During
the Faculty of Arts and Sciences (FAS) meeting last April 2—at which dean Michael
D. Smith and President Drew Faust revealed that further University
investigations of e-mail accounts had been undertaken during a wide-ranging
Administrative Board investigation of student cheating on a spring 2012 final
exam—Faust announced two concrete actions: an external review of the adequacy
of the fact-finding concerning the e-mail investigations; and the formation of a
University policy-setting committee. The report of the former has just been
released.
Boston attorney and Law School alumnus Michael B. Keating’s “Report
to the Subcommittee of the Harvard Corporation on E-Mail Searches Conducted in
Connection with the Academic Integrity Cases,” describing him as counsel to
the subcommittee, was dated July 15 (see report here). Its executive summary for the first time
provides a clear account of the brief period within which all of the e-mail
account searches took place, and of the targets of those searches, which
extended to resident deans’ communications with student advisees (presumably
students concerned about their involvement in the Administrative Board
misconduct investigation) and with reporters for The Harvard Crimson (and, it turns out, The Boston Globe). It reads:
Between September 12, 2012 and September 15, 2012, three separate
searches of email accounts occurred. The first search involved the search of
log files that included all of the Resident Deans’ administrative email
accounts to
determine if any Resident Dean had forwarded a confidential email, with the
subject line “case process,” that had been sent on August 16, 2012 (hereafter
“the ‘case process’ email”), to all of the Resident Deans by John “Jay”
Ellison, Associate Dean of Harvard College, who serves as Secretary of the
Administrative Board. That search revealed that a Resident Dean (hereafter
referred to as “Resident Dean X”) had transmitted the “case process” email to
one of the students whom Resident Dean X advised. The second search involved
log and mailbox searches of Resident Dean X’s administrative account to
determine if Resident Dean X had forwarded the “case process” email, or other
confidential information, to two named reporters for The Harvard Crimson. That search found no indication that Resident
Dean X had transmitted the “case process” email, or any other confidential
information, to The Crimson
reporters. The third search occurred following a meeting at which Resident Dean
X admitted having forwarded the “case process” email to a student (and after
Resident Dean X later acknowledged having forwarded the same email to a second
student as well). That search was a mailbox search of Resident Dean X’s
administrative and personal email accounts to determine if Resident Dean X had
forwarded the “case process” email to any other student or exchanged emails
with the two previously identified Crimson reporters. That search revealed that
Resident Dean X had forwarded the “case process” email to two students, both
advisees of Resident Dean X, and that Resident Dean X had also exchanged emails
with one of The Crimson reporters.
Thus,
as previously indicated, the resident dean involved shared information with
students, but did not forward the
Administrative Board document in question, or other confidential information,
to student reporters. A third search, probing further into the resident dean’s
contact with reporters, covered the resident dean’s personal e-mail account, as
well as the dean’s administrative account.
In
the course of the searches, Keating’s report reveals, metadata for some 14,000
e-mail accounts maintained within Harvard were scanned, and 17,000 e-mail
accounts maintained by an outside vendor were scanned.
The
executive summary also notes that beyond conducting the searches with the
outside vendor, Harvard University Information Technology (HUIT)
“archived” or made copies of all of the Resident Deans’
administrative accounts for possible review at a later date. No further review
of these administrative accounts was made, however. HUIT also archived Resident
Dean X’s personal email account.
The summary concludes that all the searches “were undertaken
in good faith,” by people who “believed that they were acting in compliance
with applicable email privacy policies.” There was no intentional violation of any
requirement that resident deans be notified about the searches (a point of
ambiguity in University policies), and “there is no evidence that any of the
individuals involved read the content of any emails that were identified as a
result of these searches.”
The Report
The full report recounts the history of the
academic-misconduct case, the August 16 memo to resident deans from Ellison in
his capacity as Secretary of the Administrative Board, and the Crimson’s August 31 request—with a copy
of the August 16 memo in hand—to discuss it with him, before it published an
article on the contents the next day. That story, Keating’s report notes,
included the information that a resident dean had confirmed Ellison’s original
dissemination of his memorandum; the Crimson
did not say how it got the memo, pointing neither to the resident dean nor any
other source.
