Annalee Newitz
Don’t look now, but the dean is watching
Pressured by the double whammy of feds looking for terrorists and the music industry chasing file sharers, universities are keeping a close eye on student Internet use.
Last March, a protest against arms manufacturer Raytheon at the University of New Hampshire was derailed by campus administrators who had been covertly monitoring the e-mail list of a student group called the Peace and Justice League. According to UNH undergraduate Rob Wolfe, the group was making plans to protest Raytheon’s presence at a UNH job fair. Wolfe says that “there are no campus administrators on the [e-mail] list,” but somehow the vice president of student affairs managed to get a copy of a private e-mail about the protest.
“Raytheon canceled their appearance literally at the last minute,” he says. “It’s unclear whether this was connected to the e-mail leak, but it’s certainly atypical of Raytheon not to follow through on a campus appearance.” A spokesperson for Raytheon refused to comment on whether the company had canceled its appearance because of the protest, but did acknowledge that the company skipped the job fair and instead met individually with students who had made appointments.
The idea that university administrators are reading private e-mail might seem distinctly Big Brotherian, but the practice is increasingly commonplace. When students access the Internet via university equipment, everything they do — from sending e-mail and visiting Web sites, to sharing pictures and using certain kinds of software — is being watched.
Historically, computer network administrators have monitored student activity online for purely legitimate, technical reasons. Increasingly, however, pressure from government and industry is forcing university administrators to become digital spies. Fears of terrorism, combined with concerns about copyright violations, are creating a climate of campus surveillance.
At the University of California at Berkeley, the everyday Web-surfing habits of students are regularly watched and recorded. Berkeley’s Systems and Network Security group uses a program called BRO — named after the infamous fascist icon from George Orwell’s “1984″ — that keeps logs of every IP address students visit on the Internet from the campus network.
Cliff Frost, UC-Berkeley’s director of communication and network services, says that “this practice is under review right now,” because the campus community feels it interferes with academic freedom. He expects that the university will continue to keep logs but will discard them after a month or two. “I’d love to keep that data forever,” he adds, “if there weren’t the threats of subpoenas for vile purposes.”
He is referring partly to recent actions by the Recording Industry Association of America, which has subpoenaed universities for the names of students allegedly engaging in music piracy. Techs must comb through saved logs for personal information to fulfill the subpoenas’ demands. Some schools, including MIT, have refused to hand over the information by arguing that it is protected under the Family Educational Rights and Privacy Act. FERPA is designed to stop students’ personal data from being handed over to third parties, and no one has yet challenged the use of FERPA in these copyright cases.
But there is a little-discussed section of the USA-PATRIOT Act that renders FERPA completely useless when federal officials subpoena personal student information for terrorism-related investigations. Not only do these federal subpoenas bypass FERPA, but the people served are not permitted to discuss them with anybody.
“You can’t challenge [these subpoenas] because you can’t tell anyone you’ve received them,” says Lauren Gelman, an attorney with the Center for Internet and Society at Stanford. “At a university, one administrator can’t even tell another administrator about these subpoenas, so there is no way to know how many have gone out.” While university administrators want to comply with federal laws, many are wary of handing over private data in such a secretive manner.
And if the experiences of MIT computer network director Jeff Schiller are any indication, USA-PATRIOT Act subpoenas are being used on a regular basis to gather information about student online activity. “Things have definitely changed around here since 9/11,” Schiller says. “Nobody has come around with a blanket subpoena looking for e-mails sent by Muslims [on campus]. But we’d never seen subpoenas for information related to national security before, and now we do.” He couldn’t reveal how many of these subpoenas he’s received, but he did confirm that there has been a marked escalation in the electronic investigation of people at MIT “on terrorist grounds.”
The only way to defend student privacy against USA-PATRIOT subpoenas, says University of Michigan public policy professor Virginia Rezmierski, is for university IT departments to stop saving their logs. You can’t subpoena information that doesn’t exist. Rezmierski is the lead author of a 2001 National Science Foundation study of network monitoring and logging practices on college campuses.
“I don’t think this study made people very happy when it came out,” she says. “A lot of our findings were very disturbing.” She describes interviewing a college systems administrator for the study who told her that he had singled out one student and periodically logged everything he did on his computer “because [the student] was really competent with network operations and he seemed a suspicious type.”
She and her co-researchers also discovered that many schools routinely kept records of everything people did on campus networks. Worse, they saved this information without stripping personal identifiers out of it. “People don’t realize there are different levels of monitoring and logging,” Rezmierski says. “You can save logs in order to analyze them for technical and security purposes without saving personal information.” When schools must save logs, she emphasizes, it’s crucial that they remove any markers that connect their data to particular individuals.
She adds that if colleges don’t have policies regulating who has access to such logs, students are left vulnerable to censure by politically motivated administrators who deem certain students or student groups “suspicious” enough to monitor.
Perhaps most disturbing to critics and privacy advocates is the fact that schools are responding to subpoenas from the music recording industry with as much alacrity — and as many privacy-invading techniques — as they are to subpoenas related to national security. In their efforts to ferret out pirates, administrators are violating their own campus privacy policies, treating students who use P2P software the same way they would treat potential terrorists.
