Monday, August 17, 2020
OSU to store employee and student location data for contact tracing
AN O’Colly Creation
@ocollycreative
By Alex Sloan News Editor @sloan_alex Student and employee location data will be kept by the university for up to 30 days to aid in contact tracing efforts, according to Oklahoma State University’s reopening plan. The reopening plan was announced on June 4, 2020, and is publicly available online. “Leveraging existing campus technology, OSU has developed analytics to identify employee and student movement across the OSU campus via WiFi access points,” the website reads. In addition to using data from WiFi access points, the plan also specifies class schedules, ID card transactions, and housing and office assignments as data that will be leveraged to aid in contact tracing.
Also of importance is the data that will not be stored. According to the university’s website, no content data is, or will be collected from individual devices. The plan limits the distribution of this location data to University Health Services. “This location data will be held in extreme confidence and shared only with leadership of University Health Services (UHS) when cases arise for which location information is useful,” the website reads. The O’Colly reached out to the university and privacy experts to find answers to several questions surrounding implementation of this policy. University officials responded in a collection of written statements through email. Below is an overview of what they had to say, in addition to expert
opinions regarding the privacy aspect of this new policy. 1. How specifically is this data being stored, and how is it being secured? Dr. Christie Hawkins, associate vice president and director of institutional research and analytics, said in a written statement that the location data would be stored on servers that are physically located on campus. The servers are owned by OSU, and not leased through a thirdparty. Hawkins said server security would be maintained by university OSU’s information technology department. 2. The Cowboys Coming Back plan reads “Leveraging existing campus technology, OSU has developed analytics to identify employee and student movement across the OSU campus via WiFi access points.” What
“existing technology” is being leveraged, and has it been used on campus previously? Basically, is the location tracking technology new, or is it just the analytics that are new this semester? Hawkins goes on to explain the nature of OSU’s previous use of WiFi access point data. She said while the WiFi access data has been collected by the university for some time, it has never been used by Institutional Research and Analytics. “Location data is tied to the access point, not the user,” Hawkins said in her statement. “While this data is stored for 30 days by IT, normally it’s only used for things like connection counts and network analysis.” 3. In the age of targeted advertising, near real-time location data on so many individuals is incredibly valuable. What
kind of enforceable assurances are in place that the university will not share this data with any third party marketing partners, or use the data for the university’s own marketing decisions? Furthermore, what prevents the university from using this location data to maximize revenues from student spending, even without sharing it with any third parties? Shanon Rigsby, the university’s public information officer, provided the answer to this question in the same written statement, using information given to her by Hawkins. “OSU takes the personal privacy of students and employees very seriously,” the statement reads. “Beyond the protection granted to students through the Family Educational Rights and Privacy Act, OSU places the utmost importance
THE NEWEST NOVEL BY OSU ALUM DAVID DEGEORGE
Can Claude solve the clues? Or will the killer torment him worse than expected? AVAILABLE AT AMAZON.COM, BARNESANDNOBLE.COM, AND SILVERLEAFBOOKS.COM. READ THE FIRST FIVE PAGES AT DAVIDDEGEORGE.COM
on the ethics of how data may be used.” Rigsby said the OSU Orange Key Account Services agreement gives the university the right to share information from its computing system with the relevant authorities during a health or public safety emergency. She said the data would only be shared with University Health Sciences leadership, and only in relation to necessary contact tracing efforts. Additionally, she emphasized the limited nature of the data being collected in this manner. “It is also important to note that WIFI access point data is strictly location data and does not include any device content data,” her statement reads. SEE SLOAN PAGE 2