Parents Built a School App Then the City Called the Cops
Stockholm’s official app was a disaster. So annoyed parents built their own open source versionâ€"ignoring warnings that it might be illegal.Christian Landgren’s patience was running out. Every day the separated father of three was wasting precious time trying to get the City of Stockholm’s official school system, Skolplattform, to work properly. Landgren would dig through endless convoluted menus to find out what his children were doing at school. If working out what his children needed in their gym kit was a hassle, then working out how to report them as sick was a nightmare. Two years after its launch in August 2018, the Skolplattform had become a constant thorn in the side of thousands of parents across Sweden’s capital city. “All the users and the parents were angry,†Landgren says.
The Skolplattform wasn’t meant to be this way. Commissioned in 2013, the system was intended to make the lives of up to 500,000 children, teachers, and parents in Stockholm easierâ€"acting as the technical backbone for all things education, from registering attendance to keeping a record of grades. The platform is a complex system that’s made up of three different parts, containing 18 individual modules that are maintained by five external companies. The sprawling system is used by 600 preschools and 177 schools, with separate logins for every teacher, student, and parent. The only problem? It doesn’t work.
The Skolplattform, which has cost more than 1 billion Swedish Krona, SEK, ($117 million), has failed to match its initial ambition. Parents and teachers have complained about the complexity of the systemâ€"its launch was delayed, there have been reports of project mismanagement, and it has been labelled an IT disaster. The Android version of the app has an average 1.2 star rating.
On October 23, 2020, Landgren, a developer and the CEO of Swedish innovation consulting firm Iteam, tweeted a hat design emblazoned with the words “Skrota Skolplattformenâ€â€"loosely translated as “trash the school platform.†He joked he should wear the hat when he picks his children up from school. Weeks later, wearing that very hat, he decided to take matters into his own hands. “From my own frustration, I just started to create my own app,†Landgren says.
He wrote to city officials asking to see the Skolplattform’s API documents. While waiting for a response, he logged into his account and tried to work out whether the system could be reverse-engineered. In just a few hours, he had created something that worked. “I had information on my screen from the school platform,†he says. “And then I started building an API on top of their lousy API.â€
The work started at the end of November 2020, just days after Stockholm’s Board of Education was hit with a 4 million SEK GDPR fine for “serious shortcomings†in the Skolplattform. Integritetsskyddsmyndigheten, Sweden’s data regulator, had found serious flaws in the platform that had exposed the data of hundreds of thousands of parents, children, and teachers. In some cases, people’s personal information could be accessed from Google searches. (The flaws have since been fixed and the fine reduced on appeal.)
In the weeks that followed, Landgren teamed up with fellow developers and parents Johan Öbrink and Erik Hellman, and the trio hatched a plan. They would create an open source version of the Skolplattform and release it as an app that could be used by frustrated parents across Stockholm. Building on Landgren’s earlier work, the team opened Chrome’s developer tools, logged into the Skolplattform, and wrote down all the URLs and payloads. They took the code, which called the platform’s private API and built packages so it could run on a phoneâ€"essentially creating a layer on top of the existing, glitchy Skolplattform.
The result was the Öppna Skolplattformen, or Open School Platform. The app was released on February 12, 2021, and all of its code is published under an open source license on GitHub. Anyone can take or use the code, with very few limitations on what they can do with it. If the city wanted to use any of the code, it could. But rather than welcome it with open arms, city officials reacted with indignation. Even before the app was released, the City of Stockholm warned Landgren that it might be illegal.
In the eight months that followed, Stockholms Stad, or the City of Stockholm, attempted to derail and shut down the open source app. It warned parents to stop using the app and alleged that it might be illegally accessing people’s personal information. Officials reported the app to data protection authorities and, Landgren claims, tweaked the official system’s underlying code to stop the spin-off from operating at all.
Then, in April, the City announced it was getting the police involved. Officials claimed the app and its cofounders may have committed a criminal data breach and asked cybercrime investigators to look into how the app worked. The move took Landgren, who had been meeting with city officials to address concerns about the app, by surprise. “It was quite scary,†he says of the police involvement.
Öppna Skolplattformen is not a complicated app. While the official School Platform is built for everyone involved in education in the Swedish capitalâ€"200,000 parents, 23,500 members of school staff, and 140,000 studentsâ€"its open source alternative is just for parents. The €1 app has been downloaded around 12,500 times on iPhone and Android (with a 4.2-star average rating) and only shows basic information.
