{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,17]],"date-time":"2026-10-17T00:56:26Z","timestamp":1792198586801,"version":"4.4.0"},"publisher-location":"New York, NY, USA","reference-count":48,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3690353","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"1656-1670","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["Trust, Because You Can't Verify: Privacy and Security Hurdles in Education Technology Acquisition Practices"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-1327-277X","authenticated-orcid":false,"given":"Easton","family":"Kelso","sequence":"first","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3045-5183","authenticated-orcid":false,"given":"Ananta","family":"Soneji","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1258-6470","authenticated-orcid":false,"given":"Sazzadur","family":"Rahaman","sequence":"additional","affiliation":[{"name":"University of Arizona, Tucson, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8832-1789","authenticated-orcid":false,"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8374-7596","authenticated-orcid":false,"given":"Rakibul","family":"Hasan","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Balash David G.","year":"2023","unstructured":"David G. Balash, Elena Korkes, Miles Grant, Adam J. Aviv, Rahel A. Fainchtein, and Micah Sherr. 2023. Educators? Perspectives of Using (or Not Using) Online Exam Proctoring. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 5091--5108. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/balash"},{"key":"e_1_3_2_1_2_1","unstructured":"Kyle Barr. 2022. Remote Learning Software Tracked Kids? Data to Sell to Brokers. https:\/\/gizmodo.com\/remote-learning-data-brokers-privacy-1848975202"},{"key":"e_1_3_2_1_3_1","volume-title":"Thematic analysis","author":"Braun Virginia","unstructured":"Virginia Braun and Victoria Clarke. 2012. Thematic analysis. American Psychological Association."},{"key":"e_1_3_2_1_4_1","volume-title":"Conceptual and design thinking for thematic analysis. Qualitative psychology 9, 1","author":"Braun Virginia","year":"2022","unstructured":"Virginia Braun and Victoria Clarke. 2022. Conceptual and design thinking for thematic analysis. Qualitative psychology 9, 1 (2022), 3."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1080\/00221546.2020.1770045"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2858036.2858498"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3544548.3580777"},{"key":"e_1_3_2_1_8_1","volume-title":"Universities. In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021","author":"Cohney Shaanan","year":"2021","unstructured":"Shaanan Cohney, Ross Teixeira, Anne Kohlbrenner, Arvind Narayanan, Mihir Kshirsagar, Yan Shvartzshnaider, and Madelyn Sanfilippo. 2021. Virtual Classrooms and Real Harms: Remote Learning at U.S. Universities. In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021). USENIX Association, 653--674. https:\/\/www.usenix.org\/conference\/soups2021\/presentation\/cohney"},{"key":"e_1_3_2_1_9_1","unstructured":"Student Privacy Compass. 2024. State Student Privacy Laws. https:\/\/studentprivacycompass.org\/state-laws\/."},{"key":"e_1_3_2_1_10_1","unstructured":"EDUCause. 2024. Higher Education Community Vendor Assessment Toolkit. https:\/\/library.educause.edu\/resources\/2020\/4\/higher-education-community-vendor-assessment-toolkit."},{"key":"e_1_3_2_1_11_1","unstructured":"Todd Feathers. 2022. This private equity firm is amassing companies that collect data on america?s children. https:\/\/themarkup.org\/machine-learning\/2022\/01\/11\/this-private-equity-firm-is-amassing-companies-that-collect-data-on-americas-children"},{"key":"e_1_3_2_1_12_1","first-page":"1673","article-title":"The Constant and Expanding Classroom: Surveillance in K-12 Public Schools","volume":"97","author":"Fedders Barbara","year":"2018","unstructured":"Barbara Fedders. 