From: kadie@eff.org (Carl M. Kadie)
Date: Tue, 12 Sep 95 08:24:04 PDT
To: eff-mail-cypherpunks@eff.org
Subject: Re: University logging mail to anon.penet
In-Reply-To: <199509082239.PAA20081@ix8.ix.netcom.com.810600068>
Message-ID: <4348m6$k72@eff.org>
MIME-Version: 1.0
Content-Type: text/plain


stewarts@ix.netcom.com (Bill Stewart) writes:

[...]
>There may be ECPA issues involved, especially if CalPolySLO is a government-
>run university; the sysadmins certainly need to learn some ethics...
[...]

I think the ECPA should apply to private universities, too. The
FERPA also applies to virutally all U.S. private universities.

- Carl

=============== ftp://ftp.eff.org/pub/CAF/faq/email.privacy ===============
q: Can (should) my university monitor my email?

a: Ethically (and perhaps legally) email communications should have
the same privacy protection as telephone calls. It would be unwise for
any university employee to tap email communications without
authorization from the university president, university legal counsel,
and the academic freedom committee. According to Mike Godwin, legal
services counsel for the Electronic Frontier Foundation (EFF), the
U.S.'s Electronic Communications Privacy Act (ECPA) could be
reasonably construed to protect university email. This is also the
reported opinion of the U. of Michigan's lawers. Also, the U.S.'s
Family Educational Rights and Privacy Act gives students at all public
and most private schools some privacy rights.

A U.S. government task force says that "[Email] monitoring [of
government employees] of actual communications and communicators may
impinge on the Constitutional rights of freedom of speech (1st
Amendment), against unreasonable search and seizure (4th Amendment),
and against self-incrimination (5th amendment), as well as on the
right to privacy, specifically as set forth in both the Privacy Act
and the ECPA."

In the context of libraries, the American Library Association's Policy
on Confidentiality of Library Records suggests this procedure to deal
with an official or police request for information about users:

'When drafting local policies, libraries should consult with their
legal counsel to insure these policies are based upon and
consistent with applicable federal, state, and local law
concerning the confidentiality of library records, the disclosure
of public records, and the protection of individual privacy.

Suggested procedures include the following:

     1.  The library staff member receiving the request to
         examine or obtain information relating to circulation or
         other records identifying the names of library users,
         will immediately refer the person making the request to
         the responsible officer of the institution, who shall
         explain the confidentiality policy.

     2.  The director, upon receipt of such process, order, or
         subpoena, shall consult with the appropriate legal
         officer assigned to the institution to determine if such
         process, order, or subpoena is in good form and if there
         is a showing of good cause for its issuance.

     3.  If the process, order, or subpoena is not in proper form
         or if good cause has not been shown, insistence shall be
         made that such defects be cured before any records are
         released. (The legal process requiring the production
         of circulation or other library records shall ordinarily
         be in the form of subpoena "duces tecum" [bring your
         records] requiring the responsible officer to attend
         court or the taking of his/her deposition and may
         require him/her to bring along certain designated
         circulation or other specified records.)

     4.  Any threats or unauthorized demands (i.e., those not
         supported by a process, order, or subpoena) concerning
         circulation and other records identifying the names of
         library users shall be reported to the appropriate legal
         officer of the institution.

     5.  Any problems relating to the privacy of circulation and
         other records identifying the names of library users
         which are not provided for above shall be referred to
         the responsible officer.'



- Carl M. Kadie

ANNOTATED REFERENCES

(All these documents are available on-line. Access information follows.)

=================<a href="ftp://ftp.eff.org/pub/CAF/law/ecpa.1986.godwin">
law/ecpa.1986.godwin
=================</a>
* Privacy -- E-mail -- ECPA - University Site

Mike Godwin, legal services counsel for the Electronic Frontier
Foundation (EFF), says that the Electronic Communications Privacy Act
(ECPA) could be reasonably construed to protect university email.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/ferpa.text">
law/ferpa.text
=================</a>
* Privacy -- Students -- FERPA (Buckley Ammendment)

The full text of the Family Educational Right to Privacy Act
(Buckley Amendment).

=================<a href="http://www.eff.org/CAF/faq/email.policies.html">
faq/email.policies
=================</a>
* Email -- Policies
 
q: Do any universities treat email and computer files as private?
 
a: Yes, many universities treat email and computer files as private.
...

=================<a href="ftp://ftp.eff.org/pub/CAF/library/confidentiality.1.ala">
library/confidentiality.1.ala
=================</a>
* Confidentiality -- 1 (ALA)

The American Library Association's "Policy on Confidentiality of
Library Records"

Suggests how to handle police or official requests for information
about a user.

