Sept. 21, 2006

Protect Your Privacy

By Margaret Gutman Klosko

When you send a personal e-mail message on your university computer through the university’s server, do you feel secure in your privacy, or do you instead imagine Big Brother reading it? It might pay to be paranoid when it comes to doing personal business on business machines. Cicero, that astute observer of local politics, wrote “Without your knowledge, the eyes and ears of many will see and watch you, as they have done already.”

Looking for a job?

See all 238 new postings

Browse all job listings:

Faculty: 3,614
Administrative: 1,896
Executive: 171
FEATURED EMPLOYERS

Whether they are watching you or not, colleges do have fairly well defined policies in regard to appropriate use of e-mail. These policies give the institutions room to maneuver and employees enough room to hang themselves.

For instance, in 2005 at the University of Virginia, an employee-critic of the administration’s various policies was fired after using her university e-mail, computer, and official electronic signature to send and sign a private message critical of university policies. One person who received the e-mail and thinking it was official university business then forwarded it by means of a listserv. The message went to the entire faculty of the College of Arts and Sciences. The university maintains that the original sender of the message was fired not because of her politics, but because of the misrepresentations in her e-mailed message, misrepresentations that she refused to rectify.

Some, maybe many, might think this employee’s sacking to be a violation of her right to privacy. Legal precedent seems to be on the university’s side. Robert M. O’Neil, former president of the University of Virginia, founding director of the Thomas Jefferson Center for the Protection of Free Expression, and a professor of law at U.Va., in a 2004 essay in The Chronicle of Higher Education. describes cases that are apparent legal precedents for the dismissal of employees for misuse of an institution’s computer systems. He cited, for example, a 2003 ruling in which the U.S. Court of Appeals for the Third Circuit rejected an employee’s claim that his privacy was violated when his e-mail messages, stored on the company’s computer system, were searched by his employer.

Not only should employees be aware of these legal rulings, they also should know their employers’ policies governing appropriate use of institutional property. Virginia’s policy about e-mail use at first seems friendly enough: “You can expect that, except in specific circumstances, the content of the e-mail files associated with your account will be treated as confidential by the University because it does not routinely examine or monitor such content, except when you have been notified in advance that such examination or monitoring is an expectation in your specific workplace.”

However, like policies at other institutions, it shows its teeth in the caveats. Virginia’s policy goes on to warn that:

You should be aware, however, that e-mail messages can sometimes be records that are subject to review with sufficient justification. They may be subject to Virginia Freedom of Information Act if they were produced, collected, received or retained in pursuance of law or in connection with the transaction of public business. They may lose whatever confidentiality they have if their release is compelled by orders issued through courts of law. Also, officials overseeing the University’s disciplinary processes may rule that e-mail or other files are evidence that may be reviewed as part of investigations. Under these circumstances, the privacy of your e-mail is not guaranteed.

Virginia’s policy is one among many. For instance, the University of Pennsylvania, after specifying the implied consent of any Penn computer user to all the policy’s provisions, lists the rules for appropriate computer use. Mostly general, they refer to “responsible behavior ... consistent with the mission of the university and with authorized activities of the university or members of the university community.” They refer to “truthfulness,” and “respect” for the rights of others and “for the value and intended use of human and electronic resources.” About enforcement, the policy stipulates that “any person who violates any provision of this policy, of the specific rules interpreting this policy, of other relevant university policies, or of applicable city, state, or federal laws or regulations may face sanctions up to and including termination or expulsion.

At Agnes Scott College the computer use policy has a voluminous list of prohibited acts along with specific examples of those acts. For example, the college tells employees that they may not:

• Use computer resources for personal commercial gain, or other commercial purpose without approval by the college.
• Use computer resources to operate or support a non-college related business.
• Use computer resources in a manner inconsistent with the college’s contractual obligations to suppliers of those resources or with any published college policy.

These rules cover a vast array of potential mischief that can affect students, and minimum, medium, and maximum wage employees. In 2001 at the University of Tennessee, its president stepped down from office citing personal reasons. However, he had been wrapped up in a scandal involving a seemingly rapid ascension up the ranks of one of his protégés, with whom he was having a sexual relationship. The two denied their affair, but the university had the goods on them: a collection of e-mail messages in which the president describes their sexual relations. In a news story about the scandal, The Knoxville News Sentinel quotes at length from their misbegotten e-mail messages.

While it is true that most of us use our employers’ computer hardware and software for innocuous personal use; and it is true that if we lived to be 100 and continued to e-mail our husbands and wives to remind them to pick up milk or dry cleaning, we would never be busted by the computer police. While we may be doing personal business on company time, this kind of personal e-mail is not — as far as we can tell — illegal use of company computer systems. On the other hand, many of us use our computers to do business that skirts and even crosses the line of appropriate use. We shop; we write letters to the editor; we apply for jobs; we moonlight in another job while at work in our main job.

Now, I am obviously not a lawyer. I am simply someone who can point out the obvious: When using your academic employer’s equipment, you probably need to monitor the kind of use you are putting it to. If you need to e-mail, shop, work another job, download material for personal and ideally legal use, romance your paramour, get in touch with your bookie, you need to use your own computer. You also need a non-university e-mail account — to use on your own computer. (If you use it on your work computer, the institution in certain circumstances might be able to access it — legally.) While you are probably OK making routine calls to your doctor about your colonoscopy, if you are calling your psychiatrist to discuss your bi-polar disorder, or if you are having a phone interview for your next job, you might want to use your cell phone.

So, be afraid. Be very afraid. You do not have to be emotionally disturbed to be suspicious of the capacity and willingness of your institution to subject your e-mail account and your computer to surveillance. You do need to be a truly incurable optimist if you continue, despite legal precedent and university statute blithely going about non-university business on university property.

Want it on paper? Print this page.
Know someone who’d be interested? Forward this story.
Want to stay informed? Sign up for free daily news e-mail.

Advertisement

Comments