New CIT policy adviser studies privacy, security, responsible use

Tracy Mitrano, policy adviser for Cornell Information Technologies and director of the Cornell Computer Policy and Law Program, poses in the Day Hall boardroom. Charles Harrington/University Photography

By Bill Steele

Tracy Mitrano has been the new policy adviser for the Office of Information Technologies (OIT), the administrative arm of Cornell Information Technologies (CIT), for about six months now. One important result: new policies.

Mitrano, like her predecessor, Marjorie Hodges Shaw, is an attorney whose job is to provide a legal presence within OIT/CIT, the organization that manages Cornell's computer infrastructure. Computers are, mostly, used by human beings. The same sorts of problems and conflicts one finds in everyday life turn up in computer use, but new technology also introduces some new twists.

Who, for instance, owns the information stored on the computer in your office? How does that differ from the computer in a student's dorm room? If a student or staff member violates copyright law online, who's liable? How private is your e-mail really?

Some of these questions are answered by the law. In that, the OIT policy adviser can inform and educate, but not offer legal opinions; that responsibility is reserved for the university counsel. But where the law ends, people have to make decisions. It would be nice if those decisions were consistent across the university community, and that's why the university maintains a variety of policy documents. Mitrano is writing and revising OIT policies, mostly working with committees that represent the affected constituencies.

There are three OIT policy documents in the works right now:

• A new policy on computer security: This policy is driven, Mitrano said, by general concerns about security in the aftermath of Sept. 11 events together with the recent increases in the number of attacks on university computers made in order to use those computers as a base for denial-of-service attacks, for example as when an attack on Yahoo was launched from a University of California-Santa Barbara computer last year. "We don't want our network used against us," Mitrano said.

• A new policy on privacy for electronic data and networking: Constitutional protections apply only to actions of governments, Mitrano points out. "For a private institution, under current law, employees -- like you and me -- essentially have no privacy," she explained. Private institutions are, for instance, legally entitled to monitor e-mail or web surfing. However, Cornell does not, she said, student rumors notwithstanding. With a policy in place, Mitrano said, the university can raise the bar a bit and formalize users rights not to have their electronic communications monitored. It can also set forth clear procedures for the rare cases where, for legal reasons, the university exercises its rights to access employee data. She predicted a "constituency tiered" policy, where students will be likely to have greater rights than employees, largely because for on-campus students, the university is their home and their computers are their own, and because, she said, students do not present the university with the same degrees of liability in employment and copyright law as employees. "Free speech and employment law need not be on a collision course at a major university, if policies are clear and users inform themselves of their rights and responsibilities," Mitrano said.

• A revision of the existing policy called Responsible Use of Electronic Communications: "The existing policy dates back to the mid-1990s." Mitrano said: "Not only is it in need of revision, like all policies of that vintage, but in light of existing policies, such as sexual harassment, and proposed ones, such as security and privacy, it requires some 'cleaning up.'" A basic principle underlying the responsible use policy is that both users and the university have the same rights and responsibilities in cyberspace as they have in the rest of the world. The policy addresses the new questions modern technology introduces about how these rights and responsibilities should be dealt with.

When CIT has formulated its policies, they will be subject to review by the universitywide Policy Advisory Group, which has representatives from every college and several administrative departments.

Mitrano also has taken over as director of the Cornell Computer Policy and Law Program (CPL), whose purpose is to educate people here and in other institutions about the sorts of problems information technology can raise, and how to deal with them. With Steve Worona, co-director for the CPL summer program, Mitrano is organizing the annual summer conference, which brings administrators from all over the country to Cornell to discuss the problems raised by information technology in higher education.

Mitrano also has launched a local series of lectures and panels on cyberspace issues. On Sept. 27, CPL, together with the Department of Computer Science, sponsored a panel discussion on the Microsoft case. Today, CPL will sponsor a university lecture on privacy featuring Robert Gellman, a privacy and information policy consultant. For the next semester there are plans for talks on electronic security and copyright. "Policy and legal issues related to electronic communications used to be for the specialist. Now, with the expanded use of networking, these policies and laws have application and interest for everyone," Mitrano said.

Mitrano, who taught college for 20 years, says being a policy adviser is just another form of being an educator. She is a 1981 graduate of the University of Rochester with a B.A. in English and history, and she received a Ph.D. in American history from Binghamton University in 1989 and a J.D. from Cornell in 1995. She has practiced corporate and family law and taught history and social policy at the University of Buffalo, Syracuse University and Cornell.