Introduction
This draft proposal has been written to provide the Ryerson community with an opportunity to review and provide feedback to the E-mail and Collaboration Committee before the committee makes a final proposal to Ryerson’s executive. We hope you can join us for one of the two town halls we have scheduled where we will present the information provided here and invite your comments. Please also feel free to comment and discuss this proposal in the comments section of this blog. The town halls are scheduled for:
- Monday November 14 at 11:00 AM in LIB 72
- Friday November 25 at 9 AM in LIB 72
Community Consultation
The E-mail and Collaboration Committee has consulted with the Ryerson community regarding the options for providing all Ryerson students, faculty, and staff with a new University-wide E-mail, Calendar, and Collaboration Platform. Our consultations have included:
- information provided on this blog that includes comments from the Ryerson Community;
- a symposium Exploring the future of E-mail, Privacy, and Cloud Computing at Ryerson;
- a requirements survey available to anyone at Ryerson;
- a Request for Proposal(RFP) that reflected Ryerson’s requirements and included sections on accessibility, security, privacy, ownership of data, mail opt out options, legal jurisdictions, and the Patriot Act.
- town halls to discuss this proposal;
The committee has also worked with Ryerson’s Privacy Coordinator and consulted with staff from the Office of the Information and Privacy Commissioner of Ontario regarding developing a Privacy Impact Assessment based on Privacy by Design Principles.
Adoption of Google Apps for Education
Google Apps for Education is a full-featured Web and mobile enabled collaboration platform that includes Gmail, Google calendar, Google Docs (including documents, spreadsheets, presentations, forms, drawings, and tables), Google Sites, Google Groups, and Google Talk (instant messaging, audio chats, and video conferences). Other features include Google Reader, Google+, Blogger, Picasa, Google Video for Business, Google Groups for Business, 25GB email storage per person, BlackBerry and Microsoft Outlook access, and integration with MS Office via SharePoint services. Google makes it possible to integrate their services with Learning Management Systems and Student Administration Systems for example Blackboard and RAMSS. Google also makes it possible to add custom widgets to their services and to build custom online services using Google’s App Engine. Google Apps for Education is not the same as Google’s consumer services. No advertising is shown to students, faculty, and staff and there is no data mining. (Alumni do see ads.) Google offers a level of physical and online security unavailable within Ryerson’s current IT infrastructure. Their services are more robust than any service at Ryerson and routinely provide well over 99.9% availability. All these services are available to Ryerson without cost. (Google also offers additional storage and other service enhancements for a fee.) The committee believes Google offers one of the best online services available anywhere in the world and, unlike any comparable service, makes all of it available for faculty, staff, and students for free. Consequently we recommend:
- Ryerson complete an in depth privacy impact assessment, financial risk assessment, integration and security assessment of adopting Google Apps for Education;
- Provided a satisfactory outcome to these steps, Ryerson should negotiate an acceptable agreement with Google and a systems integrator for professional services to help planning and implementing the adoption of Google Apps for Education;
- Provided a satisfactory contract is negotiated, Ryerson will adopt Google Apps for Education as Ryerson’s University-wide E-mail, Calendar, and collaboration platform;
- After the transition to Google Apps for Education is complete, the GroupWise E-mail and Calendaring system will be decommissioned;
- We also anticipate that Faculties and Departments that run their own E-mail and/or calendaring systems will also migrate to Google Apps for Education and that they be encouraged to do so in order to provide a universal calendaring and collaboration platform for everyone at Ryerson;
Security, Privacy, and the Protection of Confidential Records
