A California research university has decided to discontinue a pilot of Google Gmail for faculty and staff e-mail because of privacy concerns about the company's popular online e-mail service.
Students attending University of California, Davis (UC Davis), will continue using Gmail and Google Apps, said Peter Siegel, the university's CIO and vice provost for Information and Educational Technology. But during the eight-week pilot that started in March, faculty members said they were worried that their research information could become public if the company mines or stores it in other countries.
Google says it mines data only to improve searches, but Siegel said the contracts don't keep up with the verbal commitment.
"We really want what Google promises to the community to be consistent with what they state in writing," Siegel said. "So I think there was a sense that it doesn't really say clearly that they're going to protect this information the way we need it to be protected."
About a month ago, Yale University decided to delay switching to Gmail so that it could consider more carefully the technological risks and security implications of storing data in the cloud. And on April 19, data protection authorities in 10 countries wrote a letter to Google CEO Eric Schmidt saying they were concerned about the privacy problems with the launch of social networking app Google Buzz and Google Street View.
While neither of these services is currently included in Google Apps Education Edition, Siegel said if privacy issues arose in those services, they might come up in other apps.
When Google Buzz does become available for educators, it will be optional, said Jeff Keltner, a business development and product marketing manager at the company. Google didn't include Buzz in the package initially because the company wanted to work with customers first to understand what kinds of controls and protections they need.
Siegel said that if Google placed as much effort into protecting user privacy as it does in protecting itself, many people may change their minds about sticking with a central campus e-mail service. He would like to see the company express in its contract that it will not use the data in Gmail secondarily and will store it in a place that will be kept as private as possible.
But eliminating secondary uses could be tough to do without disabling the types of things that users want from Google, Keltner said. For example, he had a package coming to him this morning, and Gmail provided a link to track that package after identifying that a tracking number came through his e-mail.
The company provides additional services to users, but does not sell information to third parties. In a letter to UC Davis faculty and staff on April 30, Siegel and committee chairs Niels Jensen and Joe Kiskis said they were concerned that outsourcing e-mail might not comply with the University of California Electronic Communications Policy.
"The policy states that the university 'does not examine or disclose electronic communications records without the holder's consent' and that 'in no case shall electronic communications that contain personally identifiable information about individuals be sold or distributed to third parties without the explicit permission of the individual,'" the letter states. "Though there are different interpretations of these sections, the mere emergence of significant disagreement on these points undermines confidence in whether adopting Google's Gmail service would be consistent with the policy."
When third parties request data, Google's education contract specifically says that it will notify schools before disclosing data to third
parties if they're legally permitted to do so, Keltner said. Google has worked with many schools to make the contract clear and protective, Keltner said, and if UC Davis requests specific changes to the contract, the company will listen.
"We're always willing to take input from schools and discuss and see if we can refine a contractual language to more adequately address any concerns that they may have," he said. "We really think that the contractual protections are very strong; we've worked with many schools to refine those protections in the legal language, and we think that they really do address the needs of institutions."
In the meantime, UC Davis will look for a more flexible and effective central e-mail system than Cyrus, which faculty and staff currently use. The university also will reconsider whether graduate students will continue using Gmail along with undergraduate students.
By pulling the plug on Gmail, UC Davis is bucking a trend. Oregon recently became the first state to bring Google Apps to its public schools, and more than 7 million users log into Google's education services. Also, a 2009 survey of 500 senior campus IT officers from the Campus Computing Project shows that many schools are outsourcing their e-mail, with more than 50 percent of public research universities and more than 60 percent of private research universities choosing Google as their e-mail provider. And a few big cities have adopted or are in the process of adopting Google Apps for the enterprise, including Orlando, Fla., and Los Angeles.
Keltner noted that the Campus Computing Project statistics clearly show that schools are moving toward cloud computing. "And I think the idea of moving in the opposite direction is somewhat out of the norm today," he said. "It really does not represent what we're seeing generally in the higher-ed market."