2018. The Constant and Expanding Classroom: Surveillance in K-12 Public Schools. North Carolina Law Review 97, 6 (2018), 1673--1726. https:\/\/heinonline.org\/HOL\/P?h=hein.journals\/nclr97&i=1722","journal-title":"North Carolina Law Review"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"crossref","unstructured":"Patricia I Fusch Ph D and Lawrence R Ness. 2015. Are we there yet? Data saturation in qualitative research. (2015).","DOI":"10.46743\/2160-3715\/2015.2281"},{"key":"e_1_3_2_1_14_1","volume-title":"Snowball sampling. The annals of mathematical statistics","author":"Goodman Leo A","year":"1961","unstructured":"Leo A Goodman. 1961. Snowball sampling. The annals of mathematical statistics (1961), 148--170."},{"key":"e_1_3_2_1_15_1","volume-title":"The GDPR and UK GDPR and its impact on US academic institutions. Issues in Information Systems 24","author":"Halawi Leila","year":"2023","unstructured":"Leila Halawi and Alpesh Makwana. 2023. The GDPR and UK GDPR and its impact on US academic institutions. Issues in Information Systems 24 (2023)."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2023-0110"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2022-0044"},{"key":"e_1_3_2_1_18_1","volume-title":"Problems with data governance in UK schools: The cases of Google Classroom and ClassDojo. (2022)","author":"Hooper Louise","unstructured":"Louise Hooper, Sonia Livingstone, and Kruakae Pothong. 2022. Problems with data governance in UK schools: The cases of Google Classroom and ClassDojo. (2022). Publisher: Digital Futures Commission, 5Rights Foundation."},{"key":"e_1_3_2_1_19_1","unstructured":"Instructure. 2024. Data insights for student success. https:\/\/www.instructure.com\/highereducation\/solutions\/data-analytics."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1186\/s41239-019-0155-0"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1002\/asi.24327"},{"key":"e_1_3_2_1_22_1","volume-title":"EDM and privacy: Ethics and legalities of data collection, usage, and storage","author":"Klose Mark","year":"2020","unstructured":"Mark Klose, Vasvi Desai, Yang Song, and Edward Gehringer. 2020. EDM and privacy: Ethics and legalities of data collection, usage, and storage. International Educational Data Mining Society (2020). Publisher: ERIC."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.5334\/jime.502"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.4103\/2249-4863.161306"},{"key":"e_1_3_2_1_25_1","unstructured":"Natasha Mack Cynthia Woodsong Kathleen M MacQueen and Greg Guest. 2005. Qualitative research methods. Family Health International."},{"key":"e_1_3_2_1_26_1","unstructured":"MAXQDA. [n. d.]. MAXQDA. https:\/\/www.maxqda.com\/."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359174"},{"key":"e_1_3_2_1_28_1","volume-title":"Interrater reliability: the kappa statistic. Biochemia medica 22, 3","author":"McHugh Mary L","year":"2012","unstructured":"Mary L McHugh. 2012. Interrater reliability: the kappa statistic. Biochemia medica 22, 3 (2012), 276--282."},{"key":"e_1_3_2_1_29_1","unstructured":"Phil Muncaster. 2023. Almost 900 US Schools Breached Via MOVEit. https:\/\/www.infosecurity-magazine.com\/news\/us-900-schools-breached-moveit\/."},{"key":"e_1_3_2_1_30_1","volume-title":"International journal of qualitative methods 19","author":"Connor Cliodhna","year":"2020","unstructured":"Cliodhna O?Connor and Helene Joffe. 2020. Intercoder reliability in qualitative research: debates and practical guidelines. International journal of qualitative methods 19 (2020), 1609406919899220."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1002\/asi.24575"},{"key":"e_1_3_2_1_32_1","unstructured":"Alex Psilakis. [n. d.]. EdTech Data Breach Emphasizes Need for Bolstered Data Privacy and Security Protections. https:\/\/digitalwatchdog.org\/edtech-data-breach-emphasizes-need-for-bolstered-data-privacy-and-security-protections\/."},{"key":"e_1_3_2_1_33_1","volume-title":"Big Tech Makes Big Data Out of Your Child: The FERPA Loophole EdTech Exploits to Monetize Student DataEdTech Exploits to Monetize Student Data","author":"Rhoades Amy","year":"2020","unstructured":"Amy Rhoades. 