The investigation of academic misconduct during an
undergraduate final examination in the spring of 2012—initially
reported last August, and officially concluded with the
February 1 announcement of disciplinary actions affecting dozens of students—was
revived in an unexpected way this past weekend. The Boston Globe reported
in a front-page, March 10 story that, as the headline and subtitle put it,
“Harvard checked deans’ e-mails” and “Chasing leak in cheating scandal may have
invaded privacy.”
The story was picked up by The New York Times (“Harvard Searched
E-Mails for Source of Media Leaks”) and followed up on March 11 (“Harvard
Search of E-Mail Stuns Its Faculty Members”).
On Monday, Faculty of Arts and Sciences dean
Michael D. Smith and Harvard College dean Evelynn M. Hammonds issued a
statement detailing the investigation from their perspective. (The full
text appears at the bottom of this dispatch.) Hammonds
chairs the Administrative Board (AB), the body that conducted the academic
misconduct investigation. Smith and University vice president and general
counsel Robert Iuliano invited Harvard
Magazine to University Hall shortly after noon to review the statement and
the underlying events.
This report summarizes the facts as now known.
The Boston Globe Report
The Globe reported:
Harvard University central
administrators secretly searched the email accounts of 16 resident deans last
fall, looking for a leak to the media about the school’s sprawling cheating
case, according to several Harvard officials interviewed by the Globe.
The resident deans sit on
Harvard’s Administrative Board, the committee charged with handling the
cheating case. They were not warned that administrators planned to access their
accounts, and only one was told of the search shortly afterward.
[According
to the board’s website, for disciplinary matters, “Students have an official representative on the Administrative
Board who will act as their liaison in any Board matter. Ordinarily, a
student’s representative to the Board is his or her Resident Dean of Freshmen
or Allston Burr Resident Dean. The role of the Board Representative is to
present to the Board a full summary of the facts of any petition or case,
making certain the student’s “voice” is heard. The Board Representative (and
the resident dean if the student is working with an alternate) abstains from
voting on all matters directly related to students whom he or she represents.”]
The dean who was informed had
forwarded a confidential Administrative Board message to a student he was
advising, not realizing it would ultimately make its way to the Harvard Crimson and the Globe and fuel the campus controversy
over the cheating scandal.
All the Harvard officials
interviewed by the Globe declined to
identify the dean, although one said no punishment had been involved.
The other 15 deans were left
unaware their email accounts had been searched by administrators until the Globe approached Harvard with questions
about the incident on Thursday, having learned of it from multiple Harvard
officials who described it in detail. Those officials asked for anonymity out
of fear of reprisal.
Harvard administrators said
they would inform the remaining deans today—almost six months after the search.
The deans have two Harvard
email accounts—one primarily intended for administrative duties, and another
for personal matters. Only the first category of accounts was searched;
information technology staffers were instructed to look only for a specific
forwarded message heading and to not read the content of messages.
The
confidential memo in question, from the AB’s secretary, associate dean of the
College and FAS member Jay Ellison (reprinted here, by the Crimson), was dated August 16; although it did
not contain any information pertaining to any individual, it did state:
The only folks that may want
to really consider an LOA are those students who know that they cheated. I
think it is important for you to talk to them about being honest and
forthcoming and remind them that only they know what happened but that we are
working to understand it and except [sic] them to help us do just that.
Fall term athletes may also
want to consider taking an LOA before their first game. The reason this matters
for athletes is that once they compete one time their season counts and they
would lose eligibility if they had to take a year off and return. That said,
these students should be sent to Nathan Fry for advice on their options
and eligibility—let’s not get into advising students on NCAA rules. Please
let me know if you have any questions.
Once the Crimson obtained it and excerpted it in its September 1 edition—just as news of the academic-misconduct
investigation was released—other news media reported on the contents as well
(with particular interest in the paragraph on athletics).
