E-mail outsourcing to U.S. stokes spying worry for Canadian professors, students

November 17, 2013

Leading Canadian universities are outsourcing their e-mail storage and transmission to American-based companies like Microsoft and Google, leaving professors and students anxious that U.S. intelligence services could gain access to private information.

The University of Toronto is currently debating whether to switch faculty e-mail and other online tools to Microsoft's Office 365, which is offered free to universities. It would host their communications on U.S.-based "cloud" servers just like those that Edward Snowden, the former intelligence contractor turned whistleblower, says the U.S. National Security Agency has been mining.

Other institutions, including the University of Alberta and Dalhousie University, have already made the switch to Google and Microsoft. School officials say those companies' systems offer cutting-edge collaborative features with stronger security, while saving universities millions of dollars as they no longer have to host banks of servers in-house. But the move has left some professors and students worried that conversations, controversial views, and even research results will be left exposed to prying eyes, compromising not just privacy but also competitiveness.

"Just at the time when attention is being brought to this issue, here's my university wanting to hand my e-mail over to Microsoft and, potentially, hand it over to the NSA," said Andrew Clement, a professor in the U of T's faculty of information, who has studied the NSA and internet traffic for years. "Because as a non-U.S. person, there are no legal protections in the U.S. against access to Canadians' data."

American privacy laws do not apply to foreign citizens' communications, and new disclosures have heightened fears about moving data abroad. According to The Guardian newspaper, the NSA has operated a program dubbed Prism, which lets spies collect the contents of e-mails, file transfers and live chats directly from servers owned by companies like Google, and to target any customers or companies based outside the U.S. Google and Microsoft have said they only disclose data to the government when legally required to.

Part of the issue is that "e-mail is fundamentally an insecure medium," said Robert Cook, chief information officer at the U of T, which is "very actively pursuing" options to add new encryption technology designed to make e-mail at least somewhat less vulnerable.

But even encryption has flaws, Dr. Clement said, and a professor's privacy and intellectual property could still be accessed. He also points to recent reports of industrial espionage carried out by Canada and Brazil's intelligence agencies as "a threat for particular kinds of research."

So far, some Canadian universities are willing to take the risk, as are powerhouse schools abroad like the University of Cambridge, which moved e-mail to Google. Until recently, the U of T was hosting some 400,000 e-mail accounts on an antiquated system, but has since moved 135,000 student accounts to Microsoft's cloud, saving at least $1-million annually. At issue now is whether to switch faculty and staff e-mail, calendaring and file sharing as well, which prompted Dr. Clement and some of his colleagues to hold a teach-in on the issue this past weekend.

Dalhousie just finished its migration to Microsoft's free service this week, ditching an aging system that "nobody liked" after calculating that building a modern in-house system would cost "$2-million just to get in the game," said chief information officer Dwight Fischer.

The Canadian Association of University Teachers opposes storing schools' information on foreign servers. And faculty at Lakehead University launched a grievance against moving school e-mail to Google in 2007, which failed at arbitration. At Dalhousie, the reaction has been mixed. "Some people are saying, you can't get here quick enough, thank God we've got some modern tools," Mr. Fischer said. "Others are saying it's the end of the world."

Students are also divided. Many aren't concerned, but At the University of Ottawa, which made using Google-hosted e-mail optional for students, 40,000 have opted in and only 2,500 steered clear. the University of Toronto Students' Union opposed the U of T's shift to Microsoft, and continues to argue "that we should be moving back to Canadian servers," said president Munib Sajjad.

In B.C., where privacy laws bar personal information held by public institutions from living on foreign servers, the University of British Columbia is building its own cloud-based e-mail system, with plans to share it with other schools in the province, and perhaps more widely.

At the same time, many more Canadian universities must choose whether to embrace free, ready-made solutions from the world's tech giants, even as worries about privacy linger.

"When a university like U of T goes one way or the other, it will probably have some influence on others," Dr. Clement said.

(Ads will not print)