Faculty, administrators and students often use the IT systems of educational institutions to gain access to the Internet, to visit Web sites and to send and receive emails. That is all well and good. The question arises, though, as to how much educational institutions should monitor the use of such IT systems.
Educational institutions do have an interest in ensuring that their IT systems are used properly and for legitimate purposes. For example, educational institutions do not want their IT systems to be used by faculty to allow intellectual property belonging to the institutions to be disseminated to the outside world, and they do not want students and others associated with the institutions to engage in improper speech that defames others. Monitoring of IT systems can deter such behavior and can root out problems.
Schools have an interest in making sure their IT systems are used properly, says Eric Sinrod
Furthermore, educational institutions want to do their best to avoid having viruses, worms, Trojan horses, and other malware from infecting their systems, Monitoring potentially could enable IT administrators to ascertain whether system users are taking steps to avoid practices that could lead to infection from such sources.
Still, educational institutions are considered bastions of freethinking and speech. Potential monitoring of communications on IT systems of educational institutions could be perceived as possibly undermining the higher mission of the institutions.
So, what are educational institutions to do? Should they not require users of their IT systems to agree to monitoring of user communications on their systems? Should they provide for monitoring only under certain circumstances? Or, should they allow for monitoring whenever they deem appropriate?
This author believes that educational institutions really should be able to monitor the use of their IT systems. Educational institutions, for the reasons expressed above, truly to have valid interests in proper use of their IT systems. Indeed, improper use of the systems could cause disruption or damage to the systems themselves, and potentially could subject the institutions to legal liability.
The next question is how far and wide should be the scope of the potential monitoring. One approach could be that educational institutions would only monitor communications on their IT systems if they had something akin to “probable cause” to believe that particular users are engaging in improper conduct.
This standard can create ambiguity, however. Plus, if educational institutions do not have full consent to monitor, they might run afoul of the law if they choose to monitor when it is later determined that they did not have sufficient cause. Moreover, the very ability of educational institutions to be able to monitor whenever they deem appropriate could deter users from engaging in improper conduct.
At the end of the day, this author believes that educational institutions should require users of their IT systems to agree explicitly that the institutions can monitor their IT systems whenever the institutions decide that such monitoring is appropriate.
It is true that at first blush this may cause some users to believe that Orwell’s Big Brother has arrived in the form of the IT administrators of educational institutions. But even with such general consent to monitoring, the truth of the matter is that the institutions do not have unlimited resources, and they generally will not have the time, capacity or interest to engage in so-called fishing expeditions. They will be more interested in ferreting out true problems, even though users have given consent for general monitoring.
More importantly, users simply should engage in proper communications on educational institution IT systems. If they do that, they will not have to worry about anything that unlikely monitoring would reveal.
This column was written by Eric Sinrod, an attorney at Duane Morris and a quest blogger at TechPulse 360. It was originally published at FindLaw.com.
Posted by Mark Boslet 