The Globe article of this weekend reported
on subsequent attempts to determine how the AB memo was leaked. It drew on a
brief statement provided by Dean Smith, who said (in full):
As a matter of policy, Harvard does not comment on
personnel matters, nor will we provide any additional information relating
to the Administrative Board cases that were concluded during the fall term. Generally speaking, however, if circumstances were to arise that gave
reason to believe that the Administrative Board process might have been
compromised, then Harvard College would take all necessary and appropriate
actions under our procedures to safeguard the integrity of that process, which
is designed to protect the rights of our students to privacy and due
process. As a computer scientist with more than a decade of experience on
issues of privacy and data security, I would agree entirely with taking steps
that found the right balance between our needs to respect the privacy of our
employees and to protect the privacy of our students.
The Globe also quoted Jeff Neal, director of University communications
(who is the principal FAS spokesman), who said, “Any assertion that
Harvard routinely monitors emails—for any reason—is patently false.”
The Globe went on to suggest, “News of the
incident could nonetheless anger Harvard faculty members, whose privacy in
electronic records is protected under a Faculty of Arts and Sciences policy.” That
prescient comment turned out to be an understatement.
Among
those who spoke to the Globe were
Gordon McKay professor of computer science (one of Smith’s colleagues in that
discipline) Harry R. Lewis, a former dean of the College. “If reading the
deans’ e-mail is really OK by the book, why didn’t they just ask the deans who
leaked the memo, threatening to read their e-mail if no one came forward?” he
asked. Lewis’s Bits and Pieces blog contained an exhaustive analysis of FAS
and University privacy policies, a close reading of the protections apparently
afforded to faculty members versus the conditions of employment governing nonfaculty
staff members, and the disheartened conclusion that “Whichever policy is applicable, this way of handling the
situation seems to me—well, dishonorable….” Lewis continued:
This seems to me a sad incident which raises many
questions. If an employee’s boss wants to spy on her, who has to sign off on it
and how does it get done? How many such searches have been done over the past
five years? Is it always done without informing the target? Have the targets
generally been people like these resident deans—people with both teaching and
administrative appointments?
In
comments on Lewis’s blog, and in other such comments, several faculty members
weighed in, expressing dismay at the reported review of e-mails to determine
the source of the leak.
The FAS-College Response
In their
statement today, Deans Smith and Hammonds begin by emphasizing the
confidentiality of AB deliberations and communications—to protect students’
privacy—and then observe that the forwarding of the e-mail originally sent to
resident deans beyond the bounds of the AB and to news media “was quite
concerning” and “warranted a better understanding of what had occurred, since
it threatened the privacy and due process afforded students before the Board.”
Subsequently,
their statement continues, on a separate occasion “confidential data” from an
AB meeting was shared with the Crimson,
“heightening the need to determine whether a member of the Administrative Board
had compromised the confidentiality of case information.” (In this case, the Crimson cited a post from the IvyGate blog, purportedly claiming as a source someone who had spoken with a resident dean.)
In each
case, the statement notes, members of the AB were notified about the issue and
queried about possible explanations for the apparent breach of confidentiality.
In the first instance, the statement says, “It was made clear at that time that
absent clarification of what happened, an investigation would be required. No
one came forward.” After the second news report on AB matters, board members
“again were queried but no explanation emerged. The senior resident dean was
asked to reach out individually to each resident dean to seek to learn what
happened, but that also yielded no insights.”
In the
briefing on the statement today, Dean Smith said that although the memo that
found its way to the Crimson had no
personal information, “That doesn’t mean it’s not of concern for us,” given the
need to assure confidentiality of AB deliberations. The board’s leadership was
concerned, he said, and resident deans were asked “repeatedly” about the
disclosure of the memo. The intent, he said, was to “clean up” the matter “so
people could be made confident the proceedings were confidential.” It was
made explicitly clear to all members of the AB, Smith said, that an
“investigation” would have to be undertaken.
The second
report of AB information in the Crimson
was “what appeared to be word-for-word discussion” of a Board
conversation about the academic-misconduct investigation—but not a forwarded
document or memorandum. Smith said that the content was less worrisome than
“what other information might be released.”
Asked by whom and in what way the investigation of the leak
was initiated, University general counsel Robert Iuliano said the request “was
pretty refined by the time it came to you” (indicating Dean Smith). Smith noted
that “I wasn’t in the room,” but that he understood after the original
memorandum leaked and queries were made about the possible source of the leak,
the initiative to investigate further came from the board itself. Under the
procedure followed, Iuliano said, the request had to come with the support of
the College dean’s office (the College dean chairs the AB)—although neither Smith’s
office nor the general counsel’s office was involved at that point.
