Investigating Harvard’s E-mail Investigations
During the Faculty of Arts and Sciences (FAS) meeting last April 2—at which dean Michael D. Smith and President Drew Faust revealed that further University investigations of e-mail accounts had been undertaken during a wide-ranging Administrative Board investigation of student cheating on a spring 2012 final exam—Faust announced two concrete actions: an external review of the adequacy of the fact-finding concerning the e-mail investigations; and the formation of a University policy-setting committee. The report of the former has just been released.
Boston attorney and Law School alumnus Michael B. Keating’s “Report to the Subcommittee of the Harvard Corporation on E-Mail Searches Conducted in Connection with the Academic Integrity Cases,” describing him as counsel to the subcommittee, was dated July 15 (see report here). Its executive summary for the first time provides a clear account of the brief period within which all of the e-mail account searches took place, and of the targets of those searches, which extended to resident deans’ communications with student advisees (presumably students concerned about their involvement in the Administrative Board misconduct investigation) and with reporters for The Harvard Crimson (and, it turns out, The Boston Globe). It reads:
Between September 12, 2012 and September 15, 2012, three separate searches of email accounts occurred. The first search involved the search of log files that included all of the Resident Deans’ administrative email accounts to determine if any Resident Dean had forwarded a confidential email, with the subject line “case process,” that had been sent on August 16, 2012 (hereafter “the ‘case process’ email”), to all of the Resident Deans by John “Jay” Ellison, Associate Dean of Harvard College, who serves as Secretary of the Administrative Board. That search revealed that a Resident Dean (hereafter referred to as “Resident Dean X”) had transmitted the “case process” email to one of the students whom Resident Dean X advised. The second search involved log and mailbox searches of Resident Dean X’s administrative account to determine if Resident Dean X had forwarded the “case process” email, or other confidential information, to two named reporters for The Harvard Crimson. That search found no indication that Resident Dean X had transmitted the “case process” email, or any other confidential information, to The Crimson reporters. The third search occurred following a meeting at which Resident Dean X admitted having forwarded the “case process” email to a student (and after Resident Dean X later acknowledged having forwarded the same email to a second student as well). That search was a mailbox search of Resident Dean X’s administrative and personal email accounts to determine if Resident Dean X had forwarded the “case process” email to any other student or exchanged emails with the two previously identified Crimson reporters. That search revealed that Resident Dean X had forwarded the “case process” email to two students, both advisees of Resident Dean X, and that Resident Dean X had also exchanged emails with one of The Crimson reporters.
Thus, as previously indicated, the resident dean involved shared information with students, but did not forward the Administrative Board document in question, or other confidential information, to student reporters. A third search, probing further into the resident dean’s contact with reporters, covered the resident dean’s personal e-mail account, as well as the dean’s administrative account.
In the course of the searches, Keating’s report reveals, metadata for some 14,000 e-mail accounts maintained within Harvard were scanned, and 17,000 e-mail accounts maintained by an outside vendor were scanned.
The executive summary also notes that beyond conducting the searches with the outside vendor, Harvard University Information Technology (HUIT)
“archived” or made copies of all of the Resident Deans’ administrative accounts for possible review at a later date. No further review of these administrative accounts was made, however. HUIT also archived Resident Dean X’s personal email account.
The summary concludes that all the searches “were undertaken in good faith,” by people who “believed that they were acting in compliance with applicable email privacy policies.” There was no intentional violation of any requirement that resident deans be notified about the searches (a point of ambiguity in University policies), and “there is no evidence that any of the individuals involved read the content of any emails that were identified as a result of these searches.”
The full report recounts the history of the academic-misconduct case, the August 16 memo to resident deans from Ellison in his capacity as Secretary of the Administrative Board, and the Crimson’s August 31 request—with a copy of the August 16 memo in hand—to discuss it with him, before it published an article on the contents the next day. That story, Keating’s report notes, included the information that a resident dean had confirmed Ellison’s original dissemination of his memorandum; the Crimson did not say how it got the memo, pointing neither to the resident dean nor any other source.
