  Universities have been forced to rely on remote educational technology to
facilitate the rapid shift to online learning. In doing so, they acquire new
risks of security vulnerabilities and privacy violations. To help universities
navigate this landscape, we develop a model that describes the actors,
incentives, and risks, informed by surveying 49 educators and 14 administrators
at U.S. universities. Next, we develop a methodology for administrators to
assess security and privacy risks of these products. We then conduct a privacy
and security analysis of 23 popular platforms using a combination of
sociological analyses of privacy policies and 129 state laws, alongside a
technical assessment of platform software. Based on our findings, we develop
recommendations for universities to mitigate the risks to their stakeholders.
