UC Davis Halts Gmail Pilot for Faculty, Staff

After conducting a pilot with Google to outsource faculty and staff e-mail, the University of California at Davis decided not  to continue because of privacy concerns.

The technology for Gmail and Google Apps is great, and the university uses it for students currently, said Peter Siegel, the university's chief information officer and vice provost for Information and Educational Technology. But during the 8-week pilot that started in March, faculty members said they were worried that their research information could become public if the company mines it or stores it in other countries.

Google says it just mines data to improve searches, which is a good thing, Siegel said. But the contracts don't keep up with the verbal commitment.

“We really want what Google promises to the community to be consistent with what they state in writing," Siegel said.  “So I think there was a sense that, well, it doesn't  really say clearly that they're going to protect this information the way we need it to be protected."

About a month ago, Yale decided to delay switching to Gmail so that it could consider more carefully the technological risks and security implications of storing data in the cloud. And on April 19, data protection authorities in 10 countries wrote a letter to Chief Executive Officer Eric Schmidt saying they were concerned about the privacy problems with the launch of Google Buzz and Google Street View.

While neither of these services are currently included in Google Apps for Education, Siegel said if privacy issues came up in those services, they might come up in other apps.

When Google Buzz does become available for educators, it will be optional, said Jeff Keltner, a business development manager at the company. Google didn't include Buzz in the package initially because it wanted to work with customers first to understand what kinds of controls and protections they need.

If Google placed as much effort into protecting the privacy of users as it does in protecting itself, many people may change their minds about sticking with a central campus e-mail service, Siegel said. He would like to see the company express in its contract that it will not use the data in Gmail secondarily and will store it in a place that will be kept as private as possible.

But eliminating secondary uses could be tough to do without disabling the types of things that users want from Google, Keltner said. For example, he had a package coming to him this morning, and Gmail provided a link to track that package after identifying that a tracking number came through his e-mail.

The company provides additional services to users, but does not sell information to third parties. In a letter to UC Davis faculty and staff on April 30, Siegel and committee chairs Niels Jensen and Joe Kiskis said they were concerned that outsourcing e-mail might not comply with the University of California Electronic Communications Policy.

"The policy states that the university 'does not examine or disclose electronic communications records without the holders consent' and that 'in no case shall electronic communications that contain personally identifiable information about individuals be sold or distributed to third parties without the explicit permission of the individual,'" the letter states. "Though there are different interpretations of these sections, the mere emergence of significant disagreement on these points undermines confidence in whether adopting Google's Gmail service woudl be consistent with the policy."

When third parties request data, Google's education contract specifically say that it will notify schools before disclosing data to third parties if they're legally permitted to do so, Keltner said. Google has worked with many schools to make the contract clear and protective, and if UC Davis requests specific changes to the contract, the company will listen, Keltner said. 

“We’re always willing to take input from schools and discuss and see if we can refine a contractual language to more adequately address any concerns that they may have,” he said. “We really think that the contractual protections are very strong; we’ve worked with many schools to refine those protections in the legal language, and we think that they really do address the needs of institutions.”

In the meantime, UC Davis will look for a more flexible and effective central e-mail system than Cyrus, which faculty and staff currently use. The university also will reconsider whether graduate students will continue using Gmail along with undergraduate students.

But UC Davis is bucking a trend. Oregon just became the first state to bring Google Apps to its public schools, and more than 7 million users log into Google's education services. Also, a 2009 survey of 500 senior campus IT officers from the Campus Computing Project shows that many schools are outsourcing their e-mail, with more than 50 percent of public research universities and more than 60 percent of private research universities choosing Google as their e-mail provider.

Keltner noted that these Campus Computing statistics clearly show a major trend that schools are moving this way. "And I think the idea of moving in the opposite direction is somewhat out of the norm today," he said. "It really does not represent what we’re seeing generally in the higher ed market.”