In fact, the resident dean (discussed in the summary above) had confirmed Ellison’s distribution of the memorandum in a conversation with a Crimson reporter on August 30 but, according to Keating’s report, refused to comment further. The resident dean, subsequently, explicitly told the reporter in an e-mail that the reporter could not use the information (about the resident dean’s confirmation that it had been circulated); and after the Crimson article appeared on September 1, the resident dean told Ellison and the senior resident dean that he or she had spoken with the Crimson in violation of Ellison’s instruction, and had expressly told the reporter that any use of the information provided was impermissible.
With that knowledge in hand, Ellison and Harvard College dean Evelynn M. Hammonds (chair of the board) raised the issue of “leaks” (the Keating report’s quotes) at the September 4 Administrative Board meeting; asked for information about how the August 16 memorandum had reached the Crimson; and warned that further investigation would be needed if information were not forthcoming. There is no evidence, Keating notes, that resident deans were put on notice that e-mail accounts might be searched.
After further news reports about the investigation on IvyGate Blog and in the Crimson, the latter noting that athletes were implicated in the misconduct investigation and had taken leaves of absence (to maintain athletic eligibility in future seasons); Crimson reports on the course in question, on possible disciplinary actions students might face, and on the Administrative Board’s need for help to process the large volume of instances of possible misconduct; and Boston Globe inquiries, administrators became concerned, the Keating report says, about a “pipeline” from the board leaking information, possibly comprising confidential investigations and the privacy of student records. The initial e-mail searches were then authorized, following a September 12 telephone conference call among FAS Dean Smith, Hammonds, and Ellison (who had contacted Harvard’s Office of the General Counsel [OGC] about a possible search the day before, according to the Keating report; the report says President Faust did not learn about the searches until March 2013).
Some of the searches necessarily were conducted by an outside vendor, because 15 resident deans’ accounts were hosted outside Harvard. For the two hosted by HUIT, certain searches could not be conducted, so the resident deans’ accounts were searched internally for e-mail to or from Globe reporter Mary Carmichael; no e-mails were found between those two accounts and Carmichael, and no further searches were conducted.
As the Keating report makes clear, the searches were apparently conducted within OGC’s interpretation of some, but not all, of the University’s existing e-mail privacy policies (some of which, it became clear after the fact, overlap or are inconsistent or leave gaps). The searches were conducted with considerable urgency, with an OGC attorney instructing an HUIT employee to proceed in a memorandum at 10:10 p.m. on September 12. In the course of the various searches, “The entire log file for all accounts hosted by HUIT (approximately 14,000 accounts on the UNIX email platform) was scanned with the metadata available which included the time and recipient.” Similarly, the outside vendor’s search encompassed review of “the entire log file (which included metadata from approximately 17,000 accounts on the Windows email platform) …in order to determine whether the ‘case process’ email had been forwarded by any sender to any recipient.”
In searches of the identified resident dean’s account to determine whether he or she had been in contact with the Crimson reporters, the searches were ultimately extended back as far as January 1, 2012—several months before the academic misconduct under investigation by the Administrative Board had occurred—and no such e-mails were found, the Keating report concludes.
After the resident dean disclosed that he or she had forwarded the August 16 Ellison memorandum to two students, both athletes, Hammonds authorized further searches of the resident dean’s administrative and personal accounts, looking for communications with students and with the Crimson reporters to whom Ellison’s memorandum might have been distributed. The Keating report says Hammonds did not consult with Dean Smith about these further searches, and that he learned about them in March 2013. These searches, the report says, confirmed what the resident dean told Hammonds.
The Keating report makes clear the mechanics of “log” and “mailbox” searches undertaken, and adds the detail that the searches involved multiple ways of examining multiple e-mail accounts under each of the three search authorizations disclosed previously, reaching not only resident deans’ accounts but also e-mails exchanged with accounts of student reporters for the Crimson (Harvard accounts and a Gmail account) and e-mail traffic to and from the Boston Globe higher-education reporter (none of which were from the resident deans’ accounts hosted by HUIT).
