From comp-academic-freedom-talk-request@eff.org Tue Apr 23 06:03:24 1991 From: comp-academic-freedom-talk-request@eff.org Reply-To: comp-academic-freedom-talk@eff.org Precedence: bulk To: comp-academic-freedom-talk Return-Path: Date: Tue, 23 Apr 91 04:42:14 -0500 Sender: "Carl M. Kadie" Subject: New NCSA e-mail policy inconsistent with Academic Freedom Status: R [Enclosed is a copy of a note I posted in "uiuc.general," a campus-wide newsgroup at the University of Illinois. I also sent e-mail copies to the administrators who approved the policy and to several Professors interested in these issues (including the president of the local chapter of the AAUP). Following this note, expect copies of the policy in question and my notes from a conversation with Michael Smith of the NCSA. I will, of course, keep the list informed as to what happens. - Carl Kadie] ---------------------------------------------------------------------- The new NCSA e-mail policy permits searches and punishment of faculty, students, and researcher who "attack" the University, or the NCSA in e-mail. ---------------------------------------------------------------------- The National Center for Supercomputer Applications (NCSA) is a department in the University of Illinois' Graduate College. On April 1 [no kidding], the NCSA set down a new e-mail policy. The policy was cleared by the University's legal counsel and the Graduate College. Faculty, students, and researchers, however, were not consulted. Although the policy offers much good advice and addresses legitimate security concerns, it is overly broad and vague. Moreover, it is inconsistent with the principles of Academic Freedom, Constitutional rights, and University policies with respect to freedom of expression and privacy. The policy should concern all users of NCSA's e-mail facilities. It should also concern anyone who sends e-mail to a NCSA user or through a NCSA managed network. Finally, it should concern anyone who believes that the principles of academic freedom (including freedom of expression and privacy) apply to computers. In a sense, this note is not constructive. I will not suggest an alternate e-mail policy. Instead, I will criticize the current policy. It is my hope that criticism will lead to the retraction of the current policy and creation of a more balanced policy that respects the rights of computer users. Specifically, here are nine criticisms (in no particular order): 1) The policy was created without user representation. The faculty, students, and researchers who use NCSA e-mail should have helped form any policy. Also, any University committees concerned with Academic Freedom should have been consulted. 2) NCSA contracts with industry are not an excuse to override academic freedom and individual rights. One attempted justification of the policy is that the NCSA is contractually obligated to provide security and confidentiality to industry. This is no justification at all. Contracts with industry must be made within the boundaries of Academic Freedom. 3) E-mail to users at the NCSA from outside the NCSA deserves more protection. Under this policy, searches of a user's e-mail will be typically conducted by inspecting that user's mbox file. If you send e-mail to a NCSA user, your note might end up in his or her mbox. If the mbox file is searched, your note might be read (without any suspicion about you and without the permission of the addressee). 4) The policy gives the Director extraordinary power with no check and balances. No search can be done without explicit authorization from the Director of the NCSA. The Director, however, reports to no one. 5) Due process is not guaranteed in the policy. If a user (faculty or student) is found to have committed an offense, he or she should have the right to a formal hearing and the right of appeal. Also, some of the due process that is provided is not guaranteed in writing. For example, there is an unwritten policy that the Director cannot delegate the authority to authorize a search. This protection should be make explicit. 6) The policy fails to respect e-mail. The policy allows disk space to be searched, but there is no similar policy allowing telephones or campus mail to be monitored or offices to be searched. Privacy should be respected in all its forms. 7) The policy is vague. It prohibits e-mail that "attempts to disadvantage NCSA." What does this mean? It prohibits "inappropriate information disclosures," but does not define "inappropriate". 8) The policy may prohibit constitutionally protected speech. According to Michael Smith, the Associate Director of the NCSA, the phrase "attempts to disadvantage NCSA" prohibits attacks in e-mail on the NCSA and the University. This interpretation (of a vague phrase) is inconsistent with the First Amendment, Academic Freedom, and University policy. The First Amendment to the U.S. Constitution says: "Congress shall make no law [...] abridging the freedom of speech, or of the press;" This amendment also applies to the States and to State institutions such as this University. It protects your right to forcefully criticize institutions such as the NCSA and the University. The Joint Statement on Rights and Freedoms of Students it the main statement on the academic freedom of students. It has been endorsed by the American Association of University Professors, the U. S. National Student Association, and