Student Service Improvements Executive Background Brief

Transcription

1 Student Service Improvements Executive Background Brief Executive Summary Despite the ubiquity of consumer services and the fact that virtually all students coming to York have been using electronic mail for many years there remains an expectation among students that the University will provide them with a University account. And indeed the vast majority of Universities in Canada and beyond continue to provide their student with this service. The rise of consumer services, like Gmail (Google) and Hotmail/Outlook (Microsoft) with their associated capacity and functionality, has also created a great gulf in expectations between what students expect from an service and what legacy University services have generally offered. Approximately six years ago Google, followed later by Microsoft began to offer their services to educational institutions at no cost for students. This proposition has proven quite attractive and as of 2014 the vast majority of Universities in North America have opted to migrate their student service to either Google or Microsoft. In Ontario virtually all Universities have gone in this direction (only one has not signaled a move to a third party service provider). In October of 2011 York started a process to examine the possibility of migrating its student service to a third-party provider via a formal RFP process. That process began in late 2011 and continued through to 2012 and included an assessment of product features etc. as well as an evaluation by students. A second period of student consultation was held in late 2012 and into The RFP process concluded in April 2013 with a recommendation from the evaluation group that the University use Google as a provider for student . A move to Google for student will provide students with a vastly improved service and will bring York in line with the service provided by other schools in the province. This is the major driver for change. This move is not without risk, however, it is felt that the contract terms provided by Google sufficiently mitigate the major risks. The University has also done a privacy impact assessment in order to assess information risks and make recommendations to protect privacy. Background and Current State Like almost all Universities, York provides its students with service - all students are provided with a "@yorku.ca" account (via the York central service) when they start their studies with York. This account is available as long as students are active. Upon graduation or otherwise leaving York the accounts are made inactive. In addition to the central service, a number of Faculties (Schulich School of Business, Osgoode, and Education) also provide service to their students. Most of the Faculties also extend access to their service to alumni. In a 2011 student survey of IT services, the University s service ranked second in the service most needing improvement indicating the need to consider changes. It is

2 reasonable to assume that the dissatisfaction related in part to the fact that the central service has changed little over the past 10 years and its web interface and capacity both lag behind services that students have experience with. The central service also provides only, no calendaring or other services. In the same student survey cited above we also learned that most students use the account but only in a limited way: Over 98% of students use their University issued account; Only 15% of students use a University issued account as their primary address; From additional data on student accounts (from October 2012) about 10% of students forward to a third-party service: Student central October 2012 Number of accounts: 71,809 Total number of forwards: 7,216 (10%) Forward to gmail: 3,306 (4.6%) Forward to hotmail/live: 2,616 (3.6%) Forward to yahoo: 344 (0.5%) Other forwards: 950 (1.3%) As of March 2014, the statistics remain relatively the same and percentages of splits are as follows. The October 2012 statistics continue to be reflective of peak usage in a typical academic year. March 2014 percentages Percentage of total forwards (8.3%) Percentage forwarded to gmail (3.9%) Percentage forwarded to hotmail/live (2.9%) Percentage forwarded to yahoo (0.4%) Percentage of other forwards: (1.1%) Over the past number of years a strong trend has emerged for Universities and Colleges to maintain their service for students by moving the provision and support for the service to a "third party" service provider (Google or Microsoft) - providing an institutionally branded service hosted in the "cloud". Both Google and Microsoft provide a package of , file storage and productivity applications at no cost to Universities. The vast majority of U.S. University and colleges have moved in this direction and the trend has begun to pick up in Canada in recent years. In Ontario Universities that have transitioned their service to a third-party provider include: Ryerson University student, faculty and staff to Google University of Toronto student to Microsoft (consultation on moving faculty and staff in progress) University of Windsor student to Google McMaster University student to Google

3 Carleton University student to Microsoft Wilfred Laurier University student to Google Lakehead University student, faculty and staff to Google University of Ottawa student to Google Laurentian University student to Google Queens student to Microsoft UOIT student to Google Trent University student to Google Nipissing student to Google Western University student to Microsoft University of Guelph student to Google In October of 2011 York launched a process to explore the possibility of using an external provider for its student . The goals of the initiative included: Performing a structured assessment of alternative providers that offer free services the assessment to include both functional and technical requirements. Identifying issues and requirements of a solution related to information privacy. The process was guided by a steering committee consisting of representatives from information technology groups, alumni, division of students and the University information privacy office. The initiative was also introduced to students via a presentation to the Student Representative Roundtable in October 2011 (The SRR also received updates on the progress of the initiative annually through ). It was determined that a possible move of student to a third party provider would be best informed by a formal RFP process. Through the winter of 2011 requirements were developed and the RFP issued in February The evaluation of responses began in March 2012 synchronous with a student evaluation of alternatives. The assessment of RFP responses was completed by a working group comprised of representatives from the same groups represented on the steering group and led by Procurement Services. Two rounds of consultations with students in March-April 2012 and again in November-December 2012 also provided input into the decision. The recommendation of the working group was to award the RFP to Google (via the reseller Aprio). The Student Representative Roundtable received updates on the progress of the initiative annually through Risk Analysis - The major risks associated with a move of student to Google include: - The service is currently offered at no cost, at the end of the term Google s business model could change to require fees. - Google is responsible for service quality. - The service feature set and upgrades are in control of Google. - Student information will reside with Google while the University remains accountable for its protection and handling. - There are perceptions of particular risks associated with the information being in the custody of a U.S. corporation.

