From Academic Misconduct to E-mail Investigation

The investigation of academic misconduct during an undergraduate final examination in the spring of 2012—initially reported last August, and officially concluded with the February 1 announcement of disciplinary actions affecting dozens of students—was revived in an unexpected way this past weekend. The Boston Globe reported in a front-page, March 10 story that, as the headline and subtitle put it, “Harvard checked deans’ e-mails” and “Chasing leak in cheating scandal may have invaded privacy.”

The story was picked up by The New York Times (“Harvard Searched E-Mails for Source of Media Leaks”) and followed up on March 11 (“Harvard Search of E-Mail Stuns Its Faculty Members”).

On Monday, Faculty of Arts and Sciences dean Michael D. Smith and Harvard College dean Evelynn M. Hammonds issued a statement detailing the investigation from their perspective. (The full text appears at the bottom of this dispatch.) Hammonds chairs the Administrative Board (AB), the body that conducted the academic misconduct investigation. Smith and University vice president and general counsel Robert Iuliano invited Harvard Magazine to University Hall shortly after noon to review the statement and the underlying events.

This report summarizes the facts as now known.

The Boston Globe Report

The Globe reported:

Harvard University central administrators secretly searched the email accounts of 16 resident deans last fall, looking for a leak to the media about the school’s sprawling cheating case, according to several Harvard officials interviewed by the Globe.

The resident deans sit on Harvard’s Administrative Board, the committee charged with handling the cheating case. They were not warned that administrators planned to access their accounts, and only one was told of the search shortly afterward.

[According to the board’s website, for disciplinary matters, “Students have an official representative on the Administrative Board who will act as their liaison in any Board matter. Ordinarily, a student’s representative to the Board is his or her Resident Dean of Freshmen or Allston Burr Resident Dean. The role of the Board Representative is to present to the Board a full summary of the facts of any petition or case, making certain the student’s “voice” is heard. The Board Representative (and the resident dean if the student is working with an alternate) abstains from voting on all matters directly related to students whom he or she represents.”]

The dean who was informed had forwarded a confidential Administrative Board message to a student he was advising, not realizing it would ultimately make its way to the Harvard Crimson and the Globe and fuel the campus controversy over the cheating scandal.

All the Harvard officials interviewed by the Globe declined to identify the dean, although one said no punishment had been involved.

The other 15 deans were left unaware their email accounts had been searched by administrators until the Globe approached Harvard with questions about the incident on Thursday, having learned of it from multiple Harvard officials who described it in detail. Those officials asked for anonymity out of fear of reprisal.

Harvard administrators said they would inform the remaining deans today—almost six months after the search.

The deans have two Harvard email accounts—one primarily intended for administrative duties, and another for personal matters. Only the first category of accounts was searched; information technology staffers were instructed to look only for a specific forwarded message heading and to not read the content of messages.

The confidential memo in question, from the AB’s secretary, associate dean of the College and FAS member Jay Ellison (reprinted here, by the Crimson), was dated August 16; although it did not contain any information pertaining to any individual, it did state:

The only folks that may want to really consider an LOA are those students who know that they cheated. I think it is important for you to talk to them about being honest and forthcoming and remind them that only they know what happened but that we are working to understand it and except [sic] them to help us do just that.

Fall term athletes may also want to consider taking an LOA before their first game. The reason this matters for athletes is that once they compete one time their season counts and they would lose eligibility if they had to take a year off and return. That said, these students should be sent to Nathan Fry for advice on their options and eligibility—let’s not get into advising students on NCAA rules. Please let me know if you have any questions.

Once the Crimson obtained it and excerpted it in its September 1 edition—just as news of the academic-misconduct investigation was released—other news media reported on the contents as well (with particular interest in the paragraph on athletics).

The Globe article of this weekend reported on subsequent attempts to determine how the AB memo was leaked. It drew on a brief statement provided by Dean Smith, who said (in full):

As a matter of policy, Harvard does not comment on personnel matters, nor will we provide any additional information relating to the Administrative Board cases that were concluded during the fall term. Generally speaking, however, if circumstances were to arise that gave reason to believe that the Administrative Board process might have been compromised, then Harvard College would take all necessary and appropriate actions under our procedures to safeguard the integrity of that process, which is designed to protect the rights of our students to privacy and due process.  As a computer scientist with more than a decade of experience on issues of privacy and data security, I would agree entirely with taking steps that found the right balance between our needs to respect the privacy of our employees and to protect the privacy of our students.

The Globe also quoted Jeff Neal, director of University communications (who is the principal FAS spokesman), who said, "Any assertion that Harvard routinely monitors emails—for any reason—is patently false." 

The Globe went on to suggest, “News of the incident could nonetheless anger Harvard faculty members, whose privacy in electronic records is protected under a Faculty of Arts and Sciences policy.” That prescient comment turned out to be an understatement.

Among those who spoke to the Globe were Gordon McKay professor of computer science (one of Smith’s colleagues in that discipline) Harry R. Lewis, a former dean of the College. “If reading the deans’ e-mail is really OK by the book, why didn’t they just ask the deans who leaked the memo, threatening to read their e-mail if no one came forward?” he asked. Lewis’s Bits and Pieces blog contained an exhaustive analysis of FAS and University privacy policies, a close reading of the protections apparently afforded to faculty members versus the conditions of employment governing nonfaculty staff members, and the disheartened conclusion that “Whichever policy is applicable, this way of handling the situation seems to me--well, dishonorable….” Lewis continued:

This seems to me a sad incident which raises many questions. If an employee's boss wants to spy on her, who has to sign off on it and how does it get done? How many such searches have been done over the past five years? Is it always done without informing the target? Have the targets generally been people like these resident deans—people with both teaching and administrative appointments?

In comments on Lewis’s blog, and in other such comments, several faculty members weighed in, expressing dismay at the reported review of e-mails to determine the source of the leak.

The FAS-College Response

In their statement today, Deans Smith and Hammonds begin by emphasizing the confidentiality of AB deliberations and communications—to protect students’ privacy—and then observe that the forwarding of the e-mail originally sent to resident deans beyond the bounds of the AB and to news media “was quite concerning” and “warranted a better understanding of what had occurred, since it threatened the privacy and due process afforded students before the Board.”

Subsequently, their statement continues, on a separate occasion “confidential data” from an AB meeting was shared with the Crimson, “heightening the need to determine whether a member of the Administrative Board had compromised the confidentiality of case information.” (In this case, the Crimson cited a post from the IvyGate blog, purportedly claiming as a source someone who had spoken with a resident dean.)

In each case, the statement notes, members of the AB were notified about the issue and queried about possible explanations for the apparent breach of confidentiality. In the first instance, the statement says, “It was made clear at that time that absent clarification of what happened, an investigation would be required. No one came forward.” After the second news report on AB matters, board members “again were queried but no explanation emerged. The senior resident dean was asked to reach out individually to each resident dean to seek to learn what happened, but that also yielded no insights.”

In the briefing on the statement today, Dean Smith said that although the memo that found its way to the Crimson had no personal information, “That doesn’t mean it’s not of concern for us,” given the need to assure confidentiality of AB deliberations. The board’s leadership was concerned, he said, and resident deans were asked “repeatedly” about the disclosure of the memo. The intent, he said, was to “clean up” the matter “so people could be made confident the proceedings were confidential.” It was made explicitly clear to all members of the AB, Smith said, that an “investigation” would have to be undertaken.

The second report of AB information in the Crimson was “what appeared to be word-for-word discussion” of a Board conversation about the academic-misconduct investigation—but not a forwarded document or memorandum. Smith said that the content was less worrisome than “what other information might be released.”

Asked by whom and in what way the investigation of the leak was initiated, University general counsel Robert Iuliano said the request “was pretty refined by the time it came to you” (indicating Dean Smith). Smith noted that “I wasn’t in the room,” but that he understood after the original memorandum leaked and queries were made about the possible source of the leak, the initiative to investigate further came from the board itself. Under the procedure followed, Iuliano said, the request had to come with the support of the College dean’s office (the College dean chairs the AB)—although neither Smith’s office nor the general counsel’s office was involved at that point.

The investigation focused on the AB memo, they said, because the second piece of leaked information—on the board’s discussions—was of a different character: it was not linked to a document that was disseminated; it was an account of a conversation; and it presumably could have come from any AB member (or second- or third-hand, from a student who heard from a board member handling the investigation of her or his conduct, or from someone such an intermediary told subsequently).

The investigation proposal that came to Smith and Iuliano for review was, the latter said, “careful, calibrated, limited”: a “precise subject-line search” focused only on the resident deans’ administrative accounts; and confined to subject-heading information only. According to the statement, “The search did not involve a review of e-mail content….No one’s e-mails were opened and the contents of no one’s e-mails were searched by human or machine.” Smith called it “a very privacy-sensitive search” that was conducted by University IT personnel, to further distance it from the College proper.

The search in fact turned up two forwarded copies of the e-mail, “both from one sender.” The resident dean with the involved account was asked about the finding, and subsequently “voluntarily reviewed his/her own sent items and confirmed that she/he had indeed forwarded the message to two students.” Based on conversations with the individual, all concerned were convinced that the action “was an inadvertent error and not an intentional breach,” and no further action was taken. (Had the resident dean been removed from the board at that point, the student cases he or she was responsible for representing would have had to be reassigned, presumably delaying and further complicating the overall, large investigation of academic misconduct.)

Further Queries

This account raises at least three questions:

Why was the second disclosure of information that appeared in the Crimson not investigated? Smith said that it remained unresolved because the nature of the information—an account of a conversation, not a document, and possibly not first-hand—meant that it could not be subject to a limited search of the kind authorized in looking for the forwarded e-mail.

What was the source of the inadvertent breach of AB confidentiality? The resident dean involved has not been identified, so it is not possible to check her or his account. From the language of the Smith-Hammonds statement about the resident dean reviewing e-mails and confirming that she or he had forwarded the memo to two students, and the timing (August 16), it seems plausible that at a time when the enormous academic-conduct investigation was taking shape (with more than 100 students involved), resident deans were scrambling for guidance to offer to the students involved; that this memo from the AB appeared, containing some broad outlines of courses of action; and that it seemed natural simply to pass it along, particularly, perhaps, to student-athletes involved in the investigation, who had to worry about their future athletic eligibility. It could simply be the case that whoever forwarded the memo was extraordinarily busy keeping up with the demands of the burgeoning investigation.

Finally and most importantly, why was the e-mail investigation not explicitly disclosed to resident deans at the time it was begun, or after it was concluded? According to the Smith-Hammonds statement, once it was decided that the disclosure was inadvertent, and that no further action would be taken, the senior resident dean was notified of the search and its outcome, and then the AB’s handling of the academic-misconduct investigation proceeded. The Smith-Hammonds statement continues:

Some have asked why, at the conclusion of that review, the entire group of Resident Deans was not briefed on the review that was conducted, and the outcome. The question is a fair one. Operating without any clear precedent for the conflicting privacy concerns and knowing that no human had looked at any emails during or after the investigation, we made a decision that protected the privacy of the Resident Dean who had made an inadvertent error and allowed the student cases being handled by this Resident Dean to move forward expeditiously. We understand that others may see the situation differently, and we apologize if any Resident Deans feel our communication at the conclusion of the investigation was insufficient.

Asked to clarify, Smith said that the University had undertaken a very limited search of e-mail headers from a population of “individuals whom we had told there would be an investigation,” although he could not confirm that there was an explicit statement that e-mail would be examined even in this limited way. (Implicitly, of course, the information under investigation was an e-mail, which had found its way from the AB to the Crimson, intact.) When the investigation was concluded, in September, he said, the University was weighing two sets of privacy concerns, without explicit policy to guide its decision on how to balance them off against one another: the privacy of students whose academic conduct was under review, in a complex and even then time-consuming investigation; and the conduct of a resident dean who was found to have inadvertently breached AB procedures and confidentiality. Given that finding, and the affected students’ interest in having the AB proceed “carefully and expeditiously,” without derailing it for an internal discussion of board procedures, expectations, and conduct (and a possible change in responsible personnel on the board itself), the decision was made to bring the matter up with the resident dean involved and the senior resident dean—but not to inform the other resident deans (whose e-mail headers were reviewed) or remaining board members.

Further Context

The investigation proceeded, Smith and Iuliano said, from the AB to the FAS’s senior administration and the University general counsel’s office; other Harvard units were not involved in the decisionmaking, other than using University IT resources to review the resident deans’ e-mail headers.

Some confusion has arisen over different policies covering the privacy of e-mails. In his blog post, Harry Lewis noted that Harvard employees “must have no expectation or right of privacy in anything they create, store, send, or receive” on  Harvard computers or networks—common, boilerplate language giving an employer access to information. FAS faculty communications are covered by language he cites to this effect:

The Faculty of Arts and Sciences (FAS) provides the members of its faculty with computers, access to a computer network and computing services for business purposes, and it is expected that these resources will be used in an appropriate and professional manner. The FAS considers faculty email messages and other electronic documents stored on Harvard-owned computers to be confidential, and will not access them, except in the following circumstances.

First, IT staff may need access to faculty electronic records in order to ensure proper functioning of our computer infrastructure. In performing these services, IT staff members are required to handle private information in a professional and appropriate manner, in accordance with the Harvard Personnel Manual for Administrative and Professional Staff.  The failure to do so constitutes grounds for disciplinary action.

Second, in extraordinary circumstances such as legal proceedings and internal Harvard investigations, faculty records may be accessed and copied by the administration.  Such review requires the approval of the Dean of the FAS and the Office of the General Counsel. The faculty member is entitled to prior written notice that his or her records will be reviewed, unless circumstances make prior notification impossible, in which case the faculty member will be notified at the earliest possible opportunity.

Thus, e-mail is protected, but there are extraordinary circumstances where communications can be accessed, with FAS decanal and general-counsel review. The review and approval process was followed in the AB investigation; but the requirement for prior notification, or “earliest possible” follow-up notification, was clearly not.

Smith said that no distinction was made, in this case, between faculty members’ and resident deans’ status. He said he was guided by “what is the right thing to do for the privacy of the individual involved” (both students being investigated and the resident dean who was found to have disclosed the AB memo to students inadvertently). Iuliano said that “e-mail is inherently sensitive,” and that the “very careful, measured steps taken” reflect such concerns. Before any investigation of e-mail is undertaken, he said, the general counsel’s office would have to approve it, along with the responsible official of the school or unit involved: here, Dean Smith.

When the University has a compelling interest in accessing such information (Lewis cites cases such as scientific misconduct or embezzlement, among the legal entanglements that might require an investigation), Iuliano said, the institution has a process in place to gain such access—and it applies to all members of the community, faculty and staff alike.

There will no doubt be further fallout and continuing faculty discussion of these matters. One blogger, Gordon McKay professor of computer science Michael D. Mitzenmacher, was critical of the administration after the Globe story broke, but now seems largely mollified by Deans Smith and Hammonds’s statement; he writes, “My high-level take—this has been blown out of proportion by the media, but it's certainly an issue the administration and faculty should discuss and work out together, so there's a common understanding.”

Smith said of his statement and the discussion in his office, “I’m mostly interested in getting to the facts that are actually out there so we can discuss the facts and not conjectures. We do not search lots of e-mails—that’s patently false.” Iuliano said that such searches are “rare,” but that the power remains to examine such communications in case of legal requirements, the need to protect the privacy of other individuals whose rights may be breached, or in the case of clear, pressing institutional interests. At the least, members of the community are on notice that—among what may be overlapping or uncoordinated statements—they are governed by the language in current FAS information for faculty:

The unauthorized examination of information stored on a computer system or sent electronically over a network is a breach of academic and community standards. Authorized system support staff however, may gain access to users’ data or programs when it is necessary to maintain or prevent harm to the University, its computer systems or the network.

and the general guidance for employees as a whole:

Electronic files, e-mail, data files, images, software and voice mail may be accessed at any time by management or by other authorized personnel for any business purpose.