The investigation focused on the AB memo, they said, because
the second piece of leaked information—on the board’s discussions—was of a
different character: it was not linked to a document that was disseminated; it
was an account of a conversation; and it presumably could have come from any AB
member (or second- or third-hand, from a student who heard from a board member
handling the investigation of her or his conduct, or from someone such an
intermediary told subsequently).
The investigation proposal that came to Smith and Iuliano
for review was, the latter said, “careful, calibrated, limited”: a “precise
subject-line search” focused only on the resident deans’ administrative
accounts; and confined to subject-heading information only. According to the statement, “The search did
not involve a review of e-mail content….No one’s e-mails were opened and the
contents of no one’s e-mails were searched by human or machine.” Smith called
it “a very privacy-sensitive search” that was conducted by University IT
personnel, to further distance it from the College proper.
The search in fact turned up two forwarded copies of the
e-mail, “both from one sender.” The resident dean with the involved account was
asked about the finding, and subsequently “voluntarily reviewed his/her own
sent items and confirmed that she/he had indeed forwarded the message to two
students.” Based on conversations with the individual, all concerned were
convinced that the action “was an inadvertent error and not an intentional
breach,” and no further action was taken. (Had the resident dean been removed
from the board at that point, the student cases he or she was responsible for
representing would have had to be reassigned, presumably delaying and further
complicating the overall, large investigation of academic misconduct.)
Further Queries
This account raises at least three questions:
Why was the second disclosure of information that appeared
in the Crimson not investigated?
Smith said that it remained unresolved because the nature of the information—an
account of a conversation, not a document, and possibly not first-hand—meant
that it could not be subject to a limited search of the kind authorized in
looking for the forwarded e-mail.
What was the source of the inadvertent breach of AB
confidentiality? The resident dean involved has not been identified, so it is
not possible to check her or his account. From the language of the
Smith-Hammonds statement about the resident dean reviewing e-mails and
confirming that she or he had forwarded the memo to two students, and the
timing (August 16), it seems plausible that at a time when the enormous
academic-conduct investigation was taking shape (with more than 100 students
involved), resident deans were scrambling for guidance to offer to the students
involved; that this memo from the AB appeared, containing some broad outlines of
courses of action; and that it seemed natural simply to pass it along,
particularly, perhaps, to student-athletes involved in the investigation, who
had to worry about their future athletic eligibility. It could simply be the
case that whoever forwarded the memo was extraordinarily busy keeping up with
the demands of the burgeoning investigation.
Finally and most importantly, why was the e-mail
investigation not explicitly disclosed to resident deans at the time it was
begun, or after it was concluded? According to the Smith-Hammonds statement,
once it was decided that the disclosure was inadvertent, and that no further
action would be taken, the senior resident dean was notified of the search and
its outcome, and then the AB’s handling of the academic-misconduct investigation
proceeded. The Smith-Hammonds statement continues:
Some have asked
why, at the conclusion of that review, the entire group of Resident Deans was
not briefed on the review that was conducted, and the outcome. The question is
a fair one. Operating without any clear precedent for the conflicting privacy
concerns and knowing that no human had looked at any emails during or after the
investigation, we made a decision that protected the privacy of the Resident
Dean who had made an inadvertent error and allowed the student cases being
handled by this Resident Dean to move forward expeditiously. We understand that
others may see the situation differently, and we apologize if any Resident
Deans feel our communication at the conclusion of the investigation was
insufficient.
Asked to clarify, Smith said that the University had
undertaken a very limited search of e-mail headers from a population of
“individuals whom we had told there would be an investigation,” although he
could not confirm that there was an explicit statement that e-mail would be
examined even in this limited way. (Implicitly, of course, the information
under investigation was an e-mail, which had found its way from the AB to the Crimson, intact.) When the investigation
was concluded, in September, he said, the University was weighing two sets of
privacy concerns, without explicit policy to guide its decision on how to
balance them off against one another: the privacy of students whose academic
conduct was under review, in a complex and even then time-consuming
investigation; and the conduct of a resident dean who was found to have
inadvertently breached AB procedures and confidentiality. Given that finding,
and the affected students’ interest in having the AB proceed “carefully and
expeditiously,” without derailing it for an internal discussion of board
procedures, expectations, and conduct (and a possible change in responsible
personnel on the board itself), the decision was made to bring the matter up
with the resident dean involved and the senior resident dean—but not to inform
the other resident deans (whose e-mail headers were reviewed) or remaining
board members.
