ie8 fix

UC Davis scraps Gmail pilot: Privacy levels 'unacceptable'

By | May 7, 2010, 12:26am PDT

Summary: A major blow to Google; the University of California has ditched its pilot of its outsourced email service citing ‘privacy issues’ to its 30,000 student and staff users.

Google has been hit with a major blow in regards to privacy by a leading US university, which this week ended their pilot of the outsourced Google Apps email system.

Peter Siegel, the University of California Davis chief information officer, sent a letter with support from senior staff to employees stating that the Gmail pilot to supply 30,000 students and staff would end before a full roll-out across its entire network, due to doubts in keeping the students’ email and content secure and private.

According to InformationWeek which broke the story, some excerpts of this letter offer some revealing and interesting justifiable perspectives from the senior university figure:

[Many faculties] “…expressed concerns that our campus’ commitment to protecting the privacy of their communications is not demonstrated by Google and that the appropriate safeguards are neither in place at this time nor planned for in the near future”

[This move by the university] “…by and large, it’s not typical of what we’re seeing in the market. We’re seeing lots of schools move their students and faculty onto Gmail” .

In regards to the concerns over passing on or examining the contents of emails without the students’ permission - which Gmail does to provide relevant advertisements.

“Outsourcing e-mail may not be in compliance with the University of California Electronic Communications Policy.”

“Though there are different interpretations of these sections, the mere emergence of significant disagreement on these points undermines confidence in whether adopting Google’s Gmail service would be consistent with the [aforementioned] policy”.

[We continue to search for] …”a more flexible and effective central e-mail system.”

I half-criticised Microsoft a few months back for not embracing a similar social application to rival Google Buzz, which comes as part of the consumer Gmail experience. Yet with hindsight and especially in light of this new story and others, Buzz is a minefield for privacy related issues and this no doubt contributes to the reasons as to why the enterprise would want to avoid such issues.

Buzz was not part of the pilot which the university had rolled out, which Neowin had entirely misreported. The letter sent by the university CIO referenced a separate letter from the privacy commissioners from nearly a dozen countries which criticised Buzz, this was used merely as an example.

I think more than anything, trashy and poor reporting was more a clear outcome to this news story than Buzz being a contributing factor to the university’s decision to cease the pilot.

Microsoft’s equivalent service, Live@edu, which includes many of the features Hotmail currently has while integrating it as a university email and productivity account, is shooting ahead of Google in the outsourced email race.

While in this case, privacy appears to be a major factor taken into account by the university, as many institutions around the world are considered ‘Microsoft campuses’ with existing contracts and technologies in place, many are opting for Live@edu instead of Google Apps.

Will this move force other enterprise customers into adopting rival services such as Microsoft’s Live@edu?

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from the Huffington Post, Business Insider, AllThingsDigital, The Atlantic Wire and CBS News.

66
Comments

Join the conversation!

Just In

RE: UC Davis scraps Gmail pilot: Privacy levels 'unacceptable'
JACOBSONR 14th Oct
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.
0 Votes
+ -
Doubtful...
jasonp@... 7th May 2010
While the privacy issue is a real concern for some people and organizations, where it's a big enough concern to pull the plug on considering GMail logic and reason would tell us it's a big enough concern to pull the plug on any hosted solution. Almost everything in IT has risks and rewards that must be evaluated. For hosted email, the reward is lower maintenance costs and hopefully a more robust system ensuring the integrity of data. The risks that come along with that include reduced privacy, lack of full envirnomental control and a more difficult support structure from an end user perspective. These risks and rewards apply to all hosted email environments, not just GMail. In some areas, hosted email simply is a non-starter. I'm sure nobody would like to see law enforcement at any level using hosted email for doing their jobs no matter who the host is...the privacy concern would trump everything else. The same goes for hospitals as HIPAA privacy concerns would also seem to trump everything else. Non-critical government services, schools and most public-sector companies/individuals have their own concerns that need to be weighed individually. As with most things in life, there is no simple answer as to where hosted email services make sense and where they don't.
0 Votes
+ -
Wow. Thanks for a great post.
Bruizer 7th May 2010
@jasonp@...

Good read.
@jasonp@...
I don't feel right about the UC Davis report. Google Apps (the education editions) has the option to disable advertising for domain so ads and the resulting scanning for ads can't be the real reason. Postini offers more security and archiving for compliance, but it isn't free like the Google Apps for Edu package.

As stated in the article, Buzz really has nothing to do with Google Apps so it couldn't be part of the decision, and it's really the only privacy snafu that Google has had.

