Is it time to shut down RMail?

This blog post was originally communicated via email to students, faculty and staff at Ryerson University. We encourage you to join the discussion in the comments section below.


Ryerson is conducting a consultation to inform recommendations on the future of the RMail system at the university. Over the next 10 days, subsequent messages and a survey invitation will be emailed directly to current RMail users and also posted on our Email & Collaboration Tools Consultation blog for discussion.

Everyone in the Ryerson community is welcome to share thoughts on this topic whether or not they are current users of RMail.

Why hold a consultation?

In November 2011, the Advisory Committee on Academic Computing (ACAC) recommended adopting Google Apps for Education—now called G Suite. Since then, 93 per cent of the Ryerson community have chosen to use Gmail at Ryerson instead of our older RMail system. At the time, ACAC recommended re-evaluating the use of RMail after two years:

“The RMail system is not expected to provide the capacity or quality of service of GMail. After two years Ryerson will re-examine the use of RMail as an opt-out option—especially to explore if there are better ways to mitigate any risks of using a provider in a foreign jurisdiction and to review the quality of service offered by RMail.”

Seven years on from ACAC’s recommendation, it’s now time to consider if Ryerson should shut down RMail and move entirely to Gmail.

Cybersecurity concerns with RMail

There are two important reasons to consider shutting down RMail at this time:

  1. Email-based attacks have become more sophisticated with greater implications for recipients. RMail is now significantly less secure than Gmail.
  2. The growing use of Gmail at Ryerson means almost every work-related email that was sent to or from an RMail account is now stored in someone’s Gmail account. Using RMail does not mean your email content is prevented from being stored in Gmail.

Ryerson’s safeguards from Google tracking

Ryerson’s agreement with Google has never permitted data mining or web and application tracking. As such, Google has never been (and is still not) able to track your Google services usage while you’re logged in to your Ryerson Google account.

What’s more, over the past seven years, Google has continuously made G Suite more secure. They now strongly encrypt all data at rest and in transit and have worked consistently to better protect Gmail accounts from phishing attacks. Google not only disabled ads in G Suite for Education but also shut down the scanning process that enabled ads.

Would you switch to Gmail? Have your say

In the next 10 days, we will post more information about the challenges of trying to secure RMail, the growing use of Gmail at Ryerson and how we might eventually migrate accounts from RMail to Gmail.

Please visit the Email & Collaboration Tools Consultation blog to share your thoughts on the idea. As part of this consultation, we plan to survey RMail users to make sure we understand any concerns they may have about moving to Gmail.

Please also feel free to write to me directly about this proposed change. ACAC will review the response from the Ryerson community before making a recommendation on the future of RMail.

Yours truly,

Brian Lesser
Chief Information Officer
Ryerson University

This entry was posted in Uncategorized. Bookmark the permalink.

33 Responses to Is it time to shut down RMail?

  1. Matthew Brown says:

    Please keep Rmail.
    I really don’t want to use Google.
    Thanks.

    • Anika Syeda says:

      That’s really interesting, you’re one of the very few people I’ve come across who have this position, but the few of you are quite steadfast in your opinion. Would we be able to talk via email about this?

  2. Zack Bradley says:

    Yes, please switch to Gmail. I have never touched by RUMail…

  3. Drew MacDonald says:

    Ryerson is the only business/institution I have encountered that spends money maintaining two separate and redundant e-mail systems. RMail should be shut down as soon as possible.

    For those that don’t “like” GMail, I am reminded of something Mick Jagger once said.

    “You can’t always get what you want.
    You can’t always get what you want.
    You can’t always get what you want.
    But if you try sometimes, well, you just might find,
    You get what you need.”

    • Anika Syeda says:

      Interesting perspective, I never even gave thought to the idea that in order to power two mail servers, the institution would have to put time, money, and manpower behind both. Would we be able to discuss more about this via email? You can reach me at anika.syeda@ryerson.ca (note how I use Gmail lol)

  4. Melissa says:

    Please keep Rmail, I still use it and don’t want to switch to gmail. Ryerson is one of the only universities in the city (UofT, York etc,) that switched their internal email server to on an external email (gmail) to maintain its users data. Improve the security of ‘rmail’ rather than abandon it for gmail. ‘gmail’ is notorious for hacks and email user data is stored on a ‘gmail’ server that users have no idea who have access to their data on these ‘gmail’ servers. There’s good reason why most universities keep their own internal email server system.

  5. Shawn Zivontsis says:

    Please maintain the RMail system. I do not use RMail but I believe it is important to provide clients with a way to go Google-free if that is what they want. Especially now with the recent Senate hearings on data protection and the introduction of the GDPR in Europe, the ability to abstain from major providers like Google is an especially topical issue and Ryerson is one of the only major organizations I’ve seen take those important concerns seriously.

    I understand that with 90% of clients using Gmail, even RMail users are likely to have their emails end up on Google’s servers. But that’s unavoidable, of course you can’t control what the recipient does with the emails you send them. Still, by using RMail, clients can be sure that at least their metadata is protected, like the dates and times which they access their email or where they do it from. This can be an especially important concern for those who access their Ryerson inbox from their mobile devices. Furthermore, RMail users can at least be sure that emails sent to or received from external sources would be out of the hands of Google, which could still be an important consideration in some cases.

    With that said, I support the idea of repositioning Gmail to be the officially recommended email solution, keeping RMail only for those clients who have a specific need for it. Another possibility which might reduce costs would be to replace RMail with a simple mail forwarding option, and eliminate the web interface and POP/IMAP functionality entirely. This could help to reduce the attack surface of having both systems while still maintaining the ability to avoid Google for those clients that desire it.

    Thanks for reading.
    Shawn

    • Guo says:

      I agree with Shawn.

    • Anonymous says:

      I couldn’t agree more; valid arguments from Shawn.

      Another point worth mentioning would be that Gmail does not count dots as part of an account name. This means “first.last@gmail.com” has the same email address as “firstlast@gmail.com”. This could pose a concern with users who have very common first and/or last names.

      Furthermore, even though Google is a “free” alternative, it scans your email messages between you and the participants. The benefit of this is the reduction of malicious emails targeted to the consumer. However, it comes at a cost. Eric Goldman, a professor at the Santa Clara University School of Law states “The basic premise of Gmail is, we’ll give you a robust e-mail service and in exchange, we want to display ads alongside our e-mail and we’re scanning your e-mail to decide what ads are most relevant,”.

      We can clearly observe that the company collects data gathered through e-mail scanning for future ad targeting, and I for one do not believe that Ryerson students should be “forced” to switch over to an email service of this kind. Ryerson RMail could be reading these messages as well, but at least it doesn’t target us with user-specific ads.

      Thanks for reading.

    • Brian Lesser says:

      Hi Shawn,
      I don’t think RMail provides the level of protection for meta data that you describe in your comment. Each email that is sent from RMail to Gmail includes header information that includes information about when and how the message was sent. You can see this when you access Gmail in your browser. Open an email and click the “more” menu item and select Show Original.

  6. Marcello Papini says:

    Rmail is ancient and should be mothballed. I didn’t even know it still existed!

    I personally would rather have CCS dedicate all possible resources to keeping the vastly superior and (more secure) gmail system up to date and running smoothly.

  7. salustri says:

    Rmail should have been mothballed YEARS ago.

  8. CM says:

    I wonder about where email is stored. With Gmail are emails stored out of country? I try to avoid using any service storing outside Canada, even though this is becoming tougher all the time.

    • Peter says:

      That is probably one of the bigger concerns with Gmail. I would never switch to Gmail since there is no guarantee of any kind in terms of data storage location and security. Google makes money from data mining and since nothing is free in this world they will find a way to make money on it. Institutions, especiallly Univerisites should use in house mail services, even if it is for basic student and staff support.

  9. Uzmah Thakor says:

    Yes please shut down RMail it is very difficult to navigate. Also, there is no point in maintaining both a Gmail and RMail account, therefore, it’ll be much easier for the students as well as the staff members that are overseeing these accounts.

  10. MK says:

    Brian — Humber maintained two email systems after adopting Google Docs. (I am not sure if that is still true.) Their advertised reason for doing so was because Google data is under US jurisdiction; their local system was not.

    If a student wanted to keep their data footprint in the USA to a minimum, they could opt-out. (The fear being a homework assignment in Google Drive would land them on the US no-fly list.) As a refugee, or fiction writer, or a comedy student, or even as a minority studying in Canada — this thinking went — your school had your best interests at heart.

    You could explore ideas and exercise free expression in a school setting without having a US customs officer taking you out of context.

    At the time Humber adopted GSuite, these fears were abstract.

    Since that time Canadians have been put on the no-fly list accidentally. (Syed Adam Ahmed’s case is the most prominent.) The NSA has been revealed to be inside Google’s data-centres without permission (see project MUSCULAR). And the Canadian security establishment has forgone due process in a number of high profile cases (see Daniel Livermore’s latest book).

    And contrary to what you pointed to above, Google still scans GSuite messages… they simply no longer do that for ad personalization.

    So if you are an edge case (or have suspicions sounding last name) it is bad information hygiene to use GSuite… and consequences aren’t an abstraction anymore.

    Does that mean Ryerson should maintain twice the amount of infrastructure just to provide a safe space for cases like this? Probably not. It’s expensive. It’s confusing. And no one cares.

    Case in point the TDSB stopped sending students on school trips to the USA — in part because of concern for minority students having to deal with US customs — but even they continue to use gSuite. The convenience trumps all.

    Ryerson, especially as an urban university in Canada, should not be a place where students or faculty hold controversial views… in public, in private, or in email. Cost and a superior user experience are more important.

    Rmail clearly has to go.

  11. Charles says:

    I don’t question the need for a more secure email system at Ryerson. I strongly question whether Google is the company that should be trusted with providing this service.

    Surely there must be other companies offering email management that don’t depend upon human data mining and aren’t caught up in the kind of privacy controversies that Google is such a magnet for?

    Beyond promises, what kind of assurances are there that Google will keep its word that it won’t somehow wind up accessing and using (monetizing) Ryerson’s email data?

    Google has a history of shirking its commitments – just a few examples:

    Business Insider article “Google needs to apologize for violating the trust of its users once again” – https://www.businessinsider.com/google-location-data-violates-user-trust-nothing-will-happen-2018-8

    Guardian article “Google ‘betrays patient trust’ with DeepMind Health move” –  https://www.theguardian.com/technology/2018/nov/14/google-betrays-patient-trust-deepmind-healthcare-move.

    Register article “Swedes grumbling about Apple Store in their park are lucky – in Toronto, Google eats all your data” – https://www.theregister.co.uk/2018/11/01/swedes_miffed_at_apple_park_upgrade/

    I hope that any decision to contract with Google for providing university wide email services isn’t a bygone conclusion (or why have a consultation?).

  12. This feels like less of a consultation and more of a campaign to discontinue RMail.

    I’ll just say that after working to discontinue my use of Google services for several years, I was quite relieved that Ryerson offered me the option of RMail so that I wasn’t forced to become a Google user again just because I’m studying at Ryerson.

    I understand how the RMail webmail client (which I very rarely use) might be a subpar option. I use Thunderbird, and Thunderbird has its own anti-phishing / security features.

    I do resent the idea that to be a student at Ryerson I need to use services from one of the big tech companies that I’ve specifically taken steps in my life to avoid. I do appreciate the RMail option, to be able to remain Google-free.

    • Peter says:

      I am 100% with you on that one. Based on my experience with Google services and their sneeky ways of data collection I willl definitely stay away from Gmail. If Ryerson decides to cut out Rmail, than they should at least let people use other email service providers for campus communications and not lock everybody into Gmail.