4 In early 2013 the University engaged with Google to discuss contractual arrangements for the service that would include terms to mitigate some of these risks. Contract review was led by York Procurement, and involved York s legal and information privacy office. The terms in the Google contract are felt by the University to be sufficient and appropriate for the student service. The very broad adoption of this service by Universities and Colleges also would be expected to serve as a force that would reduce the likelihood of radical negative change by the company. With respect to information privacy risks, the University's guidelines and procedures on use state that, "By its nature, is not a confidential medium; it is possible for messages to be intercepted, modified, copied or redirected without the knowledge of the sender or recipient by those with sufficient access to the transport systems or networks". Nevertheless the expectation of the users of our services is that they are operated and maintained in such a way to ensure appropriate access, security and custody of information. The University maintains these same responsibilities even if the service is operated by a third party on the University s behalf. Attachment 1 contains a set of questions and answers prepared to respond to potential concerns around information privacy (drafted for student information on the new service). Included in the questions in Attachment 1 is a section addressing potential concerns around the fact that the Google service would be subject to the U.S.A. patriot act. A number of legal authorities have expressed opinions that the patriot act does not represent a special risk to information. A similar opinion was expressed by the Ontario Privacy Commissioner in a report in June of 2012 (report PC12-39): There may be no greater area of confusion and misunderstanding than fear of the PATRIOT Act. The PATRIOT Act has invoked unprecedented levels of apprehension and consternation far more than I believe is warranted. For the reasons outlined on pages 5 and 6, the feared powers were available to law enforcement long before the passage of the PATRIOT Act, through a variety of other legal instruments. In my view, these fears are largely overblown, and focusing on them unduly constitutes a pointless exercise. I believe it is far more productive to compel organizations to be fully responsible and accountable for the services they provide or outsource. Finally, the University Information Privacy Office and UIT worked together on a privacy impact analysis that examined the information risks related to Google s hosting of student and made recommendations for protecting privacy within the context of York s implementation of the new service.

5 ATTACHMENT 1 - Responding To Questions About Privacy York University is committed to maintaining and protecting the confidentiality and privacy of our students' personal information. Before implementing this new service, we looked at the privacy implications and ways to help ensure that personal information is protected in accordance with the University's policies on personal information and with applicable legislation governing personal information. As part of the implementation, we: looked at different service provider options conducted our own internal review of our privacy needs in relation to student consulted with Canadian universities that had already implemented, or were in the process of implementing, a cloud- based student solution consulted students as part of the service provider selection process conducted a Privacy Impact Assessment (PIA) with a view to identifying major risks and implementing remediation measures to help reduce those risks consulted with the University's Information and Privacy Office and with the Office of the Counsel Will Google own the data that is stored in Google or passes through Google servers? Google does not own student data. Data Google accounts is the property of York University and/or the student, the end user. The agreement that York University has entered into with Google has no impact on the intellectual property rights or ownership of student data. What steps has the University taken to ensure that my privacy is protected? We have taken the appropriate steps to ensure that your privacy rights, as outlined in the University's policy on Access to Information and Protection of Privacy, are safeguarded. Passwords are not shared with Google. Our contract with Google prohibits Google s access to content, except to exercise rights and fulfill its obligations under our Agreement, including situations of Services abuse or technical threat. Google is also committed to your privacy and to ensuring the confidentiality and security of your personal information. Their security policies include provisions on the protection of your data against threats and unauthorized access. What personal information is shared with Google?

6 A limited amount of student information is shared with Google in order to create a Google- powered student account. The following personal information is provided: first name, last name, username, and address to validate against our authentication services. Will Google log my activity or scan my content? Google has some access to your account as explained in the Terms of Service. Google has agreed that the University is not granting Google any rights, implied or otherwise, to content. Google is not permitted to conduct data mining. Google has also agreed that Google is not permitted to include advertising in our student accounts. Google employees may be granted temporary access to your for troubleshooting purposes or to ensure the integrity of the services provided, but only with the approval of York University Administrators. Can Google share my personal information with any third parties? No. Our agreement with Google states that Google is not allowed to share students' personal information. Who is responsible for protecting the data stored in or sent from Google account? Students continue to be responsible for how they use their University- provided accounts in accordance with the University s computing policies. Students have an obligation to promote responsible, ethical and secure use of services. Google is also responsible for protecting and maintaining the security standards of the facilities it uses to store and process end- user data. Where is Google account data stored? Student account data is stored at one of Google's global facilities; access to these facilities is governed by the laws of the jurisdiction in which the data is stored, including the USA PATRIOT Act. Note that both Canada s Privacy Commissioner and Ontario s Information and Privacy Commissioner have stated that privacy risks from the USA PATRIOT Act are no greater than the risks from domestic or other foreign law enforcement bodies. Account data may be stored in multiple locations to protect information against system failures and IT security risks. For further information about how your personal data is treated, see Google Inc.'s Privacy Policy.

7 How secure is my information? , by its very nature, is neither completely private nor secure, regardless of the type of system being used or where the server is located. Any may be the target of Internet predators, which is why it is important to have a strong password and not to share your confidential information with others. Never provide your password or other personal, secure information via . Google offers a number of security features, and also offers tips on keeping your account secure. Read more about choosing secure passwords on the Computing website. Are users offered any spam protection? Google includes spam protection with their service. Spam is automatically directed to a spam folder and purged after 30 days. The service also includes safeguards for virus checks and verifications before downloading data. However, not all spam protection is 100% effective. It is still up to you to exercise some caution when communicating with unfamiliar sources or downloading attachments.