If it is on machines that the university controls, they can install a root certificate of their own and then MITM the encrypted web traffic. I've seen this a f

If it is on machines that the university controls, they can install a root certificate of their own and then MITM the encrypted web traffic. I've seen this a few times at large companies. All work provided machines will have the company's root cert installed and this allows them to intercept and monitor all the traffic. I'm not a lawyer but I assume that this is legal. The company is monitoring their own network and their own machines. The employees may have even signed some document during their on-boarding which further stated that the company is allowed to monitor any activity on their own equipment. I consider this an ethically grey area. It starts to become unethical in my mind if the users of the network are not explicitly told in plain language that all of their web traffic will be monitored.