=================<a href="ftp://ftp.eff.org/pub/CAF/library/computer.draft.ala">
library/computer.draft.ala
=================</a>
* DRAFT: Access to Electronic ... Services and Networks ... (ALA)

A draft interpretation by the American Library Association of the
"Library Bill of Rights"

Says in part: "Libraries and librarians exist to facilitate [freedom
of speech and freedom to read] by providing access to, identifying,
retrieving, organizing, and preserving recorded expression regardless
of the formats or technologies in which that expression is recorded."

=================<a href="ftp://ftp.eff.org/pub/CAF/statements/bill-of-rights.aahe">
statements/bill-of-rights.aahe
=================</a>
* Bill of Rights ... for Electronic ... Learners

This is the "Bill of Rights and Responsibilities for the Electronic
Community of Learners". It could become the first widely endorsed
statement directly related to computers and academic freedom.

=================<a href="ftp://ftp.eff.org/pub/CAF/statements/caf-statement">
statements/caf-statement
=================</a>
* Computer and Academic Freedom Statement -- Draft

This is an attempt to codify the application of academic freedom to
academic computers. It reflects our seven months of on-line discussion
about computers and academic freedom. It covers free expression, due
process, privacy, and user participation.

Comments and suggestions are very welcome (especially when posted to
CAF-talk). All the documents referenced are available on-line.
(Critiqued).

=================<a href="ftp://ftp.eff.org/pub/CAF/statements/caf-statement.critique">
statements/caf-statement.critique
=================</a>
* Computer and Academic Freedom Statement -- Draft -- Critique

This is a critique of an attempt to codify the application of academic
freedom to academic computers. It reflects our seven months of on-line
discussion about computers and academic freedom. It covers free
expression, due process, privacy, and user participation.

Additional comments and suggestions are very welcome (especially when
posted to CAF-talk). All the documents referenced are available
on-line.

=================<a href="ftp://ftp.eff.org/pub/CAF/academic/student.freedoms.aaup">
academic/student.freedoms.aaup
=================</a>
* Student Freedoms (AAUP)

Joint Statement on Rights and Freedoms of Students -- This is the main
U.S. statement on student academic freedom.

=================<a href="ftp://ftp.eff.org/pub/CAF/academic/speech-codes.aaup">
academic/speech-codes.aaup
=================</a>
* Speech Codes (AAUP)

On Freedom of Expression and Campus Speech Codes Expression - An
official statement of the American Association of University
Professors (AAUP)

It says in part: "On a campus that is free and open, no idea can be
banned or forbidden.  No viewpoint or message may be deemed so hateful
or disturbing that it may not be expressed."

=================<a href="ftp://ftp.eff.org/pub/CAF/law/uwm-post-v-u-of-wisconsin">
law/uwm-post-v-u-of-wisconsin
=================</a>
* Expression -- Hate Speech -- UWM Post v. U Of Wisconsin

The full text of UWM POST v. U. of Wisconsin. This recent district
court ruling goes into detail about the difference between protected
offensive expression and illegal harassment. It even mentions email.

It concludes: "The founding fathers of this nation produced a
remarkable document in the Constitution but it was ratified only with
the promise of the Bill of Rights.  The First Amendment is central to
our concept of freedom.  The God-given "unalienable rights" that the
infant nation rallied to in the Declaration of Independence can be
preserved only if their application is rigorously analyzed.

The problems of bigotry and discrimination sought to be addressed here
are real and truly corrosive of the educational environment.  But
freedom of speech is almost absolute in our land and the only
restriction the fighting words doctrine can abide is that based on the
fear of violent reaction.  Content-based prohibitions such as that in
the UW Rule, however well intended, simply cannot survive the
screening which our Constitution demands."

=================<a href="ftp://ftp.eff.org/pub/CAF/law/gillard-v-schmidt">
law/gillard-v-schmidt
=================</a>
* Privacy -- School -- Staff Desk -- Gillard v. Schmidt

Description of an appellate court ruling that the school board could
not search the desk of a school counselor without a warrant.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/email.gov-employee">
law/email.gov-employee
=================</a>
* Privacy -- E-mail -- Government Employees

A U.S. government task force: "[Email] monitoring [of government
employees] of actual communications and communicators may impinge on
the Constitutional rights of freedom of speech (1st Amendment),
against unreasonable search and seizure (4th Amendment), and against
self-incrimination (5th amendment), as well as on the right to
privacy, specifically as set forth in both the Privacy Act and the
ECPA." Enclosed are guidelines for legitimate monitoring of government
employee email.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/mass-student-searches">
law/mass-student-searches
=================</a>
* Privacy -- Mass Students Searches

An excerpt from The ACLU Handbook: _The Rights of Students_, stating that
"there must a reasonable suspicion directed specifically at each student
before a school official can search students."