the Association of American Colleges. It says: "Academic institutions exist for the transmission of knowledge, the pursuit of truth, the development of students, and the general well-being of society. Free inquiry and free expression are indispensable to the attainment of these goals its members of the academic community, students should be encouraged to develop the capacity for critical judgment and to engage in a sustained and independent search for truth." Faculty's freedom of expression is, of course, also protected by Academic Freedom. The University of Illinois Code on Campus Affairs says: "STATEMENT ON INDIVIDUAL RIGHTS I. Preamble A student at the University of Illinois at the Urbana-Champaign campus is a member of the University community of which all members have at least the rights and responsibilities common to all citizens, free from institutional censorship; affiliation with the University as a student does not diminish the rights or responsibilities held by a student or any other community member as a citizen of larger communities of the state, the nation, and the world." ... "III. Campus Expression A. Discussion and expression of all views is permitted within the University subject only to requirements for the maintenance of order. [...] C. The campus press and media are to be free of censorship. The editors and managers shall not be arbitrarily suspended because of student, faculty, administration, alumni, or community disapproval of editorial policy or content." ... "VI. Student Affairs [...] B. Freedom of Inquiry and Expression 1. Students and student organizations should be free to examine and to discuss all questions of interest to them, and to express opinions publicly and privately. [...] 2. Students should be allowed to invite and hear any person of their own choosing. [...] The University's control of campus facilities should not be used as a device of censorship. It should be made clear to the academic and larger community that sponsorship of guest speakers does not necessarily imply approval or endorsement of the views expressed either by the sponsoring group or the institution." 9) The policy may allow constitutionally prohibited search. The Fourth Amendment says: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." A government institution, such as this University can not ignore these protections just because it owns the facilities [Mancusi v. DeForte 392 U.S. 364, 368 (1967); Gillard v. Schmidt 579 F.2d 825, 829 (3d Cir. 1978)] University privacy policy is described in the Code on Campus Affairs. I think University rules concerning assigned office space provide the best model of how disk space and e-mail should be treated. "IV. Privacy A. Members of the University community have the same rights of privacy as other citizens and surrender none of those rights by becoming members of the academic community. These rights of privacy extend to residence hall living. Nothing in University regulations or contracts shall give University officials authority to consent to a search by police or other government officials of offices assigned or living quarters leased to individuals except in response to a properly executed search warrant or search incident to an arrest. B. When the University seeks access to an office assigned or living quarters leased to an individual to determine compliance with provisions of applicable multiple-dwelling unit laws, ordinances, and regulations, or for improvement or repairs, the occupant shall be notified of such action not less that twenty-four hours in advance. There may be entry without notice in emergencies where imminent danger to life, safety, health, or property is reasonably feared and for custodial service. C. The University may not conduct or permit a search of an office assigned or living quarters leased to an individual except in response to a properly executed search warrant or search incident to an arrest." In conclusion, the new NCSA e-mail policy is inconsistent with the constitutional rights and the academic freedom of faculty, students, and researchers. It says that freedom of expression and the right to privacy to not extend to computers. I urge the NCSA to rescind the policy. -- Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign From comp-academic-freedom-talk-request@eff.org Tue Apr 23 06:03:24 1991 From: comp-academic-freedom-talk-request@eff.org Reply-To: comp-academic-freedom-talk@eff.org Precedence: bulk To: comp-academic-freedom-talk Return-Path: Date: Tue, 23 Apr 91 04:42:59 -0500 Sender: "Carl M. Kadie" Subject: FYI: Re: New NCSA e-mail policy inconsistent with Academic Freedom Status: R Newsgroups: uiuc.general Path: m.cs.uiuc.edu!kadie Sender: kadie@m.cs.uiuc.edu (Carl M. Kadie) Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom Message-ID: <1991Apr23.083947.3254@m.cs.uiuc.edu> Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL References: <1991Apr23.082959.78@m.cs.uiuc.edu> Date: Tue, 23 Apr 91 08:39:47 GMT Lines: 88 [Here is text of the letter setting out the policy. Any typos are probably mine - Carl] University of Illinois at Urbana Champaign National Center for Supercomputer Applications 152 Computing Applications Building 605 East Springfield Avenue Champaign, IL 61820 217 244-0072 Date: April 1, 1991 Sender: Michael D. Smith, Associate Director, Computer Operations and System Administration NCSA Security Officer Phone: (217) 