Cloud based email server at Rutgers raises privacy concerns among faculty
According to the Office of Information Technology (<g>OIT</g>), more than 1 million emails are delivered to Rutgers-linked accounts <g>every day, making them an indispensable part of everyday operations at Rutgers. </g>
Last year, the University merged its many departmental email systems into one universal cloud-based service known as Rutgers Connect to facilitate communication. But faculty members are concerned that the new software puts their private emails at risk.
Rutgers Connect is a system based on Microsoft’s Office 365. Office 365 includes email, video-conferencing, calendar, word processing, PowerPoint and more services linked together in Microsoft’s cloud service.
“These features are helping people across the University collaborate and do their work more efficiently,” said Allan Hoffman, the director of OIT and Marketing.
Hoffman said this same system is used by other universities such as Duke, the University of California at Los Angeles, Harvard, Ohio <g>State and</g> the University of Michigan. Within the Rutgers Connect cloud specifically, there are 45,000 accounts in the system with 23,000 active users, as well as more than 6 million files saved to the cloud.
Robert Scott, undergraduate director and associate professor in the Department of Anthropology, expressed concerns with the new system.
“It has really degraded communications,” he said.
The loss of individual departmental email systems and the inability to link Rutgers Connect emails to outside accounts has created headaches for many faculty members and makes the system confusing and inefficient, Scott said. The most troubling feature of Office 365 is the ability for system administrators to capture private emails and documents from the cloud.
“A critical component of that choice seems to be that they (University administrators) can easily capture and record our email with that system," he said. "That is not really acceptable for faculty who may be carrying out pretty sensitive research. Imagine communicating with an informant who you have an ethical obligation to keep anonymous. Is it okay for Rutgers to listen in?"
Scott said the <g>University</g> justified the new service by listing examples of when it would be used, such as in a sexual harassment investigation or to prevent cybercrimes against faculty members. He said the University is treating its faculty like small children by not trusting them to manage their own cybersecurity and records of communications.
When concerns about privacy were mentioned to Hoffman he referred to the University’s policy on acquiring private communications.
“Privacy is extremely important to us, and Rutgers has implemented guidelines and tools to ensure user privacy," he said. "Administrators at Rutgers cannot access employee emails at their own discretion. Emails are only accessed to comply with legal or investigatory requirements. A limited number of offices — the Office of General Counsel, University Ethics & Compliance or the Custodian of Records — can initiate those requests.”
In regards to security, Hoffman provided statistics from <g>OIT</g> that stated more than 960,000 spam emails and 9,000 emails containing malicious software were stopped by the new system.
Scott said he feels the danger lies within the University, and the amount of access it has to private conversations. He said the true concern comes from the University shutting faculty out of the decision-making processes regarding their own emails.
Faculty did not have a voice in choosing Office 365 as the new software and are not given transparent information about when and how the University acquires private communications, Scott said.
“Most importantly, there needs to be due process and a system analogous to getting a search warrant and demonstrating probable cause," he said. "There must be faculty representation in that process. How might you feel as a student if you email your professor and it turns out the University was listening in."
