From the December 2 Senate Meeting comes the long-anticipated draft revision to the Code of Conduct for McGill Computing Facilities. Recall, this was supposed to have been brought forward more than a year ago by one of our departing mustelids.
At any rate, the draft document, Responsible Use of McGill Information Technology Resources, is interesting on at least three counts:
1. Despite the principle, articulated in:
2.3. Users have a reasonable expectation of privacy in their use of McGill IT Resources.
5.2. Confidential data shall only be accessed by authorized users. Where a user has authorized access to confidential data, the user shall only access the data as needed for a legitimate purpose.
We have the notwithstanding exceptions:
5.3. Notwithstanding sections 2.3 and 5.2 , access to user data shall be provided in the following cases:
…
(ii) Where access is required by a University official to investigate potential breaches of University policies or regulations or to protect a member of the University community, where there are reasonable grounds to believe there may be a breach. This includes, but is not restricted to University officials, such as Provost, Vice‐Principal(Finance and Administration), Dean of Students, Secretary‐General, or Executive Director(Internal Audit).
(emphasis is mine)
This is noteworthy because it codifies an additional “right” nay, responsibility, of the administration to violate privacy beyond that which appears in current guidelines, from Article 9 in the Companion Document to (Code of Conduct) Policy:
Users should further recognize that, as specified in the relevant administrative policies at McGill, authorized McGill personnel have the obligation to take reasonable and appropriate steps to ensure the integrity of MCF and to ensure that this Code is observed.
Users are cautioned that technology used in today’s computers and networks does not provide for complete privacy. For example: during the diagnosis of problems, repair of hardware, software or data, user data may become visible or need to be
accessed by authorized system administrators; system failures may occasionally make otherwise private data accessible to other users; despite reasonable precautions, unauthorized use, from both inside and outside McGill, occasionally occurs.
McGill’s responsibility is limited to taking reasonable actions.
… and this “right” goes beyond the powers allowed to police, who would require “reasonable and probable grounds” that a crime has been committed in order to violate one’s privacy, whether electronic or physical. At McGill, it appears that having once inadvertently breached regulations concerning nominative information of a plagiarist student, one is henceforth forever “reasonably and probably” assumed to be committing offenses that warrant immediate and secretive breaches of privacy by the administration.
I’m not a privacy nut, but recent actions of the McGill administration give me pause. Apparently, I’m not alone, as the ranks of faculty members who have decided to take some of their ICT services (email, web server, etc.) outside of the boundaries of the Roddick Gates continues to grow, as some object to their Department Chair or Dean having access to their personal correspondence or authority over their personal web pages.
In this regard, some of the controversy surrounding Eric Schmidt’s (Google CEO) recent remarks pertaining to on-line privacy is instructive. In response to Schmidt, the highly respected crypto-security guru Bruce Schneier referred to his May 2006 essay, The Eternal Value of Privacy, in which he noted that
“Privacy is an inherent human right, and a requirement for maintaining the human condition with dignity and respect.”
Certain members of McGill’s administration would have us believe that their responsibility to ensure proper usage of MCF outweighs such concerns, or that whereas professors can’t be trusted with confidential information, e.g., about students who plagiarize their assignments and are rewarded for doing so, the administration acts only with noble intent.
When I spoke recently with CAUT executive director James Turk about these issues, I mentioned that while I objected to the manner in which my Senior Faculty Administrator gained access to my private files without my permission (or knowledge), I wasn’t bothered by his access, per se, to the content, since I had nothing to hide. Turk countered that the claim “I don’t mind someone invading my privacy when I have nothing to hide” means that you no longer have privacy… period.
Weighing in on the subject, from a speech back in June, EFF Fellow Cory Doctorow notes:
We have an unfortunate tendency to conflate personal and private with secret and we say, “Well, given that this information isn’t a secret, given that it’s known by other people, how can you say that it’s private?” And we can in fact say that there are a lot of things that are [not] in secret that are in private. Every one of us does something private and not secret when we go to the bathroom. Every one of us has parents who did at least one private thing that’s not a secret, otherwise we wouldn’t be here.
Perhaps more directly relevant to the issue at hand, the threat is not only to privacy but also to academic freedom. As highlighted in the CAUT Bulletin Vol 56, No 8, the CAUT Warns about Threat to Faculty Custody & Control of their Files:
In a nine-page memo, CAUT executive director James Turk said that academic staff custody and control of their own files and records is a vital underpinning of academic freedom.
The memo, issued to all member associations last month, noted that for that reason, “it has been the longstanding practice in Canadian universities that, with limited exceptions, documents and records in academic staff members’ files and offices, whether hard copy or electronic, have been in their custody and control — not in the universities’. In some cases, this practice has been codified in university policies.”
CAUT considers the exceptions to be restricted to documents an academic staff member received or produced in relation to an administrative function for the university, such as in the capacity of departmental chair, graduate secretary or member of a university/ faculty/departmental committee. Even then, only those records pertaining directly to those administrative functions would be in the university’s custody or control. Email sent to colleagues while chair, but not in the person’s capacity as chair, would not be in the university’s custody or control.
To illustrate what has been the practice, Turk asked colleagues to imagine coming into their offices and finding the dean going through their file cabinet or reading their email. “The typical response,” Turk said, “would rightly be outrage because your files and re-cords are your files and records, not the university’s.”
(emphasis is mine)
Can a senior Faculty Administrator in McGill’s Faculty of Engineering say “Oops!”?
Well, even if he can’t (Ed. he can’t), the proposed new guidelines, above, would legalize his behaviour, on the grounds that he “believes” there may be a breach of University polices or regulations.
By the way, for those Blackberry owners out there on McGill payroll, this article on corporate access to text messages, albeit from the US, is most illuminating.
2. Then there’s this one:
7.5. Domain names that include the McGill wordmark shall not be purchased or registered by individual units or McGill employees without the approval of the Secretary‐General.
Gee, I wonder whether that could possibly be referring to something like, hmm… this website? Seriously, not only is the intent behind Article 7.5 absurdly transparent, but its formulation is an affront to the menial level of commonsense intelligence one should expect from a university administrator, especially when their job title deals with computer systems.
What’s next? I’ll offer the following proposed addenda:
Article 7.5b: Any parody of administrative folly or discussion of the implications of proposed policy by individual units or McGill employees shall be prohibited without the approval of the Secretary‐General, assuming that the Secretary-General hasn’t been quietly fired… again.
Article 7.5c: The exercise of freedom of expression under the Canadian Charter of Rights and Freedoms is not permitted on McGill Computing Facilities.
3. Finally, I couldn’t resist poking at this one:
11.2 Any potential breach of this policy shall be reported to the Office of the CIO.
(Again, emphasis is mine.)
Pre-crime, anyone?