It just feels like UC Davis wants to stick with what it has. There may be a mostly Outlook solution right now, and Outlook users are extremely hard to move off that platform. I've read where they are the #1 reason that migrations to Google Apps fail.

If, on the other hand, everyone is checking e-mail with Mutt, then I don't see why they wouldn't want to move.
@daengbo Google Apps Sync is included with Premier and Educational accounts. It includes an Outlook connector much like Exchange or Zimbra uses. So I doubt Outlook would be an excuse either.
@daengbo
I think this points out that free isn't a good choice when privacy is concerned. If its free, then its getting subsidized by other means and when its Google that means advertising,which means they spy on your emails,web searching,fav web sites. And i even read an article they wanted to record our voice communications.
So i think that free in this case has a far to heavy price.
@daengbo
Outlook interoperates with Google Apps email as an IMAP source beautifully....
On the one hand, university environements are supposed to open forums for discussion and sharing of information but, on the other hand, student information is supposed to be fully protected since in many, if not most, states undergraduate college students are considered minors - making protecting their privacy of utmost importance.

On the other side of the coin, state universities are subject to state and federal "freedom of information" laws which which require instutions to make available (upon demand) any information housed on any institutionally-own systems.

So, to protect their students private e-mails, they are turning to service providers such a Gmail but any data considered "private" needs to reside on university-owned systems to meet federal and state guidelines.

Lots of conflicts there.
0 Votes
+ -
That's ridiculous
ubiquitous one 7th May 2010
student information is supposed to be fully protected since in many, if not most, states undergraduate college students are considered minors - making protecting their privacy of utmost importance.

Most college students are 18 and above, so that would make them legally adults. That reason doesn't wash.
@mwagner@... "undergraduate college students are considered minors - making protecting their privacy of utmost importance."
Nope. It's the Buckley bill, the main result of which is that students are considered ADULTS, which means schools can't rat kids out to their parents (such as letting them see grades, etc.)
@mwagner...
FERPA, the Family Educational Rights and Privacy Act of 1974, protects education records in all U.S. educational institutions regardless of public, private, secondary, or post-secondary. It doesn't matter what age the students are. Student email qualifies as education records because it directly relates to the student and is maintained by the institution or an agent of the institution and is not one of the explicit exceptions (law-enforcement, medical treatment, employment, or post-attendance). Some states have more restrictive privacy laws, so FERPA is really a starting point.

FERPA applies to institutions acting as agents of the educational institution, so Google is subject to FERPA as well. In some minds this is where the issue and doubt lies.

@drobinow
The Buckley bill (which is another name for FERPA) does not prevent "ratting" out grades from students to parents. FERPA allows legal guardians access to student records, including grades, with or without student consent.
0 Votes
+ -
@mwagner@... I read your comment and I am very interested in what you said. So if taxpayer money is funding the university e-mail accounts, how does one request access to e-mails of students discussing illegal activity.
@jasonp@... The difference is the business model.

While there is a loss of privacy with any hosted service as you suggest, Google's business model makes it less trustworthy than most others. Google makes all of its money by spying on its users, building a profile, and selling advertising on that basis. And, because of their pervasiveness, it is very hard not to get profiled and stored by Google. Even if you use none of their apps or services, they still link to your IP address from your searches and accumulate those searches to build a profile. On top of that, many sites use other "free" Google services such as google-analytice (this site is amongst those) so they can link your visit to your IP again.

For those fervent users of Google, they have all your emails, your contacts, your calendar, your docs, your whereabouts, your home location, your chats, any soon your television watching habits.

Such an accumulation of data about so many people around the world by one company has got to represent one of the major dangers to society that exists. This is not the Google started by Larry and Sergei to help search for information. This is a company that parasites off all the information produced by others and sells advertising so that you can see the parasited info. This is the Google of Eric, and it is not to be trusted.
0 Votes
+ -
HAHAHHAHAHAHAHHAHAHA!

LOLOLOLOLOLOLOLOL!

Another punch to the face for Google! The education for those University of California students is really paying off. They were smart enough not to fall for Google's antics. Now lets see if more universities and other organizations follow this great example. Poor Larry and Sergy must be crying their little eyes out right now. LOL!!
0 Votes
+ -
what a $hill!
Linux Guru Advocate 7th May 2010
@Loverock Davidson
This is a dark day for software freedom and this university should be shun by the students.
@Linux Guru Advocate

What would you know about being a student and attending a university?
  • Flagged
0 Votes
+ -
Why should the University be shunned
Snooki_smoosh_smoosh 7th May 2010
@Linux Guru Advocate: when it is evident that Google wasn't concerned about security. I have listened in on several meetings and discussions about Google's lack of interest in complying with security and privacy standards.