  13. N.M says:

    I strongly object to doing away with Rmail and forcing everyone into a Google product. How is it acceptable to force students to use a product from a company that is probably the biggest violator of digital privacy on earth? How is it acceptable to force students to handover and let Google control all their data? So is that the condition for being a Ryerson student, you should be willing to sacrificing your privacy and put your trust in a company that doesn’t deserve it.

    This feels nothing like a consultation and more like an attempt to hoodwink us, especially given your follow up emails touting Google. It also quite telling that while you speak to the virtues of Gmail, you have said little to nothing about the parent company and the implications of data privacy. Institutions like Ryerson should be leading the charge when it comes to issues of privacy and data gathering but instead, and not to be rude but you guys are acting like Google salespeople. Do not assume that the rest of us don’t know what we’re talking about.

  14. Cole says:

    In my first year I didn’t know what I was doing when I said no to gmail and went with an Rmail account. In the words Cher, if I could turn back time, knowing what I do now, I probably would have gone with gmail. That being said, I have Rmail, I realize gmail is vastly superior and Rmail is sinking fast, but that doesn’t mean I jump ships; no, we’re going down together. I’ve learned to live with Rmail’s retro little quirks. I love Rmail for now and forever.

  15. Aspirin says:

    Canadian Servers for Canadian People.

    If RMail goes…I will abandon my account.

  16. Bill Glassman says:

    A difficult question. I still use Rmail (have used it for more than 20 years), and prefer it. My reasons include:
    It’s easier to use a stand-alone mail program (Thunderbird in my case)–I hate web-based mail.
    Privacy and aversion to data-harvesting. Google may not be posting ads, but they are omnivores for data-harvesting. In today’s world, digital data collection is finding more and more uses, and Google is the 800-pound gorilla. I am also concerned that the non-localization of servers means my communications are also available to data users who are not governed by Canadian law. (Some would consider it paranoid, but just because Google _says_ they’ve turned off data collection for advertising purposes in the Education context does not mean they actually _have_–note it was recently revealed that Android phones track location even when users turn off permission to use location information!) These represent important reasons why I prefer Rmail.
    At the same time, I realize that maintaining Rmail is not a trivial cost, especially if usage is declining. (It would be nice to know usage stats–originally only faculty had the option to use Rmail, but some of the comments posted suggest students can also opt to use it now.) As a point of reference, how many current users are there, and what is the approximate cost to the university in annual terms?
    I strongly prefer keeping Rmail, and appreciate the opportunity for discussion–though I will be unsurprised if cost-cutting leads to killing Rmail.

    • Brian Lesser says:

      Hi Bill,
      Good to hear from you and thanks for posting.

      I think it is important to distinguish between Google’s add-driven consumer services and the G Suite of applications it provides to corporations and public sector organizations. Google has roughly 4 million corporate/public sector clients who pay something like one billion a quarter for these services. So the enterprise focused G Suite service they provide us (including Gmail) is not ad driven. G Suite is provided under a written agreement which limits what Google can do with our content. Basically the only use they can make of our data is to provide the service. An example would be indexing email for the purpose of allowing you to search on it.

      While Google makes much more from their consumer ad-based services, the enterprise is a growing revenue source for them. Enterprise customers demand privacy and security. If they don’t like what Google offers they can switch to Microsoft 365.

      The problem with Android phone location tracking is a good example of the difference between the consumer and enterprise services that Google provides. Ryerson turned off tracking for everyone at the university. As a result your location is not tracked against your Ryerson account. To truly turn off location tracking in your consumer Google account you have to find the activity tracking options in your profile and turn it off.

      Here’s a link to a screenshot of the activity controls from my Ryerson Google account. You can see it is off and can’t be turned on.

      http://email.blog.ryerson.ca/files/2018/11/CantTrack.png

      Regarding usage stats and costs, I hope to post some things about that later. But yes, 93% of new students and faculty choose to use Gmail.