In fact, the resident dean (discussed in the summary above)
had confirmed Ellison’s distribution of the memorandum in a conversation with a
Crimson reporter on August 30 but,
according to Keating’s report, refused to comment further. The resident dean, subsequently, explicitly told the reporter in an e-mail that the reporter could
not use the information (about the resident dean’s confirmation that it had
been circulated); and after the Crimson
article appeared on September 1, the resident dean told Ellison and the senior
resident dean that he or she had spoken with the Crimson in violation of Ellison’s instruction, and had expressly told the reporter that any use of the information
provided was impermissible.
With that knowledge in hand, Ellison and Harvard College
dean Evelynn M. Hammonds (chair of the board) raised the issue of “leaks” (the
Keating report’s quotes) at the September 4 Administrative Board meeting; asked
for information about how the August 16 memorandum had reached the Crimson; and warned that further
investigation would be needed if information were not forthcoming. There is no
evidence, Keating notes, that resident deans were put on notice that e-mail
accounts might be searched.
After further news reports about the investigation on
IvyGate Blog and in the Crimson, the
latter noting that athletes were implicated in the misconduct investigation and
had taken leaves of absence (to maintain athletic eligibility in future
seasons); Crimson reports on the
course in question, on possible disciplinary actions students might face, and on the Administrative Board’s need for help to process the large volume
of instances of possible misconduct; and Boston
Globe inquiries, administrators became concerned, the Keating report says,
about a “pipeline” from the board leaking information, possibly comprising
confidential investigations and the privacy of student records. The initial e-mail
searches were then authorized, following a September 12 telephone conference
call among FAS Dean Smith, Hammonds, and Ellison (who had contacted Harvard’s Office
of the General Counsel [OGC] about a possible search the day before, according to
the Keating report; the report says President Faust did not learn about the
searches until March 2013).
Some of the searches necessarily were conducted by an
outside vendor, because 15 resident deans’ accounts were hosted outside
Harvard. For the two hosted by HUIT, certain searches could not be conducted,
so the resident deans’ accounts were searched internally for e-mail to or from Globe reporter Mary Carmichael; no
e-mails were found between those two accounts and Carmichael, and no further
searches were conducted.
As the Keating report makes clear, the searches were
apparently conducted within OGC’s interpretation of some, but not all, of the
University’s existing e-mail privacy policies (some of which, it became clear
after the fact, overlap or are inconsistent or leave gaps). The searches were
conducted with considerable urgency, with an OGC attorney instructing an HUIT
employee to proceed in a memorandum at 10:10 p.m. on September 12. In the
course of the various searches, “The entire log file for all accounts hosted by HUIT (approximately
14,000 accounts on the UNIX email platform) was scanned with the metadata
available which included the time and recipient.” Similarly, the outside
vendor’s search encompassed review of “the entire log file (which included
metadata from approximately 17,000 accounts on the Windows email platform) …in
order to determine whether the ‘case process’ email had been forwarded by any
sender to any recipient.”
In
searches of the identified resident dean’s account to determine whether he or
she had been in contact with the Crimson
reporters, the searches were ultimately extended back as far as January 1, 2012—several
months before the academic misconduct under investigation by the Administrative
Board had occurred—and no such e-mails were found, the Keating report
concludes.
After
the resident dean disclosed that he or she had forwarded the August 16 Ellison
memorandum to two students, both athletes, Hammonds authorized further searches
of the resident dean’s administrative and personal accounts, looking for
communications with students and with the Crimson
reporters to whom Ellison’s memorandum might have been distributed. The Keating
report says Hammonds did not consult with Dean Smith about these further
searches, and that he learned about them in March 2013. These searches, the
report says, confirmed what the resident dean told Hammonds.
The
Keating report makes clear the mechanics of “log” and “mailbox” searches
undertaken, and adds the detail that the searches involved multiple ways of
examining multiple e-mail accounts under each of the three search
authorizations disclosed previously, reaching not only resident deans’ accounts
but also e-mails exchanged with accounts of student reporters for the Crimson (Harvard accounts and a Gmail
account) and e-mail traffic to and from the Boston
Globe higher-education reporter (none of which were from the resident
deans’ accounts hosted by HUIT).
