The implications for all of us are clear: never assume your email is private. And if you care, take measures to protect yourself
The campus of Harvard
University, which has been shaken by revelations of a secret search of
deans' email. Photograph: Eamonn McCabe for the Guardian
According to Harvard University, email subject lines are not "content". This remarkable claim comes in a university statement, sardonically called a "partial apology" by the Boston Globe, attempting to explain why Harvard semi-searched email accounts of 16 "resident deans" to find out who'd leaked information about a student cheating scandal to the press.
The statement attempted to put to rest a mini-uproar set off by the Globe's initial report on the leaker probe methods. In attempting to explain what had happened, and to assure the Harvard community that people's emails weren't being scanned wholesale, the statement answered some questions but only provoked others.
Most of all, the entire episode highlighted several realities in today's working world: notably, the folly of using an employer's email system for any purpose that might ever prove controversial.
I won't even attempt to sort out the Harvard explanation; it's too convoluted. But I do want to point to the bizarre assertion mentioned at the top of this piece. The statement says, in part:
I take for granted that Harvard, like all employers, has a right to look at pretty much anything it pleases on the machines that are part of its network, and I'd put administrative email accounts, as these were, fairly high on the list. That doesn't mean Harvard is necessarily doing the right thing, or that any employer exercising its internal snooping rights, except in the rarest of circumstances, is being honorable with its employees.
It does mean that employees should always assume that their employers' networks are under surveillance, at least internally.
This is why I tend to believe another assertion in the Harvard statement, that the leak was inadvertent, "not an intentional breach". Even the most ivy-covered professors surely know by now that the last email account and network to use for a leak to the press should be the one he or she uses inside the institution itself.
The Harvard matter comes at a time when leaks and the threats to leakers – to all people who want to communicate securely, for whatever reason – have begun to reach critical mass in public attention.
Governments are leading the charge in asserting that nothing we say and do online is safe: the Obama administration has prosecuted leakers with a vengeance. Dictatorships facing rebellion are using every electronic trick in the book to spy on their dissidents. American ISPs, carrying water for the copyright cartel, now spy on what we do online.
It's not just employees and others who want to blow whistles who need to be more careful – such as using external accounts, encryption and a lot of other tools to be safer. (Note: I didn't say "safe", because absolute safety is exceedingly hard to achieve, if it's even possible.)
Journalists, too, need better tradecraft when it comes to their dealings with sources. My impression of the typical newsroom's precautions is that there aren't many.
The Harvard controversy could serve a useful purpose if it alerts people everywhere to some facts of modern life, including these top two. No 1: your employer can and may well spy on you. No 2: look for safer ways to communicate, because, someday, you may need them.
• Disclosure notice: the author is an unpaid faculty associate, and a former fellow, at the Harvard Berkman Center for Internet and Society
The statement attempted to put to rest a mini-uproar set off by the Globe's initial report on the leaker probe methods. In attempting to explain what had happened, and to assure the Harvard community that people's emails weren't being scanned wholesale, the statement answered some questions but only provoked others.
Most of all, the entire episode highlighted several realities in today's working world: notably, the folly of using an employer's email system for any purpose that might ever prove controversial.
I won't even attempt to sort out the Harvard explanation; it's too convoluted. But I do want to point to the bizarre assertion mentioned at the top of this piece. The statement says, in part:
"The search did not involve a review of email content; it was limited to a search of the subject line of the email that had been inappropriately forwarded. To be clear: no one's emails were opened and the contents of no one's emails were searched by human or machine."I have news for the deans under whose names this statement appeared. Like most people who send email, I try hard to make the subject line relevant enough that the recipient will be inclined to open the missive and read it. Other highly relevant material in my email includes the name of the person I'm sending it to; the date; the time; the internet address of the machine I'm using; and the network I'm sending from. None of those is the message itself, but they are "content" in every way that matters. That data form the basis for all kinds of inferences and knowledge about me.
I take for granted that Harvard, like all employers, has a right to look at pretty much anything it pleases on the machines that are part of its network, and I'd put administrative email accounts, as these were, fairly high on the list. That doesn't mean Harvard is necessarily doing the right thing, or that any employer exercising its internal snooping rights, except in the rarest of circumstances, is being honorable with its employees.
It does mean that employees should always assume that their employers' networks are under surveillance, at least internally.
This is why I tend to believe another assertion in the Harvard statement, that the leak was inadvertent, "not an intentional breach". Even the most ivy-covered professors surely know by now that the last email account and network to use for a leak to the press should be the one he or she uses inside the institution itself.
The Harvard matter comes at a time when leaks and the threats to leakers – to all people who want to communicate securely, for whatever reason – have begun to reach critical mass in public attention.
Governments are leading the charge in asserting that nothing we say and do online is safe: the Obama administration has prosecuted leakers with a vengeance. Dictatorships facing rebellion are using every electronic trick in the book to spy on their dissidents. American ISPs, carrying water for the copyright cartel, now spy on what we do online.
It's not just employees and others who want to blow whistles who need to be more careful – such as using external accounts, encryption and a lot of other tools to be safer. (Note: I didn't say "safe", because absolute safety is exceedingly hard to achieve, if it's even possible.)
Journalists, too, need better tradecraft when it comes to their dealings with sources. My impression of the typical newsroom's precautions is that there aren't many.
The Harvard controversy could serve a useful purpose if it alerts people everywhere to some facts of modern life, including these top two. No 1: your employer can and may well spy on you. No 2: look for safer ways to communicate, because, someday, you may need them.
• Disclosure notice: the author is an unpaid faculty associate, and a former fellow, at the Harvard Berkman Center for Internet and Society
No comments:
Post a Comment