Google Outsourcing: General Issues Raised by ITAC-DI
1. “Students only” vs. “All UF,” including employees: if students only, then how to
handle employees displaced from GatorLink mail. If employees too, as proposed,
then what specifically are the concerns?
Given the fact that:
so many students are also employees
so many employees also take classes
so many individuals frequently switch back and forth between ‚student‛ status and
‚employee‛ status
…
and Google suspends or terminates use of the Service by a majority of its similarly situated
customers;…
Change 30day to 12 months.
OK
8. Do we own the data or does Google?
Many questions revolve around issues of privacy, and ownership of information. General
guidance can be found in section 8 of the Google Apps for Education contract, headed
"Ownership; Restricted Use" (excerpt below).
"...Google does not own Customer Content, or any End User or third-party content
and/or information used as a part of the Service, including the content of communications
8/13
appearing on the Service. ... Google will not acquire any right, title, or interest to
Customer Content, except for any limited use rights expressly set forth in the Agreement.
Any rights not expressly granted herein are deemed withheld. "Intellectual Property
Rights" means any and all rights existing from time to time under patent law, copyright
law, semiconductor chip protection law, moral rights law, trade secret law, trademark
law, unfair competition law, publicity rights law, privacy rights law, and any and all
other proprietary rights, and any and all applications, renewals, extensions and
restorations thereof, now or hereafter in force and effect worldwide. For the avoidance of
doubt, Google does not own third party content contained in or provided as part of the
Service, including any Additional Content."
The above is excerpted from the standard "Google Apps Education Edition Agreement".
[http://www.google.com/a/help/intl/en/admins/education_terms.html]
[NOTE: the version of the agreement/contract submitted by Google to UF, and under review at
UF, differs slightly from the on-line version in some wording. The wording quoted in this
document is from the version sent directly from Google to UF.]
It was asked whether Google owns the data when a student graduates. In effect Google is
saying regardless of the status of the user that they don’t own the data even if they don’t know
who owns the data.
OK
9. At what times are emails encrypted?
UF plans to use a bi-directional mail gateway – i.e., all mail, both inbound and outbound will be
routed through the gateway. Inbound mail will be encrypted at the UF inbound gateway before
being forwarded to Google; it will be decrypted within the Google system prior to delivery to
user mailboxes. Outbound mail from Google will be encrypted within the Google system before
being forwarded to the UF outbound gateway. Outbound mail will be decrypted at the UF
outbound gateway prior to being routed to its destination.
OK
10. Will Google sell email lists after students graduate?
No. Section 2 of the UF/Google contract, headed "Services" contains the following provision:
"Except as provided for under this Agreement, Google shall neither contact the End Users directly
through email, nor permit any third party to contact the End Users directly by email for advertising
purposes."
9/13
Note that users of the UF/Google service continue to be ‚End Users‛ even after they graduate.
OK
11. How will Google know when students become alumni?
UF is required to notify Google periodically regarding changes in students’ status. Specifically,
‚Section 2. Services‛ of the contract contains the following language:
“Customer agrees that Google may serve advertisements (“Ads”) in connection with the Service to End
Users who are not designated by Customer as Students, Staff, or Volunteers. Google agrees that
Customer may disable Ads for End Users who are Students, Staff or Volunteers. Customer will update
the status of its End Users on a regular basis but no less frequently than twice yearly.”
To be determined but it can and will be done.
OK
12. How will service accounts (e.g., webmaster@ufl.edu) be affected?
At this time we envision ‚service accounts‛ being migrated to the central UF Exchange system,
which provides the capability for creating, managing, and using such accounts.
Administrative accounts can be accommodated in Exchange.
13.OK Will retention policies of staff emails be a problem?
No more, nor less so than it is with the current service. UF Administrators will have the ability
to take a ‚snapshot‛ of the contents of any account at any point in time (just as they do now).
We will implement the UF policy once it is determined.
OK
14. Will staff be restricted from using the UF Google email service?
Depending on University policy, it is possible that certain units (colleges, departments, etc.)
might be allowed to prohibit use of the UF Google email service by staff as a matter of unit
policy. Those units will need to make other provisions (such as UF Exchange, or
departmentally-owned servers) for such staff.
We don’t Know.
Possible recommendation.
10/13
15.What happens when users approach or go over the email storage quota?