244-7714, E-mail: msmith@ncsa.uiuc.edu Re: Policy on the Use and Security of NCSA E-mail Facilities NCSA wishes to inform its e-mail users of the primary purpose of the e-mail facilities, as well as when and user what circumstances individual e-mail messages may be monitored or examined. NCSA's e-mail facilities were established and intended to be used for center business only, as opposed to personal or private business. NCSA does not promise or guarantee that individual e-mail messages are private or secure. Authorized system administrators and/or security staff may be required to monitor or examine e-mail messages udner the following circumstances: 1.) In order to support e-mail, system administration personnel routinely monitor the successful delivery of e-mail to users. Undeliverable e-mail due to incorrect addressing, unknown users, and the like may be returned to the system postmaster for delivery resolution. The system postmaster must at a minimum, read the header containing crucial information about who and where the e-mail was being sent in order to determine why the message was not deliver to the designated recipients(s). In the course of the above mentioned operator, the text of the message of course is also open to view. 2.) NCSA networks require monitoring as a standard for network maintenance and problem resolution, capacity planning and product testing. This requires watching information actually moving across NCSA networks. In the course of network monitoring, it is possible that electronic mail messages will be part of the information packets moving across the network. As such, this mail might be exposed to the person actually doing this activity. [page 2] 3.) In order to protect NCSA's e-mail facilities from flagrant abuse of the above mentioned purpose of the system, as well as protect NCSA staff from threats to their personal safety and well being, protect NCSA against fraud, attempts to disadvantage NCSA, prevent and/or ensure NCSA against inappropriate information disclosures, it might be necessary for authorized system administration and/or security staff to monitor or examine and individual employee's and/or user's e-mail. This type of activity is only performed for legitimate security reasons; only when there is cause for such activity and only at the discretion of the NCSA's Director. The users themselves can minimize occurrences of two of the three above mentioned activities (items 1 and 3) by following common sense guidelines regarding the use of e-mail. First, always take care when address e-mail messages, thus reducing the chance of the e-mail being forwarded to the system postmaster for resolution. Not only will this reduce the chance of your e-mail being examined, but it will also significantly reduce the workload of our various system postmasters. Second, strive to use the e-mail facilities for their intended purpose as stated above. E-mail is an inappropriate vehicle for the transmission of extremely personal and/or confidential information which one would not disclosed to others. Hardware and software problems to arise which might send your e- mail to an inappropriate addressee whose receipt of such you might not have intended or desired. Good judgment should be exercised when deciding to incorporate such personal and/or confidential information. cc: James R. Bottum, NCSA Judith S. Libman, OVCR Larry, [sic] L. Smarr, NCSA Harvey J. Stapleton, OVCR Steven A. Veazie, OUC -- Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign From comp-academic-freedom-talk-request@eff.org Tue Apr 23 06:03:25 1991 From: comp-academic-freedom-talk-request@eff.org Reply-To: comp-academic-freedom-talk@eff.org Precedence: bulk To: comp-academic-freedom-talk Return-Path: Date: Tue, 23 Apr 91 04:43:19 -0500 Sender: "Carl M. Kadie" Subject: FYI: Re: New NCSA e-mail policy inconsistent with Academic Freedom Status: R Newsgroups: uiuc.general Path: m.cs.uiuc.edu!kadie Sender: kadie@m.cs.uiuc.edu (Carl M. Kadie) Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom Message-ID: <1991Apr23.084510.17584@m.cs.uiuc.edu> Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL References: <1991Apr23.082959.78@m.cs.uiuc.edu> Date: Tue, 23 Apr 91 08:45:10 GMT Lines: 193 [These are my notes from my conversation with Michael Smith - Carl] Earlier today (April 23, 1991), Michael D. Smith and I talked over the phone. He kind enough to answer my questions about the NCSA e-mail policy. Mr. Smith is the Associate Director of the National Center for Supercomptuer Applications (NCSA), a department of the University of Illinois. He is also the Computer Operations and System Administration NCSA Security Officer. It is he who sent the letter setting down the NCSA's e-mail policy. The following is my reconstruction of the information he provided. It is based on the notes I scribbled down as we spoke; thus it contains no direct quotes. I will, of course, send a copy of this note to Mr. Smith. I assume he will correct any mistakes I make. q: [In his first e-mail note to me, Mr. Smith mentioned that the e-mail policy was "University Approved"] What does "University approved" mean? a: The policy was approved by the University's legal counsel and the Graduate College. [The NCSA is a department within the College of Graduate Studies.] q: Was there any user input or any input from any University committee's concerned with Academic Freedom? a: No. q: What was the motivation for creating this policy? a: To stop flagrant abuse of resources. We also have contractual obligations to industry. q: Some of the language in the policy sounds like it is trying to explicitly say that the NCSA is not covered by the e-mail provisions of the Electronic Communications Privacy Act (ECPA). Was this a motivation? a: [Mr. Smith said he was familiar with the ECPA.] No, it wasn't. q: Can you be more explicit about your contractual obligations? a: We promise a certain level of security. For example, no letter bombs, no threats, no viruses. q: You don't mean "level of security" in any formal or governmental sense do you? a: No, I don't. q: Did you consider general University privacy policies? a: There is an article about security in the IEEE software review. Our computers policy is consistent with the trend at Fortune 500 companies and other Universities. q: Has this policy ever been used? a: It has been used once in the last six years. q: But the policy as only been in effect for a couple months [actually, less than a month]. Was this use after the policy was set down? a: Yes q: So, it has been used once in the last two months? [Actually, once is less than a month] a: Yes [If the suspect would like to tell his or her side of the story, he or she could contact me (or just post a note).] q: Can you detail how the Director authorizes monitoring of e-mail? For example, is monitoring allowed only for a limited amount of time? Is it limited to a particular location? a: We should be clear here, "monitoring" is a bad word. We don't actually read the e-mail when it is transmitted. We look at the user's mbox file. [Note, mbox is the computer file in a user's home directory where e-mail is often archived.] The investigation is, thus, of very limited duration. [Comment: "monitoring" is the word used in the policy letter.] q: The mbox file can contains both mail sent *by* the user and mail *to* to the user. Does this mean that you can look at mail send from outside NCSA? a: It is possible, but not likely. q: Can the Director delegate the authority to authorize a search? a: Absolutely not. The Director must authorize each investigation on a case-by case basis. q: What records are kept of the the search? a: A full report is made. It is kept in a safe. q: Is the user [suspect] eventually notified? a: Yes, always. q: Are records of the search keep confidential as required by the Family Educational Rights and Privacy Act [of 1974]? a: Yes. q: Are the records available to the user as required by the act? a: Yes. q: Can the Director authorize the monitoring of NCSA telephones? a: We don't control our telephones, so he can not. q: Can the Director authorize the search of NCSA office space? Or campus mail or US mail sent from NCSA? a: There is no policy about any of that, so a search cannot be done. q: What is the relationship between the NCSA and the University? a: The NCSA is department of the Grad College of the University. q: The policy says that e-mail is only for NCSA business. What is "NCSA business"? a: You are misreading the policy. It says that when the e-mail system was established, it was *intended* for NCSA business. People now use it for personal business. That is OK. Personal use can be important; it can be used to build relationships. q: This question may not make as much sense now, but let me ask it anyway. Would it be OK to discuss the e-mail policy via e-mail? Would it be OK to criticize you or the Director in e-mail? a: Yes, of course. q: Would it be OK to make such criticism without your knowledge? In other words, is there legitimate NCSA business that is private from you? a: Yes. q: And under the e-mail policy, might you end up reading a note between two NCSA users criticizing you? a: It is possible. q: In section three of the policy, it says that one reason for a search is if there are "attempts to disadvantage NCSA." Can you explain what this means? a: Here is an example, suppose the NCSA has a nondisclosure agreement with a company. And suppose someone tried to send out information covered by the agreement. That would be an attempt to disadvantage NCSA. q: Let me clarify the situation. In this scenario, has the person who is sending out the information signed a nondisclosure agreement. a: Maybe not. Suppose it is a secretary. Here is another example of an attempt to disadvantage NCSA: suppose some is sending e-mail that attacks a person, or NCSA, or the University. [Mr. Smith continued:] We've been talking about section 3 of the policy [protection of NCSA from abuse], parts 1 [misaddressed e-mail might be read] and 2 [e-mail may be read in the course of network maintenance] are also important. Lots of e-mail gets misaddressed; people should be more careful. There is no practical way to figure out where note should go without the body of the note being possibly seen. Also, notes can be seen by network analyzers [A network analyzer is a device that monitors traffic on a network. At the least, it measures the number of packets being sent. It is like a voltmeter for information.] q: Do network analyzers show the text of packets? a: Some do and some don't. q: Which kind does the NCSA have? a: We use both. [I commented that the merits (or deficentcies) of section 3 are independent of the merits (or deficentcies) of sections 1 and 2.] -- Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign