Minister of Education of Baden-Württemberg, Susanne Eisenmann

The BigBrotherAward 2020 in the “Digitalisation” Category goes to Susanne Eisenmann, Minister of Education, Youth and Sports of the federal state of Baden-Württemberg (and lead candidate of the conservative party, CDU, for the state parliamentary elections in 2021), for plans to have essential services of the state’s digital education platform run by Microsoft, thus delivering data and e‑mails of all teachers and pupils in Baden-Württemberg to that US company and to the US intelligence services.

Of course there are warnings and reservations against such a decision. But Dr. Eisenmann will not be stopped: The planned start is just a few weeks away, the ministry announced early in July during a session of the state parliament’s Education Committee.¹

How did we end up here?

Our awardee, Minister of Education Susanne Eisenmann, is under substantial pressure. In February 2018 she stopped the planned self-hosted e‑learning platform “Ella” because of serious technical deficiencies², three days before starting pilot operations in 100 schools. A string of reports about mishaps followed: expert reports revealed that the state-owned IT service provider tasked with the implementation had commissioned subcontractors without being authorised.³ There were no clear arrangements. The State Court of Audit found “substantial deficiencies in project management”.⁴ The minister removed the main service provider from the project.⁵ Everything was supposed to be restarted from scratch. Newspapers kept writing about “shambles” and “education platform about to be axed”, for two and a half years.

Ms. Eisenmann intends to run for prime minister in Baden-Württemberg next year, and the corona crisis has pressed the accelerator pedal hard to the floor concerning digitalisation in schools. So the digital education platform just has to work, before the critical phase of the election campaign. Reservations second! (Translator’s note: This is a quote from an election campaign slogan of the German Liberal Democrats, FDP: “Digitalisation first, reservations second!”)

There have been enough warnings about Microsoft.

Let us start with our own warning: After Microsoft received the BigBrotherAward in 2002 for their lifetime achievement,⁶ we awarded the prize in 2018 for Windows 10’s telemetry transmissions.⁷ The hunger for data is growing.The version “A3” of Microsoft 365, planned to be installed by the ministry, comprises a word processor, spreadsheet, file storage, video conferencing, mail server, etc.⁸ Everything is saved to Microsoft servers, and the software keeps precise logs, e.g. about which user has been working for how long on a document.⁹ “No problem”, the ministry says, “the A3 version has configurable privacy settings.”¹⁰ That may well be, Madam Minister, but not all settings are configurable. The so-called “essential services” cannot be deactivated.¹¹

The State Commissioner for Data Protection, Dr. Stefan Brink, is also very sceptical. In a statement he doubted that Microsoft 365 could legally be used in schools: “There seem to be structural features […] casting in doubt that use of the software can comply with data protection regulations without substantial modifications of the data processing by Microsoft.”¹² The data protection impact assessment commissioned by the minister from the company PwC, who, according to their own web site, co-operate with Microsoft¹³, is seen to have “methodological shortcomings” and should be extensively reworked “prior to a potential deployment of the product.”¹⁴

But that’s not all. Even an all-new ruling of the European Court of Justice could not shake the minister. On July 7, 2020 the court had declared the data protection agreement “Privacy Shield” between the EU and the US null and void.¹⁵ This confirms what really had been clear all along: Data from non-US citizens, collected by a US company, can be retrieved by US intelligence agencies on the basis of the CLOUD Act¹⁶ and FISA¹⁷.

Even twelve days after that, Ms. Eisenmann argued in a press release¹⁸ that a server located in the EU would solve that problem. No. Just no. Microsoft’s promise to store the data exclusively on EU-based servers is worthless. The US snooping agencies don’t care where the server is located.¹⁹ Experts – which you condescendingly called “self-styled data protectionists” in a press release – have been telling you exactly that for a long time.

But you have been committed to Microsoft.²⁰

This in disregard of the fact that many schools in Baden-Württemberg already use the secure messenger “Threema”, the free e-learning platform “Moodle” and the free and privacy-friendly video conferencing software “BigBlueButton”. And their experience has been a good one, you said so yourself.²¹ So why are you so keen on changing that? We don’t get it.