The superior security, ability to control default privacy settings, the expected language in a contract with Google, and ability to integrate with Ryerson’s identity management, authentication, and directory services means that adopting Google Apps for Education will improve Ryerson’s ability to protect the privacy of its users and the confidentiality of records hosted by Google. However, Google is based in the United States and so falls under U.S. laws including anti-terrorism legislation such as the Patriot Act. Naturally this leads to concern that U.S. law enforcement agencies might have access to information that they would not have access to if Ryerson’s data is hosted by Ryerson or another Canadian organization based entirely in Canada. However, Canada has similar anti-terrorism legislation that provides for access to information without a court order and without notification. U.S. and Canadian law enforcement officials have both formal and informal information sharing agreements in place and routinely share large amounts of information. Also mutual legal assistance treaties allow Canadian authorities to get warrants for US authorities, and vice versa. ( http://blog.privacylawyer.ca/2011/10/cloudlaw-law-and-policy-in-cloud.html ) In other words, U.S. law enforcement agencies are capable of accessing information in Canada without a court-issued warrant and without notifying the person to whom the data belongs. It is therefore difficult to judge if there is a significant increase in risk to using Google Apps for Education. However, even if the increase in risk is extremely small for most people, the consequences of access to private information may be significant. Consequently, we recommend that Ryerson provide an opt-out option for faculty and students who judge they have an increased risk if their E-mail is hosted by Google. Because the incremental risk of using a U.S.-based provider is so small, we expect the vast majority of students, faculty, and staff will prefer to use GMail. However, we recommend:
- Before providing access to Google Apps for Education, users and departments will be informed by Ryerson that data, including emails, stored with Google will reside in foreign jurisdictions and will be subject to the laws of those jurisdictions including the Patriot Act. They can then make an informed decision about what kind of information they will transmit through GMail or store in any of the Google Apps for Education services.
- Faculty and students may elect to use RMail instead of GMail. (Staff should discuss any concerns with their managers as operational concerns may make opting out unfeasible.) However they must choose between Email systems. They cannot use both.
- All faculty, staff, and students will be provided with a Google calendar which may contain automatically updated schedule information from RAMSS and information regarding significant dates, events, and deadlines.
- By default, all faculty, staff, and students have available to them all the features of Google Apps for Education except E-mail for users who opt to use RMail.
- Authentication will be done by Ryerson with no need to provide your login credentials to Google when only the web interface is in use.
- Logging in through my.ryerson.ca and accessing resources available through Google will not send your Ryerson password to Google. Some services may require you provide Google with a password. For example to use an E-mail client that supports IMAP and connects directly to Google’s service. Where possible Ryerson and Google will work together to avoid this scenario or provide options such as using a second password only for Google. Otherwise Ryerson will notify the community where passwords will pass through Google’s service.
- There will be no advertising or data mining for faculty, staff, and student accounts. Google may display ads in Alumni accounts.
- Google will not own any data. All data is the property of Ryerson and/or its end users and the contract with Google will have no impact on the intellectual property rights, custody, or control of faculty, staff, and student data.
- Google will make available to Ryerson SAS 70 Type 2 internal controls compliance reports. These reports are conducted by a third party and include information on Google’s controls and processes related to physical security, privacy, logical security, change management, organization and management.
- All client/service Web traffic will be encrypted in transit by default as will all University/Google traffic.
- The RMail system is not expected to provide the capacity or quality of service of GMail. After two years Ryerson will re-examine the use of RMail as an opt out option – especially to explore if there are better ways to mitigate any risks of using a provider in a foreign jurisdiction and to review the quality of service offered by RMail.
Summary
Ryerson’s E-mail and Calendaring systems have not remained competitive with online services provided by companies like Google. For example, Ryerson’s systems do not provide Gmail’s features, storage capacity, or availability. Ryerson does not currently offer University-wide calendaring, instant messaging, video chat services, real-time collaborative document editing and review, and other services required to provide a rich online working and collaboration environment.
Adopting Google Apps for Education will provide the Ryerson community with a rich collaboration platform that will work consistently across the entire University. Just as Ryerson’s Master Plan is a bold undertaking designed to revitalize the campus and act as a catalyst for change and renewal, we believe adopting Google Apps for Education will act as a catalyst by dramatically improving the online environment at Ryerson.
