@mrdale, I am not involved in academia (though I used to be a departmental director at Azusa Pacific University), so my own concerns are not with FERPA or any other legal requirements. My concerns are a little more at the people-might-be-thrown-in-a-North-African-jail-and-disappear-forever scenario.
In our CBOX based community, many of our intended participants are humanitarian activists in various parts of the world. I work with a niche consulting firm that builds and advises partnerships/networks of faith-based nonprofits in more than 80 countries. Altogether, more than 2000 different organizations are involved. We are building our community for the leadership of those networks/partnerships. Over 3000 individuals have signed up to our launch list.
One of the promises we have made to our constituency is that while we want to facilitate free and open communication, we will also pay serious attention to the security & privacy of the community. If people want to form and join what they believe are private/hidden groups, then those conversations should remain private. If people want to create collaborative docs or attach files, those documents and attachments should be locked down.
So far, it’s a little touch-and-go, to be honest. As you’ve already seen in the help&support forum, there was a known issue with bbPress forum visibility settings for private/hidden groups:
https://commonsinabox.org/groups/help-support/forum/topic/private-group-forum-posts-visible-in-public-feed/#post-3303
I think some other security areas to pay special attention to are file attachments/sharing, the docs/wiki component, and group administration. Depending on your plug-ins and configuration, attachments (to docs/forums) can be exposed to the public. Group association, ownership, and visibility of the docs/wiki pages can be fiddly. If a private group is deleted, its associated docs and forum still exist, so there are constant admin cleanup tasks that must follow. I’m sure the list is much longer, but those are the big red flags on my list at the moment.
After getting my site into a somewhat stable state, my next plan is to hire one of the white hat certified ethical hackers we know to bang away on the site and see if there are other security/privacy issues.
In the end, it all comes down to trust. Your students, clients, or constituents trust that you (as the sponsor of the community) will keep the community platform secure and private. In my case, there are no second chances. So I’m taking a much more cautious approach now.
.