We also don’t understand why the data protection impact assessment you commissioned, and the response from your State Data Protection Commissioner²², concerning such an important decision, have not been been made transparent to teachers and parents.

For months, instead, we have been hearing from parents and teachers in Baden-Württemberg that they had been “muzzled by the ministry”, or “I am not allowed to talk about that”, or “I am not taken seriously.”²³

Finally it is supposed to start!

In autumn teachers at a few dozen schools will receive e‑mail addresses and a “personal workspace” with Office software and online storage, everything by Microsoft 365, storage location: Microsoft servers. But this is not just about data of all teachers, which the ministry surrenders to Microsoft (which in itself would be bad enough): minutes of school conferences, Excel spreadsheets or e‑mails exchanged between teachers will always contain sensitive information about individual children. It is impossible to separate that in any meaningful way.

And you intend to just rubber-stamp this without a sufficient data protection impact assessment? The devastating criticism of the State Data Protection Commissioner has not yet been conclusively disproven. We doubt that this could be achieved before the start of the project. Even more doubtful is Microsoft’s ability to implement the required changes before October. But you, Ms. Eisenmann, are hell-bent.

What a coup for Microsoft!

Allowing Microsoft to deploy a school platform means opening the floodgates. If Baden-Württemberg is going to be the first education ministry to make itself dependent in this way, other federal states will follow.

Of course, e‑mails and teacher workspaces are just the first step. “Medium term”, according to ministry’s plans, children will also be using the central file storage.²⁴ After that, they will also get access to the Office software packages – anything else would be nonsense from an educational-politics point of view.

This means that from an early age, children are getting accustomed to Microsoft products, and will be reluctant to change to a different software later. The corporation rejoices. This means they will be able to circumvent the prohibition for advertising in schools because they will be the officially authorised service provider for the ministry. This vendor lock-in effect, combined with data protection risks, is an epic pedagogical error.

This is not how we envisioned digital sovereignty²⁵.

One more thing: A Microsoft school platform is a ticking bomb

Initially, only teachers will be connected. Maybe they won’t object at first – it is their employer’s decision, after all. But a few months later, the parents will become involved.

We know that a lot of parents and teachers have objections against data-collecting software. What happens if they seize their fundamental rights and wisely refuse to agree to Microsoft’s data protection agreement? Are you going to enforce their “yes”? Or perhaps exclude children from class? The agreement to data processing must be voluntary – there is a conflict between the GDPR and compulsory schooling, don’t you think, Madam Minister? (Translator’s note: schooling is compulsory in Germany.)

Dear Ms. Eisenmann, would you want a big company and US intelligence agencies to know what you wrote in your youth in school essays about common themes? About euthanasia? Abortion? Homosexuality? Or the death penalty? This is a question other schools and ministries flirting with Microsoft should also think about. We are also talking to them in this laudation, when we say:

Turn back, Ms. Eisenmann!

Stop your plans for introducing Microsoft 365 as part of the education platform before it is too late! Before parents’ and teachers’ associations drown you in a wave of lawsuits.

Continue on the way you had already started, using Threema, BigBlueButton and Moodle: continue to rely on free software, open formats, decentralised architectures and on Nextcloud (a software which, incidentally, is being developed right at your doorstep, in Stuttgart). From a financial standpoint it is the best solution anyway. The State Court of Audit agrees.²⁶

24 million euros have been earmarked for the educational platform for Baden-Württemberg. Invest this in the adaptation of free software to your needs! Create know-how! Upgrade servers and storage, as you already did during the deployment of Moodle at the beginning of the corona crisis.²⁷ Public money invested like that will also benefit others. (“Public Money? Public Code!”)

Well, all that won’t be quite ready before the parliamentary elections. But parents and teachers will be grateful. And so will our liberal and democratic educational ideals – and those are certainly worth preserving.

Congratulations for winning the BigBrotherAward 2020 in the category “Digitalisation”, Dr. Susanne Eisenmann.

Awardee Adsress:

Ministerin Dr. Susanne Eisenmann
Ministerium für Kultus, Jugend und Sport
Thouretstraße 6
70173 Stuttgart
0711 279-0
0711 279-2810
poststelle@km.kv.bwl.de

Authors: Claudia Fischer, Jessica Wawrzyniak, Leena Simon