2020. Big Tech Makes Big Data Out of Your Child: The FERPA Loophole EdTech Exploits to Monetize Student DataEdTech Exploits to Monetize Student Data. American University Business Law Review 9 (2020)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3624010"},{"key":"e_1_3_2_1_35_1","first-page":"107","article-title":"Transparency and the marketplace for student data. Va","volume":"22","author":"Russell N Cameron","year":"2018","unstructured":"N Cameron Russell, Joel R Reidenberg, Elizabeth Martin, and Thomas B Norton. 2018. Transparency and the marketplace for student data. Va. JL & Tech. 22 (2018), 107.","journal-title":"JL & Tech."},{"key":"e_1_3_2_1_36_1","unstructured":"D Samuelson. 2017. Student data being sold to the highest bidder as privacy rights have gone down the drain. https:\/\/www.naturalnews.com\/2017-05--12-student-data-being-sold-to-the-highest-bidder-as-privacy-rights-have-gone-down-the-drain.html"},{"key":"e_1_3_2_1_37_1","volume-title":"Data breaches cost higher education and training organizations 3.7M on average","author":"Schwartz Natalie","year":"2023","unstructured":"Natalie Schwartz. 2023. Data breaches cost higher education and training organizations 3.7M on average in 2023. https:\/\/www.highereddive.com\/news\/data-breaches-cost-higher-education-colleges\/689499\/."},{"key":"e_1_3_2_1_38_1","unstructured":"Common Sense. 2024. Student Online Personal Information Protection Act (SOPIPA). https:\/\/www.commonsensemedia.org\/kids-action\/about-us\/our-issues\/digital-life\/sopipa."},{"key":"e_1_3_2_1_39_1","volume-title":"EDM 2018 workshop on policy and educational data mining.","author":"Sun Kaiwen","year":"2018","unstructured":"Kaiwen Sun, Christopher Brooks, Abraham H Mhaidli, Florian Schaub, and Sonakshi Watel. 2018. Taking student data for granted? A multi-stakeholder privacy analysis of a learning analytics system. In EDM 2018 workshop on policy and educational data mining."},{"key":"e_1_3_2_1_40_1","volume-title":"A tutorial on pilot studies: the what, why and how. BMC medical research methodology 10","author":"Thabane Lehana","year":"2010","unstructured":"Lehana Thabane, Jinhui Ma, Rong Chu, Ji Cheng, Afisi Ismaila, Lorena P Rios, Reid Robson, Marroon Thabane, Lora Giangregorio, and Charles H Goldsmith. 2010. A tutorial on pilot studies: the what, why and how. BMC medical research methodology 10 (2010), 1--10."},{"key":"e_1_3_2_1_41_1","unstructured":"US Department of Education. [n. d.]. Family Educational Rights and Privacy Act (FERPA). https:\/\/www2.ed.gov\/policy\/gen\/guid\/fpco\/ferpa\/index.html."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-57959-7"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1111\/joca.12506"},{"key":"e_1_3_2_1_44_1","unstructured":"Wikipedia. [n. d.]. Educational technology. https:\/\/en.wikipedia.org\/wiki\/Educational_technology\/."},{"key":"e_1_3_2_1_45_1","unstructured":"Wikipedia. 2024. Health Insurance Portability and Accountability Act. https:\/\/en.wikipedia.org\/wiki\/Health_Insurance_Portability_and_Accountability_Act."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1080\/13562517.2020.1748811"},{"key":"e_1_3_2_1_47_1","unstructured":"Jeffrey R Young. 2020. As Instructure Changes Ownership Academics Worry Whether Student Data Will Be Protected. https:\/\/www.edsurge.com\/news\/2020-01--17-as-instructure-changes-ownership-academics-worry-whether-student-data-will-be-protected\/."},{"key":"e_1_3_2_1_48_1","first-page":"339","article-title":"Student privacy principles for the age of big data: Moving beyond FERPA and FIPPS","volume":"8","author":"Zeide Elana","year":"2015","unstructured":"Elana Zeide. 2015. Student privacy principles for the age of big data: Moving beyond FERPA and FIPPS. Drexel L. Rev. 8 (2015), 339.","journal-title":"Drexel L. Rev."}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690353","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3690353","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T06:07:53Z","timestamp":1755842873000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690353"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":48,"alternative-id":["10.1145\/3658644.3690353","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3690353","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}