ACAC Recommends Going Google

Posted on January 13, 2012 by Brian Lesser

On December 6 the Advisory Committee on Academic Computing (ACAC) voted unanimously to recommend that Ryerson adopt Google Apps for Education. Here is the final text of the recommendation.

December 6, 2011

Proposal to Adopt Google Apps for Education

Background

The E-mail and Collaboration Committee has consulted with the Ryerson community regarding the options for providing all Ryerson students, faculty, and staff with a new University-wide E-mail, Calendar, and Collaboration Platform. Our consultations have included:

  • information provided on this blog that includes comments from the Ryerson Community;
  • a symposium Exploring the future of E-mail, Privacy, and Cloud Computing at Ryerson;
  • a requirements survey available to anyone at Ryerson;
  • a Request for Proposal(RFP) that reflected Ryerson’s requirements and included sections on accessibility, security, privacy, ownership of data, mail opt out options, legal jurisdictions, and the Patriot Act.
  • town halls to discuss this proposal;

The committee has also worked with Ryerson’s Privacy Coordinator and consulted with staff from the Office of the Information and Privacy Commissioner of Ontario regarding developing a Privacy Impact Assessment based on Privacy by Design Principles.

Adoption of Google Apps for Education

Google Apps for Education is a full-featured Web and mobile enabled collaboration platform that includes Gmail, Google calendar, Google Docs (including documents, spreadsheets, presentations, forms, drawings, and tables), Google Sites, Google Groups, and Google Talk (instant messaging, audio chats, and video conferences). Other features include Google Reader, Google+, Blogger, Picasa, Google Video for Business, Google Groups for Business, 25GB email storage per person, BlackBerry and Microsoft Outlook access, and integration with MS Office via SharePoint services. Google makes it possible to integrate their services with Learning Management Systems and Student Administration Systems for example Blackboard and RAMSS. Google also makes it possible to add custom widgets to their services and to build custom online services using Google’s App Engine. Google Apps for Education is not the same as Google’s consumer services. No advertising is shown to students, faculty, and staff and there is no data mining. (Alumni do see ads.) Google offers a level of physical and online security unavailable within Ryerson’s current IT infrastructure. Their services are more robust than any service at Ryerson and routinely provide well over 99.9% availability. All these services are available to Ryerson without cost. (Google also offers additional storage and other service enhancements for a fee.) The committee believes Google offers one of the best online services available anywhere in the world and, unlike any comparable service, makes all of it available for faculty, staff, and students for free. Consequently we recommend:

  1. Ryerson complete an in depth privacy impact assessment, financial risk assessment, integration and security assessment of adopting Google Apps for Education;
  2. Provided a satisfactory outcome to these steps, Ryerson should negotiate an acceptable agreement with Google and a systems integrator for professional services to help planning and implementing the adoption of Google Apps for Education;
  3. Provided a satisfactory contract is negotiated, Ryerson will adopt Google Apps for Education as Ryerson’s University-wide E-mail, Calendar, and collaboration platform;
  4. After the transition to Google Apps for Education is complete, the GroupWise E-mail and Calendaring system will be decommissioned;
  5. We also anticipate that Faculties and Departments that run their own E-mail and/or calendaring systems will also migrate to Google Apps for Education and that they be encouraged to do so in order to provide a universal calendaring and collaboration platform for everyone at Ryerson;

