Slashdot Mirror
Harvard Secretly Searched Deans' Email
theodp writes "Taking a page from HP's playbook, Harvard University administrators secretly searched the emails of 16 deans last fall, looking for a leak to reporters about a case of cheating. The deans were not warned about the email access and only one was told of the search afterward. Dean and CS prof Michael Smith said in an email Sunday that Harvard will not comment on personnel matters or provide additional information about the board cases that were concluded during the fall term. Smith's office and the Harvard general counsel's office authorized the search, according to a Boston Globe report. Smith's Harvard bio notes that his entrepreneurial experience included co-founding and selling Liquid Machines, where Smith coincidentally invented a software technique designed to keep unauthorized people from reading electronic documents."
Dean who?
It was always made clear to me that my work email could be monitored for any reason. Dean or janitor, you are an employee.
Tomorrow is another day...
re: "...Smith coincidentally invented a software technique designed to keep unauthorized people from reading electronic documents." [emphasis mine]
.
Since the Deans and Faculty members are technically employees of the Harvard Corporation / Harvard University, then there was no unauthorized access, since I am sure that Harvard reserves the right to peruse and otherwise scrounge through the work product of its employees. Whether it can do that to its students, though, may be another matter.
.
Anyone here have direct access to a Harvard Faculty / Administration Employment Manual or Employee Agreement or Contract? That's the only way to be sure: look at the actual contract.
We're all supposed to be geeks, here, especially computer geeks.
Computer geeks are supposed to be the ones who have to repeat ad nauseum and hammer home the fact that no, email is not secure (or private).
Shouldn't the story just be "shrug [link]"?
Shouldn't the comments just be all speculation about how the fact that this made "news" could possibly mean we face further uninformed and draconian measures in legislation?
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
If I want to leak something, it'll be over an SSL encrypted webmail account (ie Gmail).
That would seem to be the new HP tablet that looks like a BlackBerry PlayBook but with a worse display and camera. What has that got to do with Harvard seeming to have forgotten the difference between a university and a corporation?
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
Here is Harry Lewis thoughts on the matter...
http://harry-lewis.blogspot.com/2013/03/email-privacy-at-harvard.html
For those not familiar, Harry Lewis was not only the Dean of Harvard College for a number of years, he is also a Professor of Computer Science.
to leak something USING the source's computers deserves to get caught. Just sayin'
I work for the Department of Redundancy Department.
You realize that if you leak anything that is on a computer, you need to access that computer at some point.
Palm trees and 8
What about Hank's?
LVX INRI
When you work for someone you need to assume that your email is read, your website are logged, your SSL traffic decrypted and your computer inventoried. It is also a fairly safe assumption that login, logoff times, screenshots and keyboard strokes as well as mouse movements are all routinely captured.
Depending on your place of employment many of these big brother activities are demanded by law (SEC etc). It's not a question of whether or not you like or the IT department likes it, because neither of you do. It's a question of someone /way/ up your food chain has made the decision to perform that level of monitoring. If your going to get mad, get mad at the VP, the legal team, the SEC, or other person typically at the VP level that had the power to demand the level of logging to begin with.
To illustrate my point on how these things are often driven by and watched from the top you need only look at Yahoo. Their new CEO looked at the VPN logs when she saw the parking lot emptier than she thought it should be. She concluded people were slacking off and not really working and ended telecommuting for everyone at Yahoo. This was a data driven decision based on the logs that Yahoo's servers kept and their CEO reviewed.
I'm not justifying this, I'm not defending this, I'm simply explaining how these things work in the real world.
Only the little people are supposed to be pissed on.
Troll is not a replacement for I disagree.
To self-encrypt everything?
They are looking for a whistleblower. An encrypted message to the press is a big red flag that says, "I am a whistleblower," unless all the deans are in the business of communicating with the press. A message to an anonymous remailer is equally incriminating.
The real answer here is to take the documents out of Harvard on a thumb drive and mail them from an Internet cafe or somewhere else that cannot be monitored by the administration.
Palm trees and 8
Harvard has a problem because of THIS:
Harvard University Information Security
FAS Policy Regarding the Privacy of Faculty Electronic Materials
The Faculty of Arts and Sciences (FAS) provides the members of its faculty with computers, access to a computer network and computing services for business purposes, and it is expected that these resources will be used in an appropriate and professional manner. The FAS considers faculty email messages and other electronic documents stored on Harvard-owned computers to be confidential, and will not access them, except in the following circumstances.
First, IT staff may need access to faculty electronic records in order to ensure proper functioning of our computer infrastructure. In performing these services, IT staff members are required to handle private information in a professional and appropriate manner, in accordance with the Harvard Personnel Manual for Administrative and Professional Staff. The failure to do so constitutes grounds for disciplinary action.
Second, in extraordinary circumstances such as legal proceedings and internal Harvard investigations, faculty records may be accessed and copied by the administration. Such review requires the approval of the Dean of the FAS and the Office of the General Counsel. The faculty member is entitled to prior written notice that his or her records will be reviewed, unless circumstances make prior notification impossible, in which case the faculty member will be notified at the earliest possible opportunity.
They were not notified according to this policy.
Could get messy.
The man is living in the past, a kinder and gentler age where the university was "like family". We are now in the age of the Internet and education as big business with "brands" that can ebb and flow with the news.
First I was like, "yeah, he speaks sense"
The matter was involving academic cheating, that's a crime worse than murder.
...then I was like, "Poe's Law."
