Software Ate My Homework

A student emailed me yesterday, panicked, in the early afternoon. She was worried about her final project in my university course, which was due at midnight. By the time I saw the email, three hours had elapsed. By the time we got on Zoom to discuss the matter, another 90 minutes.

That’s when I learned about the outage. Canvas, an online service used by as many as 40 percent of North American colleges, among them Washington University in St. Louis, where I teach, had gone down globally—victim to a ransomware attack. Just like ride-share apps replaced the physical act of hailing a cab, “courseware” such as Canvas has replaced more analog systems at almost every college and university, which now use the tool to run classrooms, manage assignments, and handle grading. When Canvas goes down, college classes cease to operate.

My heart sank because already I could anticipate a million little irritations that would add up to a huge headache for everyone, as students worried about how to submit their work, whether they would be penalized, whether they could be given an opportunistic extension—and I worried about whether I would have to reschedule my weekend to complete grading by Monday. Students had already started emailing—Submitting my project just in case. Better safe than sorry. I get it—I’d threatened to refuse late submissions, but only because I had endeavored to push the deadline as late as possible in the first place, to give them as much time as I could. Of course, I wouldn’t hold this against them, but I understood their anxiety. Students are all anxiety, today. Every interaction begins and ends with worry.

Later in the day, while I waited for the crisis to resolve, I watched the episode of Mad Men in which Don forces Megan to eat orange sherbet and then abandons her at a Howard Johnson’s in Plattsburgh, New York. Communication in this era was simpler: pay phones, whose calls may or may not reach their recipients. Ambiguity and uncertainty were assumed and understood. Some answers would not come right away; you would just have to wait. I considered how nostalgia for the 20th century is, in part, a longing for a time when human interactions felt more direct and therefore more successful, even when they failed. Now, people feel trapped by the tools we use, unable to interact in a human way by means of them—and forced to do so less efficiently besides.

But in the moment, with the student’s nervous face on my computer screen, I faced a more immediate problem. Having changed her plans for the project at the last minute, she wondered if her new plan for her video game—the course is an Atari 2600 game-programming class—would make the result, and her grade, worse. The question was reasonable. Students have been encouraged to orient themselves toward performance; faculty have been advised to meet them where they are; college costs a lot of money and mainly serves to professionalize students, even when they are learning to program a 50-year-old computer.

But I could not answer her question, despite wanting to. The reason was the rubric, a name for the detailed liturgy of how a professor will assess an assignment. Rubrics are meant to avoid arbitrariness, but they also serve other instrumental goals: normalizing “learning objectives” so that universities can assess “learning outcomes” for accreditation and other bureaucratic purposes. This, in part, justifies the use of software such as Canvas, which allows instructors to write rubrics and grade against them, and (in theory at least) for assessors to roll up such results into reports and data. My assignment existed only inside Canvas, and my rubric along with it. I could not log in to see my own grading criteria and thereby offer my student advice about how to maximize the seven hours remaining until the assignment was due.

As those hours elapsed, I read more about the outage, which sounded serious. Hackers who had previously targeted Google and Ticketmaster had purposely chosen now, when college finals are happening, to threaten Instructure, the company that makes Canvas, that they would leak the personal information of 275 million Canvas users, among them teachers such as myself and the students in my class, if the company didn’t pay up. That leverage was possible because so many universities have outsourced course management—a concept that didn’t exist when I was a student—to a handful of companies providing it via cloud-based “software as a service,” and at great expense. In place of the usual Canvas webpage was an image of robots fixing a cartoon rocket above the text, “Canvas is currently undergoing scheduled maintenance,” a message that seemed like a lie.

[Jenny Anderson: What happened after a teacher ditched screens]

Neither Canvas nor my university were yet offering alternatives for how to close out the semester successfully and fairly, but I knew I needed one. Students are notorious for not checking their email, but I couldn’t figure out how to email them anyway; communication between teachers and students is now managed in Canvas, which I could not access.

My heart sank again as I fell upon an answer. Over the past five years, my campus, like many others beset by the deficiencies of IT systems first made in the 1990s or 2000s, has spent hundreds of millions of dollars on Workday, the cursed but ubiquitous enterprise-resource-planning software that might afflict you at your job, to operate our enrollment, registration, and other student-facing systems. I had recently had an exchange with a colleague in the provost’s office, wondering if we could make the students upload their photo to Canvas so that professors like me could use the thing as a face book of sorts. That feature is in Workday, she reminded me.

I logged into Workday and navigated its alien Instructor Teaching Dashboard to locate my course and its roster. I was able to send an email to the students via an awkward and unfamiliar Workday form. I had no idea if it worked. My goal was not to communicate information, but to assure: Don’t panic. I will decide what to do next once information becomes available. Implied in my message: Please do not email me, because the last thing I need is 30 more emails asking the same question I also cannot answer.

It was 9:45 p.m. I navigated to Canvas out of curiosity. It worked! I sent a Canvas Announcement, a private-label version of an email—a type of communication that I was never certain students actually received. I extended the deadline from midnight to noon and notified them of this fact. I’d have to rejigger my schedule a little, but this was the software-as-a-service life, the way of being that no one chose, yet all of us now suffer under. I thought about a trip to the dentist earlier in the week, during which, out of impatience, I’d rebuked the staff for sending so many text-message reminders about my appointment, an act that the dental office had not even really intended to do but that was simply a consequence of whatever patient-management software it must use, the dental equivalent of a courseware assignment rubric.

The next day arrived, and with it more emails from students. Canvas had gone down again. Not Canvas itself, actually—this time, my university had disabled access to it, out of an abundance of caution, which is to say, in order to avert further trouble.

The university had promised an update by 9:30 a.m. It was now 9:40. In the faculty Slack, one of my colleagues in computer science reflected on the wisdom of so many universities putting their faith in one outsourced software provider. A staff member relayed IT’s advice to submit a ticket regarding any Canvas/Workday problems. I felt my blood boiling—more software was being prescribed to solve the problems created by other software. I composed and then deleted a Slack reply that would have only inflamed the situation.

Now 9:45 a.m.: Canvas was back! I logged in from my home office, which required carrying out two-factor authentication via Duo. Thanks to false-confidence attacks on Duo 2FA, that process now required the entry of a three-digit code, not just the pressing of a button. I composed a Canvas Announcement reiterating the noon deadline that I had already decided upon. I also sent the same message via Workday, just in case. In each message, I described my intention to send the same message via the other software service. Why? Out of an abundance of caution, I suppose. Caution for what? I no longer knew.

[Lila Shroff: Is schoolwork optional now?]

I replied to all of the students who had emailed me their work directly. “Please also submit to Canvas”—I had to ask this, because I grade in Canvas, because that’s where the rubric lives, that’s where the records live, that’s where I hold everything in my head at once, if ineptly. I hoped they wouldn’t reply. One replied, “I already did so.” Just in case. Out of an abundance of caution.

Another emailed for the first time. Her phone had stopped charging, she reported, and it was now dead. That meant she couldn’t login to Canvas, not because it was down, but because logging in off campus requires two-factor authentication, and 2FA requires a working mobile phone. She attached the materials to the email. Just in case.

I hit “Reply,” to assure her that I had received it, that I understood, that none of us had chosen any of this, but that now we must live together in its murk. “What a world,” I wrote, and then pressed “Send.” I worried briefly that this reply would not be interpreted definitively enough, and that a follow-up requesting explicit confirmation would arrive. An hour passed absent such a reply, and I heaved a sigh of relief, as a morsel of ambiguity connected her and me, a tiny thread of human understanding eked out of a world run by software.