4 ms·

Good comments. But note that UC doesn't have a document that says one can't expect privacy--it has one that says that (except in special cases, and in these t

Good comments. But note that UC doesn't have a document that says one can't expect privacy--it has one that says that (except in special cases, and in these the user is supposed to have recourse) one can expect privacy. See http://policy.ucop.edu/doc/7000470/ElectronicCommunications http://policy.ucop.edu/doc/7000470/ElectronicCommunications The monitoring may be routine and innocent. But it shouldn't be secret, and it shouldn't be in stark violation of the University's own (stated) policies.

jcrawfordor 11y ago
I wasn't familiar with that document, but I read IV-C-2-b as authorizing this activity: "University employees who operate and support electronic communications resources regularly monitor transmissions for the purpose of ensuring reliability and security of University electronic communications resources and services (see Section V.B, Security Practices), and in that process might observe certain transactional information or the contents of electronic communications." This is followed by standard restrictions (only for valid purposes, controls to protect information, etc). They provide a stronger assurance of privacy than I would expect, but still leave plenty of latitude for this activity. Edit: copied and pasted from a PDF. never again..... Further edit: V-B is really interesting and requires user permission "it is necessary to examine suspect electronic communications records beyond routine practices." This is kind of a strange rule, but particularly since they're using a third-party vendor, all of this would easily fall under routine. It's important to note that this policy primarily discusses "disclosure," which I can't see this being considered. It does go to a third party, but one contracted for internal purposes.
- toufka 11y ago
  Doesn't this: "they are not permitted to seek out transactional information or contents when not germane to system operations and support, or to disclose or otherwise use what they have observed." [4C2b] Conflict a bit with the product's advertised description: "The Deep Session Inspection engine sees every single packet that traverses the network, reassembles those packets into session buffers in RAM, and recursively decodes and analyzes the protocols, applications and content objects in those session buffers in real-time - while the sessions are occurring. This allows XPS to “see deeper” into applications and, in particular, the content that’s flowing over the network." [1] Boiled down: "University employees are not permitted to seek out... content when not germane to system operations and support", juxtaposed against, "XPS reassembles those packets... and content objects... to "see deeper" into applications and, in particular, the content that's flowing over the network." Or do we go all bureaucratic-NSA-legalese and say that, "all content is [could be] germane to some kind of ethereal 'persistent threat'". And that "'automated packet inspection' based on human-generated rulesets is different from a human 'seeking out' content." If so, then there shouldn't even be a privacy carve-out, as there's nothing from which to carve. And the first sentence in the policy is entirely meaningless. [1] https://www.fidelissecurity.com/sites/default/files/ds_fidelis_xps_1509.pdf https://www.fidelissecurity.com/sites/default/files/ds_fidel...
  - jcrawfordor 11y ago
    I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.
    - toufka 11y ago
      But would you argue that reviewing content is germane to security monitoring? Content and traffic are very different things. And is that really the (required) 'least invasive' mechanism to achieve a properly functioning network?
toufka 11y ago
From the policy: IV - A - "The University does not examine or disclose electronic communications records without the holder’s consent." IV - B - "The University shall permit the examination or disclosure of electronic communications records without the consent of the holder of such records only: (i) when required by and consistent with law; (ii) when there is substantiated reason (as defined in Appendix A, Definitions) to believe that violations of law or of University policies listed in Appendix C, Policies Relating to Access Without Consent, have taken place; (iii) when there are compelling circumstances as defined in Appendix A, Definitions; or (iv) under time-dependent, critical operational circumstances as defined in Appendix A, Definitions." IV - B1c - "In addition, California law requires state agencies and the California State University to enable users to terminate an electronic communications transaction without leaving personal data (see Appendix B, References). All electronic communications systems and services in which the University is a partner with a state agency or the California State University must conform to this requirement. In no case shall electronic communications that contain personally identifiable information about individuals, including data collected by the use of "cookies" or otherwise automatically gathered, be sold or distributed to third parties without the explicit permission of the individual. " IV - C2b - "In the process of such monitoring, any unavoidable examination of electronic communications (including transactional information) shall be limited to the least invasive degree of inspection required to perform such duties. This exception does not exempt systems personnel from the prohibition (see Section IV.A, Introduction) against disclosure of personal or confidential information. Except as provided above, systems personnel shall not intentionally search the contents of electronic communications or transactional information for violations of law or policy."
- anomic_one 11y ago
  More policy. http://ucop.edu/privacy-initiative/uc-privacy-and-information-security-steering-committee-final-report.pdf http://ucop.edu/privacy-initiative/uc-privacy-and-informatio... was adopted as policy by the Regents in 2013. These really are principles, not policy, but among other things it describes "web sites visited" by an individual as an aspect of "autonomy privacy", and claims to accord these a high degree of respect, invoking academic freedom, and suggests that policy should follow the first and fourth amendments.