Parents log in using the Swedish digital identity system BankID, which is also used by the Skolplattform. They can then see information about their children that’s pulled into the app through the Skolplattform API. The app shows school calendars and events such as music concerts, a daily schedule for pupils, notifications from teachers that link out to grades and news updates, food that’s being served in cafeterias, and an option to report if children are sick. “Everything that we display is open and public information,†says Öbrink, one of Öppna Skolplattformen’s cofounders. He explains that when students’ grades are shown, they are displayed through an in-app browser where the app can’t access any data. One of the first iterations of the app included some parents’ personal details, which are available through the official platform, but these were later removed. “It was sort of an accidental success,†Öbrink adds. “We never anticipated that it would work as well as it did.†He says the Öppna Skolplattformen team held meetings with the city in which they said officials could take their code and use their version of the app. “They did not want to collaborate or even discuss collaboration with us, they just went on and reported us to the police,†he says.
The City of Stockholm was unsure about Öppna Skolplattformen from the beginning. “We do not have open APIs, so they have made their own solution,†Hélène Mossberg, the deputy head of digitization and IT at the city’s education division, told Swedish publication Ny Teknik in February. Mossberg, speaking before the unofficial app launched, said it may be “illegal†because people’s personal data was involved. Although Mossberg claimed to be generally positive about the app, she said a “rigorous†investigation was being launched. The city encouraged the developers not to publish the app until the investigation was completed, official documents say. In mid-February, Swedish security firm Certezza completed an external audit of the appâ€"the report was not published, despite Sweden’s strong transparency laws. In order to access the document, the Öppna Skolplattformen team challenged the nondisclosure in court.
Three weeks later, at the end of February, the stakes were raised. The city said it was making security updates to the Skolplattform to stop any potential personal data from being accessedâ€"effectively shutting down Öppna Skolplattformen’s home-brewed API. The city’s action started a tug-of-war between the two sides: The Skolplattform would be updated; Öppna Skolplattformen would respond with its own updates. In March, Öppna Skolplattformen was apparently updated seven times to avoid “sabotage†from the city, which continued to change its underlying systems. “They were worried that their information was sent elsewhere,†Landgren says. At around this time, he claims, a dedicated task force was established to tackle the Öppna Skolplattformen problem.
Lena Holmdahl, director of education at the City of Stockholm, says the city acted in line with its responsibilities to its suppliers, students, and employees. “I can understand that the Open School Platform feels that we make it difficult for them,†Holmdahl says. “We have responsibilities that we try to perform in accordance with the agreements, laws, and regulations we are obliged to follow.†Holmdahl adds that the city has met with the team to try to explain its position. “The developers behind the app have many interesting thoughts and ideas, and they have, with their app, put their finger on things that we need to work on.â€
In early April, the city asked the developers to unpublish their source code from GitHub. On April 15, the education administration, led by Holmdahl, announced it had completed its investigation into the parent-developed system and had concerns about how the app handled data. The city then reported the developers and Öppna Skolplattformen to the police, saying it believed a data breach may have happened.
“They wrote the police report in a way that was supposed to look scary,†Landgren says. In the following weeks, cybercrime investigators came to his house and interviewed him about the open source appâ€"a process Landgren says caused him to doubt the work the team had done. “You have to make a decision at that point on what you’re trying to do,†he says. Ultimately he continued to work on the projectâ€"along with an expanding teamâ€"as they believed it was the right thing to do.
While the dispute was unfolding, Öppna Skolplattformen continued growing in popularityâ€"including a swell in the number of people involved in its development. Cofounders Landgren and Öbrink say up to 40 people have worked on development of the app. This group of volunteers has found and squashed bugs, developed a search feature, and translated the app into different languages. They also raised potential security issues with the official app, even as the city worked against them. The team includes designers, lawyers, and developers. “As private citizens, we are highly digitalized,†Landgren says.
As Sweden’s startup scene has thrivedâ€"Spotify, Klarna, and King were all founded thereâ€"its public sector technology has struggled to keep up. The most recent OECD report into government digitization, from 2019, ranks Sweden at the bottom of the 33 countries reviewed. “When we use these official tools, they are stuck in the ’90s,†Landgren says. “To bridge that gap we, and a lot of other people that joined us, think that open source is probably the best way for us to start collaborating.†He argues that citizen development can be more effective than costly and often botched government IT projects that take years to complete and are out of date by the time they are completed.