Google is fine for consumers, Heck I even have my on Gmail account that acts as my primary personal account.

The college campus for which I work is migrating our students over to MSFT's Hosted site, where security and their enterprise customers are their top concern.
@jm1981
You _do_ know about Postini, right?
@jm1981
You _do_ know about Postini, right?
0 Votes
+ -
Software freedom, or the freedom to use our data?
John Zern Updated - 7th May 2010
@Linux Guru Advocate, it really is a dark day indeed when people like you feel it is acceptable to give away all of your private info for the price of a few pennies in savings.

Yes, a Dark Day indeed.
@Linux Guru Advocate

How so? These students have freedoms too. Shouldn't they have the freedom to choose what works best for them?? Just wondering!
@Loverock Davidson

Not too bright are you?
0 Votes
+ -
@blueskip Brighter than the sun happy
@Loverock Davidson

Smart enough not to choose Google, or not smart enough to see through the Microsoft monopoly headlock?

Universities should be a place of support for open minds and diversity. For Microsoft, ed is just another market to control.
0 Votes
+ -
And it's not to Google, pwatson?
AllKnowingAllSeeing 7th May 2010
Universities should be a place of support for open minds and diversity. For Google, ed is just another market to influence people into using their software for Google's profits, nothing more.
SHUT THE VOICES IN MY HEAD ARE OVERBEARING!!!
0 Votes
+ -
No problems here
rag@... 7th May 2010
Our campus switched to Google Apps for Education last summer. The IT heads had extensive discussions with Google regarding privacy, advertisements, etc. We have no ads with the apps and no problems with the service. Once people became accustomed to the new e-mail, calendar, etc. - the whole transition was well planned and proceeded smoothly as could be expected with something like this.

Google continues to add functionality to the package, and it's been good for the university.
0 Votes
+ -
Ads?
ricklabanca 7th May 2010
For private gmail the ads can be turned off and there isn't any scanning of email for targeting, so what's the privacy issue?
0 Votes
+ -
Ads, etc.
rag@... 7th May 2010
@ricklabanca We were assured of privacy...that our data would be separate from the usual data mining that they do with consumers. I think it was written into the contract. We were also assured that we would be able to get access to things in case of some legal issue with a student, for example. But the whole privacy thing was a big deal, and I'm pretty sure it's in the contract.
Fresno state just migrated its students on May 3rd. I didn't like the idea for privacy reason but oh well it was going to happen automatically no matter what
0 Votes
+ -
It certainly makes me think twice...
Steve Goldman 7th May 2010
We were considering migrating our current Exchange environment to Gmail but now with such a major disapproval of how Gmail handles privacy concerns, we will have to seriously reconsider our options.
Not surprised.
An MS solution was never even in consideration when moving our office over to a new email service. At least three times over the time I used my Hotmail account, I logged in to find all my mail gone. Simply vanished. Not once but *three* times. I've been using GMail for a couple of years now for my personal email without a single issue so that's what our office is using now. Privacy issues or not, being able to keep your email trumps all else.
All of the students have the ability to set up their own email account with whatever source and register it with the university. Any student who is not able to handle setting up their own email account is not qualified to be in a university.
@balsover Especially as the edu edition of Gapps is free...
A load of Bull is talked about Gmail and privacy...

Gmail personal version (i.e. free) has to pay for itself - it does this with fairly unobtrusive targeted ads. I have no problem with this, or of their engine scanning my mail to find out what might interest me - that is my personal mail... I wouldn't commit anything sensitive to e-mail in any case - its inherently insecure (if you believe the hype) and is likely to be cached by an isp somewhere along the route in any case.

Google mail for Enterprise is a different beast, especially with Postini/Google Message Security/discovery included.

The enterprise product has NO ads and there is a cost associated with this (not unreasonably), you can turn on message encryption (TLS?), and access your mail via a "secure" https connection, or via MAPI (in outlook), or IMAP (in any number of e-mail systems) - all "out of the box".

I wonder what sort of trial was undertaken in this case, was it a full trial of Google Apps (and thus the associated Gmail client) or was it, as it sounds, just a few people trying free Gmail and noticing the ads/etc...

Or does the Edu edition still have ads?

Also this seems, to me, to be a rehash of an earlier story about the same thing.

Those thinking twice about migrating to Gmail, are right to do so, there are some limitations with Gmail, and even GApps which you need to be aware of (mainly around Outlook integration, and power users usage of, for example, spreadsheets) - go visit a demo at a local Google HQ, or talk to one of their partners (who charge a reasonable fee to get you set up).