References
- November 25th Town Hall video: https://ryecast.ryerson.ca/25/watch/1565.aspx
- Heather Driscoll’s November 25 slides: TOWNHALL_privacy.pdf
- Brian Lesser’s November 25 slides: Is Ryerson Ready to Go Google?
- November 14 Town Hall: https://ryecast.ryerson.ca/46/watch/1550.aspx
- Google Apps for Education: http://www.google.com/apps/intl/en/edu/
- Security and Privacy: http://www.google.com/apps/intl/en/edu/privacy.html
- Google Accessibility Statements: http://www.google.com/accessibility/policy/
- Is Ryerson Ready to Go Google?
- Presentation slides and videos from the Symposium: Exploring the Future of E-mail, Privacy, and Cloud Computing at Ryerson.
- Detailed information on SAS 70 Type 2: http://www.aicpa.org/Research/Standards/AuditAttest/DownloadableDocuments/AU-00324.pdf
- Google’s description of SAS 70 Type 2: http://www.google.com/support/a/bin/answer.py?answer=138340
- Universities that have gone Google: http://www.google.com/apps/intl/en/edu/customers.html
- Google Apps for Government: http://www.google.com/apps/intl/en/government/
- Google Apps for Business: http://www.google.com/apps/intl/en/business/index.html
Updated Nov. 28, 2011 with small changes to items 6 and 8 to address concerns expressed by faculty regarding single sign on and custody and control.
Ryerson really needs this! It’s been way too long in coming.
I’m working on a story for RUtv News about the new email system. Would i be able to shoot footage at the town hall Monday? Was also wondering if either Dimitri Androutsos or Brian Lesser would be available for an on-camera interview?
Why is Google offering all this for free with no Ads?It costs real money for them to host such features. Basically, the privacy policy with this Google arrangement is \We trust Google to do what it tells us it is doing and its under no control from illegitimate sources.\ I rather Ryerson try to host its own system using third party tools if needed so that the data remains within Canadian borders. Or have Google Canada in Kitchener host it there instead of using server farms south of border. Furthermore, students can use Google right now to schedule events,etc without Google and Ryerson being integrated. Why do we need to combine the two?
Also, the argument that \they have access to information anyway through cooperation between governments\ disregards for the fact we can actually trust the government of Canada to do proper evaluation for these transactions and these representatives are elected by Canadians; they are under a penalty if they fail. I seriously doubt any US congressperson being prosecuted in Canada. Seriously, when has that ever happened for an important case? The problem with the current generation of \Facebook\ users is that they dont care about privacy as long as they have usability even though self hosted open source alternatives such as Diaspora are available.
Even if this thing goes through, having a temporary opt out option is unacceptable. It needs to be permanent or have the option to delete data once not in Ryerson.
Hi Bob,
I’ve written a few responses to some of your comments:
> Why is Google offering all this for free with no Ads?
> It costs real money for them to host such features.
Google wants our students to use their services in the hope that they will continue using them when they leave Ryerson. If students use the consumer service after they leave, Google will make money on ads. If their employer decides to subscribe to Google’s corporate services, Google will profit from the fees it collects from them. Over 4 million businesses use Google Apps for Business. Google is locked in a world-wide competition with Microsoft for these sorts of cloud-based consumer and commercial services. They have a long term interest in attracting as many people as possible to their platform.
In order to attract corporations and governments to the corporate version of their services they must protect their customer’s data.
> Basically, the privacy policy with this Google arrangement is
> We trust Google to do what it tells us it is doing and its under no control
> from illegitimate sources.
If we go forward with Google it will only be if we can agree with Google on a contract that binds Google to protect the privacy of the Ryerson community. However we don’t just have to take Google’s written agreement for it that they protect privacy. Google also submits to third party SAS 70 type 2 audits and must provide Ryerson with the results. I’ve posted some references about SAS 70 audits in the references section of this page. Google also has a 20 year agreement with the FTC in the United States to have its privacy practices audited. Due to its size, and lobbying by its competitors, Google is heavily scrutinized. It is in their interest to maintain very high security standards and protect the privacy of users in their Google Apps for Education and Google Apps for Business offerings.
