By Aengus Mulroney
Are you worried about organizations outside of Ryerson tracking and surveilling your Ryerson emails? A new study by University of Toronto researchers suggests you should be.
“Seeing through the Cloud” is the culmination of a year’s worth of research by four academics at the U of T. The researchers examined the ramifications of organizations such as universities outsourcing their e-communications and data storage to cloud-based services like Google and Microsoft Office 365.
The report says that all online communication and data stored in the cloud on a system like Google — which Ryerson uses for its communication infrastructure — can be, and probably are, read and tracked by government organizations in jurisdictions outside of Canada.
Ryerson moved over to the Google platform in October, 2012. The administration says that privacy was a top priority, and that no one has raised any privacy issues since.
“The motivation for the research was the prospect that the University of Toronto was going to outsource its faculty and staff email to Microsoft,” said Andrew Clement, professor emeritus in the Faculty of Information at U of T, and one of the study’s authors.
“I and a number of others were concerned about this and we didn’t feel like they had adequately considered the privacy issues, particularly in light of (Edward) Snowden.”
In 2013, when Snowden’s documents were leaked, it became clear that Microsoft had ties to the U.S. National Security Agency, Clement said. In those documents, the NSA claimed it had access to Microsoft’s and Google’s servers.
James Turk, distinguished visiting professor at Ryerson and director of the new Centre for Free Expression, said the study is directly relevant to the university community.
“(It) should send alarm bells to students and faculty because Ryerson is one of the handful of universities that have contracted out its email and e-communications to Google,” he said.
Both Clement and Turk believe cost is the main reason Ryerson and other universities outsource their communications to companies like Google.
“Universities are really strapped for cash, their funding per capita is going down and Ontario is one of the worst in the country,” Clement said. “So when they see that they can save a few million and they can do something for their students and faculty, it seems like a great bargain. But they need to think again. It’s going to come at a very high price.”
The study challenges the belief that Canadian and American privacy laws are similar enough that there is little to no cause for concern, the so-called “similar risk” assumption, presenting substantial legal evidence to the contrary.
The study closes by recommending that organizations avoid outsourcing e-communications until a there is a thorough investigation into privacy protections in other countries, and that those which have already outsourced should reconsider their practices.
Ryerson president Sheldon Levy said the university held meetings prior to adopting the Google platform and the issue of privacy was discussed extensively. He noted that the school sought the counsel of Ann Cavoukian, who was Ontario’s privacy commissioner at the time.
“The issue of protecting the privacy of individuals was top of mind when we chose Google,” he said.
“I can tell you I have not heard one issue arise since we moved over to Google as a platform,” he said. “It doesn’t mean they don’t exist, but I haven’t heard of it.”