We have decided NOT to go to Gapps to replace Exchange YET, but we are migrating to Google Message Discovery (Postini) in order to provide a form of Business Continuity (not complete, yet, although FULL Google apps would provide this), and to archive our Exchange E-mails for legal purposes - this has taken a lot of heart searching, and competitor analysis to get us to this stage, but imo their solution is the best and most cost effective for my organisation - it may not be for you... BUT you can try it for free, and they provide the api to get your data out easily - also they DO NOT demand all users use it, and won't tie you in for more than a year (so many suppliers tried to get me to commit to 3 years...)
0 Votes
+ -
UC Davis = Morons
blueskip 7th May 2010
enough said

Switching to M$ for security is the equivalent of going to the bookstore to buy groceries - you're just in the wrong place altogether.
@blueskip You got it.
0 Votes
+ -
@ blueskip. Google's a search and ad company
AllKnowingAllSeeing 7th May 2010
so going to them for anything else would be worse, IMHO.
Security is something that only applies to their code, not anything of ours.
All e-mail is scanned for viruses, phishing attacks, spam, etc. Ads are just another use case for the scanner.
No matter what email service is used, typing a few choice key words into an email will likely result in Homeland Security flagging, so this facade of privacy is just that - a facade.

If I "reply-all" to an email that has 25 other email addresses in the cc:, how many different servers is that email now stored on? And if half of those people are in another country or countries, how many different laws impose upon that data and how it's handled?

Privacy? C'mon folks, aren't we passed this by now?

A good comparison is the "concept" of free speech, which does not allow you to yell "fire!" in a crowded theatre, or greet a flight steward with an enthusiastic "Hi, Jack!".

Like freedom of speech, privacy has its limits. We live in a real world.
Like USPS would open envelops on route, read through and cram in a number of specific ads based on the content.
0 Votes
+ -
Google did it to themselves
DevStar 7th May 2010
Google did this to themselves. When your CEO says things like, "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place", well I'd be very worried about using that service too.

Really, what was Schmidt thinking? Did he think as CEO he could say that with no consequences? If you're a 14 year old girl, privacy may not be a concern -- go ahead and use gmail. But if you're virtually anyone else, Google's attitude on privacy is enough to worry.

See http://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmidt-dismisses-privacy
@DevStar I'm a 63 year old man. Privacy is not a concern.
I think the concept of a Gmail-like service is a no-brainer, especially as the availability of internet access increases in the years to come. I use Gmail for personal use but won't place any sensitive business documents on their servers. The same holds true for Microsoft's Office Live. I don't trust the security of either one and feel much better with my sensitive data on a system under my own roof.

What I would like to know is if others have tried any cloud services that have solid security. I'm looking for something for small groups of maybe 10-20 people. Thoughts would be appreciated.

LoveRock loves Microsoft and hates Google. I know, I know. Anyone else?
UC Davis says that ??????Outsourcing e-mail may not be in compliance with the University of California Electronic Communications Policy.?????? In addition, the faculty have said that they are concerned about privacy with Google. What UC Davis has left out of their news release is that they have outsourced their Sakai - Open Source Learning Management System (LMS). So -- UC Davis feels that google is not secure for faculty to faculty emails, but that it is ok to put student grades and actual FERPA privacy data on the cloud.
or faculty and staff to be able to manage the privacy settings appropriately. If you "trust" Google, the email scanning is mostly a non-issue, isn't it? An automated system scans emails to serve appropriate ads. I personally have clicked on a Gmail ad maybe 3 times in the 3 years that I have been using Gmail.

Is there some way for the ad-serving companies to exploit the privacy angle? To obtain personal identifying information in some way?
But was it really "unacceptable'? When I read the excerpts from the UC letter itself, what I see is quite different: it is that the UC POLICY makes it difficult to see how they can justify outsourcing it.

But that is something quite different from claiming that privacy is not guaranteed.
0 Votes
+ -
doesn't matter much
Hobyx 7th May 2010
UC Davis is slacker school of pot-smoking beach bums and bleach blonde Heathers anyway, I don't think their decision should be given much attention.
0 Votes
+ -
Maybe im missing something....
storm14k 7th May 2010
....but isn't this a public school. Isn't everything on their systems public record anyway? If I'm not mistaken you can request all of the faculty emails if you want. The idea of privacy may be a bit silly here.

It sounds like a university I know that was about to flip the switch with Google and all of a sudden stopped. A year later they are about to go with Live@edu. I think some older big wig got involved and was stuck on MS.
Yeah, they an get whatever email service they want, but how many students will just automatically forward that email to their gmail account?
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix