For Andrew Brigham, Google’s offer to host Lakehead University’s e-mail system was almost too good to be true.
The network administrator for the Thunderbay, Ont.-based university had been struggling with a patchwork of legacy systems and spending half his time just to keep e-mails flowing amongst faculty, students and alumni.
Jeff and Sam from Google talk about the benefits of Google Apps for Education
When the university finally decided to find a new system to bring together the e-mail servers, many options cost millions of dollars to support the 60,000 users. Then Google came along with its new Google Apps Education Edition and offered to do it all for free.
“Administrators don’t like hearing ‘free’,” Brigham says. “It’s hard to get over, because there’s always a catch.”
But after thorough review, Brigham and his team decided to do the deal and become the first Canadian school to use Google’s services.
It took just 16 hours of staff time to put the system in place. Since going live in November 2006 the hosted service has run seamlessly and freed IT staff up to work on other projects.
The catch came from a non-technical point.
Lakehead faculty became concerned with their “@lakeheadu.ca” accounts being hosted by a U.S.-based company that would be subject to the U.S. Patriot Act.
The anti-terrorism legislation gives the American government great powers to seize data at a whim and can prevent the user from ever knowing they are under investigation. Despite privacy watchdogs saying there is limited threat from the Act, the legislation has still been an obstacle for Google in selling their educational service abroad.
Last March, Lakehead faculty entered into arbitration with the university. At the heart of the issue was a perceived threat to academic freedom, says Jim Turk, the executive director of the Canadian Association of University Teachers and lawyer representing the Lakehead faculty.
“What if you’re a political scientist doing research on the rise of terrorism in the 20th century?” he says. “If all your data goes through a Google e-mail system, it may trigger an algorithm [that has] you labeled as a person of interest.”
U.S. intelligence agencies have the power – under the Patriot Act – to issue Google a Security Letter demanding data from Lakehead’s e-mail be turned over. That method also bars Google from even informing Lakehead that it was forced to release the data to authorities.
The Mountain View, Calif.-based company does all it can to keep user data safe, says Jeff Keltner, business development manager at Google. But it must follow the law.
“We consider all data private,” he says. “We don’t disclose data to third parties unless required by law to do so, and we’ll notify our clients unless the law bars us from doing so.”
That need to comply with U.S. law is why Lakehead faculty wants the school to either host its own services or find a Canadian company to do it, Turk says. Of even greater concern is that the Patriot Act doesn’t recognize the rights of non-American citizens.
It wouldn’t take much for a professor to end up on a no-fly list and find their ability to travel hamstrung.
“If you become a person of interest to U.S. intelligence agencies, it can have serious consequences for your life,” he says. “There have been cases of people who’ve got on no-fly lists wrongly and have to go to great lengths to get off them.”
Privacy concerns aren’t limited to Lakehead. Google has run into problems pushing their service to faculties of many post-secondary institutions around the world as a result of worries over the Patriot Act.
While Keltner says there are more than 2,000 schools using the e-mail service for students in 100 countries, he could only name two using it for faculty e-mail – Abilene Christian University in Texas, and St. Louis University in Missouri.
The Patriot Act has “been a major concern, I’m not going to lie to you,” Keltner says. “It’s taken a little longer for some schools to get to the point where they are as comfortable with the legislation as the U.S. might’ve been.”
This slow growth comes despite the benefits Google Apps offers the university’s IT teams.
It is free and the service continues to improve. It has saved Lakehead millions of dollars and a lot of time and effort, Brigham says. It offers a built-in backup system and allows Lakehead to maintain administrative control over the accounts. Every user gets eight gigabytes of space for e-mail – far more than the 40 megabytes under the old account.
Users also have access to all the other services offered through Google Apps, Brigham adds. That includes shared calendar ability, and a space to publish videos. The system has been reliable, with only 10 minutes of planned downtime over almost two years of use, and no surprise downtime.
“We measured our other system’s downtime in days, not in minutes,” Brigham says. “We were warned of the one outage ahead of time because they had to move the entire data centre. We were assured afterwards that because of the upgrades made, there would be no more downtime.”
Schools shouldn’t let the Patriot Act get in the way of outsourcing data hosting services to American companies, says Anne Cavoukian, the information and privacy commissioner of Ontario.
She says there’s no problem with Lakehead outsourcing to Google so long as they did their due diligence on the contractual agreement made regarding usage of the data.
“Fears associated with the Patriot Act are grossly exaggerated… It’s like this big bogeyman in the room,” she says. “This is a theoretical situation that might happen to your data residing in the U.S.”
There were already laws before the anti-terrorism legislation was passed that would allow U.S. authorities to seize data, Cavoukian adds. Even the Security Letter that bars disclosure of an investigation is not unique to the Patriot Act. So if universities are worried about the Act, they should have been worried long before.
But Turk disagrees. He hasn’t been persuaded by arguments that the new legislation isn’t a serious threat to privacy.
“There have been some bad findings by privacy commissioners on this one,” he says. “Because we can’t know – especially if they do it through a national Security Letter – there’s no way to know if there’s been any problems.”
Still, Cavoukian says other aspects of privacy protection are more important to consider when outsourcing. Google is a member of Safe Harbour, she points out, a set of standards created by the European Commission that focus on data protection.
The compliance standards were set up to bridge the gap between European and U.S. privacy laws.
Google has also gone to court in the past to defend its user’s data on YouTube from a demand by Viacom that it hand it over in July. Google struck a deal with the media conglomerate to provide the data only after making the user information and IP addresses anonymous.
To counter the fear of the Patriot Act, Keltner has encouraged potential clients to have their own legal counsel review the issue.
“There’s a kind of belief that the U.S. Patriot Act is the ability of the government to get whatever they want, whenever they want it, and that’s just not true,” he says. “When interpreting law, you really need to get council involved.”
Google has only been offering its education service for two years and is “really excited about it,” he adds. Keltner predicts that many more universities will adopt the service for faculty e-mail in a year’s time.
At Lakehead an arbitrator is expected to issue a decision in the next few months. Meanwhile, Brigham is enjoying his time that’s been freed from maintaining e-mail servers. To him, the deal with Google is just as good as it sounded after all.
“We were basically promised the world,” he says. “We just didn’t believe what we were seeing.”
Now Brigham believes.