>I rather Ryerson try to host its own system using third party tools if needed
>so that the data remains within Canadian borders.
>Or have Google Canada in Kitchener host it there instead of
>using server farms south of border…
The Canadian Anti-Terrorism Act allows a secret Canadian court to issue secret orders that include the interception of communications and to obtain any stored information. Canada and the US have mutual legal assistance treaties that allow Canadian authorities to get warrants for US authorities, and vice versa. Canadian and US authorities share vast amounts of information. American authorities can get information in Canada without a warrant. The recently elected government of Canada is introducing highly intrusive surveillance legislation. Hosting in Canada does not protect information from access by US law enforcement authorities.
>Furthermore, students can use Google right now to schedule events,etc
>without Google and Ryerson being integrated.
>Why do we need to combine the two?
Based on the complaints I’ve received (and if I understand what you are saying) this sort of approach has not worked. When people are on different calendaring systems (Google, Microsoft, GroupWise, etc) they cannot do a simple busy search to schedule a meeting. Instead they end up with frustrating email negotiations over dates and times. CCS often receives requests for an easier way to schedule office hours, student group meetings, committee meetings that may include faculty, staff, and/or students, and so on. In 2011 we should be able to offer the entire community the ability to schedule things in one system if they choose to. I don’t know of any large commercial enterprise that does not offer this service for everyone who needs it.
>Even if this thing goes through, having a temporary opt out option is unacceptable.
>It needs to be permanent or have the option to delete data once not in Ryerson.
There was some concern that we would leave Rmail to rot if we adopted Google. So, I thought it would be a good idea to commit to reviewing things in two years. Also, I can’t predict the future so I thought it would be a good idea to see if there were better mitigations to simply running Rmail.
Finally, you can delete data in Rmail or Gmail at any time. However, Email you’ve sent may not be deleted by the receiver or the people they forwarded it to. And, of course, Email you’ve received may not be deleted by the sender or other people they sent it to – possibly without your knowledge. A lot of people at Ryerson forward their Email to Google, Microsoft, or Yahoo. All have major data centres in the US.
Yours truly,
-Brian
A student asked me to post this here via an Email:
I agree with that statement. This is not right at all I will never use this service.
I’m in favour of moving to Google apps. I’ve already been using gmail as my email client, as well as Calendar, Reader, Docs, Google+, Blogger, Analytics, AdSense, Sites, Groups, and YouTube.
I’ve never had any trouble with any of these services. Meaning no disrespect to the folks at CCS who are doing their very best, Google services are just more usable, more reliable, and more accessible than anything we can run in-house.
Brian is right in saying that they’re giving their stuff away to schools for advertising purposes. Many other software companies, who give ridiculously high discounts to educational institutions, have the same motive: to get graduates to recommend those tools to their bosses in the future. Google, being so large, can afford to give their services away for free. Smaller companies cannot do that.
On the matter of “pernicious hegemony,” I would respectfully request the student to offer evidence of cases where google has indisputably done anything that cannot be equally well-explained under the rubrics of capitalism and accommodating the sometimes byzantine regulations in different countries. I would also ask that student to suggest alternative software systems to Google’s systems.
This comment was removed at the request of the person who posted it.
Hi all,
I was at the town hall presentation today but had to leave a bit early.
The presenters did a great job clarifying the privacy and security risks of using Google Cloud Services. However, I felt the comparison of product features between Google and Microsoft, and the subsequent rationale for going with Google, was very much glossed over.