=================<a href="ftp://ftp.eff.org/pub/CAF/law/constraints.constitutional">
law/constraints.constitutional
=================</a>
* Constitution -- Public University -- Constraints

Comments from _A Practical Guide to Legal Issues Affecting College
Teachers_ by Partrica A. Hollander, D. Parker Young, and Donald D.
Gehring.  (College Administration Publication, 1985).  Discusses the
constitutional constraints on public universities including the
requires for freedom of expression, freedom against unreasonable
searches and seizures, due process, specific rules.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/ecpa.umich">
law/ecpa.umich
=================</a>
* Privacy -- E-mail -- ECPA - University Site

A summary of a newspaper report that the U. of Michigan's lawyers
believe(d) that the institution is barred under the federal Electronic
Communications Privacy Act from reading electronic mail.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/privacy.email">
law/privacy.email
=================</a>
* Privacy -- E-mail -- Law -- Hernandez

"Computer Electronic Mail and Privacy", an edited version of a law
school seminar paper by Ruel T. Hernandez.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/privacy.workplace">
law/privacy.workplace
=================</a>
* Privacy -- Workplace

Comments from and about _The new hazards of the high technology
workplace_ see (1991) 104 _Harvard Law Review_ 1898. Talks about email
and other electronic monitoring.

=================<a href="ftp://ftp.eff.org/pub/CAF/law/email.bib">
law/email.bib
=================</a>
* Privacy -- E-mail -- Bibliography

I have been having an e-mail conversation with Stacy Veeder for several 
days on the topic of e-mail privacy. She mailed me this bibliography
which she has compiled for two papers which she is currently writing.

I post it here with permission.

PS - She is interested in talking with anyone who has some views on the 
topic/information to share.

Mark N.

=================
=================

If you have gopher, you can browse the CAF archive with the command
   gopher gopher.eff.org

These document(s) are also available by anonymous ftp (the preferred
method) and by email. To get the file(s) via ftp, do an anonymous ftp
to ftp.eff.org (192.77.172.4), and then:

  cd  /pub/CAF/law
  get ecpa.1986.godwin
  cd  /pub/CAF/law
  get ferpa.text
  cd  /pub/CAF/faq
  get email.policies
  cd  /pub/CAF/library
  get confidentiality.1.ala
  cd  /pub/CAF/library
  get computer.draft.ala
  cd  /pub/CAF/statements
  get bill-of-rights.aahe
  cd  /pub/CAF/statements
  get caf-statement
  cd  /pub/CAF/statements
  get caf-statement.critique
  cd  /pub/CAF/academic
  get student.freedoms.aaup
  cd  /pub/CAF/academic
  get speech-codes.aaup
  cd  /pub/CAF/law
  get uwm-post-v-u-of-wisconsin
  cd  /pub/CAF/law
  get gillard-v-schmidt
  cd  /pub/CAF/law
  get email.gov-employee
  cd  /pub/CAF/law
  get mass-student-searches
  cd  /pub/CAF/law
  get constraints.constitutional
  cd  /pub/CAF/law
  get ecpa.umich
  cd  /pub/CAF/law
  get privacy.email
  cd  /pub/CAF/law
  get privacy.workplace
  cd  /pub/CAF/law
  get email.bib

To get the file(s) by email, send email to ftpmail@decwrl.dec.com
Include the line(s):

  connect ftp.eff.org
  cd  /pub/CAF/law
  get ecpa.1986.godwin
  cd  /pub/CAF/law
  get ferpa.text
  cd  /pub/CAF/faq
  get email.policies
  cd  /pub/CAF/library
  get confidentiality.1.ala
  cd  /pub/CAF/library
  get computer.draft.ala
  cd  /pub/CAF/statements
  get bill-of-rights.aahe
  cd  /pub/CAF/statements
  get caf-statement
  cd  /pub/CAF/statements
  get caf-statement.critique
  cd  /pub/CAF/academic
  get student.freedoms.aaup
  cd  /pub/CAF/academic
  get speech-codes.aaup
  cd  /pub/CAF/law
  get uwm-post-v-u-of-wisconsin
  cd  /pub/CAF/law
  get gillard-v-schmidt
  cd  /pub/CAF/law
  get email.gov-employee
  cd  /pub/CAF/law
  get mass-student-searches
  cd  /pub/CAF/law
  get constraints.constitutional
  cd  /pub/CAF/law
  get ecpa.umich
  cd  /pub/CAF/law
  get privacy.email
  cd  /pub/CAF/law
  get privacy.workplace
  cd  /pub/CAF/law
  get email.bib
-- 
Carl Kadie -- I do not represent EFF or my employer; this is just me.
 =Email: kadie@eff.org, kadie@cs.uiuc.edu =
 =URL: <http://www.eff.org/CAF/>, <ftp://ftp.cs.uiuc.edu/pub/kadie/> =