The report concludes:
The email searches of the Resident Deans’ accounts described above arose in the context of an unprecedented event in the history of the University in which as many as 125 undergraduates were suspected of conduct inconsistent with academic integrity. Under University rules, it was the responsibility of the Administrative Board to resolve these cases. Confronted with credible evidence that the guaranteed confidentiality of the Administrative Board’s communications had been compromised, and concerned that the identities of affected students might be disclosed, University and FAS administrators felt compelled to identify the source of the disclosures. The intense media attention on the academic integrity cases and the manner in which the Administrative Board was handling them heightened the concern about any possible disclosures of confidential information, whether intentional or by accident. Time was also of the essence, because the cases had been pending for months, and the students were entitled to hearings that were both fair and expeditious. Faced with inadequate University policies governing the privacy of email communications, FAS Administrators acting in good faith undertook the searches described in this Report in order to proceed with and complete the disciplinary proceedings of the Administrative Board and to protect the confidentiality of that process. The Administrative Board was able to complete its review of the academic integrity cases arising from this episode with no further breach of confidentiality.
Presidential and Corporation Comment
In a statement on the report, President Faust reiterated that she had asked Keating to examine what had happened, believing “that whatever the conclusions each of us might draw about judgments made at the time, all actions related to the searches were undertaken in good faith, fueled first and foremost by a sense of responsibility for protecting the confidentiality of our students and the disciplinary process” and that “our policies, procedures and protocols regarding the privacy of e-mail communications were insufficient, poorly understood, and variably implemented. For better and for worse, Mr. Keating’s report confirms both those assumptions.” She continued:
I am reassured by Mr. Keating’s conclusion that the individuals involved in the searches were acting in good faith, in a manner they believed to be consistent with applicable policy and with a guiding responsibility for safeguarding student confidentiality and the integrity of the Ad Board process.
Unfortunately, the detailed factual account in Mr. Keating’s report deepens my already substantial concerns about troubling failures of both policy and execution. The findings strengthen my view that we need much clearer, better, and more widely understood policies and protocols in place to honor the important privacy interests that we should exercise the utmost vigilance to uphold. A university must set a very high bar in its dedication to principles of privacy and of free speech; these are fundamental and defining values of our academic community. The searches carried out last fall fell short of these standards, and we must work to ensure that this never occurs again. I am grateful that Professor David Barron and the task force I have appointed on electronic communications policy will be creating recommendations for guidelines that will assist us in achieving that goal. Michael Keating’s insights and observations will make a critical contribution to that work. In the meantime, I will be announcing before the start of the fall semester interim protocols governing any searches of e-mails at the University.
Separately, Corporation member William F. Lee said:
Mr. Keating found those involved in the searches to have acted in good faith and with a guiding desire to safeguard the confidentiality of the Ad Board process. That aspect of his report is reassuring. His detailed account of how these searches were done, however, makes it even clearer than before that there is much work ahead in improving the University's policies and protocols concerning privacy of, and access to, electronic communications. The committee appreciates the willingness of Professor David Barron and his task force to take on that important work and to learn from this episode as we look forward.
Given that the April 2 disclosures rendered inadequate and incomplete a March statement by Smith and then-dean of the College Hammonds (chair of the Administrative Board during the academic-misconduct investigation; Hammonds’s service as dean concluded on June 30) that spoke of a single review of resident deans’ e-mail accounts to trace the possible disclosure of confidential board information, Faust said then:
Dean Smith, Dean Hammonds, and I want to be sure that we now have a full understanding of the searches that were undertaken. To that end, I am asking Michael Keating, a leading Boston lawyer from outside Harvard, to take the necessary steps to verify that the information we have discussed today is, as we believe, a full and accurate statement of the searches and to report to me.
Keating, LL.B. ’65, is a partner and past chair of the litigation department at Foley Hoag, and a past trustee of Williams College, his undergraduate alma mater. He was charged, in other words, with conducting an outside review to determine whether all the facts about the investigation as reported to the faculty in the expanded, second airing of the issue were known and the situation was then completely understood. As The Harvard Crimson subsequently reported, it was later decided that Keating would deliver his report to a committee comprising Corporation members Lawrence S. Bacow, William F. Lee, and Theodore V. Wells Jr., and Faust, with information to be shared with the wider community. According to a statement issued by Lee:
At the request of a Corporation committee, Mr. Keating’s review is focusing on the facts bearing on any searches of e-mail or e-mail metadata done in connection with the Administrative Board proceedings relating to a take-home exam in a spring 2012 undergraduate course.
