Proctorio used DMCA to take down a student’s critical tweets

A series of tweets by one Miami University student that were critical of a proctoring software company have been hidden by Twitter after the company filed a copyright takedown notice.

Erik Johnson, a student who works as a security researcher on the side, posted a lengthy tweet thread in early September about Proctorio, an Arizona-based software company that several U.S. schools — including his own — use to monitor students who are taking their exams remotely.

But six weeks later, Johnson received an email from Twitter saying three of those tweets had been removed from his account in response to a request by Proctorio filed under the Digital Millennium Copyright Act.

Proctoring software isn’t new, but its usage has skyrocketed because of the pandemic. More students than ever are having to take exams and tests from home, and colleges and universities are relying on proctoring software to administer the tests. Students have to install their university’s choice of proctoring software, which gives the exam administrator deep access to the student’s computer, often including their webcams and microphones, to monitor their activity to spot potential cheating.

But students say that proctoring software is fraught with problems. Vice reported that students had complained that the proctoring software they had to use could not recognize darker skin tones, and others say the software requires high-speed internet, which many low-income houses don’t have.

Falling foul of any of these checks, whether known to the student or otherwise, could result in failing the test altogether.

Thousands of students at schools in Washington and Florida have already petitioned their schools to stop using proctoring software — including Proctorio — citing privacy and security risks.

Proctorio, based in Scottsdale, Arizona, says its proctoring software is privacy friendly. Students are required to install its Chrome extension before taking a test, which the company says students can remove once they’re done.

Unlike desktop software, most Chrome extensions can be easily downloaded and their source code viewed and examined. Johnson did this and tweeted his findings. Three of those tweets described under what circumstances Proctorio would “terminate” a student’s exam if it detected signs of potential cheating — such as if a student “switched networks” or if “abnormal clicking” and “eye movements” were detected. The tweets also included a link to snippets of code found in Proctorio’s Chrome extension, which Johnson posted to code-sharing site Pastebin.

Those three tweets are no longer accessible on Twitter after Proctorio filed its takedown notices. The code shared on Pastebin is also no longer accessible, nor is a copy of the page available from the Internet Archive’s Wayback Machine, which said the web address had been “excluded.”

A spokesperson for Twitter told TechCrunch: “Per our copyright policy, we respond to valid copyright complaints sent to us by a copyright owner or their authorized representatives.”

Johnson provided TechCrunch a copy of the takedown notice sent by Twitter, which identified Proctorio’s marketing director John Devoy as the person who requested the takedown on behalf of Proctorio’s chief executive Mike Olsen, who is listed as the copyright owner.

Olsen is no stranger to controversy. Earlier this year he drew ire after posting private support chat logs from a student, which he later deleted and set his Twitter account to private following the incident. Proctorio is also suing security researcher Ian Linkletter, a learning technology specialist at the University of British Columbia, after tweeting critically of the company’s software.

When reached by phone, Olsen claimed that Miami University had accepted the company’s terms and conditions on behalf of Johnson, and that Johnson allegedly violated those terms when he tweeted about the code.

Following the call, Proctorio emailed TechCrunch a statement through its crisis communications firm Edelman, claiming Johnson “violated Proctorio’s exclusive rights by copying and posting extracts from Proctorio’s software code on his Twitter account,” and in response, Proctorio filed the DMCA takedown request “to ask that the content be removed and Twitter removed it.”

“Mr. Johnson’s claim that he has the right to reproduce the code because he was able to download it is simply not true. Regardless of his ability to download the files, they remain protected under the Copyright Act. Also, had Mr. Johnson looked at the files he downloaded, he would have seen the multiple copyright notices in the header of each file that state expressly that the code is owned by Proctorio and that ‘unauthorized reproduction, display, modification, or distribution of this software, or any portion of it, may result in severe civil and criminal penalties, and will be prosecuted to the full extent permitted by law.’ His reproduction of that code violated Proctorio’s rights, which is why Proctorio asked Twitter to remove it,” said Edelman’s senior vice president Andy Lutzky, on behalf of Proctorio.

With help from the nonprofit internet rights group the Electronic Frontier Foundation, Johnson said he has now submitted a counter notice to appeal the takedown.

“This is really a textbook example of fair use,” said EFF staff attorney Cara Gagliano. “What Erik did — posting excerpts of Proctorio’s code that showed the software features he was criticizing — is no different from quoting a book in a book review. That it’s code instead of literature doesn’t make the use any less fair.”

“Using DMCA notices to take down critical fair uses like Erik’s is absolutely inappropriate and an abuse of the takedown process,” said Gagliano. “DMCA notices should be lodged only when a copyright owner has a good faith belief that the challenged material infringes their copyrighted work — which requires the copyright owner to consider fair use before hitting send.

“The application of fair use is clear cut here, and this notice never should have been sent,” she said.

Update: Hours after publication, Johnson tweeted that Twitter had released his tweets after it found Proctorio’s takedown notice to be “incomplete.” You can read his fully restored tweet thread here.

Got a tip? You can reach the author over Signal and WhatsApp at +1 646-755-8849 or by email: zack.whittaker@techcrunch.com