Further Context
The investigation proceeded, Smith and Iuliano said, from
the AB to the FAS’s senior administration and the University general counsel’s
office; other Harvard units were not involved in the decisionmaking, other than
using University IT resources to review the resident deans’ e-mail headers.
Some confusion has arisen over different policies covering
the privacy of e-mails. In his blog post, Harry Lewis noted that Harvard
employees “must have no expectation or right of privacy in anything they
create, store, send, or receive” on
Harvard computers or networks—common, boilerplate language giving an
employer access to information. FAS faculty communications are covered by
language he cites to this effect:
The Faculty of Arts and Sciences
(FAS) provides the members of its faculty with computers, access to a computer
network and computing services for business purposes, and it is expected that
these resources will be used in an appropriate and professional manner. The FAS
considers faculty email messages and other electronic documents stored on
Harvard-owned computers to be confidential, and will not access them, except in
the following circumstances.
First, IT staff may need access to
faculty electronic records in order to ensure proper functioning of our
computer infrastructure. In performing these services, IT staff members are
required to handle private information in a professional and appropriate
manner, in accordance with the Harvard Personnel Manual for Administrative and
Professional Staff. The failure to do so constitutes grounds for
disciplinary action.
Second, in extraordinary
circumstances such as legal proceedings and internal Harvard investigations,
faculty records may be accessed and copied by the
administration. Such review requires the approval of the Dean of the
FAS and the Office of the General Counsel. The faculty member is entitled to
prior written notice that his or her records will be reviewed, unless
circumstances make prior notification impossible, in which case the faculty
member will be notified at the earliest possible opportunity.
Thus, e-mail is protected, but there are extraordinary
circumstances where communications can be accessed, with FAS decanal and general-counsel
review. The review and approval process was followed in the AB investigation;
but the requirement for prior notification, or “earliest possible” follow-up
notification, was clearly not.
Smith said that no distinction was made, in this case,
between faculty members’ and resident deans’ status. He said he was guided by
“what is the right thing to do for the privacy of the individual involved”
(both students being investigated and the resident dean who was found to have
disclosed the AB memo to students inadvertently). Iuliano said that “e-mail is
inherently sensitive,” and that the “very careful, measured steps taken”
reflect such concerns. Before any investigation of e-mail is undertaken, he
said, the general counsel’s office would have to approve it, along with the
responsible official of the school or unit involved: here, Dean Smith.
When the University has a compelling interest in accessing
such information (Lewis cites cases such as scientific misconduct or
embezzlement, among the legal entanglements that might require an
investigation), Iuliano said, the institution has a process in place to gain
such access—and it applies to all members of the community, faculty and staff
alike.
There will no doubt be further fallout and continuing
faculty discussion of these matters. One blogger, Gordon McKay professor of
computer science Michael D. Mitzenmacher, was critical
of the administration after the Globe
story broke, but now
seems largely mollified by Deans Smith and Hammonds’s statement; he writes, “My high-level take—this has been blown out of proportion by the
media, but it’s certainly an issue the administration and faculty should
discuss and work out together, so there’s a common understanding.”
Smith said of his statement and the
discussion in his office, “I’m mostly interested in getting to
the facts that are actually out there so we can discuss the facts and not
conjectures. We do not search lots of
e-mails—that’s patently false.” Iuliano said that such searches
are “rare,” but that the power remains to
examine such communications in case of legal requirements, the need to protect
the privacy of other individuals whose rights may be breached, or in the case
of clear, pressing institutional interests. At the least, members of the
community are on notice that—among what may be overlapping or uncoordinated
statements—they are governed by the language in current FAS information for
faculty:
The unauthorized examination of
information stored on a computer system or sent electronically over a network
is a breach of academic and community standards. Authorized system support
staff however, may gain access to users’ data or programs when it is necessary
to maintain or prevent harm to the University, its computer systems or the
network.
and the general guidance for
employees as a whole:
Electronic
files, e-mail, data files, images, software and voice mail may be accessed at
any time by management or by other authorized personnel for any business
purpose.
