Former DHS Boss Puts University Of California Employees Under Secret Surveillance

Privacy

from the you-didn't-see-anything-so-you'd-better-not-say-anything dept

Former DHS boss Janet Napolitano — who once stated she “doesn’t use email” (for many reasons, but mainly to dodge accountability) — is now showing her underlings at the University of California why they, too, might not want to “use email”: someone might be reading them over their shoulders.

UC professor Christopher Newfield has the inside details of the recently-exposed monitoring system secretly deployed by the University of California (and approved by school president Napolitano) to keep tabs on the communications, web surfing and file routing of its employees. The SF Chronicle has an article on the secretly-installed spyware behind its paysieve [try this link], but Newfield has the internal communications.

The installation of the third-party monitoring software was so secretive that even the university’s campus information technology committee was forbidden from discussing it with other staff. The committee has now decided to go public.

UCOP would like these facts to remain secret. However, the tenured faculty on the JCCIT are in agreement that continued silence on our part would make us complicit in what we view as a serious violation of shared governance and a serious threat to the academic freedoms that the Berkeley campus has long cherished.

Some salient facts:

– The UCOP had this hardware installed last summer.

– They did so over the objections of our campus IT and security experts.

– For many months UCOP required that our IT staff keep these facts secret from faculty and others on the Berkeley campus.

– The intrusive hardware is not under the control of local IT staff–it sends data on network activity to UCOP and to the vendor. Of what these data consists we do not know.

– The intrusive device is capable of capturing and analyzing all network traffic to and from the Berkeley campus, and has enough local storage to save over 30 days of *all* this data (“full packet capture”). This can be presumed to include your email, all the websites you visit, all the data you receive from off campus or data you send off campus.

The official excuse for the installation of intrusive spyware is “advanced persistent threats” possibly related to a cyberattack on the UCLA Medical Center last summer. How monitoring staff emails plays into the thwarting of “threats” hasn’t been explained. Now that the secret’s out, the university is claiming it’s all good because policies prevent the university from using any intercepted information/communications for “nonsecurity purposes.”

The university may have a policy forbidding this activity, but that’s not really the same thing as guaranteeing abuse of this surveillance will never happen. Its belated not-an-apology offers no contrition for keeping this a secret from a majority of its staff. And the statement does not name the third party in charge of the collection and monitoring.

While it certainly isn’t unusual for employers to monitor employees’ use of company computers and devices, it’s normally clearly stated in policy manuals, rather than installed surreptitiously and cloaked in deep secrecy.

As Newfield points out, no one was apprised of the monitoring until after it was underway. Some heard a few weeks after the monitoring was put in place (August of last year) when the university updated its security policies following the medical center breach. Many more heard nothing until the first week of December. Following the wider exposure, staffers were assured by the school’s vice president that the monitoring would cease and the software would be removed.

The VP said one thing and the school did another.

On Jan. 12, 2016, The Berkeley Joint Committee on Campus Information Technology (JCCIT) met with Larry Conrad and others. The committee was informed that contrary to the Dec. 21, 2015 statements, UCOP had decided to continue the outside monitoring and not disclose any aspects of it to students or faculty.

At this point, the decision was made to go public. A letter was drafted and sent to school administration. It was also sent to the New York Times. This prompted the generation of bullshit from the Executive VP’s office.

On Jan. 19, 2016, UCOP Exec. VP and COO Rachael Nava sent a letter to those who signed the Jan. 15, 2016 letter. The original version was marked “CONFIDENTIAL: DO NOT DISTRIBUTE” and invoked “Attorney-Client privilege”. After several recipients responded to her via email questioning who is the client and why her letter must be kept secret, a revised version of the letter was sent the next day removing that language, stating: “All: Please accept my apologies with regard to the confusion on the attorney client privilege language on the letter. It was a clerical error and was not intentional. Please find a revised version of the letter with the language removed.”

The full letter contains some truly incredible statements.

With respect to privacy, the letter and structure of the University’s Electronic Communications Policy (ECP) reflect the principle that privacy perishes in the absence of security. While the ECP establishes an expectation of privacy in an individual’s electronic communications transmitted using University systems, it tempers this expectation with the recognition that privacy requires a reasonable level of security to protect sensitive data from unauthorized access.

Privacy does not “perish” in the absence of security. This conflation of the two is ridiculous. If a malicious party accesses private communications, that’s a security issue. If an employer accesses these communications, that a privacy issue. Claiming to value privacy while secretly installing monitoring software (and then lying about removing said software) only serves to show the university cares for neither. By adding a third party to the monitoring process, the university has diminished the privacy protections of its staff and added an attack vector for “advanced persistent threats.” It has effectively harmed both privacy and security and, yet, still hopes to claim it was necessary to sacrifice one for the other.

The other statement, tucked away as a footnote, absurdly and obnoxiously claims the real threat to privacy isn’t the school, but people making public records requests.

Public Records Act requesters may seek far more intrusive access to the content of faculty or staff records than what the ECP permits for network security monitoring. The limits on the University’s own access to electronic communications under the ECP do not apply to Public Records Act requests.

Meanwhile, the school’s tech committee has pointed out its IT staff is more than capable of handling the privacy and security of the network and, quite obviously, would show more respect for their colleagues’ privacy while handling both ends of the privacy/security equation.

It’s perfectly acceptable for entities to monitor employees’ use of communications equipment. But you can’t do it this way. You can’t install the software secretly, swear certain employees to secrecy, not tell anyone else until the secret is out in the open, promise to roll it back and then secretly decide to do the opposite, etc. And when challenged, you can’t play fast and loose with “security” and “privacy” as if they were both the same word spelled two different ways.

[Update: a TD reader has given us a copy of Janet Napolitano’s response to the outcry over the school’s secret surveillance efforts. A new post on that letter is on the way. If you’d like a head start, it’s embedded below.]

Filed Under: deep packet inspection, dhs, janet napolitano, surveillance
Companies: university of california