Speaking as an infosec professional, security monitoring software should be targeted at threats, not at the user. We want to know the state of the laptop as it relates to the safety of the data on that machine. We don’t, and in healthy workplaces can’t, determine what an employee is doing that does not behaviorally conform to a threat.
Yes, if a user repeatedly gets virus detections around 9pm, we can infer what’s going on, but we aren’t tracking their websites visited, because the AUP is structured around impacts/outcomes, not actions alone.
As an example, we don’t care if you run a python exploit, we care if you do it to a machine you do not have authorization to (i.e. violating CFAA). So we don’t scan your files against exploitdb, we watch for unusual network traffic that conforms to known exploits, and capture that request information.
So if you try to pentest pornhub, we’ll know. But if you just visit it in Firefox, we won’t.
We’re not prison guards, like these schools apparently think they are, we’re town guards.
PotentiallyApricots@beehaw.org 1 week ago
I feel you’re coming at this from an abstract angle more than how these things actually play out in practice. This isn’t reliable software, it isn’t proven to work, and the social and economic realities of the students and families and districts have to be taken into account. The article does a better job explaining that. There are documented harms here. You, an adult, might have a good understanding of how to use a monitored device in a way that keeps you safe from some of the potential harms, but this software is predatory and markets itself deceptively. It’s very different than what I think you are describing.