Earlier this year, administrators at Penn State decided to hunt down and punish students on the campus network who were using Direct Connect, a program that can be used to trade music files. Although Penn State promises students that their computer use won’t be monitored, administrators tracked down over 200 students using Direct Connect in April and shut down their campus network accounts. Contrary to its expressed policy, the school was retaining logs of network activity that could be traced to individual students.
Penn State’s vice provost of information technology, Russell Vaught, refused to say how the students had been identified, explaining only that his office had “acted within the law.” But undergraduate Mike O’Connor, director of technology affairs for Penn State’s undergraduate student government, showed me an e-mail he’d received from Vaught that acknowledged university techs had watched the online activities of students to find out which ones were using Direct Connect. Vaught’s office may not have broken the law, but O’Connor says that he and other students believe that “Penn State violated its own policy in using these methods.”
For a few months last year, the University of Wyoming used a program called AudibleMagic to look at the content of every piece of data traveling over the campus network suspected of containing copyrighted material. Administrators could gain access to any student’s private data if they suspected he or she might be pirating music. Lambasted in the press, administrators stopped using the program in May. Robert Aylward, the vice president of information technology at the university, says that it no longer uses AudibleMagic and has switched to a program called Packeteer, which tracks data flow on the network but doesn’t look at the content of that data.
However, an AudibleMagic rep says that other universities are adopting its technology.
There are countless products and services like AudibleMagic on the market, all enabling network administrators to place students under surveillance in the name of copyright protection, network monitoring and national security. On college campuses today, the question isn’t whether your computer activity is being watched; it’s who might use your private information against you.
Genome liberation
The information that details who we are is too important to be privately owned.
At Jim Kent’s Human Genome Browser Gateway, anyone curious about the fundamental building blocks of the human body can point and click their way through gigabytes of publicly available genetic data.
The vast data set is only about 90 percent complete, in contrast to the proprietary sequencing of the human genome already assembled by the biotech company Celera, but what is there is open to all — provided they have the biological chops to make sense of it. Users can click on pictures of chromosomes, drilling down into the data until they reach individual genes or areas of as-yet-unanalyzed sequences of nucleotides.
Continue Reading CloseSex with storm troopers
A journey to the heart of science fiction fandom reveals that selling out is a geek survival trait.
It’s 1 a.m. Saturday, Labor Day weekend. Slightly intoxicated, some friends and I wobble into the basement of the Atlanta Hyatt and find a roomful of big, soft chairs facing a small stage. About 10 people are in the room, some of them dressed like medieval peasants, most of them with guitars in their laps.
A man in the back of the room starts strumming his guitar. He’s the quintessential nerd: coke-bottle glasses, unstyled hair, a large belly. He sings a song about the days when giants walked the earth, when everyone was peculiar and it didn’t matter.
Continue Reading CloseOn-the-go porn
Cellphone pornography is set to be the next wave of adult techno-entertainment. Too bad its creators haven't learned from history.
Before live nude streaming video, before the daily deluge of “click here for hot chix” spam, before the so-called adult Web was ever a glimmer in a would-be pornographer’s eye, there was “ASCII pr0n.” Spelled “pr0n” instead of “porn” in a typically obscure hacker joke, it consists of erotic art composed of the most basic elements: the ASCII character set — not much more than the alphabet, numbers and assorted punctuation marks.
Newbies to the ASCII pr0n scene might be surprised to see what can be done with little more than a deftly placed comma and a whole bunch of ampersands. ASCII pr0n is a tribute to the time when bandwidth was limited on the Net, but creativity was high.
Continue Reading CloseBagels, no lox
A new Web site, HalfJew.com, plans to use the Internet to create a community for the partially Judaic.
Just months after the U.S. government included “mixed race” as a checkbox in the 2000 U.S. Census, two dot-com entrepreneurs are incorporating this newly-acknowledged identity into business plans. Monday, CEO Wendy Marston is launching HalfJew.com, a cross between a magazine and a community site that focuses on the experiences of people whose heritage is — what else? — half-Jewish. “I’m sick of hearing from Jews that there’s no such thing as a half-Jew,” quipped Marston, herself the child of a Jewish father and an Episcopalian mother. “One of the goals of this Web site will be to establish a half-Jewish homeland,” says Marston. “As CEO, I’ve decided it’s going to be Governor’s Island, off the coast of Manhattan. Nobody is using it, and we can have our mixers there! Mixers for the mixed.”
Continue Reading CloseImagining an orgasm
For mind-control erotica fans, reading about hypnotic states is the biggest turn-on.
The typical story goes something like this: A woman yearns for an erotic slave who will yield to her utterly. She accomplishes this by inventing a mind-control drug, or deploying powerful forms of hypnosis or, even more fantastically, by learning telepathy or magic or how to use an alien technology.
Armed with this knowledge, she happens upon a luscious, impressionable woman or man, looks deeply into their eyes and gradually gains control of her chosen one’s mind through whatever means are at her disposal. After a long, delicious period of mental seduction (often called induction), she forces her victim to desire sex so much that he or she can think of nothing else. The victim often winds up a brainwashed slut who lives only for pleasure, submission or humiliation.
Continue Reading ClosePage 1 of 2 in Annalee Newitz