Messages to an over-quota mailbox will be bounced back to the sender, with the message:
‚'User over quota”.
http://mail.google.com/support/bin/answer.py?hl=en&answer=82457#OverQuota
OK
16. Will GatorLink accounts expire?
That is a policy decision which is properly within the scope of inquiry for ITAC-DI. It is our
understanding that, as a result of recent a recent addition of a ‚self-renewal‛ relationship within
the UF directory, it is now technically feasible to offer ‚Service for Life‛ if so desired.
We need to recommend how GatorLink accounts will be managed in the future and how it
would relate to Gmail. Need a user agreement for email for like.
OK
17. What will happen to @ufl.edu email addresses that are published?
They will continue to function; mail addressed to username@ufl.edu may be forwarded to
the Google system, UF Exchange, or any other system permitted by administrative policy,
including, but not limited to, AOL, HOTMAIL, YAHOO, BELLSOUTH, COX, and others.
UF can forward mail like we do now.
UF policies relative to email forwarding of UFl.EDU need to be addressed in this area.
This has no bearing on the decision to use or not use Gmail.
18. How many minutes will pass before emergency emails are delivered in
disaster situations?
That is a question which can only be answered by testing.
Likely not a problem but it could be depending on the length of time it takes but this could be
an issue for any outsourced product.
19. How will LISTSERVs be handled?
Exactly as they are now; the E-mail outsourcing proposal has no affect or impact on UF’s
existing LISTSERV service.
There is additional work that will have to be done but this does not appear to be a big issue.
11/13
OK
20. Will the Gmail application for reading email on cell phone work for the
UF Google mail?
No. An attempt to do this yielded the following message: ‚This application only works with
gmail.com email addresses. To access your gtest.cns.ufl.edu email, go to
http://mail.google.com/a/gtest.cns.ufl.edu‛. In addition, the ‚Gmail for mobile Application‛ does
not have the ability to redirect authentication to UF’s Shibboleth servers, so users cannot
authenticate via that mechanism.
However, users can access UF/Google mail via cell phone using their phone’s web browser.
OK
21. How will spam be handled?
Google’s standard spam (and virus) filters will be active on the UF/Google e-mail system. UF's
spam scoring and virus protection will be invoked when mail crosses the UF Gateway.
However, the current method of embedding the spam score within mail headers is not testable
by Google's end user filters.
OK
22. Will consultants be permitted to use the UF Google email through a
business associate agreement?
This is actually two separate issues, which appear to have become confused.
1) Will consultants be permitted to use the UF Google email system?
Yes; According to the contract, UF can give accounts to whomever it wishes. The contract
contains the following language (under ‚Definitions‛): ““End Users” means individuals associated
with Customer to whom customer chooses to give End User Accounts. This group may include, but is not
limited to Students, Staff, and Volunteers.” The “but is not limited to” language gives UF complete
discretion in this regard.
2) Will Google sign a ‚Business Associate Agreement?‛
This is a Health Center/HIPAA issue about which there is still a significant degree of
uncertainty. When asked, Google’s representative replied that they have not signed a Business
Associate Agreement with any health provider as yet.
They have not to this point agreed or refused to sign such an agreement.
12/13
If they do agree to sign this then this issue is OK.
If they do not agree to sign this agreement then we will have to make substantial policies
relative to acceptable users of Gmail if we are to say this is OK.
23. Would we deploy this UF Google email without the Health Science
Center?
It is possible. If the issues/concerns regarding HIPAA requirements cannot be resolved to the
satisfaction of the Health Science Center, they may elect not to participate. That does not
necessarily prohibit the rest of the University from implementing this service.
OK, with concerns.
24. Can a unit opt out from having its students use Gmail?
Yes, but this would be a policy-matter, not a technical one. Due to the fact that students can be
‚in‛ multiple units simultaneously, and move between units frequently, we would not attempt
to implement any sort of technical prohibition.
OK, with concerns
25. Which university policies need to be changed?
Few, if any. The e-mail outsourcing workgroup envisions applying existing policies (such as the
AUP, privacy policy, etc.) to the outsourced solution. The only policy we have identified as
possibly needing to be changed is the GatorLink account expiration policy – if it is decided to
offer ‚service for life,‛ then clearly that is one policy which would require change.
Part of this recommendation may include policy change recommendations.
13/13