Tuesday, June 12, 2007

On University e-mails, Google and Privacy

It is ironic that two days after Google is described as allegedly having the "worst privacy policy" of popular net firms, it is seen to be "expanding its empire into universities with entire campus e-mail networks switching over to using Google's e-mail service.

Whatever one's feelings about Google (and it is time to start having them) the move to Web based services will make sense to students, tutors and University administrators. Anecdotal evidence from our work at Treforest has shown that communication with students is often confused by their possession of several email addresses and the reluctance of some to check internal emails provided by VLE's such as Blackboard.

Trinity College Dublin, Arizona State University and Linkopings University Sweden are moving to Google Apps for Education. Students existing email addresses will remain the same but behind the scenes the system will be driven by Google. Access will be provided to all the Google hosted online tools, in exchange Google will acquire a new audience for their advertisers and will accumulate further valuable data from the email traffic.

The Director of Information Services at Trinity College Dublin said that there had been debate within the university about privacy and loss of control to Google but that the "partnership was to the university's advantage - outsourcing the need to maintain an e-mail system without any cost.

I suspect that there is a cost, only time will tell what it really is.

The Privacy International report on Web Privacy makes for interesting reading. Over the last six months they have investigated the privacy practices of key Internet based companies. Their "ranking lists the best and the worst performers both in Web 1.0 and Web 2.0 across the full spectrum of search, email, e-commerce and social networking sites." It is important to remember that this is an interim report for consultation, their full report will be available in September

The companies studied were
  • Amazon
  • AOL
  • Apple
  • BBC
  • Bebo
  • eBay
  • Facebook
  • Friendster
  • Google
  • Hi5
  • Last.fm
  • LinkedIn
  • LiveJournal
  • Microsoft
  • Myspace
  • Orkut
  • Reunion.com
  • Skype
  • Wikipedia
  • Windows Live Space
  • Xanga
  • Yahoo!
  • YouTube
The interim results are available as a PDF from Privacy International.
None of these organisations merited a privacy friendly rating but Google was placed at the bottom of the league described as being "hostile" to privacy. .

It must be reassuring for those Universities who have adopted Google as their email provider to read that :-

Google's specific privacy failures include, but are by no means limited to:
  • Google account holders that regularly use even a few of Google's services must accept that the company retains a large quantity of information about that user, often for an unstated or indefinite length of time, without clear limitation on subsequent use or disclosure, and without an opportunity to delete or withdraw personal data even if the user wishes to terminate the service.
  • Google maintains records of all search strings and the associated IP-addresses and time stamps for at least 18 to 24 months and does not provide users with an expungement option. While it is true that many US based companies have not yet established a time frame for retention, there is a prevailing view amongst privacy experts that 18 to 24 months is unacceptable, and possibly unlawful in many parts of the world.
  • Google has access to additional personal information, including hobbies, employment, address, and phone number, contained within user profiles in Orkut. Google often maintains these records even after a user has deleted his profile or removed information from Orkut.
  • Google collects all search results entered through Google Toolbar and identifies all Google Toolbar users with a unique cookie that allows Google to track the user's web movement.17 Google does not indicate how long the information collected through Google Toolbar is retained, nor does it offer users a data expungement option in connection with the service.
  • Google fails to follow generally accepted privacy practices such as the OECD Privacy Guidelines and elements of EU data protection law. As detailed in the EPIC complaint, Google also fails to adopted additional privacy provisions with respect to specific Google services.
  • Google logs search queries in a manner that makes them personally identifiable but fails to provide users with the ability to edit or otherwise expunge records of their previous searches.
  • Google fails to give users access to log information generated through their interaction with Google Maps, Google Video, Google Talk, Google Reader, Blogger and other services.

Google have expressed their disappointment with the report which they believe is based on "inaccuaracies and misunderstandings", furthermore they remind us that "Google aggressively protects their users privacy"

It might not be long before questions asked by prospective students while selecting a university will include
  • Who provides your email service?
  • How private is it?
  • Who provides your VLE?
  • How secure is it?

No comments:

Post a Comment