MSU officials confirm D2L tracks students’ locations

MSU officials acknowledged to the Exponent on Sept. 5 that the University’s online learning platform, Desire2Learn (D2L), allows faculty to monitor student activity and potentially track their locations using their Internet Protocol (IP) addresses.

IP addresses are unique identification numbers assigned to every device connected to the Internet, according to Cornell Law School’s Legal Information Institute. Essentially, IP addresses allow users to send and receive information between devices on a network. According to Forbes, IP addresses are used to determine approximate user location such as city and zipcode, the internet service provider’s log and a log of internet activity within a session on that network.

Forbes states that while IP addresses don’t explicitly reveal personal information, they can reveal pieces of personal identifiable information that people with very little technical knowledge are able to access. Personal identifiable information is defined by the U.S. Department of Labor as information that could be used to “reasonably” infer the identity of an individual by “direct or indirect means.”

This disclosure by the University raises questions surrounding data privacy for MSU students. According to the University's 2024 Fall Registrar’s Enrollment Report, there are 17,144 students currently enrolled at MSU, most of which likely use D2L.

MSU confirms that D2L tracks student IP addresses

On Aug. 23, a faculty member — who requested to remain anonymous due to concerns with potential repercussions — demonstrated to a class attended by an Exponent reporter how data is collected through D2L. Information such as IP addresses and login histories can be accessed by instructors to monitor a student’s approximate geolocation, both on and off campus.

During the presentation, the anonymous faculty member — with a student's consent — used the D2L-provided IP address from the aforementioned student's last login, looked up “IP tracker,” clicked the first link and pasted the IP address into the tracker to display the student's last recorded IP geolocation to the class. The student later confirmed the validity of the demonstration to the Exponent.

For the purpose of addressing potential capabilities and privacy threats posed by D2L, MSU Vice President of Information Technology Ryan Knutson and Director of Academic Technology and Outreach Kimberly Obbink agreed to a joint interview with the Exponent on Sept. 5.

Obbink confirmed that there are known instances of MSU faculty members using D2L-provided IP information to track students, however, she maintained that the function was used for educational purposes.

“We know that some faculty have used it to deal with academic integrity, for example, you may have had a class where your instructor said I'm going to deliver the exam in [D2L,] but I want you to be in this classroom while you're taking the exam. We've known that there have been instances where people texted that password to someone outside the class and someone outside of the classroom took the exam,” she said.

Regarding IP addresses’ use in monitoring students, Knutson reiterated the ability of IP addresses to provide a general geolocation, but not the “exact” geographic location a student is in, stating that the location can be adjacent to or surrounding an area.

Obbink and Knutson were then asked if there had been any efforts by the University to inform students on how accessible student IP addresses were for MSU faculty. Obbink said that D2L’s monitoring is not “specifically mentioned” anywhere.

Privacy concerns and personal data

Obbink stated that IP addresses do not fall under the definition of personally protected information. “And as far as IP addresses go, it's not illegal to collect them, so people can collect them. I think the rule of law says if you're using them for illegal purposes then it becomes illegal to collect them,” she said.

According to the U.S. Department of Education, personally protected information includes “identifiable information that is maintained in education records and includes direct identifiers” such as a student’s name, identification number, date of birth and other information that can be used to determine someone's identity through correlation with other information.

There is an ongoing national conversation surrounding data privacy rights, and Montana has not been excused from that discussion. The Montana Legislature recently passed Senate Bill 384, establishing the "Consumer Data Privacy Act" which took effect on Oct. 1. The Act intends to establish requirements and limitations for controllers and processors of personal data, according to its purpose section. It also defines personal data as “any information that is linked or reasonably linkable to an identified or identifiable individual.” However, the Act exempts compliance for nonprofits, health and financial institutions, institutions of higher education and government entities.

In an email to the Exponent on Sept. 25, Montana House Representative Daniel Zolnikov explained that there are many perspectives regarding the protection of IP addresses. He referenced a 2020 article written by David Zetoony for Greenberg Traurig — a global law firm based in Miami — which concludes that the answer to whether IP addresses qualify as personal data is a firm "maybe."

In the article, Zetoony highlighted a similar debate in California, noting that the California Attorney General declined to definitively state whether IP addresses alone constitute personal information under the California Consumer Privacy Act. Zetoony emphasized that the determination depends on specific facts and context.

Student and faculty opinions

Nathan Hager, a third-year computer science student, was asked whether he believes IP addresses are private information. "Yes, absolutely," he said. "There are a lot of things people can do with an IP address to target attacks specifically toward you." He explained that an IP address is often the first step in launching a cyberattack, calling it a way to "get your foot in the door."

"Once you identify [an IP address], with enough time and planning, you can theoretically do anything," he said. Upon learning that MSU made student IP addresses accessible to faculty, Hager's immediate reaction was: "That's not good."

He then expressed concerns, stating that teachers have no legitimate need to access student IP addresses and that they should never have been collected in the first place.

Hager also raised safety concerns, noting the potential risks if a faculty member harbored malicious intent toward a student. “There are things you could do to protect your IP address, but students shouldn't be expected to do that,” he said.

Moriko Peterson, a sophomore at MSU, was also asked if she felt her geographic location was private information. “I would say yes, it is, because it’s the location of where I am at,” she said. “Especially during the off-school season or whatever, or if it’s during Thanksgiving Break or Fall Break and I have to go home, my teachers know where I live. That’s not cool. That’s kind of scary, if I’m being honest.”

In the Aug. 23 interview, the anonymous faculty member who first demonstrated D2L’s ability to expose student IP addresses also detailed concerns for the potential misuse of that information. “If it ever ends up coming to that point — and I hope it never happens, but we live in this kind of world — where a student feels like they're being stalked by a [faculty member], you know that they probably know where you are because of the IP address function on D2L,” they said.

What can you do to protect your data?

Regardless of the intended educational use of IP address tracking by D2L, students concerned about potential privacy risks posed by faculty having access to their locations can take action to obscure their IP addresses.

According to Microsoft, there are a few main ways for Internet users to hide their IP addresses. One of these includes using a virtual private network (VPN) to obscure your IP address through a private network connection. VPNs redirect user activity through a VPN-owned server that encrypts data coming in and out of your computer.

Knutson also noted the usage of VPNs as a way to protect personal data. Additionally, he mentioned to be mindful of where and to what you're connecting your devices, as these practices could help maintain your privacy when accessing the Internet.

“I always think it's a good idea for students to be educated on the dangers that do exist,” he said.

If you or someone you know feels they are being watched, followed, stalked or faced with any form of harassment, contact Campus Civil Rights at (406) 994-1568 or civilrights@montana.edu. If there is an immediate threat to life or property, or if you require emergency assistance, contact University Police at (406) 994-2121 or dial 911