From: Arthur Chandler <arthurc@crl.com>
Date: Thu, 19 Jan 95 11:58:06 PST
To: cypherpunks@toad.com
Subject: "Disclosing" private email
Message-ID: <Pine.SUN.3.91.950119115343.15974B-100000@crl7.crl.com>
MIME-Version: 1.0
Content-Type: text/plain



  Greetings! I'd like to solicit your/our best thoughts on the following
message. San Francisco State University is considering a policy of
"disclosing" private email to outside agencies.  I'm aware that such a
policy is yet another argument for using crypto; and the last cypherpunks
meeting gave some encouraging instances of "transparent" encryption
schemes that are not a hassle or a fear-barrier for newbies. 
  But if you could post or private email me your thoughts about the 
legal/ethical aspects of "disclosure," I'd be much obliged.
  I've put a few of my own concerns at the end of the enclosed quote.


---------- Forwarded message ----------

>From: "Deirdre C. Donovan" <deirdre@mercury.sfsu.edu>
>
>I am rewriting the information handouts which we here in San Francisco
>give out to our students when they apply for Internet access accounts.
>The issue with which I am struggling is one of privacy.  I have heard of
>universities (anecdotally only) where the administration reserves the
>right to read E-mail.  Here, we are leaning more toward something like the
>paragraph below, which is taken verbatim from an Indiana University draft
>document.
>
>        IU computing centers will maintain the confidentiality of all
>        information stored on their computing resources.  Requests for
>        disclosure of confidential information will be reviewed by the
>        administrator of the computer system involved.  Such requests
>        will be honored only when approved by University officials
>        authorized by the [President] of the campus involved, or when
>        required by state or federal law.  Except when inappropriate,
>        computer users will receive prior notice of such disclosures.
>

   I'm uneasy about the chain of "prior notice":
  
   1) Does this policy give university administrators the power to read
private email before the decision is made to "disclose" it to outside
persons or agencies? 
 
   2) Does this "prior notice" mean "We're going to do it" or "We plan to do 
it, and if you disagree, let's discuss it before we release it"?
   
   3) What constitutes "inappropriate"?