The
report concludes:
The email searches of the Resident Deans’ accounts described above
arose in the context of an unprecedented event in the history of the University
in which as many as 125 undergraduates were suspected of conduct inconsistent
with academic integrity. Under University rules, it was the responsibility of
the Administrative Board to resolve these cases. Confronted with credible
evidence that the guaranteed confidentiality of the Administrative Board’s
communications had been compromised, and concerned that the identities of
affected students might be disclosed, University and FAS administrators felt
compelled to identify the source of the disclosures. The intense media
attention on the academic integrity cases and the manner in which the
Administrative Board was handling them heightened the concern about any
possible disclosures of confidential information, whether intentional or by
accident. Time was also of the essence, because the cases had been pending for
months, and the students were entitled to hearings that were both fair and
expeditious. Faced with inadequate University policies governing the privacy of
email communications, FAS Administrators acting in good faith undertook the
searches described in this Report in order to proceed with and complete the
disciplinary proceedings of the Administrative Board and to protect the
confidentiality of that process. The Administrative Board was able to complete
its review of the academic integrity cases arising from this episode with no
further breach of confidentiality.
Presidential and Corporation Comment
In
a statement on the report, President Faust reiterated that she had asked
Keating to examine what had happened, believing “that whatever the conclusions each of us might draw
about judgments made at the time, all actions related to the searches were
undertaken in good faith, fueled first and foremost by a sense of
responsibility for protecting the confidentiality of our students and the
disciplinary process” and that “our policies, procedures and protocols
regarding the privacy of e-mail communications were insufficient, poorly
understood, and variably implemented. For better and for worse, Mr. Keating’s
report confirms both those assumptions.” She continued:
I am reassured by Mr. Keating’s conclusion that the
individuals involved in the searches were acting in good faith, in a manner
they believed to be consistent with applicable policy and with a guiding
responsibility for safeguarding student confidentiality and the integrity of
the Ad Board process.
Unfortunately, the detailed factual account in Mr.
Keating’s report deepens my already substantial concerns about troubling
failures of both policy and execution. The findings strengthen my view that we
need much clearer, better, and more widely understood policies and protocols in
place to honor the important privacy interests that we should exercise the
utmost vigilance to uphold. A university must set a very high bar in its
dedication to principles of privacy and of free speech; these are fundamental and
defining values of our academic community. The searches carried out last fall
fell short of these standards, and we must work to ensure that this never
occurs again. I am grateful that Professor David Barron and the task force I
have appointed on electronic communications policy will be creating
recommendations for guidelines that will assist us in achieving that goal.
Michael Keating’s insights and observations will make a critical contribution
to that work. In the meantime, I will be announcing before the start of the
fall semester interim protocols governing any searches of e-mails at the
University.
Separately, Corporation
member William F. Lee said:
Mr. Keating found those involved in the searches to
have acted in good faith and with a guiding desire to safeguard the
confidentiality of the Ad Board process. That aspect of his report is
reassuring. His detailed account of how these searches were done,
however, makes it even clearer than before that there is much work ahead in
improving the University’s policies and protocols concerning privacy
of, and access to, electronic communications. The committee appreciates
the willingness of Professor David Barron and his task force to take on that
important work and to learn from this episode as we look forward.
Background
Given that the
April 2 disclosures rendered inadequate and incomplete a March statement by
Smith and then-dean of the College Hammonds (chair of the Administrative
Board during the academic-misconduct investigation; Hammonds’s service as dean
concluded on June 30) that spoke of a single review of resident deans’ e-mail
accounts to trace the possible disclosure of confidential board information,
Faust said then:
Dean Smith,
Dean Hammonds, and I want to be sure that we now have a full understanding of
the searches that were undertaken. To that end, I am asking Michael Keating, a
leading Boston lawyer from outside Harvard, to take the necessary steps to
verify that the information we have discussed today is, as we believe, a full
and accurate statement of the searches and to report to me.
Keating, LL.B. ’65, is a partner and past chair of the litigation department at Foley
Hoag, and a past trustee of Williams College, his undergraduate alma mater. He
was charged, in other words, with conducting an outside review to determine
whether all the facts about the investigation as reported to the faculty in the
expanded, second airing of the issue were known and the situation was then
completely understood. As The Harvard Crimson subsequently
reported, it was later decided that Keating would deliver his report to a
committee comprising Corporation members Lawrence S. Bacow, William F. Lee, and
Theodore V. Wells Jr., and Faust, with
information to be shared with the wider community. According to a statement
issued by Lee:
At the request of a Corporation committee, Mr. Keating’s
review is focusing on the facts bearing on any searches of e-mail or e-mail
metadata done in connection with the Administrative Board proceedings
relating to a take-home exam in a spring 2012 undergraduate course.
