On the internet, complete privacy is virtually impossible. Wi-Fi networks can determine a user’s approximate location and keep logs of the websites visited by users on the network, and websites use analytics to further track the habits of their users.

At the University of North Florida, internet users are not entirely anonymous, but protections exist to comply with laws such as the Family Educational Rights and Privacy Act (FERPA) that protect student data.

Even with FERPA, students are often required to join social media websites such as LinkedIn or Facebook to complete assignments. When students use third-party applications and websites, their online privacy rights begin to diminish. 

To understand what information is kept private online and what is stored and shared, students must first understand what different online systems do.

Networks

Service providers like Comcast allow subscribers to connect to their Wi-Fi networks. When a device connects to a network, the provider collects certain information about that device, such as the approximate geographic location of the device through its internet protocol (IP) address and the websites the device visits during a session. 

According to UNF’s Director of Networking, Systems and Security, Jeff Durfee, the UNF Wi-Fi network is no different. Any user connected to the UNF-Wireless network can be traced to an extent. 

“Certain pieces of information are, just simply by nature of the way machines work, never truly private. So, if you’re a student and you’re logged in […] then yes, there’s a network log that shows where you go.”

Durfee explained that these logs are kept for troubleshooting purposes and not for collecting personal information about students. The UNF Information Technology Services (ITS) Help Desk can use these logs to help students who have problems on the network.

“You just see where they’ve gone. You don’t see what they did anywhere,” said UNF ITS’s Vice President and Chief Information Officer Brian Verkamp. This means that although the websites visited by people connected to UNF-Wireless are logged, their activity on those websites is not.

Durfee said that the website logs are stored for up to six months for the purpose of police investigations. Sometimes, police contact the university requesting to see the websites visited on UNF’s Wi-Fi by someone who potentially committed a crime.

ClearPass and OnGuard

ClearPass is an authentication system that prevents people not affiliated with UNF from connecting to UNF-Wireless.

ClearPass identifies who is connecting to UNF-Wireless through users’ UNF login information to authenticate that the person connecting to the network is affiliated with the school. ClearPass also collects the MAC address of the user, which identifies the device that is connected to the network.

OnGuard is a software system that runs health checks on devices that connect to the UNF-Wireless network. 

Durfee gave an analogy of a network being like a swimming pool. All the users connected to a network are in the same swimming pool, and when one is infected, all the other people in the pool are at risk.

“OnGuard is a step in the direction to say is this device, your computer, clean and safe to be on the network with everyone else in that swimming pool,” said Verkamp.

OnGuard collects information about devices such as the operating system used, if the device uses antivirus software, and if the device has a virus.

Analytics

Most websites collect some form of user analytics. Analytics is used to monitor the performance of websites so website hosts know if technical issues occur on a webpage, as well as how many people visit their pages. Analytics companies may use cookies to track the web pages users visit and determine user interests, finances and other identifying information.

“The most widely used data analytics is Google Analytics, and all social media has their own analytics,” stated UNF Associate Professor Dr. Chunsik Lee. 

Dr. Lee explained that Google Analytics uses cookies to collect user data across the web, but they cannot collect demographic data about a user unless they are logged in to their Google account.

Social media sites collect user data by tracking users and saving the information users voluntarily give to them. This presents a dilemma for students who are sometimes required to create a LinkedIn, Instagram account or build a personal website for a class. In these cases, students have to choose between giving up their information to social media websites or not doing an assignment.

“You’re voluntarily disclosing all your information to the tech companies [by using social media],” explained Dr. Lee. “The conversations that you had with your friend, your profile update, your private message in email if you use Google mail or Outlook.”

“They [Facebook] were, in their app, tracking what you do in the other apps that you have on your phone,” said the director of UNF’s School of Computing, Dr. Sherif Elfayoumy.

“They never disclose those very fine subtle details about what has been collected about you,” continued Dr. Elfayoumy, “many of these companies aren’t very transparent.”

Enterprise

Large organizations such as universities use Enterprise accounts to manage the software they provide to members of their organization.

When a large organization like UNF purchases software for its members to use, it does so through an Enterprise account. Where a single person who purchased software for themself would have to agree to the software company’s terms of use, an organization using an Enterprise account gets more control over the terms and conditions for using the same software. UNF has a data review process where a committee writes the terms of use and sends it to the software provider, who must agree to them before the university will purchase the software for its members to use.

As a public university, UNF must comply with FERPA rules, which legally protect student academic records from being disclosed to the public. For UNF to provide software to its students, it must first make sure that the software complies with FERPA regulations.

For example, someone using Zoom on their personal account must agree to Zoom’s terms of use before using their product. By agreeing to Zoom’s terms, users agree to allow Zoom to keep their video chats, messages and recordings, according to Zoom’s privacy policy. 

If a person uses Zoom through their UNF account, the terms of use are different. The specific privacy policy for UNF’s Enterprise account for Zoom is not easily accessible for students to read, but it does ensure that student data cannot be shared with third parties. 

“We have storage that we purchase with Zoom, and we keep an Enterprise level of storage that’s only for UNF,” Verkamp stated. 

Verkamp said that UNF controls the stored data and keeps it private, even from Zoom. Any recorded videos on Zoom are saved in storage until the person who initiated the recording requests that they be deleted, said Durfee.

The data review process applies to other apps and software that UNF provides to students through its Enterprise accounts such as Office 365. 

Private Accounts

If a student uses social media for their class, it’s likely that their social media account is not protected the way an Enterprise account is. 

“With personalized accounts, there is usually [a] very long document of fine print that talks about your rights, or actually, the lack of your rights using that software,” Dr. Elfayoumy pointed out.

“For social media, there is no way [to protect your data], unless you don’t use it,” said Dr. Lee. He explained that social media will collect and store any information users give them. 

Dr. Lee mentioned that social media users trade their data for the service. Often, user data is not just shared with third parties for profit, but it is used for machine learning for companies to improve their products.

“The common misconception that people have is that Facebook will sell your private information to the third party […] the bigger problem is they try to keep the user data to themselves,” explained Dr. Lee.

Complete anonymity online is unobtainable for most people. Some website analytics function to help inform web hosts about how their site is used, while others collect as much user data as possible. UNF students, who use the software provided by UNF, enjoy some privacy protections that are not available for non-affiliated users, but students are still identifiable by the university. Being aware of online privacy rights and controls is one-way users can protect themselves in an environment where organizations want to collect their data without their consent. 

___

For more information or news tips, or if you see an error in this story or have any compliments or concerns, contact editor@unfspinnaker.com.