By Madelyn Stone, News Staff
The university’s policy on computer use may appear at the start of every student’s experience on the network, but even with the recent National Security Agency privacy scandal, it’s hardly at the front of students’ minds.
Clicking through the welcome page to access the NUwave Guest network implies an acceptance of the terms of use in Northeastern’s Appropriate Use Policy, as does accessing any university information system – NUwave, cable and printers included. The policy isn’t light reading, and for some students the stipulations it outlines are easily ignored.
“I’m not aware,” Lauren Burstein, a master’s candidate in finance, said when asked about the use policy. Others echoed the feeling.
But while an ignorance of the policies poses its own problems, reading through the document does little to provide an accurate understanding of university practices on monitoring and managing online activities. Sections of the use policy outline Northeastern’s sweeping rights to access and store any communications made by students, faculty, staff and guests on the network.
As part 23 states: “No user of University systems should have an expectation of privacy in their electronic communications. All electronic communications, files and content presented to and/or passed on the Northeastern network, including those to, from or through Internet connection(s), may be monitored, examined, saved, read, transcribed, stored or re-transmitted by an authorized employee or agent of the University, in its sole discretion, with or without prior notice to the user. The University reserves and intends to exercise the right to do so.”
Policies such as these don’t exactly make students feel comfortable. Andrew Flanagan, who is in his first year studying digital media in the College of Professional Studies, said he wasn’t aware the university had access to this range of communications.
“It seems like it might go a little bit further than probably is necessary,” he said. “I would expect them to monitor what websites you’re going to, but as far as actually reading stuff, being able to pull that stuff up – that seems a little bit more than than I’m comfortable with …. That makes me not want to use my personal device on the network.”
The rights the policy gives Northeastern may sound broad, but Director of Information Technology Security Mark Nardone was quick to clarify that the university does not regularly capture, examine or store students’ online activities.
“As a matter of course Northeastern doesn’t monitor network traffic at all for content,” he said. “The university does have the ability and the capability to capture all network traffic. Any network provider does. But we require appropriate legal documentation from appropriate sources to actually do that capturing part.”
What the university does monitor – bandwidth, malware and virus activity – it monitors in order to protect its network and devices. Nardone explained that despite the university’s stated right to save and store any content passing through the network, his department only keeps certain technical information, and only for a brief period of time.
“We preserve logs for up to 48 hours and that’s mainly just to be able to troubleshoot any incidents that might happen on the network … We keep 48 hours worth of information traffic logs but we don’t capture content at all.”
Only an explicit request for information in a subpoena from law enforcement or an internal judicial disciplinary case gives the university the authorization to look at internet traffic data, Nardone explained.
“So students should feel comfortable that their activity on the network, for the most part, is not monitored,” he said.
Such limitations may be in place, but the policy descriptions leave something to be desired in terms of explaining where the checks begin and end. Interpreting the policy at face value, some students feel the extent of these capabilities encroaches on their own rights.
“I didn’t know this, actually,” Guillermo Martinez-Cubells, a sophomore finance major, said after reading through the “Right of University to Monitor Content” section of the document. “I don’t agree though. I mean I have agreed with it, obviously, because I signed the contract with the university. But ‘No user of university systems should have an expectation of privacy in their electronic communications’ – that’s like basically violating your freedom of speech.”
Students aren’t the only ones expressing a bit of dismay at the sweeping rights the policy appears to give the university. Khaliah Barnes, administrative law counsel at the public interest research non-profit Electronic Privacy Information Center, said the descriptions lacked clarity.
“That’s not a good policy,” she said. “That’s incredibly broad … The way in which it’s written, it almost strips students of many privacy rights that they would have in communications across university systems.”
Nordone said the information services department intentionally words the policy broadly.
“That’s basically how the policy was written – to make people aware that [monitoring content] is a possibility but that it’s the exception rather than the rule of what happens on the network,” he said. “I know it does seem like a very broad and sweeping statement, but that’s true across any ISP [internet service provider] … The ISP is required through these various statutes and laws to have the ability to allow law enforcement to capture and monitor.”
Considering that the university’s access to online activity falls within tighter limits than the use policy seems to suggest, students feel there’s room for improvement in the explanations.
Burstein said that while she lives off campus and rarely uses the Northeastern network, the policy’s wording made her feel a bit nervous.
“I feel like I’m not really sure what’s going on here,” she said. “I think it should be more clear, definitely.”
