Western students alerted about security breach at exam monitor Proctortrack

A security breach of Proctortrack, the software Western University uses to monitor student exams remotely, is adding new fuel to a debate raging on campus over privacy concerns about the program.

Proctortrack allows students to be monitored to prevent cheating while they take exams at home using their own computers. The program is in widespread use at Western with most in-person exams all but impossible due to COVID-19 restrictions. 

To use the program, students set up an account and their identity is verified moments before they take the exam using face-recognition technology. The software uses the computer's camera to monitor the exam-taker and flag any behaviour that might be cheating, such as opening a web browser to research answers or get help from someone inside the room. 

On Thursday morning, students at Western's Ivey Business School received an email notifying them of a "data breach" at Proctortrack. The email said Western is seeking more details from the company, but "at this time, they have said there is no impact to Ivey students." 

Rahul Siddharth is CEO of Verificient technologies, the New York-based company that developed and licenses Proctortrack. He said the incident wasn't a "data breach" but a "security breach." 

He said on Wednesday one of the company's servers in Europe was accessed by a "prankster" who attained access by masquerading as a Verificient employee. The hacker contacted some Proctortrack clients and sent communications to them. Siddharth said the breach was caught within a few hours and the servers were quickly frozen. 

"Our logs show there has been no data breach on the servers," said Siddharth in an interview with CBC News. "Student data has never left Canada. It's still on their servers. We just froze that data. Canadian students don't need to worry." 

In a statement emailed to students Thursday night, Western said Verificient told the university the company will suspend service for seven to 10 days while it reviews the breach.

"Western takes the data protection and privacy of its students very seriously and will not be proceeding with the use of Proctortrack until we are confident that it is safe to do so," Western's statement says.

Student refuses to install software on computer

Cole Davison is one of the students in the Ivey program who received the email alert on Thursday. However, the data breach didn't affect him because he'd refused to download the software on his computer due to privacy concerns. 

"It's disappointing that this happened," said Davison. "I want to know what data was leaked and how we can be impacted." 

He also said the company hasn't been upfront about the incident. 

A statement posted on Verificent's website announced a security breach, but didn't say which clients were affected. 

"I don't think there's been enough transparency here," said Davison.

Even if student data wasn't taken, the security breach will create headaches for Western in what has already been a topsy-turvy year trying to continue normal operations amid the pandemic.

Concerns over privacy and data collection

The incident comes as some critics raise privacy concerns about the software. Some have expressed concern about allowing Proctortrack to access their computer's camera. They also wonder what happens to the data the company collects. 

Siddharth said data used to verify a user's identity before an exam is typically not kept more than 60 days afterward.

Meanwhile, a petition continues to circulate calling on Western to stop using Proctortrack, something Davison supports. 

However, Siddharth said the software has allowed institutions like Western to maintain the integrity of their programs and keep them running during the pandemic. 

"Without this kind of software, you'd have lives on hold," he said.