Cybersecurity Privacy vs Academic Freedom Open Learning Competing

Cybersecurity & Privacy vs. Academic Freedom & Open Learning Competing Values in Higher Education Dr. Anita L. Allen, JD, Ph. D

Session Premise Colleges & universities face a unique new challenge: fostering academic freedom & open learning for faculty, students, and staff, while also deploying IT resources to protect campus networks, data, and individuals’ privacy rights. Question: Are cybersecurity & data privacy protection truly at odds with ideals of academic freedom and novel open learning initiatives?

At odds? If so, what has to give? Academic Freedom & Open Learning Cybersecurity & Data Privacy Protection

Mission-Critical Higher Ed Priorities Traditional Academic Freedom Open Learning Initiatives Cybersecurity & Privacy Protection

Working Definitions Mission. Critical Priorities Academic Freedom: age-old tradition whereby students and faculty assert, explore and debate ideas without censorship. Open learning: an emerging practice making educational resources available to public under liberal use policies – “courses, course materials, modules, textbooks, streaming videos, tests, software, and any other tools” -(www. hewlett. org/Programs/Education/OER/) Cyber/security: protection of data & networks through software, hardware and human practices that limit access, collection, use, disclosure of data. Privacy Protection: limited access to people and personal information.

Cybersecurity & Data Privacy Matter Decreased Cybersecurity and Data Protection… …Increased risk of data breaches, unauthorized access to private, confidential, sensitive, secret and proprietary data

Data breach negligence or mischief exposing data to unauthorized access Secrecy intentional concealment of data Sensitive data a community regards as meriting special protection from unauthorized disclosure Common Cybersecurity Concepts Confidentiality limiting data to authorized recipients Privacy Identity theft limited access to people and personal information Unauthorized use of misappropriated personal data Proprietary Owned or protected by copyright, trademark, patent etc.

Converging Capacities Six Spheres Sensitivity Data Privacy Protection Cybersecurity

Spheres of Data Sensitivity in Higher Ed 1. 2. 3. 4. 5. 6. Education information (FERPA+) • Transcripts • Applications • Disciplinary Health information (HIPAA+) Employment information • General personnel records, performance reviews • Confidential Faculty Promotion and Tenure Files Problems and Disputes • Grievance, Legal, Ombud and Counseling Identities • Religion, Race, Sexual Orientation, Emigration Status, Trans/Gender) Ideas • Research, Works in Progress • Classes, lectures and labs: Sites for open exchange of ideas • Proprietary Innovations

At Odds • Cybersecurity & data privacy are potentially and genuinely at odds with some student and faculty preferences and some open learning practices • • A philosophical problem A technical problem IT/CPO professionals Open Learning Proponents

An Inessential Tension • Interests in cybersecurity & privacy protections often converge with interests in traditional academic freedom around data regarding identity and ideas Identity and ideas Cybersecurity &Data Privacy Traditional Academic Freedom

Clash of Cultures: Framing the Problem: “It is important to understand how the …. perspective of security clashes with the information exchange culture of the education domain. The current focus of the security community on technical mechanisms to enforce and protect desired behaviours does not fit well within a learning environment…. [which] thrives upon a tradition of trust, information exchange and discussion. The security domain, in contrast, relies on a culture of distrust, restricted information flow and autocratic rules. It should also be noted that students do not respond well to the traditional authoritarian approach of many security departments. ” Anne Adams and Ann Blandford (2003)

IT/Security Issues With Open Learning User Authentication Passwords Payments Welcome Users Excluded Resources Not Reliability Available Integrity Problems Data Privacy/Confidentiality Multicultural Users

Strategies for IT/Privacy -Know your Institution’s Open Learning Goals -Invest in updated hardware/ software -Hire/train outstanding IT professionals -Manage wisely centralization issues on decentralized campuses -Say “no” only judiciously to popular or desired programs or capacities that pose a threat to security -Embrace open learning objectives/culture of your institution -Mind knowledge gap between IT and non IT staff -Boldly encourage individual responsibility for privacy(e. g. , use of anti-virus and password management software)

Principles and Best Practices -In higher education the tail cannot wag the dog: the most data secure campus in the world not worth it, if costs to academic freedom and innovative open learning experiments exceptionally high. Obey law, but remember core mission. -Higher ed employers have wide-ranging legal rights over conduct and data of employees (and students) but higher ed organizations stand uncritically on their rights to their detriment.

Thank you for participating in today’s session. We’re very interested in your feedback. Please take a minute to fill out the session evaluation found within the conference mobile app, or the online agenda.