In addition to discussing his findings with the Corporation
committee, he will prepare a written report, with appropriate regard for
confidentiality, that will be shared with the Harvard community. He aims
to finish his work by June 30.
Faust’s second initiative,
announced April 2, was to form a task force
to develop recommendations on a set of policies and
guidelines about email privacy. Those recommendations will be submitted for
community discussion and Corporation consideration by the end of the fall term.
I am pleased to report that Professor David Barron, the S. William Green
Professor of Public Law at Harvard Law School, has agreed to chair this task
force. Professor Barron is a graduate of the College—a history concentrator—and
of Harvard Law School. He worked as a journalist early in his career, served as
a Supreme Court clerk, and recently completed two years of service heading the
Justice Department’s Office of Legal Counsel in Washington. I am very grateful
to him for agreeing to lead this process. The task force will draw members from
across the University and will be broadly consultative in its work.
As reported, the task force members
were appointed and began their work last May 6, before the spring semester
concluded. Its detailed charter, from Faust, reads:
The task force will consider and recommend appropriate
policies regarding access to, and confidentiality of, electronic communications
that rely on university information systems. It will consult with faculty,
staff, and students in order to obtain a full understanding of the perspectives
of each group.
In undertaking its work, the task force will inform
itself about policies now in place at Harvard and other relevant institutions
and solicit perspectives and advice on best practices.
The task force will consider whether and to what extent
Harvard’s policies should be University-wide or specific to certain parts of
the University or particular institutional roles and responsibilities.
The task force will be expected to focus on recommending
policies for the future that are both principled and practicable and that
account for the reasonable expectations of individuals, the legitimate
interests of the University, and associated issues of notice and process. The
task force is not expected to investigate or render judgments on past events,
but rather to take general account of instructive examples at Harvard and
elsewhere as one means to understand the complex of considerations that can
inform sound recommendations for the future.
Joining Barron are:
Patricia Byrne, executive
dean, Harvard Divinity School
Emma Dench, professor of the
classics and of history, FAS
Karen Emmons, associate dean
for research and professor of social and behavioral sciences, Harvard
School of Public Health (HSPH)
Ann Forsyth, professor of
urban planning, Harvard Graduate School of Design
Jeffry Frieden, Stanfield
professor of international peace, FAS
Archon Fung, Ford Foundation
professor of democracy and citizenship, Harvard Kennedy School
John Goldberg, Goldston
professor of law, Harvard Law School (HLS)
Rakesh Khurana, Bower
professor of leadership development, Harvard Business School,
and Master of Cabot House
Jennifer Leaning, director,
François-Xavier Bagnoud Center for Health and Human Rights, and FXB
professor of the practice of health and human rights, HSPH, and associate
professor of medicine, Harvard Medical School (HMS)
Nonie Lesaux, professor of
education, Harvard Graduate School of Education
Barbara McNeil, Watts
professor of health care policy and professor of radiology, HMS
Daniel Meltzer, Story professor
of law, HLS
Richard Mills, executive dean for
administration, HMS
John Gregory
Morrisett, Cutting professor of computer science, School of Engineering
and Applied Sciences
Jonathan Lee Walton, Plummer
professor of Christian morals and Pusey minister in the Memorial Church,
FAS, and professor of religion and society, Harvard Divinity
School
The task force is staffed by
Marilyn Hausammann, vice president for human resources; Robert Iuliano, vice
president and general counsel; Anne Margulies, vice president and chief
information officer; and Leah Rosovsky, vice president for strategy and
programs.
In his investigative report,
Keating noted:
The
mandate to the undersigned was to undertake fact-finding to determine what
occurred with regard to the email searches conducted in connection with the
academic integrity cases. The mandate did not include making any
recommendations in this report regarding how the University might revise or
improve its policies concerning such searches. The undersigned will be
available, however, to meet and consult with Professor David J. Barron, of the
Harvard Law School, who serves as Chair of the special committee charged with
considering these policy issues.
