Subject: Re: E-mail Private or not?

From: [email-masked] (Greg Johnson)
Date: Wed, 15 Mar 95 10:40:39 CST

Michael Blazek <[email-masked]> quotes a new OSU policy:
 
>Under Oklahoma law, all electronic mail messages are presumed to be
>public records and contain no right of privacy or confidentiality except
>where Oklahoma or Federal statutes expressly provide for such status.
 
Just a guess:  Many states have "sunshine" or "open meeting" laws that
require that meetings in state-funded institutions be open to the
public.  Exceptions are typically listed for personnel reviews, etc.
Some states have "Freedom of Information" laws that allow affected
citizens to obtain any transcripts of meetings on state property.
These laws might allow you to pop in on your college regents, your
state senators, etc., if they're meeting on state property or doing
state-related business.
 
I'd bet that a sunshine law has been construed to apply to email on
the Oklahoma State University computer systems.
 
If I were you, I'd politely enquire for the citation number of the
law(s) upon which this email policy is based.
 
Then use reductio ad absurdum.
 
I bet that the hypothesized sunshine law opens "state records" to
_everybody_, not just sysadmins.  You could as fairly request to see
OSU President Halligan's email, or the govenor's email, or the
sysadmin's email, as they to see yours.
 
But complete openness would interfere with University missions such as
submitting homework by email and taking contractor or vendor bids.  If
the law applies to OSU email, why not also to OSU campus mail too?
Why not to an instructor's answer sheet?
 
As a sysadmin and policy-formulator myself, I struggle reconciling
four things:  genuine needs for confidentiality; genuine needs for
mission-centered accountability;  sometimes vague laws and policies
that could not anticipate all nuances of developing technology;  and
screwy perceptions of entitlement by both users and service providers.
If OSU has clear policies on conserving resources, on protecting the
institution from civil & criminal liabilities such as piracy or
harassment via email, then these are probably sufficient bases for
precisely-regulated sysadmin access to email;  particularly if scans
are performed by programs or under search warrant, are normally reported
to those being scanned, and are generally not entrusted to any one
person's whims.
 
"Sunshine laws" do apply to some aspects of university life, but
mostly, as I read them, to opening administrative activities to
public scrutiny, not vice versa!
 
-Greg Johnson, Campus Computing, U of Missouri - Columbia