That is, of course, unless you're talking about murdering a clown. *That's* a community service worthy of a medal. Creepy John Wayne Gacy motherfuckers.
When are people going to learn that they have no privacy on their employer's computer systems? Geeks and IT folks seem to have the biggest problem with this. If you really need that privacy, go out to your car on your lunch hour and use your smartphone. At the end of the day, it's your employer's power, bandwidth, space, and equipment. If they want to monitor their systems, they have every right to do so. Now obviously, some monitoring is a huge gray area when it comes to moral and ethical issues. So why not simply side step the issue by using your own person accounts, devices, and access?
Here we have a story about how students, generally of wealth and privilege, being caught cheating, and being handed less severe sentences then are handed out by low ranking local state schools. Adding to that, the school's biggest concern now seems to be to get whomever had the audacity to air Harvard's dirty laundry.
Slashdot reaction? Silly noobs, e-mail is insecure. Employers have the right to search company e-mail.
Hey guys, how about concern about what these people are teaching the kids who, let's face it, will be future congresscritters and other leaders. Hey, it's OK to cheat, just don't get caught, or else you'll get a slap on the wrist. Oh, and be sure to exact revenge on whoever lets the plebs know.
He mentions scientific fraud, but when the school is EXPELLING 60 students over ONE incident, they are looking at the "academic death sentence" if they find professors involved in any way.
Having professors involved would be the WORST possible outcome the University would have. They were looking for blood, there is probably a secret organization that would have "suicided" the offending professors... After they were pubically tarted and feathered (Harvard has old traditions) Privacy was the least concern.
... he could always claim he had Changnesia.
This would never happen at Deandale! I mean Greendale!
I think we're going to finally see end-to-end encryption popularized for email. You can now mod me funny.
After they were pubically tarted and feathered (Harvard has old traditions)
Tarted and feathered? Is this some reference to an old punishment of dressing up academics like they were performers in the Moulin Rouge? That would be... well, rather eccentric and would make an absolutely wonderful punishment really. You'd only have to do it once and people would behave for the best part of a century (except for those who are secretly extreme exhibitionists and who want to do that sort of thing in public anyway; different strokes for different folks, and all that). Or were you talking about turning them into meat tarts? (I really think that sort of thing would be illegal. Gross too.) Or putting a custard pie in their face perhaps?
When you get right down to it, with an old tradition about you can never really tell.
"Little does he know, but there is no 'I' in 'Idiot'!"
These guys are for real
The Harvard effort is amateurish...
If you change the title to reflect reality
Company does what it said it may do in employment contract/IT policy amendment.
It's really not so scandalous
That's *the American* way, dude.
You mean the portion of the real world that is you and people like yourself.
Property owned by Harvard.
No illegal searching at all.
This covers all faculty, staff and students, including all Administration employees and board members and chancellors as the structure may be.
If there is a 'concern' among faculty, staff and students then re-direct to a pseudonym e-mail.
Well, they do that whole Hasty Puddings Theatrical crossdressing burlesque thing....
Is Harvard still a university, or has it now become a brand?
Seems to me its become all about its brand...
"In June 2010, Liquid Machines was acquired by Check Point Software Technologies Ltd, an Israeli Internet and data security company best known for its ZoneAlarm firewall software."
You have got to be shitting me ! ! !
AccountKiller
Only at some white tower like Harvard would faculty members be surprised that they have no expectation of privacy. Just like everyone else at any other organization — commercial or otherwise – anywhere.
And good luck getting a “private” email account. What are you going to use? Gmail? Hotmail? Yahoo? Any of those places will drop trou the moment someone with a badge shows up, and ask questions later, specifically because the federal government has retroactively made it legal to do basically anything they want with digital communications.
Cell traffic instead? We just found out that the FBI's been snooping it and dodging the legal questions for 20 years. Well whaddya know? Since the technology was invented. Who'd've guessed?
Maybe Harvard professors should think twice before they produce the next generation of jurists, presidents, senators, and congressmen that continue to erode our Constitutional rights, and the limp-wristed “journalists” and news “anchors” that let them get away with it.
For those not familiar, Harry Lewis was not only the Dean of Harvard College for a number of years, he is also a Professor of Computer Science.
He was a real dean. Turns out, the "deans" in this story are just people in charge of residence halls. Calling them deans and houses is just ivy league bullshit.
Traffic inspection at the firewall should come with tough ethical standards such as "if there is no data leaked, the inspector must keep EVERYTHING he sees for himself". Running your own SIGINT operation for other purposes than securing a network or ACTUAL corporate secrets is the province of slimy and corrupt "private eyes".
There are also a couple of rules regulating who can do SIGINT in almost every country. Generally speaking, only the state is allowed to perform that and you normally go directly to jail if you run your private SIGINT operation. Then, of course, exceptions apply to rich, powerful and connected people and organizations.
The KGB only does good things to protect good citizens. Nothing to hide, nothing to fear, etc etc.
Hey, I couldn't help but comment when I saw this Harvard Dean post - especially since it drew a comparison to the HP pre-texting spygate scandal. I was one of the reporters HP targeted in this scandal, when I worked at CNET. They hired private investigators who hacked into my *PERSONAL* cell and home phone records to see who I was speaking with. That's a big difference than what Harvard did. Unfortunately, employers are allowed to rifle through your company email - because it *is* their property you are using. Now that I work at Dice, where we ask readers to feel free to send us tips on company layoffs and hirings, I'll say the same thing here as I do there: "please, please, please, use your personal email address and *not* your traceable company email." Take care, Dawn Kawamoto, Dice Associate Editor