New Zealand school data collected and on-sold to Google, Microsoft

A company with ties to the Chinese Government collected information on the budgets and cybersecurity of Kiwi schools, and the information was on-sold to Google and Microsoft, to the shock of some principals.

"It's quite a shocking revelation to hear that school information, given in good faith, was being shared with companies for commercial on-selling," Berhampore School Principal Mark Potter told Newshub.

Originally pitched as 'multi-year', the Ministry of Education-sanctioned survey was quietly canned in late 2018 after questions about the use of the information were asked by primary teachers union NZEI.

"A company had been surveying schools around the country about their actual use of digital technologies and their projected use of digital technology," NZEI national secretary Paul Goulter told Newshub.

"That raised alarm bells for us because that information seemed to be kept by that company and on-sold."

He said NZEI checked it out with a number of principals right across the country and "they were totally unaware that that information could be on-sold to big data".

Louise Francis, research director for IDC Australia and New Zealand, told Newshub the final report was sent to Google and Microsoft under a non-disclosure agreement. 

In an acknowledgment it got it wrong, the Ministry of Education said it canned the survey because it would gain more benefit if the data was under its own direct control.

But it's refusing an interview and won't even say if it knows which companies the schools' data was sold to. 

The survey focused on schools' Bring Your Own Device (BYOD) programmes, which included the size of school budgets, which operating systems are used and whether cybersecurity systems are in place.

School principals were asked to fill out the survey in a notice in a Ministry of Education publication School Bulletin, and were then emailed the survey by International Data Corporation (IDC).

The survey sponsors received "customised reports" based on survey data, and as of December 2018, the information collected by IDC was still "open for purchase".

Global corporate China Oceanwide Holdings has a 90 percent ownership share of IDC, the company running the survey. China Oceanwide was founded by Beijing billionaire Lu Zhiqiang, who has close ties to the Chinese Communist Party.

Schools were asked whether security and internet filtering applies to all devices on the school network, and whether that still applies when devices are being used remotely.

They were also asked which applications - like Google's G-suite, Dropbox - are being used, and whether students' devices are on Andriod, Chrome or iOS operating systems.

The Bulletin told school staff, "information collected will be used to get insights into how primary and secondary schools are adopting and using technology, including a deeper look into schools where students bring their own device (BYOD).

"We intend to undertake the survey annually to better understand the trends and inform our policies."

Dave Parry, AUT's head of computer science, said he'd be concerned about how the survey asked to "speculate about how parents spend their money, and I don't think that's a reasonable thing to do".

He said the survey had detail marketing information which would be "valuable for corporates".

The survey was supposed to end on March 2, 2018, but on March 5 a notice in the Schools Bulletin advised the survey was extended to March 16 and schools that hadn't participated were chased up.

The work for the survey was not tendered as the Whole of Life value of the project was less than $10,000.

Potter said when he fills out surveys for the Ministry of Education as a principal, he does it in "good faith", and said, "we don't want anything to make us doubt that faith we give".