“​​It shows very clearly some of the ways in which Sweden’s digitalization has gone wrong,†says Mattias Rubenson, the secretary of the Swedish branch of the Pirate Party, which has been chronicling the problems it has with the Skolplattform. “There is, in general, the possibility of a school platform being good. But you have to involve students, and especially teachers, in the development from the start. There has been none of that in the School Platform.â€
Öppna Skolplattformen had to wait months to be cleared. “We do not believe that anything criminal has been committed,†Åsa Sköldberg, the leader of the police’s preliminary investigation, told Dagens Nyheter on August 16. Data regulator Integritetsskyddsmyndigheten did not open an investigation into the city’s complaint, a spokesperson says.
The police report, shared with WIRED by Landgren, references the Certezza security review, which was commissioned by the city and completed on February 17, 2021. The review concluded that the open source app wasn’t sending any sensitive information to third parties and didn’t pose a threat to users. The police report went further in clearing the Öppna Skolplattformen developers. “All information that Öppna Skolplattformen has used is public information that the City of Stockholm voluntarily distributed,†it said.
Landgren was traveling to his brother’s wedding in France at the start of September when he got the phone call. The city was changing its position on Öppna Skolplattformenâ€"and any other apps seeking to do similar thingsâ€"and decided to let others access the data within its systems. To do so, the city struck a deal with an external provider that will be able to set up licenses between Öppna Skolplattformen and the city.
“With this solution, the City of Stockholm can guarantee that personal data is handled in a correct and secure way, while parents can take part in the market’s digital tools in their everyday lives,†Isabel Smedberg-Palmqvist, a city councillor in Stockholm, said in a statement issued on September 9. The move was validation of Öppna Skolplattformen’s effortsâ€"the team estimates that hundreds of hours of work have been put into the app. But the call also came as a shock to Landgren. Just days earlier, he claims, Öppna Skolplattformen was once again being buffeted by attempts to block its access to official APIs. After the announcement was made, the efforts stopped.
Landgren now hopes Öppna Skolplattformen will be able to strike a deal with the City of Stockholm that will result in the city paying for a license to the app. The aim is for it to be made free for all parents. “It's going to look a lot like [the city] buying Microsoft Office,†Landgren says. “A typical license deal.†If the deal can be struckâ€"the details and numbers are still being negotiatedâ€"Öppna Skolplattformen volunteers will be paid for their contributions, he says. The founders say the effort has never been about making money and that they have always intended on giving any funds generated through downloads to the parents who created it.
While the official School Platform has improved in the two years since it was releasedâ€"including during the pandemic, when remote learning became the norm for many students and teachersâ€"there’s still a lot of work to do. “The teachers I have been in contact with have all experienced great difficulties with the system,†says Sanna Olsson, a teacher and board member of the Lärarförbundet Stockholm union. “Several of the functions have become smoother and easier to use over time, but there are still far too many keystrokes and functions for us to easily get where we are going,†she says, adding that when she tries to log in as a parent the system doesn’t work “half the time.â€
Holmdahl, from the city’s education board, admits that the app could be easier for parents to useâ€"although she points out that, unlike the unofficial app, it has to work for teachers and students as well. “User-driven IT development is interesting but must work together with legislation and responsibility for secure personal data,†she says. Holmdahl maintains the city has always had a license agreement that people could use to get personal data but that there was no license provider at the time Öppna Skolplattformen started.
Despite the disputes, Öppna Skolplattformen looks to have a bigger future and is expanding beyond Stockholm’s city limits. Landgren and his collaborators have already seen interest from elsewhere in Sweden, where such school platforms are operated by individual cities. Chief among these is Gothenburg, Sweden’s second-largest city. Talks between parents and city officials are taking place, and Landgren says the team is already working on a new version of the app. (City officials had not responded to a request for comment by the time of publication).
Ultimately, Landgren hopes the Öppna Skolplattformen saga will teach politicians and city officials that the technology they provide for citizens shouldn’t be procured as huge IT projectsâ€"and that the people who will end up using it should be involved in the planning and development. Landgren argues that cities should learn to run their IT projects with small updates, rather than monstrous procurements that can easily go wrong. Most of all, Landgren argues that officials should make their APIs open so citizens can build technology that works for them. “If you build the API,†he says, “the app will come.â€
More Great WIRED Stories
0 Response to "Parents Built a School App Then the City Called the Cops"
Post a Comment