Marilu Goodyear CIO & Vice Provost for Information Services Jenny Mehmedovic

1. USA PATRIOT Act and Beyond: How Higher Education Institutions and Libraries are Cooperating and Coping Marilu Goodyear CIO & Vice Provost for Information Services Jenny Mehmedovic Coordinator of IT Policy & Planning Educause Live! August 3, 2004

2. Policy=Values Written Down • Building consensus around institutional values has always been important • Reflecting that consensus in policy actions is even more important now • Environmental factors changing fast • 9/11 • Technology changing fast • Degree of latitude wider • Value choices vs. legality Educause Live! August 3, 2004

3. Important Value Choices • Privacy • What are the values of your organization? • Is privacy seen as an integral part of academic freedom? • Privacy from whom? • Internal • External • Different views from different players? • Administration • Faculty • Governance • Concern vs. action Educause Live! August 3, 2004

4. Important Value Choices • Responses to criminal activity • Are we interested in protection? • Are we interested in catching criminals? • How should we balance information gathering for law enforcement activities with other priorities? • The practical aspects of catching and prosecuting computer crime • Does the difficulty affect our priorities? Educause Live! August 3, 2004

5. Has the PATRIOT Act changed the playing field? • More requests from law enforcement? • Hard to say • Need for coordinated response procedure? • Yes, but just enhance what’s probably already in place • Library personnel with a different worldview? Educause Live! August 3, 2004

6. Preparing for law enforcement requests • Create a procedure • Involve your legal counsel, campus police, registrar, human resource office, student support office, as well as information services • Designate who should respond • Decide whether to respond to requests that lack a subpoena, search warrant, or other court order • Provide 24/7 access to legal counsel for review of subpoena, search warrant, and court orders • Describe relationship with campus police Educause Live! August 3, 2004

7. Preparing for law enforcement requests • Distribute and discuss the procedure widely • Staff • Student employees • Help Desk • Operations Staff (after hours) Educause Live! August 3, 2004

8. During law enforcement requests • Verify identification • Review court order, subpoena, or search warrant • Appropriate (and advisable) to ask legal counsel to assist • Producing the records requested • Appropriate (and advisable) to alert dean, director, or department chair • Subpoena v. search warrant • Ask for time to have legal counsel review paperwork • Call legal counsel for assistance • If officer won’t wait, don’t inhibit the search! Educause Live! August 3, 2004

9. Inviting law enforcement in • Intercepting electronic communications of computer trespassers • Designate who can do the inviting • CIO/VP for Info Services • May be harder to invite them OUT! Educause Live! August 3, 2004

10. Records Management • You can only give up what you have • State-level laws that affect decisions about records • Definition of a public record • Created by a governmental agency • Received by a governmental agency • Transact official business • Any format • Retention schedules Educause Live! August 3, 2004

11. Open Records Laws • Legitimate need for the public to see what actions governmental organizations are taking • Access to information issues (press) • Exemptions • Privacy • Security • Cost-effective governmental management • Exemptions mean you don’t have to release • Definitions of what is a record can differ from the general records statute Educause Live! August 3, 2004

12. Records management • Do you really need to create a record in the first place? • How long should you keep it once you’ve created it? • Are there steps you can take to “de-identify” the record? Educause Live! August 3, 2004