Security, Privacy, and the Protection of Confidential Records

The superior security, ability to control default privacy settings, the expected language in a contract with Google, and ability to integrate with Ryerson’s identity management, authentication, and directory services means that adopting Google Apps for Education will improve Ryerson’s ability to protect the privacy of its users and the confidentiality of records hosted by Google. However, Google is based in the United States and so falls under U.S. laws including anti-terrorism legislation such as the Patriot Act. Naturally this leads to concern that U.S. law enforcement agencies might have access to information that they would not have access to if Ryerson’s data is hosted by Ryerson or another Canadian organization based entirely in Canada. However, Canada has similar anti-terrorism legislation that provides for access to information without a court order and without notification. U.S. and Canadian law enforcement officials have both formal and informal information sharing agreements in place and routinely share large amounts of information. Also mutual legal assistance treaties allow Canadian authorities to get warrants for US authorities, and vice versa. ( http://blog.privacylawyer.ca/2011/10/cloudlaw-law-and-policy-in-cloud.html ) In other words, U.S. law enforcement agencies are capable of accessing information in Canada without a court-issued warrant and without notifying the person to whom the data belongs. It is therefore difficult to judge if there is a significant increase in risk to using Google Apps for Education. However, even if the increase in risk is extremely small for most people, the consequences of access to private information may be significant. Consequently, we recommend that Ryerson provide an opt-out option for faculty and students who judge they have an increased risk if their E-mail is hosted by Google. Because the incremental risk of using a U.S.-based provider is so small, we expect the vast majority of students, faculty, and staff will prefer to use GMail. However, we recommend:

  1. Before providing access to Google Apps for Education, users and departments will be informed by Ryerson that data, including emails, stored with Google will reside in foreign jurisdictions and will be subject to the laws of those jurisdictions including the Patriot Act. They can then make an informed decision about what kind of information they will transmit through GMail or store in any of the Google Apps for Education services.
  2. Faculty and students may elect to use RMail instead of GMail. (Staff should discuss any concerns with their managers as operational concerns may make opting out unfeasible.) However they must choose between Email systems. They cannot use both. The University will provide a means to change systems at certain times every year.
  3. All faculty, staff, and students will be provided with a Google calendar which may contain automatically updated schedule information from RAMSS and information regarding significant dates, events, and deadlines.
  4. By default, all faculty, staff, and students have available to them all the features of Google Apps for Education except E-mail for users who opt to use RMail.
  5. Authentication will be done by Ryerson with no need to provide your login credentials to Google when only the web interface is in use.
  6. Logging in through my.ryerson.ca and accessing resources available through Google will not send your Ryerson password to Google. Some services may require you provide Google with a password. For example to use an E-mail client that supports IMAP and connects directly to Google’s service. Where possible Ryerson and Google will work together to avoid this scenario or provide options such as using a second password only for Google. Otherwise Ryerson will notify the community where passwords will pass through Google’s service.
  7. There will be no advertising or data mining for faculty, staff, and student accounts. Google may display ads in Alumni accounts.
  8. Google will not own any data. All data is the property of Ryerson and/or its end users and the contract with Google will have no impact on the intellectual property rights, custody, or control of faculty, staff, and student data.
  9. Google will make available to Ryerson SAS 70 Type 2 internal controls compliance reports. These reports are conducted by a third party and include information on Google’s controls and processes related to physical security, privacy, logical security, change management, organization and management.
  10. All client/service Web traffic will be encrypted in transit by default as will all University/Google traffic.
  11. The RMail system is not expected to provide the capacity or quality of service of GMail. After two years Ryerson will re-examine the use of RMail as an opt out option – especially to explore if there are better ways to mitigate any risks of using a provider in a foreign jurisdiction and to review the quality of service offered by RMail.

Summary

Ryerson’s E-mail and Calendaring systems have not remained competitive with online services provided by companies like Google. For example, Ryerson’s systems do not provide Gmail’s features, storage capacity, or availability. Ryerson does not currently offer University-wide calendaring, instant messaging, video chat services, real-time collaborative document editing and review, and other services required to provide a rich online working and collaboration environment.

Adopting Google Apps for Education will provide the Ryerson community with a rich collaboration platform that will work consistently across the entire University. Just as Ryerson’s Master Plan is a bold undertaking designed to revitalize the campus and act as a catalyst for change and renewal, we believe adopting Google Apps for Education will act as a catalyst by dramatically improving the online environment at Ryerson.

References

Updated Nov. 28, 2011 with small changes to items 6 and 8 to address concerns expressed by faculty regarding single sign on and custody and control.

 

Brian Lesser
Director, Computing and Communications Services

Dimitrios Androutsos
Chair, Advisory Committee on Academic Computing
Associate Professor, Electrical and Computer Engineering

This entry was posted in Uncategorized. Bookmark the permalink.