocking are no longer reliable – and are already allowing far too many students to slip through the net undetected – more advanced tools are needed to close off the roads to circumvention.

Whether installed via a managed device or through a cloud application, modern security solutions must be up to the task of tracking students even as they attempt to disappear behind VPNs, Tor, Psiphon and similar tools. At minimum, a good solution should be able to flag the fact that students are using these tools – even if they can’t actively monitor their screens – and allow faculty to step in.

This need for nuance has significant implications for student learning during classroom hours as well. Many schools rely on what can broadly be called “over-blocking” – a simple approach used to meet minimum compliance requirements that has an unwanted side effect of often blocking potentially helpful sites, even as it fails to detect some of the tools discussed earlier.

Sites such as Google and YouTube can be powerful tools for teachers in the classroom, provided that they’re used smartly and safely with a filter solution that is nuanced enough to allow students to access productive material without drifting off to content they shouldn’t be looking at. Blocking them outright can be highly frustrating to both teachers and their students – potentially heightening the risk of the latter group turning to these tools in the first place.

For a more measured approach, once the roads to circumvention are closed off, SSL decryption has emerged as a capability that grants schools much more insight into what’s actually happening on student devices. Are they researching a book such as “To Kill a Mockingbird” or for something much more dangerous, like “How to kill myself?”

One school district in Houston thought its basic firewall was doing enough to keep its students in check, but on trying a more nuanced, intricate solution ended up getting 280 million hits in a single week. Students are getting smarter, and it’s time for districts to step up to that challenge if order in the classroom is to be maintained.

About the author

Paul Hafen is a K-12 Cybersecurity Specialist at ContentKeeper Technologies, an Impero Software company. For 20 years, Paul has been working with school districts on their cyber safety and security projects. Paul understands K-12 customers' needs around analytics, multi-platform support, instructional effectiveness and providing safe access to online educational content. He believes that the Internet-connected learning environment is unique and requires cloud filtering, management and security tools built specifically for the K-12 market.