All of the presentations are at:
http://www.stonesoup.org/Meeting.next/
Talking about email, primarily for students.
Why do we want to talk about this? Save and re-purpose money and other resources.
Why are the corporate players motivvated?
Targeting email accounts for life – a highly valued demographic.
Decision points –
Opportunity and real costs; client-driven service model; Identity management; security and privacy; functionality, features, and services.
Dennis notes that their internal auditor says that this evolution is inevitable.
Jim Jokl – UVa – They’ve been working on this for a while. They’re migrating student mail to commercial providers – two choices available – Google Apps for Education and Windows Live@edu
http://www.itc.virginia.edu/email/student.html
Their current environment is IMAP with WebMail and POP, and 2 GB quotas and IronPort anti-spam, 50MB max message size, Oracle cal licensed for all students, with a small percentage of off-site forwards (single digits, though was increasing slowly).
Some reactions to the announcement – “Rarely is a decision by the University met with near universal praise. The decision to outsource student e-mail accounts to Google and Microsoft might be the exception.” Students don’t seem to be worried about privacy issues. Most of the reaction was overwhelmingly positive.
The single best thing people will get is a seamless transition from student to alumni. They’re doing single-sign-on integration.
White-list control to enable guaranteed delivery of messages to/from students.
The state of current migration tools aren’t as good as you want, but they’re coming along quickly.
They’re doing single-sign-on – using pubcookie. SOAP-based interface to WindowsLive, SAML to Google, using Google’s java app.
USC has been testing Google with Shib 2.0.
They’ll use the same third-level domain name for both Google and Microsoft, as all their mail routing is done at their LDAP directory.
Steve Worona is talking about legal and policy issues with outsourced email
Common issues that come up – FERPA and E-Discovery (the latter more in the context of faculty and staff).
FERPA background –
1974, aka the “Buckley Ammendment”
Limits what you can do with “education records” that you “maintain”
FUD says don’t tell anyone anything, but there’s been a huge change as a result of the VaTech shootings. There will be Educause Live! events on FERPA on Oct 17 and Nov 5.
What’s an “education record”? Anything that can identify a student. A piece of email, e.g.
What’s “Maintain”? Maintained by the institution. There are lots of nuances.
FERPA is administered by a unit within the Dept. of Education called FPCO, run by Leroy Rooker. THeir interpretation is a lot of the actual law, embodied in letters written to campuses. The penalty for FERPA violation is complete loss of student funding, but that’s never been applied. In practice, Leroy sends letters telling people to stop what they’re doing. Gonzaga v. Doe (2002) holds that there is no private right of action for FERPA violation – only the FPCO can bring FERPA actions.
State privacy laws can be more restrictive than FERPA.
FERPA and Outsourcing –
Do you want student mail to be a maintained education record, protected by FERPA? If the mail’s not in the control of the university, then it’s not maintained, so it’s not FERPA protected.
Mail as a vehicle for FERPA-protected data.
What FPCO really says – “protect education records in ways that are reasonable and appropriate to the circumstances in which the information or records are maintained.”
E-Discovery –
New federal rules as of late 2006. Document, enforce, formalize maintenance and backup standards. Know where your corporate data is, prepare for “litigation hold”. Case law and refinements eagerly awaited. Attorneys think law will be refined over time, but there’s a lot of angst and energy being spent right now.
You should figure out your business practices first. Then – treat outsourcing in the context of “agency” – a well-established legal concept of contracted terms of relationships and responsibilities.
It may be that you want the student email provider to not be your agent, but the fac/staff provider to be your agent – there are some issues to explore.
Bruce explores the survey results –
Clemson is offering Google Apps for students as of last week. USC for Spring 08 will get to use Google.
Technorati Tags: CSG-Fall-2007, email, outsourcing
Oren Sreebny 