Tell HN: My kid's school installed spyware and I can't remove it

My middle schooler goes to Chicago Public Schools. They use Google Classroom for assignments and other communications.

I bought him a Chromebook for schoolwork, but also for other private things. When we logged in, the system installed GoGuardian monitoring software on the Chromebook without notice or permission.

And now I can't remove it. I wrote to GoGuardian support, and they replied that I had to contact the school or remove my son as a user. The instructions for removing him as a user do not work; on the contrary, I see the message "cps.edu manages this user and may remotely manage settings and monitor user activity" and he can't be removed.

I did a full factory reset, signed in to his account again, and now the system is once again locked down.

So now I'm in the position where I have to ask permission from a local government entity to please let me install stuff and don't monitor the computer I bought and paid for.

Does anyone know how to refer these people to law enforcement for prosecution?

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in, the system installed GoGuardian monitoring software on the Chromebook without notice or permission.

Can you give more details? Logged in to what? I don't know how Chromebooks work, but I take your description to mean logged into a webpage, which allowed it to install arbitrary software on your computer - this sounds like a vulnerability in Chromebooks.

Edit: On rereading the post, I suppose you mean logged in to Google Classroom.

This is similar to MDM. Sign in to a school .edu Google account that force auto provisions the device.

Easy, wipe the system and install Linux on it.

Nothing gets “installed” in the traditional sense on a chromebook.

When you login to the chromebook, you can log in with any Google credentials. The credentials the school gave your son are managed by them. If you log into that account, it configured the user session per the management of the account, so this will start a “managed” session for that managed user.

If you use a personal Google account, none of that should happen. It’s not a managed account, it’s a normal one, and there shouldnt be any additional provisioning.

You should be able to switch between them and use both independently.

However, if you are saying that is what you are doing, and the spyware isn’t respecting the config between users, then that is definitely a problem.