We had a great discussion here at the University of Victoria about Privacy issues, and outsourcing of e-mail about a month ago. Our discussion focused mainly on Google. What was great about the group participating, is that we not only had IT managers and staff in attendance, but also a Senior University Auditor who has a particular interest in privacy issues. Here are my notes from the meeting: Outsourcing Email Discussion Points Presentation notes at: <a href="http://docs.google.com/Doc?id=dd7xm6g_29323m37">http://docs.google.com/Doc?id=dd7xm6g_29323m37</a> Privacy Concerns <ul><li>How would this relate to recent privacy concerns regarding the BC Government contracting out to US-hosted servers? Very similar. </li><li>Can US vendors enter computers hosted in Canada, if the parent company is based in the US? Canadian subsidiaries may be OK in this regard. However, even if the parent company is not from the US, the US Government can request data held by Canadian companies. </li><li>Trust is the underlying issue, to meet conditions of contract. Doesn't matter who the host is, the question is whether they can be trusted not to abuse their position of privilege. </li><li>Privacy is only a "useful illusion". </li><li>Cookies can be considered a form of privacy policy statements. Nothing that is *not* collected. Privacy concerns are not relevant. Privacy issues could be problematic with any hosting arrangement, externally contracted or not. </li></ul> Ownership of Data <ul><li>Google contract ensures users retain ownership of the data, however, Google has control over the data. </li><li>Advertising is directly relevant to content of messages, indicating that Google scans the content of messages to generate context sensitive advertising. This advertising can be turned off for currently enrolled students. </li></ul> Advantages <ul><li>Can users delete account? Yes. </li><li>Advantages: Logging, spam filter, phone integration, Word->HTML conversion, 2 GB storage. Added functionality: collaborative services. Contrast Sharepoint: no checkout/check-in with Google, but in Google can do co-editing (i.e. two peopled edit the same document at the same time, w/ versioning). </li></ul> Integration with existing infrastructure and organizational policy <ul><li>Does it integrate with LDAP? Yes. Can use @<a href="http://uvic.ca">uvic.ca</a> for google and non google accounts. </li><li>If an institution were to look at introducing it, what would be the process? </li><li>Can an organization legitimately require students to have GMail accounts? Some schools require students to check accounts. </li><li>Attractive to management as money-saving measure. Will there be union concerns about contracting out? </li></ul> -- Rich McCue Systems Administrator University of Victoria Faculty of Law <a href="http://law.uvic.ca/rmccue">http://law.uvic.ca/rmccue</a> +1 250 472 4716