Statement by FAS dean
Michael D. Smith and Harvard College dean Evelynn M. Hammonds, released March
11, 2013
With the
responsibility of helping students work through disciplinary and academic
issues, the Administrative Board serves one of the most important and sensitive
functions in the Faculty of Arts of Sciences (FAS). Its overarching responsibility
to our students means that the Board operates with stringent but necessary
expectations of confidentiality – in the information provided by students, in
the observations made by other members of the Board when considering cases, and
in the other communications that permit the Board to meet its obligations to
students and the Faculty effectively.
In the early
days of the Administrative Board case that became public at the end of last
summer, a confidential email sent to Resident Deans, important members of the
Administrative Board and the frontline administrators in dealing with every
sort of student issue, was forwarded beyond the group, and eventually made its
way to news outlets. The forwarded email was quite concerning and warranted a
better understanding of what had occurred, since it threatened the privacy and
due process afforded students before the Board. The situation was shared with
the entire Board, including with all Resident Deans. It was made clear at that
time that absent clarification of what happened, an investigation would be
required. No one came forward. A short time later, confidential data from an
Administrative Board meeting was shared with the Crimson, heightening the need to determine whether a member of the
Administrative Board had compromised the confidentiality of case information.
Members of the Board were again queried but no explanation emerged. The Senior
Resident Dean was asked to reach out individually to each Resident Dean to seek
to learn what happened, but that also yielded no insights.
While the
specific document made public may be deemed by some as not particularly
consequential, the disclosure of the document and nearly word-for-word
disclosure of a confidential board conversation led to concerns that other
information – especially student information we have a duty to protect as
private – was at risk.
Consequently,
with the approval of the Dean of FAS and the University General Counsel, and
the support of the Dean of Harvard College, a very narrow, careful, and precise
subject-line search was conducted by the University’s IT Department. It was
limited to the Administrative accounts for the Resident Deans – in other words,
the accounts through which their official university business is conducted, as
distinct from their individual Harvard email accounts. The search did not
involve a review of email content; it was limited to a search of the subject
line of the email that had been inappropriately forwarded. To be clear: No
one’s emails were opened and the contents of no one’s emails were searched by
human or machine. The subject-line search turned up two emails with the queried
phrase, both from one sender. Even then, the emails were not opened, nor were
they forwarded or otherwise shared with anyone in IT, the administration, or
the board. Only a partial log of the “metadata” - the name of the sender and
the time the emails were sent – was returned.
The Resident
Dean whose account had been identified was asked about the incident and
voluntarily reviewed his/her own sent items and confirmed that she/he had
indeed forwarded the message to two students. Although the Resident Dean’s
actions violated the expectations of confidentiality surrounding the
Administrative Board process, those involved in the review and the conversation
with the individual were sufficiently convinced that it was an inadvertent
error and not an intentional breach. The judgment was made not to take further
action. The Senior Resident Dean was immediately informed of the search, and
its outcome, and the Administrative Board case moved forward.
Some have asked
why, at the conclusion of that review, the entire group of Resident Deans was
not briefed on the review that was conducted, and the outcome. The question is
a fair one. Operating without any clear precedent for the conflicting privacy
concerns and knowing that no human had looked at any emails during or after the
investigation, we made a decision that protected the privacy of the Resident
Dean who had made an inadvertent error and allowed the student cases being
handled by this Resident Dean to move forward expeditiously. We understand that
others may see the situation differently, and we apologize if any Resident
Deans feel our communication at the conclusion of the investigation was
insufficient.
Again, in every
instance the actions and decisions in this case were motivated by the goals of
protecting the integrity of our faculty-legislated processes and the privacy of
our students. We hope the fuller account of the actions in this instance make
abundantly clear how high a bar we have, and will always have, for any review
of email (or, in this case, even email metadata) and how carefully we construct
searches when the need in situations such as this does arise, which is
extremely rare.