Re: Gmail, etc. - Forwarding Email to Personal Accounts!

["Mark S. Bruhn" <mbruhn () INDIANA EDU>]

It may be less costly, in fact -- if the institution doesn't hold the data,
it cannot be sought by legal orders served on the institution.

We went through that here, because the Indiana open records law has
absolutely no exception for personal email -- that is, someone can ask for
all of the email currently in my IU-provided email mailbox, and we would not
be able to hold back or redact anything (other than those bits which would
be excepted under the very few exceptions that are in the law).

So, when the no-personal-email-exception was confirmed recently, we started
telling everyone that they might want to get themselves an outside account
for their personal email.  What we did NOT say was that the outside email
could constitute a safe haven for business email, because that would have
been, at very least, contrary to the spirit of the law.  On the other hand,
we do not have a stated policy that employees MUST use their IU-provided
email account to transact IU business.

The bigger issue that is adjacent to to the one you identify is collections
of mission-related email stored somewhere else -- if that employee is
terminated or is otherwise unable or unwilling to ship those back to someone
on campus, that could be a real problem.

By the way, we DO have a statement from Student Affairs that official email
to students will be sent to their IU email address, and it is the student's
responsibility to make sure (for situations under their control) that their
email accounts are ready and able to receive that mail.  Inasmuch as we are
starting to contemplate whether we will stay in the student email business,
that will perhaps become an issue.

M.

--
Mark S. Bruhn

Associate Vice President for Telecommunications
Executive Director, REN-ISAC (http://ren-isac.net)
Indiana University



> From: David Lundy <dlundy () PACIFIC EDU>
> Reply-To: The EDUCAUSE Security Discussion Group Listserv
> <SECURITY () LISTSERV EDUCAUSE EDU>
> Date: Wed, 8 Nov 2006 15:21:47 -0800
> To: <SECURITY () LISTSERV EDUCAUSE EDU>
> Subject: Re: [SECURITY] Gmail, etc. - Forwarding Email to Personal Accounts!
>
> All:
>      I not seen anyone else mention it, but the elephant in the room
> for us is E-Discovery.  If faculty and staff are allowed to forward
> email to a non-university personal account, they will no doubt use that
> account for sending official email.  In addition replies to emails sent
> from that account could return directly to that account.  We would have
> no means of archiving that email which could be a serious and possibly
> costly problem if we are sued.  We are looking at archiving
> possibilities which would have the requisite search tools, possibly
> hosted by a third-party and requiring all official email (faculty and
> staff) use the campus email system so the email would be archived.  Is
> anyone else dealing with E-Discovery issues?
>
> David Lundy
>
> ----
> David Lundy
> Acting IT Security Officer
> University of the Pacific
> Stockton, CA 95211
> Email: dlundy () pacific edu
> Voice: 209-946-3951
> Fax: 209-946-2898
>
> > > > "Sadler, Connie" <Connie_Sadler () BROWN EDU> 11/08/06 12:02 PM >>>
>
> Hi, all... we have more and more people (faculty and staff as well as
> students) who want to forward their work-related messages, as well as
> their personal messages, to one central email account, usually gmail.
> Obviously, I am concerned about having potentially sensitive
> university
> email content sitting on a gmail server. What are you folks doing to
> manage these sorts of requests? Are you preventing staff or faculty
> from
> doing this? If so, how has that worked? We are rapidly moving toward
> expectations people have of having all of their messaging funneled to
> one place, and while this is certainly convenient, I'm quite concerned
> about how we can ensure a reasonable level of security.
>
> Thanks -
>
> Connie J. Sadler, CM, CISSP, CISM, GIAC GSLC
> IT Security Officer
> Brown University Box 1885, Providence, RI 02912
> Connie_Sadler () Brown edu
> Office: 401-863-7266
> PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x91E38EFB
> PGP Fingerprint: DA5F ED84 06D7 1635 4BC7 560D 9A07 80BA 91E3 8EFB