In addition to discussing his findings with the Corporation committee, he will prepare a written report, with appropriate regard for confidentiality, that will be shared with the Harvard community. He aims to finish his work by June 30.
Faust’s second initiative, announced April 2, was to form a task force
to develop recommendations on a set of policies and guidelines about email privacy. Those recommendations will be submitted for community discussion and Corporation consideration by the end of the fall term. I am pleased to report that Professor David Barron, the S. William Green Professor of Public Law at Harvard Law School, has agreed to chair this task force. Professor Barron is a graduate of the College—a history concentrator—and of Harvard Law School. He worked as a journalist early in his career, served as a Supreme Court clerk, and recently completed two years of service heading the Justice Department’s Office of Legal Counsel in Washington. I am very grateful to him for agreeing to lead this process. The task force will draw members from across the University and will be broadly consultative in its work.
As reported, the task force members were appointed and began their work last May 6, before the spring semester concluded. Its detailed charter, from Faust, reads:
The task force will consider and recommend appropriate policies regarding access to, and confidentiality of, electronic communications that rely on university information systems. It will consult with faculty, staff, and students in order to obtain a full understanding of the perspectives of each group.
In undertaking its work, the task force will inform itself about policies now in place at Harvard and other relevant institutions and solicit perspectives and advice on best practices.
The task force will consider whether and to what extent Harvard’s policies should be University-wide or specific to certain parts of the University or particular institutional roles and responsibilities.
The task force will be expected to focus on recommending policies for the future that are both principled and practicable and that account for the reasonable expectations of individuals, the legitimate interests of the University, and associated issues of notice and process. The task force is not expected to investigate or render judgments on past events, but rather to take general account of instructive examples at Harvard and elsewhere as one means to understand the complex of considerations that can inform sound recommendations for the future.
Joining Barron are:
- Patricia Byrne, executive dean, Harvard Divinity School
- Emma Dench, professor of the classics and of history, FAS
- Karen Emmons, associate dean for research and professor of social and behavioral sciences, Harvard School of Public Health (HSPH)
- Ann Forsyth, professor of urban planning, Harvard Graduate School of Design
- Jeffry Frieden, Stanfield professor of international peace, FAS
- Archon Fung, Ford Foundation professor of democracy and citizenship, Harvard Kennedy School
- John Goldberg, Goldston professor of law, Harvard Law School (HLS)
- Rakesh Khurana, Bower professor of leadership development, Harvard Business School, and Master of Cabot House
- Jennifer Leaning, director, François-Xavier Bagnoud Center for Health and Human Rights, and FXB professor of the practice of health and human rights, HSPH, and associate professor of medicine, Harvard Medical School (HMS)
- Nonie Lesaux, professor of education, Harvard Graduate School of Education
- Barbara McNeil, Watts professor of health care policy and professor of radiology, HMS
- Daniel Meltzer, Story professor of law, HLS
- Richard Mills, executive dean for administration, HMS
- John Gregory Morrisett, Cutting professor of computer science, School of Engineering and Applied Sciences
- Jonathan Lee Walton, Plummer professor of Christian morals and Pusey minister in the Memorial Church, FAS, and professor of religion and society, Harvard Divinity School
The task force is staffed by Marilyn Hausammann, vice president for human resources; Robert Iuliano, vice president and general counsel; Anne Margulies, vice president and chief information officer; and Leah Rosovsky, vice president for strategy and programs.
In his investigative report, Keating noted:
The mandate to the undersigned was to undertake fact-finding to determine what occurred with regard to the email searches conducted in connection with the academic integrity cases. The mandate did not include making any recommendations in this report regarding how the University might revise or improve its policies concerning such searches. The undersigned will be available, however, to meet and consult with Professor David J. Barron, of the Harvard Law School, who serves as Chair of the special committee charged with considering these policy issues.