Let me be fair to the man up front. He's old, he's tenured, and he's got a shirtless fishing photo on LinkedIn with his face fully visible and a grin that says the fish was worth it. Not a crime. Plenty of people go through life happy to be findable, and if you've spent forty years in academia with your name on a faculty directory, that horse left the barn sometime around the Clinton administration. His threat model is "none," which is a valid threat model for a guy whose biggest exposure is a bass.
Mine isn't "none." The course he teaches is about exactly that difference, which is the part I've been chewing on for three weeks.
Cryptography Applications. The thesis of the whole discipline, the reason any of it got invented, is that there are situations where you need to hand somebody part of what you know while keeping the rest. That's what I'm paying tuition for. Keep it in mind, it comes back.
The assignment was a one minute video. Talk about your project topic. Record yourself presenting.
I submitted audio. My voice, my content, full runtime, every box on the rubric ticked, minus a high resolution capture of my face going into a university content management system whose retention policy I've never been shown, run by a department I'd bet real money has never read its own third party sharing agreements. I know what those systems look like from the inside. I've got opinions about them.
He sent it back. Not sufficient. He needs to see me.
Second version had my chin, my shoulders, a shirt, and the general silhouette of a guy sitting in a chair explaining cryptography. That's where I stopped, not because I ran out of argument but because I ran out of patience, and there's a hard limit on how many hills you can die on with somebody holding your transcript. Minimum viable human. Hit submit. Went and made dinner.
He marked me down for it.
My topic was Private Set Intersection.
If you haven't met PSI: it's a family of protocols that let two parties work out what they've got in common without either side learning anything else. You bring your set, I bring mine, we both walk away knowing the overlap and nothing past it. Minimum necessary disclosure, implemented in math instead of in a policy document nobody reads. It exists because the industry eventually worked out that the safest data is the data you never handed over in the first place.
I submitted a video of my chin to explain this concept. In a course about data minimization. To a professor who docked points because the disclosure was too minimal.
I'd love to see the committee that signed off on his dissertation. Great Value Edu. Three credits, ships in four to six weeks.
People hear "I'd rather not be on camera" and file it under stage fright, so let me kill that reading now. A face is a credential you can't rotate. Password leaks, you change the password and get on with your week. Your face lands in a scraped dataset and there's no undo, no breach notification, no email saying "we regret to inform you your facial geometry was collected from a course submission in 2026, please report to the nearest face rotation center." It sits out there, indexed, doing whatever it does, permanently.
Scrapers don't check the intent behind a file. They check whether it's video, whether there's a face in it, and whether they can reach it. University LMS platforms aren't hardened, they're procured. I've watched how academic institutions handle sensitive data up close and the most charitable summary I can offer you is "lol." If you think footage you dropped into Canvas is protected from third party collection, tell me what you're basing that on, since it can't be the documentation.
Which brings me to the thing that should bother you even if your own face isn't a concern: nothing was disclosed. No retention window. No sharing terms. Not one sentence anywhere about what happens to a video of a student after grading. Record yourself, due Friday. That was the entire data governance conversation, and it took place inside a cryptography course.
Read the assignment language before you argue with anybody. Mine said "your image and voice must be present in the video." Image. Not face. Your hands are your image. Your shadow on the wall is your image. Your jaw and your shoulders and your visibly-a-human-being outline are your image, none of that hands a recognition model anything it can key on, and all of it complies with what the professor wrote down.
If they push back, ask them to point at the word "face" in the rubric. They usually can't, because it isn't there, and you're allowed to read what's on the page instead of what they meant.
If they keep pushing, your school has a privacy office. That office exists to field questions about how student data gets collected and used, and a written inquiry asking what the retention window is on facial footage submitted through Canvas, and whether the requirement squares with the institution's own data minimization policy, isn't a complaint. It's a request for information. It's got a way of making administrators reconsider what they've been dropping into rubrics on autopilot.
Or do what I did, which was show the man my chin, take the grade, and write it up afterward. Depends on how much fight you've got in you that week.
I don't think he's malicious. I think he's got a fishing photo on LinkedIn and has never once sat down and worked out what he's asking students to hand over, which is a different problem and still a problem, and the field he teaches exists because "I didn't think about what I was asking for" is how data ends up somewhere it shouldn't be. Watching that play out inside the curriculum rather than outside it is going to rattle around my skull for a while.
I need a drink. And maybe a twink or three to make out with while we all chug vodka.
Your face is yours. Read the assignment. Submit the minimum. And if somebody calls you paranoid for keeping your biometrics off a university server, remember which program you're in and which one of you needs to review the material.
I said I didn't think he was malicious. Filing that under things I've said.
The grade dispute went fine. I cited the rubric, asked him to name the criterion the deduction came from, he couldn't, he walked it back. Resolved, in writing, done.
Four hours later my phone rang. Campus police.
"Complaint was filed."
"By who?"
"Your professor."
"About what?"
"Your shirt."
I own a shirt with a cartoon duck on it. The duck says "I choose violence." That's the shirt. That's the whole shirt. A duck you've scrolled past on nine different meme pages produced a police complaint against a graduate student at an accredited institution. The officer sounded roughly as thrilled to be making the call as I was to be receiving it, and told me before I finished asking that no, this wasn't a real concern, and yes, he was aware of how it looked.
Sit with the sequence for a second. I disputed a grade. Inside the same calendar day, a police complaint was filed about my clothing. I'm not going to editorialize, I'm going to put both events on the table and let you do what you want with them, because I'm not a court and neither are you, but we've both got functioning pattern recognition.
Then the follow up emails landed and the duck started looking quaint.
Respondus LockDown Browser, mandatory facial recording, both exams. (I've got a whole article about that company. Go read it, I'll wait.) Student ID capture possibly required for exam verification, which nobody mentioned at enrollment, which is a fun thing to learn in week nine. And facial expressions are now an evaluation criterion on the final presentation, a requirement that didn't exist in the original rubric and appeared after I raised a privacy concern about facial recording.
One objection in. Three new facial data requirements out, a police call about a duck, and a line in writing telling me my "requirements of facial recording" could "disqualify my continuation of this course."
Direct quote. I did not paraphrase it. I did not punch it up. It arrived pre-assembled.
Where it stands: formal complaints with the Dean of Student Affairs and the Dean of the School of Computer Science, both holding the full email chain, cop call included. Privacy office inquiry filed covering the Respondus requirement, retention, third party sharing, and whether an alternative assessment exists for students who'd rather not hand their biometrics to a vendor I've already written an entire article about. No responses yet.
If a proctoring requirement shows up in your course that wasn't in the syllabus, and doubly so if it shows up right after you raised a concern about something, DOCUMENT EVERYTHING. Every email, saved somewhere your university doesn't control, because your student account isn't your archive and you'll find that out at the worst possible moment. The grade dispute process exists. The privacy office exists. The Dean exists. Use all three, in writing, and keep copies of every piece of it.
Including the part about the duck.