Once we get past the security security concerns, isn’t this whole exercised aimed at improving our work and student lives? Microsoft Office products have dominated my day-to-day computer use – whether as staff, TA or student – and I assume this is true for most of the Ryerson community (otherwise there wouldn’t be any work getting done…). Shouldn’t integration with Microsoft Office Products be a top priority for the Cloud Solution used at Ryerson? I fear that people have not raised this concern because of an assumed compatibility between Google Docs and Microsoft Office but in fact they are competitors, and files do not seamlessly convert from Google Docs format to Microsoft Office format. For example, if you are working in Microsoft Word, using Microsoft word features, your document could look very different after uploading to Google Docs format (which is a very limited word processor). I for one love Word-specific features such as academic referencing and footnotes. You could also spend weeks collaborating in GoogleDocs but still need to convert back to Microsoft Office in order to send a file to an external partner because, like Ryerson, the majority of the business/professional world uses Microsoft Office. In explaining the rationale for going with Google Docs, the presenters demonstrated some cool features including the ability to see (in real-time) who else is editing a document as you view it. After getting past the \ohs and wows\ I’m not sure that feature in particular has any day-to-day applicability. It would drive me crazy if I went to work on a document and noticed 5 people simultaneously editing and moving things around.
Somebody today raised a good point about reputation and it is a valid one. When most people think of Google, they think of the cool funky company based in California. They think of apps on cell phones and neat features like StreetView. But let’s face it, Microsoft has the professional image – should Ryerson? Then again somebody else could just as easily argue that Ryerson should be associated with cutting-edge ideas and innovation like Google.
It must be hard to navigate these issues… I don’t envy the CCS/ACAC team!
Good luck,
– Ryan
used Microsoft Office products
I’m quite frankly disappointed at my colleagues’ willingness to sign away their privacy for a shiny new toy: GMail and other Google services. That being said, that’s their problem, mostly. My issue is with the fact that these pro-Googlers now wish to sign away MY privacy and that’s where I’m uncomfortable. Sure, we can opt-out of GMail (for now…), but I am not happy with the fact that I’ll be automatically opted-in for calendars and other services. I don’t use GMail, I don’t use any Google services and I find it offensive that my employer will upload my information (e.g. teaching/meeting schedules, student schedules? grades?) to Google’s services on my behalf, whether I want that or not. I don’t want Google to know what committees I participate it, where I’ll be and when. Ok, maybe the pro-Googlers will think I’m crazy and paranoid, but they should respect my wish to stay off the Google radar like I respect their wish to upload their life into Google in exchange for convenience. It’s bad enough that I’ll now have to keep in mind that every time I send an email to a colleague or student (including Academic Integrity decision letters, Grade Appeals letters, DAC teaching assessments, etc.), it’s going straight to that server in the US even though I have opted-out because most of my colleagues/students won’t have. Yes, I know, many students/faculty are doing this already anyways and there’s no way for me to find out. But now, it’ll basically be everyone.
So if/when we do go with the Google-everything option, as it seems appartent now that we will, we MUST be able to FULLY OPT-OUT of all services not run in-house: that is the only “fair” option for all. I would, of course, much much prefer we keep it all in-house but it is obvious to me now this will not happen.
What if it turns out that Google is better able to protect your privacy than any Canadian University?
By that I mean that for the Apps for Education services available under contract with Google, what if Google, over-all, does a better job of protecting your privacy?
Catherine,
What I have gained form this entire exercise is that I have to think twice, if not three times, before I send an e-mail to anyone, including people internal to Ryerson, as I have no idea what route it may take and where it could end up. Sensitive information should probably not be e-mailed. Most of the things you mention above, I personally refuse to deal with on an electronic basis and always do it the “archaic” paper way.
…also forgot to mention:
Currently 16,352 people forward their e-mail OUT of Ryerson, mostly to places like Google and Yahoo. So, even now, your fear of storing e-mail and information on US servers is real for you since you have no idea who is doing this since it is students *and* faculty.
Pingback: Google User Interface | Artur Sedov 11008