jcrawfordor 11y ago

I wasn't familiar with that document, but I read IV-C-2-b as authorizing this activity: "University employees who operate and support electronic communications resources regularly monitor transmissions for the purpose of ensuring reliability and security of University electronic communications resources and services (see Section V.B, Security Practices), and in that process might observe certain transactional information or the contents of electronic communications." This is followed by standard restrictions (only for valid purposes, controls to protect information, etc). They provide a stronger assurance of privacy than I would expect, but still leave plenty of latitude for this activity. Edit: copied and pasted from a PDF. never again..... Further edit: V-B is really interesting and requires user permission "it is necessary to examine suspect electronic communications records beyond routine practices." This is kind of a strange rule, but particularly since they're using a third-party vendor, all of this would easily fall under routine. It's important to note that this policy primarily discusses "disclosure," which I can't see this being considered. It does go to a third party, but one contracted for internal purposes.

toufka 11y ago
Doesn't this: "they are not permitted to seek out transactional information or contents when not germane to system operations and support, or to disclose or otherwise use what they have observed." [4C2b] Conflict a bit with the product's advertised description: "The Deep Session Inspection engine sees every single packet that traverses the network, reassembles those packets into session buffers in RAM, and recursively decodes and analyzes the protocols, applications and content objects in those session buffers in real-time - while the sessions are occurring. This allows XPS to “see deeper” into applications and, in particular, the content that’s flowing over the network." [1] Boiled down: "University employees are not permitted to seek out... content when not germane to system operations and support", juxtaposed against, "XPS reassembles those packets... and content objects... to "see deeper" into applications and, in particular, the content that's flowing over the network." Or do we go all bureaucratic-NSA-legalese and say that, "all content is [could be] germane to some kind of ethereal 'persistent threat'". And that "'automated packet inspection' based on human-generated rulesets is different from a human 'seeking out' content." If so, then there shouldn't even be a privacy carve-out, as there's nothing from which to carve. And the first sentence in the policy is entirely meaningless. [1] https://www.fidelissecurity.com/sites/default/files/ds_fidelis_xps_1509.pdf https://www.fidelissecurity.com/sites/default/files/ds_fidel...
- jcrawfordor 11y ago
  I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.
  - toufka 11y ago
    But would you argue that reviewing content is germane to security monitoring? Content and traffic are very different things. And is that really the (required) 'least invasive' mechanism to achieve a properly functioning network?

toufka 11y ago

From the policy: IV - A - "The University does not examine or disclose electronic communications records without the holder’s consent." IV - B - "The University shall permit the examination or disclosure of electronic communications records without the consent of the holder of such records only: (i) when required by and consistent with law; (ii) when there is substantiated reason (as defined in Appendix A, Definitions) to believe that violations of law or of University policies listed in Appendix C, Policies Relating to Access Without Consent, have taken place; (iii) when there are compelling circumstances as defined in Appendix A, Definitions; or (iv) under time-dependent, critical operational circumstances as defined in Appendix A, Definitions." IV - B1c - "In addition, California law requires state agencies and the California State University to enable users to terminate an electronic communications transaction without leaving personal data (see Appendix B, References). All electronic communications systems and services in which the University is a partner with a state agency or the California State University must conform to this requirement. In no case shall electronic communications that contain personally identifiable information about individuals, including data collected by the use of "cookies" or otherwise automatically gathered, be sold or distributed to third parties without the explicit permission of the individual. " IV - C2b - "In the process of such monitoring, any unavoidable examination of electronic communications (including transactional information) shall be limited to the least invasive degree of inspection required to perform such duties. This exception does not exempt systems personnel from the prohibition (see Section IV.A, Introduction) against disclosure of personal or confidential information. Except as provided above, systems personnel shall not intentionally search the contents of electronic communications or transactional information for violations of law or policy."

anomic_one 11y ago
More policy. http://ucop.edu/privacy-initiative/uc-privacy-and-information-security-steering-committee-final-report.pdf http://ucop.edu/privacy-initiative/uc-privacy-and-informatio... was adopted as policy by the Regents in 2013. These really are principles, not policy, but among other things it describes "web sites visited" by an individual as an aspect of "autonomy privacy", and claims to accord these a high degree of respect, invoking academic freedom, and suggests that policy should follow the first and fourth amendments.