      I also hope to respond regarding lawful access in the US and Canada. There is an assumption that things must be better in Canada. But that isn’t the case. See this article for example. To get a sense of the level of sharing between US and Canadian intelligence agencies please see Communication Security Establishment’s cyberwarfare toolbox revealed. One of the CSEC documents obtained by the CBC says “CSEC offers resources for advanced collection, processing, and analysis, and has opened covert sites at the request of the NSA. CSEC shares with NSA their unique geographic access to areas unavailable to the U.S.”

      Anyway, more later, and thanks again for posting.

      Yours truly,
      -Brian

  17. Judith Waalen says:

    I do have a gmail account but use it rarely. Like some others, I am used to rmail and prefer it. Yet, as Bill asks, the cost and declining usage needs to be provided.

    Judy Waalen

    • Brian Lesser says:

      Hi Judy (and Bill),
      I have posted the usage stats as part of this article:
      http://email.blog.ryerson.ca/2018/11/27/rmail-privacy-and-security-may-not-be-what-you-expected/

      Regarding the costs of running RMail, the yearly cost of the software is $ 112,784. However, this includes subscriptions to spam filtering services, directory service licenses, and the license for the email system itself. If we stop using RMail I don’t know if we can do without the directory service or if we will discontinue all prefiltering of email. The hardware to run the filtering services, directory and Rmail system is $162,993. Again I’m not sure what our actual savings will be if we discontinue RMail. Even if we can stop prefiltering and don’t need the directory service it might take a year or two to draw down those systems and realise the full savings. All told it takes about two people to manage RMail and take care of the directory and filtering systems.
      Yours truly,
      Brian

  18. Robin Church says:

    During my last trip to China, all of Ryerson’s G Suite was inaccessible. I could still use RMail. Had I switched to GMail, I assume that would that have been inaccessible as well. As far as I know, it is only China that blocks google and all of its services, for now. There are a number of countries, mostly in Asia and the Middle East, that periodically block some google services. What sort of VPN (or other measures) will we need to use to access even our email when in parts of the world that are decidedly unfriendly to google?

  19. salustri says:

    It’s unfortunate that there continue to be unsubstantiated claims of malignant behaviours by Google. Is Google perfect? Of course not; nothing is. So what?

    On the other hand, there may well be some cases where individuals have legitimate claims against the service as provided.

    So here’s an idea: CCS approach each person who has posted here suggesting an instance of unacceptable behaviour by Google, and get SPECIFIC details and evidence of that behaviour. CCS should then investigate every instance and report the results of those investigations in summary/anonymous form to the community.

    I will wager $20 that the majority of investigated incidents will turn out to be not incidents at all, but rather vague fears or outright lies derived from false reporting by the media at large, amplified by a variety of human cognitive biases.

  20. BC says:

    As a retired Ryerson faculty member, alumnus, and parent to a current Ryerson student I have always been concerned about the use of Gmail by Ryerson. When Gmail was originally offered to RFA members I without much difficulty decided to remain with Rmail. My concerns with Gmail have not changed over the years.

    When I retired I was also lead to believe that the use of my existing email account on Rmail was a retirement benefit provided to retired RFA members. If I had been required to switch to Gmail I would have ceased to use my Ryerson account and most likely severed many links with RU.

    Clearly I agree with Bill Glassman and “strongly prefer keeping Rmail” but I suspect that in the end Ryerson will ultimately choose to go with what is expedient and ignore the larger ethical concerns many Ryersonians have with Google and Gmail.

  21. Jeremy says:

    Yes, I think you should move away from Rmaile. I imagine is also has a lot of costs and infrastructure associated with it that could be better used. It would be great if the capacity recovered from closing Rmail went to educating and encouraging more staff and faculty started using the Gsuite products as they have greater security, revision tracking and collaborative capabilities.

Comments are closed.