Software used by U of Regina to prevent exam cheating has security breach, temporarily shuts down

The company behind a computer program that monitors University of Regina students taking exams remotely has suspended its services for up to 10 days after a security breach was detected.

With U of R students mostly learning remotely this year, university administration selected Proctortrack as the computer program that would watch students take online exams. Verificient Technologies, the company that created the program, announced earlier this week that it had detected a security breach and shut down Proctortrack systems.

"The university takes the protection of our students' personal information very seriously and is awaiting additional information from Verificient regarding the extent and nature of the security breach and steps being taken to prevent such incidents in the future," a U of R spokesperson said in an email.

Verificient issued a release about the security breach around 1:30 p.m CST on Oct. 13, and later tweeted that someone had sent fraudulent emails from its systems. U of R students weren't notified until Oct. 15.

Rahul Siddharth, the chief operating officer of Verificient Technologies, told CBC News that a "prankster" somehow logged into a server located in Europe, sent out an email and "played around with some files."

As a precaution, Proctortrack shut down so computer codes can be reviewed and enhanced. So far, it appears no personal data was accessed, Siddharth said.

"What we have seen in the last three days of discovery, there was no personal information that was downloaded, so there was no data breach. No test scores have been compromised," he said, adding that all data in Canada appears to be intact.

"This has been a challenging couple of days. Very disruptive. Security breaches now, unfortunately, they're part of our modern tech world," he said.

"We do what we can to prevent it from happening. There's always going to be some bad actors … that just, sometimes, want to be a bit of a troll and pick and scratch at some vulnerability."

An email sent out to U of R students and staff said Proctortrack systems will be down for seven to 10 days.

Another email to faculty asked professors using Proctortrack who had upcoming exams to come up with an alternative, such as continuing on with the exam without proctoring, coming up with a new academic assessment, or rescheduling the exam.

The security breach also impacted business students at Western University in London, Ont.

Breach an 'I-told-you-so' moment

U of R students had aired concerns about Proctortrack from the jump, citing concerns about the data it collects and the potential for someone to hack the system. An online petition calling on the university to remove the program now has more than 2,700 signatures.

The security breach affirmed those concerns, said undergraduate student Julian Wotherspoon, who signed the petition weeks ago.

"It's really frustrating. It's not surprising for anybody who had concerns about the software from the beginning," said Wotherspoon.

"It was sort of an 'I told you so' moment. Earlier in the semester I had been repeatedly dismissed when I had concerns about this type of thing happening. I had been assured repeatedly that I was overreacting."

Wotherspoon will have to be monitored by Proctortrack for an exam in the coming weeks and again near the end of the semester. The recent breach is not calming her concerns, she said.

David Gerhard, head of the University of Regina's computer science department, said many of the concerns students raised are legitimate, but that since courses moved online the university has "had an epidemic of cheating."

"Lots and lots of students feel that, because courses… and evaluations are online, they can cheat with impunity," said Gerhard.

He said there's a sort of herd mentality growing among typically honest students.

"Many students who wouldn't normally cheat feel like, 'Now that everyone else is cheating, I have to cheat as well to keep up with the grades that will be provided by the course,'" he said, adding that Proctortrack allows the university to keep its academic integrity.

The U of R is using the program in a less invasive way than other institutions and is not using all of its available features, said Gerhard.

Proctortrack monitors webcam video, eye movements, audio, which devices are connected to a particular computer, applications running on the computer, what is visible on the screen and a student's ID (which is confirmed before and periodically throughout an exam), according to Proctortrack's frequently asked questions site.

The program does not monitor browser history or delve into personal computer files, the site says.

The U of R is using the program to verify that students are who they say they are and to investigate potential academic misconduct should a professor notice something untoward when correcting an exam.

In that scenario, Gerhard said, the professor would notify an investigating dean, who would access data gathered by Proctortrack in a server that stores the data for 180 days.

Siddharth told CBC News that students do have the option of destroying their data.

Roughly 200 fall courses — or about 10 per cent of courses offered this term — are expected to use Proctortrack for exams, said a U of R spokesperson. That "number is somewhat in flux" because instructors are finalizing plans for final exams, they said.