ProctorTrack Company Releases Statement on Status of Student Data

NEW BRUNSWICK, NJ—Verificient Technologies, the company behind the student-monitoring, anti-cheating software ProctorTrack, finally began to notify Rutgers University students that it had deleted their personal data from spring semester 34 days late, according to a recently-signed contract.

That data includes video and audio of students taking online exams, as well as personal information about the student and their computer.

Recent statements from Rutgers and Verificient addressed concerns about how long they will hold on to student data for the first time.

Those statements came in response to increasing pressure from major media outlets, tech blogs, and internet users.

As we reported, ProctorTrack uses remote-monitoring technology to collect audio and video, and document the web activity of students as they take the exam.

The software also scans the ID, face and knuckles of the student, and takes a voice sample.

The company had originally previously promised to purge data within 30-60 days, shortly after the software first came under scrutiny in February.

But, when the company finally signed a contract with the school, after seven months of a “verbal agreement,” the period was changed to 90 days.

“Total data deletion completion period, is ninety days from the time the student completed the last test in the course,” reads the contract, which also said the deletion would trigger “an automatic generated email to the student.”

But multiple students told New Brunswick Today they still had not received any such notification, even after the contract was singed on August 25, more than three months after most students had taken their last exam.

As the new semester began, students still had not received notification about their data.

Multiple inquiries to Verificient and Rutgers Media Relations were not returned, but New Brunswick Today’s coverage of ProctorTrack sparked a number of other media outlets to inquire about the apparent violation of the contract.

Even Channel 11 featured the controversy on a September 15 broadcast.

That coverage came after Gawker Media’s Jay Hathaway picked up on the story, citing New Brunswick Today’s work in a biting critique of the software, and their dealings at Rutgers.

The story was posted on Gawker.com at 6:10 pm on Monday, September 14.  Hours later, Verifient sent out emails to students who used ProctorTrack in the spring semester, telling them that their data had been “purged” two weeks earlier, on September 1.

Hathway noted in an update to that story that, “A spokesperson for the University told Gawker via email that the data has been purged, and notices began going out to students Sunday (a couple of days after New Brunswick Today started looking into the issue).”

Rutgers told the technology blog Ars Technica that it still believed the company was “in compliance” with the contract, explaining that data was preserved until September 1 because the 90-day period was meant to start on June 1, supposedly the last day that students could submit make-up work for the spring semester.

“Based on the academic calendar, Verificient used June 1, 2015 as the last date of the semester for the Spring 2015 term (allowing time for make ups exams and it was also the last day and deadline for completing incomplete grades from Spring 2015),” University spokesperson EJ Miranda wrote.

However, students finishing make-up work from the spring can actually hand in those assignments as late as December 2015.

CONTRACT INCLUDES ERROR, CONTRADICTORY STATEMENTS

The contract between Rutgers and Verificient includes contradictory and unclear language, especially in the section titled “student data purge and retention.”

The first sentence in that section says that that student data would be held for either 90 days after the last day of the semester, or 90 days after the student takes their final exam.

These two dates could vary greatly. The end of the spring 2015 semester was May 13, meaning that students should have gotten a data purge confirmation email on August 11 at the latest.

If a student’s data was held for 90 days after they took their last exam, then a student who used ProctorTrack only for an exam taken at the beginning of March 2015 should have their data deleted months before students who used ProctorTrack for an exam during the finals period.

Given that Rutgers University suffered a crippling DDOS attack which took down online learning tools and internet access during final exams, many classes, especially those online, skipped their final exam.

The agreement goes on to mention an additional 30-day period for deletion of data from backup servers, but then continues to say that the “total data deletion completion period” is 90 days after the last exam.

University officials struggled to explain the delays, after initially ignoring New Brunswick Today’s questions.

“Verificient Technologies informed us that student notifications are usually sent out within a week to 10 days of deletion, but because the Labor Day holiday fell during that period, there was a brief delay,” Miranda said, adding that sending out 3,000 emails at once may result in some of them ending up marked as spam.

However, under the contract, there is no mention of a delay of any type regarding the notification of students via email.

The contract says the “automated” emails would go out simultaneously along with the data deletion.

The ProctorTrack contract also includes a reference to another university, most likely resulting from a sloppy copy-and-paste job.

The signed agreement states that Verificient will provide Anderson University with a copy of an audit report within 15 days of the completion of the purge data cycle.

Founded in 1911, Anderson University is a private, liberal arts, Christian college based in Indiana.

New Brunswick Today inquired about whether this was an error or if Anderson University is actually meant to receive an audit report, as well as whether that college has plans to use ProctorTrack software.

Verificient and Rutgers officials have so far not responded to questions on those inquiries.

“VERBAL AGREEMENT” ALLOWED TO LAST OVER 7 MONTHS

The contract between Rutgers and Verificient was released to New Brunswick Today on August 25, the very same day it was signed by a representative from Rutgers.

New Brunswick Today had been threatening to sue the university for a copy of the agreement with the help of by Walter Luers, a New Jersey attorney specializing in public records laws.

The one-year agreement went into effect on Janaury 13, months before it was signed by either party, and only a week after ProctorTrack received a federal patent on January 6.

According to Rutgers officials, a “verbal agreement” was in place between Verificient and Rutgers from January through August 25, when the contract was finally signed.

During the seven months under the verbal agreement, confusion and miscommunications arose over the price of the software and its slipshod introduction to students, as well as how long the private company would retain student’s personal data, and whether students had to use it or if they could use alternative proctoring methods.

Students were also frustrated about the $32 fee to use the software, much higher than the cost at other colleges, and the perceived lack of notification, which resulted in many students finding out about the new software after it was too late to drop their courses.

University officials, along with Verificient CEO Tim Dutta, maintained that the introduction of the software in the beginning of the spring 2015 semester went flawlessly.

Rutgers officials also defended the rollout, and the notifications made to students about the changes to online courses.

“The ProctorTrack notice appeared from the first day of class in the Course Home and the first assignment on the first day of class was to read these documents,” Rutgers spokesperson EJ Miranda wrote in February. “The notice included the pricing.”

“All students had the regular drop/add period plus the two-day extension to drop the course if they wished to do so.”

But months later, University President Bob Barchi admitted in an interview with the Daily Targum that Rutgers might not have done enough to make sure students were properly notified about the software.

“I think what maybe wasn’t done quite right here was to make sure that everybody who is taking that course knew that was coming,” Barchi told the paper.