Growing up in suburban Libertyville, Illinois, Miami University student Erik Johnson had a passion for technology. 

“I just like to poke around with stuff and break things,” the first-year computer engineering major says.

Last fall, one of the things he poked around in was Proctorio — the electronic proctoring program that Miami makes available to instructors as a tool for online “monitoring students as they take high-stakes exams,” according to Miami’s website.

That led Johnson, 18 and a self-identified security researcher, to what he considered several suspicious lines of code in Proctorio.

Concerned that Proctorio’s software infringes on the privacy rights of students, Johnson took his criticism to Twitter, Pastebin, and GitHub – posting code from the program early last September to prove his point. 

That prompted Proctorio to take action.

Proctorio CEO Mike Olsen first wrote directly to Johnson, requesting he remove his Twitter posting. Proctorio then swiftly requested each company remove Johnson’s postings from their respective platforms, stating that the code “was protected under the Digital Millennium Copyright Act (DMCA)” in a request to the operators of each site. 

Johnson did not agree. Now, with the help of the Electronic Frontier Foundation (EFF), Johnson is suing Proctorio, joining a string of lawsuits against one of the nation’s leading proctoring providers.

A breakdown of the case

Johnson filed suit April 21, in U.S. District Court for the District of Arizona, where the company is based, alleging that Proctorio misused the DMCA in calling for him to remove his social media postings, according to the suit, Johnson v. Proctorio Inc. The suit alleges that Olsen misused the DMCA takedown provisions to shut down public criticism of the company.

While the suit focuses mostly on copyright matters, Johnson also said he believes Proctorio seriously violates student privacy. In analyzing Proctorio, the suit says, he learned that the company’s support staff can participate in live room scans, threaten students who attempt to bypass the software’s integrity features, and route data through Proctorio servers.

To prove his point, Johnson’s Tweets linked several lines of code from the Proctorio browser extension, which he says “was written in plain English and is…accessible by anyone publicly on the web-store.” 

He said he decided to sue Proctorio after it filed the DMCA takedown notice, and the platforms he had posted on quickly complied.

The Electronic Frontier Foundation 

EFF attorneys Cara Gagliano and Hannah Zhao took up the lawsuit on Johnson’s behalf. After reviewing the case details, Gagliano sided with Johnson’s argument, and even went so far as to view Proctorio’s actions as “a form of fraud.” 

Gagliano views her organization as the “premier non-profit defending civil liberties in a digital world.”

In the end, Gagliano saw this case as a major opportunity. “I want companies to realize [that] you can’t just make up to suit our purposes; just because we don’t want information out there,” Gagliano said, referring to companies lying about violations to hide criticism. “This is a straightforward case that we never should have had to file.”

Zhao agreed. “The legal system is not supposed to be manipulated by people with power, who can do these DMCA takedowns…and use that as a hammer against criticism when they face it,” she said.

Proctorio Inc. did not respond to a request for comment. 

The company, created in 2013 and headquartered in Scottsdale, Arizona, claims more than 2 million weekly test-takers in the digital classrooms at more than 1,000 institutions, according to its website.

Northern Kentucky University law professor Kenneth Katkin agrees that it’s “crystal clear that Erik’s (Johnson’s) use was fair use,” adding that “it’s not even debatable.” 

However, Katkin said he believes that the case may ultimately be dismissed. “If the dispute has already resolved itself in the real world, which seems to have happened to some extent here,” the case may be dismissed as “moot,” or not justifiable, according to Katkin. 

No matter the reason for the takedown, University of Cincinnati Libraries Scholarly Communications and Digital Publishing Strategist Mark Konecny is critical of Proctorio’s actions. 

“It’s a high-risk move for them to do this kind of assertive effort to squash the little guy,” Konecny said. “If you don’t want to garner unwanted publicity, you make sure this kind of thing doesn’t come up in a court case because it gets written about.” 

As Proctorio handles Johnson’s suit, it is pursuing a similar one against University of British Columbia Learning Technology Specialist Ian Linkletter. 

According to Linkletter, who raised over $84,175 in Canadian dollars from a GoFundMe in support of his work, “Proctorio is currently suing me for sharing links on Twitter to seven YouTube videos, and a screenshot showing how they removed them.” 

A question of fair use

While Proctorio took action to remove both posts on the basis of fair use, Katkin said he believes that this may have been a mistake. Rather, the Terms of Service may have restricted the use of program data in this way.

That means both Johnson and Linkletter may have actually agreed not to post Proctorio files on third-party websites.

“If you agreed to some things in a click-through type agreement that was part of your university’s contract with Proctorio, then you might have agreed not to do certain things that would otherwise be a fair use,” Katkin said. 

Johnson said that while there were no terms to agree to to download the extension, “Proctorio’s terms of service don’t matter until you actually use the software and click the checkbox before you take an exam.” Similarly, when asked about this, Linkletter said that he did not “remember any pop-ups or agree to anything like that. That’s a really contested issue.” 

No matter the outcome of his case, Johnson’s motivation is clear. 

“I’m hoping to just sort of inform more people, specifically administrators at universities, that student surveillance is becoming a problem,” Johnson said.

Linkletter is striving for the same goal. “It’s important to raise concerns and share information so that the companies have to either respond or improve their product. But they can’t just ignore us,” Linkletter said.

Proctorio continues to face backlash across the country from students and educators, with some universities. The University of Illinois Urbana-Champaign announced in January it would drop the software at the end of this summer’s term, following more than a year of complaints about it on the campus over privacy and other issues. 

At Miami, officials from the libraries, English Department, Pre-Law Program, Office of News & Communication, and Office of Information Security either declined comment or did not respond to a request for comment for this story.

Johnson, meanwhile, ended up banned from Proctorio. Instead, for his entire first year at Miami, he had to take any exams that were supposed to include Proctorio monitoring separately, over Zoom calls outside of scheduled exam times.