Teknoids

Jonathan Ezor wrote:
> For all (and especially my colleague) Matt:
>
> Inside Higher Ed had a recent article discussing some of the FERPA and other
> privacy concerns related to outsourcing e-mail:
>
> http://www.insidehighered.com/index.php/news/2008/03/21/privacy
>
>
> Worth reading, whatever the conclusions one draws. {Jonathan}

Sadly, the Inside Higher Ed site seems to be down just at the moment, so
if what I'm about to say repeats or is refuted by its insights, well,
just call me unoriginal, or wrong.

I have real reservations about the use of GMail that are not quite at
the center of hard-and-fast privacy concerns -- more in the penumbra,
you might say. I have no doubt that Google makes explicit privacy
guarantees that it lives up to, and that they are probably good ones,
and that they probably come close to meeting any legal obligations that
their academic customers must honor. And I doubt that Google would
fight a subpoena much less vigorously than a University counsel's office
would, and they have a lot more money to do it with. Though I suppose
one should be mindful of the honeypot; it would be a lot more expensive
for, say, DOJ to win a case against Google, and they'd be up against a
much deeper pocket, but just think of the doors it would open for them.
With the right case it would be worth it, I expect, and as a repeat
player Google has some incentives to go along in order to get along.

But that's not what I wanted to say, really. I'm more worried about
issues of taste and University image. I'm particularly worried about
mining of the data, whether personally-identifiable information is
exposed or not. There are huge potential problems with anonymized,
aggregated data that is still institutionally identifiable, especially
if it is resold for marketing purposes. I'm not sure that anyone wants
to open the US News law-school ranking issue to find a full page ad
claiming that X% of Cornell students prefer Y brand of
/(booze|car|condom)/ based on mentions in e-mail. I choose a
deliberately horrific scenario, of course, because if you can't have a
cheap laugh at the expense of a university, what's left? But the point
is that permitting Google to aggregate data in a way that can be
*institutionally* identified is more or less the same as handing your
University logo to someone and saying, hey, sell this to whoever you
want -- we trust you.

Will they do that? Who knows. And it seems that nobody knows, one way
or the other. Thus far this seems to be an issue that few have raised,
so perhaps there are assurances. But none have been mentioned in any of
the discussions here that I've attended (and yes, Cornell is considering
outsourcing, and I sit on the University Faculty Advisory Board....).
Here, the whole thing is mostly being driven by two very valid concerns:
the usual ones you hear about keeping up with the spam/virus arms
race, and one that threatens to be even more problematic, which is
support for a huge, churning pool of flavor-of-the-month mobile devices
carried by (interestingly) students and senior administrators.

And there is something akin to panic over these issues, and
understandable burnout on the part of mail administrators who are, even
more than usual, unable to fulfill their so-reasonable charge of making
everyone happy at all times without having the resources of, oh, Google.
The exhaustion and the worry are understandable. Back when
pterodactyls were wheeling around in the sky and I still did IT
management consults for law schools, the pattern that preceded my hiring
was almost always the same: a long period of misbehavior by all parties
and simmering dissatisfaction with IT, ended abruptly with an e-mail
system failure that, however heroically recovered, resulted in the
formation of a Faculty Necktie Party (as they called 'em in the Old
West) with the IT department as guest of honor. Others (Elmer? Pablo?
John? anyone?) can confirm whether or not that pattern continues. But
it's understandable that a sane person would want to avoid the risks.

Oh, and we use Zimbra at the LII, which I like, despite a few problems
-- particularly problematic is that task lists are unevenly supported.
But this note is coming to you from a Thunderbird/Lightning setup that
works with Zimbra's server, and works equally well under MacOS and
Windows. You'd have to ask my colleagues (Dan? Sara?) whether I'm
objective on this issue or not, and if Zimbra is really any good. Of
course, if they lip off, I'll job-share them with central campus IT, and
they can find out what customer support is *really* about ;-).

Best,
Tb.

PS: Just got the Inside Higher Ed piece out of Google cache ;-). No
surprises. Reminded me, though, of the other three words that are
scaring people to death on this issue -- just put "Virginia Tech" in the
same sentence as "e-discovery". That's another 400-lb gorilla in the room.

--
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
Thomas R. Bruce, Director
Legal Information Institute
Cornell Law School

http://www.law.cornell.edu/
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+