PLEASE NOTE: The CIVIL LIBERTIES UNION OF HARVARD has made every attempt to make this report clear in this text-only format. However, because it was originally designed to be viewed as a hard-copy report, with a summary of conclusions, a table of contents, page numbers, and so forth, some confusion or apparent repetition may arise, despite our efforts, in this text-only format. TABLE OF CONTENTS Summary of Suggested Action by Harvard The Report on Computers at Harvard --------------------------------------------- ** Introduction ** General Principles ** Some Applications of the General Principles ** Suggested Action by Harvard ------------------------------------------------------------------------- SUMMARY OF SUGGESTED ACTION BY HARVARD I. Harvard should compile all rules on computer use into a single document. This document should specify what conduct constitutes a violation of the rules, by what process offenses are investigated and punished, and what range of punishments is applied to what offense. This document should be readily available to students. ------ II Harvard should explicitly reject any content-based restrictions on e- mail, newsgroup postings, Web pages, on other electronic communication, or on the information stored in a student's account. Harvard should change rules that prohibit content that is obscene, commercial, or annoying. In its prohibition of "harassing" e-mail, Harvard should narrowly define "harassing" as repeated, unsolicited, and personally threatening. Except where limited by HASCS's resources, Harvard should permit chain letters and mass-mailed messages; Harvard should seek technical solutions to resource problems before limiting students' ability to communicate. To the extent technologically possible, Harvard should give students the ability to screen or identify and dispose of unwanted mail without reading it. ------ III Harvard should endeavor to protect students' privacy and should make clear to students the extent to which their actions on the computer network are not private. Harvard should inform students prior to placing their personal information (such as phone numbers or ID photographs) in a publicly accessible electronic location, and Harvard should offer students an easy method to decline to have their information placed in such a location. Harvard should allow any student to receive an "unlisted" email account; for such accounts, HASCS should keep a confidential database identifying the account holders, but this information should not be accessible to the public through "finger" and similar UNIX commands. Harvard should inform students of the extent to which UNIX is a public system that enables others to find out a student's actions while on the system. ------ IV Harvard should allow anonymous and pseudonymous e-mail and newsgroup postings, though it may prohibit malicious or reckless impersonation. ------ V Wherever resources allow, Harvard should give individuals and student groups equal access to electronic communication. ------ VI Harvard should prohibit administrators from accessing a student's account, except when authorized by the student or when taking action necessary to the technical maintenance of the system. When a need for such maintenance arises, administrators should make reasonable attempts to warn students in advance of accessing their accounts. ------ VII Through an open application process, Harvard should increase the student representation on the Committee on Information Technology, which advises the Faculty on Harvard's rules for computer use. This committee should endeavor to make the Harvard community aware of its proceedings and to consider the opinions of students in its decisions. ----------------------------------------------------------------------------- The Civil Liberties Union of Harvard's REPORT ON COMPUTERS AT HARVARD INTRODUCTION Computer use has become an integral part of the academic and social life of the members of the Harvard community. Debates on campus occur as much on computer newsgroups as in student papers or on kiosks. To locate information, many students now look first to the World Wide Web and Gopher and only then to the Harvard libraries: even at that point, many first turn to the HOLLIS computerized card catalogue. Students' network computer accounts are as likely to contain their academic projects and personal files as are their desk drawers and filing cabinets. Perhaps most importantly students are tied by e-mail to campus organizations, to their friends on campus, and to their associates at other schools around the world. The computer network of the Faculty of Arts and Sciences (FAS) is administered by the Harvard Arts and Sciences Computer Services (HASCS). The Committee on Information Technology oversees HASCS and advises the Faculty Council on Harvard's rules for the use of this computer network; this committee consists of twelve members of the faculty and administration and two students, one from the College and one from the Graduate School of Arts and Sciences (GSAS). The Committee, the College and GSAS Administrative Boards, and the Faculty have had to grapple with creating rules for unprecedented situations. Many students' rights are implicated in students' use of Harvard's computer network. To the extent that students use computers to contribute to public debates and to take part in private communication, they must be concerned that their rights to freedom of speech are protected. To the extent that students keep personal, private information in their accounts, they must be concerned that their privacy is secure. The Harvard administration has always been concerned to structure its rules so as to protect the rights of its students and to grant students those rights that civil and academic society demand, even where the university is not legally bound to do so. However, the speed with which Harvard's computer network has become a part of campus life has been so great that Harvard's current rules on computers in many ways do not conform to the university's tradition of respect for students' rights. The Civil Liberties Union of Harvard has issued this report to aid Harvard in designing and redesigning its rules on computer use. Included are general principles that should guide Harvard's decisions on the subject, an application of these principles to specific aspects of computer use, and a discussion of areas where Harvard should take immediate action to secure students' rights on the network. CLUH recognizes that there may be practical limitations on Harvard's ability to take action in these areas immediately. However, CLUH hopes that based on this report's conclusions and suggestions, the Harvard administration will make every effort to construct its rules so as to protect the rights, liberties and basic expectations of the University's students. -------------------------------------------------------------------- GENERAL PRINCIPLES THE PROCESS. In all cases, the rules under which students live should be public and clear. Students should know in advance what conduct constitutes offenses, by what procedure offenses are judged, and what range of punishments is applied to what offenses. Computer offenses should be punished by the normal bodies for the punishment of all student offenses, e.g., in the College, the Administrative Board or the Student-Faculty Judicial Board. ------ FREEDOM OF SPEECH. Computer communication should receive all of the same protections that the university provides for spoken, written, and telephonic speech. Wherever consistent with the function of the electronic forum involved, Harvard should not censor communication on its computer network. Harvard should seek to maximize the access of members of the Harvard community to forums of electronic communication. Whenever possible, all individuals should have equal access to the functions of the computer network, and no priority should be given to groups. When necessary, criteria pertinent to the limitations of the forum, and not merely the "official" recognition of certain activities or groups, should be established to limit privileges, e.g., if it is necessary to limit access to newsgroups, frequency of use rather than the official recognition of the group sponsoring them might be chosen as the key criterion. ------ PRIVACY. The information stored in students' accounts should be as protected from intrusion as their personal effects in their rooms. Access should be prohibited to this information at all times to people (other than university officials) who have not been granted access by the owner of the account. Access should be prohibited to university officials unless they are involved in operations necessary to the technical maintenance of the system. Technical maintenance consists of those activities necessary to preserve the functionality of the system; it does not include activities conducted to discover or prevent violations of University rules (just as the similar maintenance clause in Harvard's dormitory agreements does not permit university officers to search students' rooms for rules violations.) ------ LIMITATIONS OF TECHNOLOGY OR RESOURCES. Where Harvard is unable to provide students with their complete rights because of limitations of technology or resources, it should strive to maximize the rights of students, consistent with these limitations of technology of resources. Harvard may prohibit any activity intended or likely to disable the computer network or the functionality of any student's account. ------ VIOLATIONS OF THE LAW The above notwithstanding, Harvard may prohibit from occurring on its computers anything that is, in the opinion of Harvard's Office of the General Counsel, a violation of law; likewise, Harvard may honor warrants and subpoenas issued by the courts. ------------------------------------------------------------------------------ SOME APPLICATIONS OF THE GENERAL PRINCIPLES NETWORK ACCOUNTS AND ACTIVITY Harvard should only deny accounts to students or revoke students' accounts as punishment for an incident involving computer use. Harvard should not prohibit students from acquiring, transmitting to willing recipients, or keeping in their accounts any files, except those that are illegal to possess. Administrators should have access to information in a student's account only when necessary for the technical maintenance of the FAS network, or where law requires (as when a court has ordered the access). Information recorded by HASCS about a student's activities (such as Log files) and stored other than in his or her account should be treated as confidential, and released only to the College or GSAS Administrative Board, upon request. Harvard should inform students about technical limitations on HASCS's ability to maintain the security of this information. ------ PERSONAL DATA STORED IN PUBLIC LOCATIONS. Students should be made aware, at the beginning of each academic year, of what personal information about them (e.g., phone numbers or addresses) is to be stored electronically in publicly accessible locations. They should be provided a simple means by which to prevent this information from being made public. Students should also be made aware of the extent to which UNIX is a public system that allows users to learn, through such commands as "finger," what other users are doing. Harvard should allow students to have "unlisted" network accounts, for which their personal information will not be stored in those files accessible by commands such as "finger." ------ E-MAIL. Harvard should not censor e-mail based on its content, e.g., its obscene, vulgar, or commercial nature, except that Harvard may prohibit violations of law. Unsolicited e-mail, like unsolicited U. S. mail, should not be prohibited, though Harvard should, to the extent technologically possible, make available means for students easily to screen out or intercept undesired mail. Harvard may prohibit "harassing" e-mail provided it narrowly defines "harassing" as repeated, personally threatening e-mail. Harvard should allow mass- mailing and the sending of chain letters, unless limitations of resources make this impossible. ------ MAILING LISTS. Both student groups and individuals should be allowed to create official mailing lists managed by HASCS, which, like other e-mail, should not be censored by Harvard. Both student-moderated and un- moderated lists should be available. The creator/owner of the mailing list should be allowed to restrict membership, but a member should have the right to be withdrawn from the list at his or her request. ------ NEWSGROUPS MAINTAINED BY HARVARD. Harvard should allow groups or individuals to establish newsgroups; these may be moderated and censored by these students or may be un- moderated. Harvard may establish newsgroups that the administration moderates by prohibiting messages that are not relevant to the newsgroup's stated purpose (e.g., a for-sale notice on a newsgroup designated for announcements of upcoming events). On these newsgroups, Harvard may attach warnings and disclaimers to postings that the administrators believe readers may find offensive, but should not prohibit the offensive messages. Also, Harvard may establish its own, "official," newsgroups, which it may censor for any reason and the postings on which are given the university's imprimatur. Harvard may not "take over" the moderation of existing un-moderated or student-moderate newsgroups. ------ NEWSGROUPS NOT MAINTAINED BY HARVARD. On any student's request, Harvard should add non-Harvard newsgroups to the list of those accessible to Harvard students for both reading and posting; if not used with sufficient frequency to justify the resources being allocated, Harvard may remove these newsgroups. ------ FTP (FILE TRANSFER PROTOCOL). Harvard should impose no content-based restrictions on what a student may acquire by FTP, except that Harvard may prohibit violations of law. ------ VINE (THE VERITAS INFORMATION NETWORK). Individuals and unofficial student groups with announcements to post on VINE should be able to do so just as official student groups, faculty departments, house committees, and others are currently permitted to do so. No students should be denied the right to post information, although VINE administrators may place warnings or disclaimers on messages that they believe viewers will find offensive. ------ WORLD WIDE WEB PAGES AND GOPHER INFORMATION. Students, as individuals or as groups, should be allowed to create Web pages and Gopher sites. Harvard should in no way censor this information, except that it may prohibit violations of law. ------ IDENTITY. Harvard should allow the sending of anonymous or pseudonymous e- mail, or similar postings to newsgroups, though it may prohibit malicious or reckless impersonation. ---------------------------------------------------------------------------- SUGGESTED ACTION BY HARVARD I. HARVARD SHOULD COMPILE ALL RULES ON COMPUTER USE INTO A SINGLE DOCUMENT. THIS DOCUMENT SHOULD SPECIFY WHAT CONDUCT CONSTITUTES A VIOLATION OF THE RULES, BY WHAT PROCESS OFFENSES ARE INVESTIGATED AND PUNISHED, AND WHAT RANGE OF PUNISHMENTS IS APPLIED TO WHAT OFFENSE. THIS DOCUMENT SHOULD BE READILY AVAILABLE TO STUDENTS. Harvard's rules are currently dispersed among various publications, including the Handbook for Students: 1994-1995 and the pamphlet Computer Rules and Etiquette; other rules can be found on-line at VINE. This makes it very difficult for concerned students to be aware of all of the rules pertinent to their activities. Often, these sources only vaguely explain what is prohibited. Computer Rules and Etiquette is the most thorough source for these rules, yet its largest component, "The Do's and Don'ts," states that it "does not distinguish computer rules from good etiquette."(p.2) In both this document and the Handbook for Students, students are told in effect "to be good" with little more specificity: for example, the Handbook for Students states that "The University expects students to be careful, honest, responsible and civil . . ."(p.71) and Computer Rules and Etiquette states "If you wouldn't say it face-to-face, don't put it in E-mail."(p.2) There are many other examples of such sweeping, general statements. In terms of procedures, students are only informed (in "Policies on the Use of FAS Computers" found in Computer Rules and Etiquette), that HASCS will notify a student's Senior Tutor or Freshman Advisor in the case of suspected wrongdoing, and that that officer "will determine the course of any investigation or disciplinary action."(p.6) Students are not told whether their case will be decided through the regular Administrative-Board process, or through some separate process. Graduate students, also covered by HASCS's rules, are left wondering if this passage means that the College Administrative Board handles all cases concerning computer use, or whether the GSAS Administrative Board handles cases involving graduate students. Finally, nowhere are students informed of the range of punishments that correspond to the various computer offenses. ------ II. HARVARD SHOULD EXPLICITLY REJECT ANY CONTENT- BASED RESTRICTIONS ON E-MAIL, NEWSGROUP POSTINGS, WEB PAGES, ON OTHER ELECTRONIC COMMUNICATION, OR ON THE INFORMATION STORED IN A STUDENT'S ACCOUNT. HARVARD SHOULD CHANGE RULES THAT PROHIBIT CONTENT THAT IS OBSCENE, ANNOYING, OR COMMERCIAL. Currently, the Handbook for Students reads, Harvard neither sanctions nor censors individual expression of opinion on its systems. The same standards of behavior, however, are expected in the use of electronic mail as in the use of telephones and written and oral communication. Therefore electronic mail, like telephone messages, must be neither obscene nor harassing . . . and should not be sent as chain letters or "broadcast" indiscriminately to large numbers of individuals. (p.72). Obscene, vulgar, or distasteful communication, as well as some communication generally called "harassing" is all a part of the exchange of ideas. Harvard has always been committed to the robust and even heated debate, and in traditional forums has generally protected students' rights to communicate even controversial, heated opinions. See, for example, the pamphlet Free Speech Guidelines. In keeping with this tradition of tolerance for free expression, and as a necessary part of free and open debate, Harvard should avoid any content-based censorship. Computer Rules and Etiquette states, "Do not use your account for commercial purposes." It is true that Harvard has a legitimate concern to prohibit commercial activity that could reasonably be attributed to it as an institution; therefore, Harvard should expressly disclaim in its rules such responsibility. However, students as individuals should be allowed to carry out commercial activity on their own behalf: then they could use electronic communication for such purposes as the selling of artistic creations and the purchasing of tickets to special events. Even files designed to attack computer security systems should not be prohibited; student organizations and individuals may use their accounts to acquire or store such programs, which they may then use for the legitimate purpose of testing security systems on their own computers. Harvard may, however, enact the strictest prohibitions and steepest penalties for the use of such programs against Harvard's security systems. IN ITS PROHIBITION OF "HARASSING" E-MAIL, HARVARD SHOULD NARROWLY DEFINE "HARASSING" AS REPEATED, UNSOLICITED, AND PERSONALLY THREATENING. Without such a narrow definition, Harvard may punish speech because of its content, and not because of the particularly unacceptable form in which it is presented. EXCEPT WHERE LIMITED BY HASCS'S RESOURCES, HARVARD SHOULD PERMIT CHAIN LETTERS AND MASS- MAILED MESSAGES; HARVARD SHOULD SEEK TECHNICAL SOLUTIONS TO RESOURCE PROBLEMS BEFORE LIMITING STUDENTS' ABILITY TO COMMUNICATE. Students' right to transmit these messages should not be limited because such letters constitute an annoyance to the recipient. Harvard should prohibit these activities only upon solid evidence that such messages would be sent in such numbers as not merely to constitute an annoyance but instead to decrease the functionality of the network. Before restricting students' rights to such communication, Harvard should exhaust technological solutions, such as the using of pointers to minimize the burden of mass-mailing. TO THE EXTENT TECHNOLOGICALLY POSSIBLE, HARVARD SHOULD GIVE STUDENTS THE ABILITY TO SCREEN OR IDENTIFY AND DISPOSE OF UNWANTED MAIL WITHOUT READING IT. Harvard should strive, without censoring or restricting the sending of messages, to provide students with the means to select which messages they wish to view. Among other actions, Harvard should publicize the existence of such programs as the Elm Filter, which allows students to instruct the computers to destroy mail sent to them from given sources or on given subjects, or based on other conditions. Another possibility is for Harvard to mark all messages sent to more than one recipient with a label identifying them as such, thus giving students warning that the letter was not personally addressed to them. ------ III. HARVARD SHOULD ENDEAVOR TO PROTECT STUDENTS' PRIVACY AND SHOULD MAKE CLEAR TO STUDENTS THE EXTENT TO WHICH THEIR ACTIONS ON THE COMPUTER NETWORK ARE NOT PRIVATE. Ensuring students' privacy on the computer network has always been one of Harvard's main goals. The following should help to achieve this end more fully. HARVARD SHOULD INFORM STUDENTS PRIOR TO PLACING THEIR PERSONAL INFORMATION (SUCH AS PHONE NUMBERS OR ID PHOTOGRAPHS) IN A PUBLICLY ACCESSIBLE ELECTRONIC LOCATION, AND HARVARD SHOULD OFFER STUDENTS AN EASY METHOD TO DECLINE TO HAVE THEIR INFORMATION PLACED IN SUCH A LOCATION. Currently, Harvard maintains publicly accessible databases with information such as students' phone numbers and addresses. Often students are unaware that this information is public. Recent freshman classes have been given some ability, at registration, to determine what information is placed in a public location, but upperclassmen have not been told in a systematic way either that information is being posted or that they have the right to refuse to have it posted. HARVARD SHOULD ALLOW ANY STUDENT TO RECEIVE AN "UNLISTED" E-MAIL ACCOUNT; FOR SUCH ACCOUNTS, HASCS SHOULD KEEP A CONFIDENTIAL DATABASE IDENTIFYING THE ACCOUNT HOLDERS, BUT THIS INFORMATION SHOULD NOT BE ACCESSIBLE TO THE PUBLIC THROUGH "FINGER" AND SIMILAR UNIX COMMANDS. Harvard should allow students to have their accounts not publicly listed with their real name; HASCS should maintain a separate, confidential database that identifies such account holders for the University. Under this system, students will be able to restrict knowledge of their network identity to the University and to their acquaintances; UNIX commands such as "finger" and "who" will not make their identity publicly accessible. This would be a great benefit to students who have been receiving unsolicited and undesired e-mail and for those students whose achievements or family have made them public figures. HARVARD SHOULD ENDEAVOR TO INFORM STUDENTS OF THE EXTENT TO WHICH UNIX IS A PUBLIC SYSTEM THAT ENABLES OTHERS TO FIND OUT A STUDENT'S ACTIONS WHILE ON THE SYSTEM. The nature of the UNIX system, by which most students make use of Harvard's network, is that it is public. Commands such as "finger" reveal information about a student's activities on the network and cannot be de-activated on individual basis. Skilled computer users can access even more detailed information about a student; moreover, system security has limits and even data theoretically restricted to system administrators can be accessed by determined hackers. Harvard should make the public nature of the UNIX system known to students and should also inform them of more private, secure systems that they have the option of using, such as VMS. ------ IV. HARVARD SHOULD ALLOW ANONYMOUS AND PSEUDONYMOUS E-MAIL AND NEWSGROUP POSTINGS, THOUGH IT MAY PROHIBIT MALICIOUS OR RECKLESS IMPERSONATION. Currently, the Handbook for Students reads, "[M]essages must not misrepresent the identity of the sender." (p.72) However, students have legitimate uses for desiring to disguise their identity. For example, because of the stigma many in society still attach to homosexuality, a person might want to contribute to a discussion on a gay-issues newsgroup without making his or her identity public. Harvard does not prohibit anonymous sending of letters through US mail, and the same tolerance should be shown for electronic mail. ------ V. WHEREVER RESOURCES ALLOW, HARVARD SHOULD GIVE INDIVIDUALS AND STUDENT GROUPS EQUAL ACCESS TO ELECTRONIC COMMUNICATION. Currently, postings to VINE, the maintenance of a Gopher site, and other privileges are restricted to official student groups and other privileged entities such as house committees. However, electronic communication is an important aspect in the lives of individuals throughout the Harvard community, as individuals and not merely because of the organizations to which they belong. Wherever possible, Harvard should extend the same rights to post pertinent information to all students and groups of students in the Harvard community. ------ VI. HARVARD SHOULD PROHIBIT ADMINISTRATORS FROM ACCESSING A STUDENT'S ACCOUNT, EXCEPT WHEN AUTHORIZED BY THE STUDENT OR WHEN TAKING ACTION NECESSARY TO THE TECHNICAL MAINTENANCE OF THE SYSTEM. WHEN A NEED FOR SUCH MAINTENANCE ARISES, ADMINISTRATORS SHOULD MAKE REASONABLE ATTEMPTS TO WARN STUDENTS IN ADVANCE OF ACCESSING THEIR ACCOUNTS. Currently, the Handbook for Students notes that administrators can make unauthorized access "to ensure compliance with other University Rules."(p.72) Harvard would not attempt to patrol students' rooms and file cabinets to ensure adherence to rules, and should accord to computer accounts a similar zone of privacy. Harvard's rules should state that when officers of the university have reason to suspect that evidence of violations of rules exists in a student's account, they should follow the same procedures before accessing the account that officers would follow when investigating violations of rules in a student's room. ------ VII. THROUGH AN OPEN APPLICATION PROCESS, HARVARD SHOULD INCREASE THE STUDENT REPRESENTATION ON THE COMMITTEE ON INFORMATION TECHNOLOGY, WHICH ADVISES THE FACULTY ON HARVARD'S RULES FOR COMPUTER USE. THIS COMMITTEE SHOULD ENDEAVOR TO MAKE THE HARVARD COMMUNITY AWARE OF ITS PROCEEDINGS AND TO CONSIDER THE OPINIONS OF STUDENTS IN ITS DECISIONS. Currently, this committee consists of twelve deans and professors and only two students, one from the College and one from the GSAS. The student members are not selected through an open, publicized, application process. This committee, which is responsible for advising the Administrative Boards and the Faculty Council on Harvard's rules for computer use, is relatively unknown to the Harvard community and even within the Harvard administration. The committee should be re-constituted so as to have its student representation equal to the combination of its administrative and faculty representation. The student members of this committee should be selected from the community at large, based on the applications of interested students. Membership on the committee should not depend on membership in any student organization. These changes will make the committee a suitable body to respond to students' concerns about the basic rights that are bound up in Harvard's rules on computer use. The committee should endeavor to publicize its meetings and to hold open hearings in which interested members of the Harvard community can express their concerns. -----