Wednesday, January 19, 2011

Universities risk data breach / Privatized IT systems put e-mail beyond protection of Japanese law

About 10 percent of universities in the nation use cloud computing services, which Google Inc. and other companies provide free of charge, to run their internal e-mail systems, according to a Yomiuri Shimbun survey.

In the survey of major universities nationwide, 14 state- and local government-run universities and 64 private universities said they had wholly or partially consigned management and maintenance of their internal e-mail systems to cloud computing providers.

This figure accounts for about 10 percent of the nearly 800 universities in the nation.

The trend raises concerns about information security, because in many cases the servers managing the universities' e-mail data are located in other countries, beyond the protection of Japanese law.

Cloud computing allows users to store and process data on the Internet, thus sparing the expense of buying and maintaining their own hardware and software. The provider companies benefit by having the chance to expose users to their products.

Nihon University was the first to adopt cloud computing in 2007, using services provided by Google. Since then, adoption among universities has been increasing rapidly.

Upon introduction of such a system, teaching staff, administrative staff, students and alumni are assigned e-mail addresses and allowed access to schedule-management and file-sharing programs.

The new e-mail addresses use the same domain name as the university's previous system, so outsiders are given no indication that the e-mail system is now being operated by a private company.

Google's Google Apps service is the most widely used by the nation's universities, the survey found, with 48 institutions, including Nihon University and Hitotsubashi University, having adopted it.

A competing service provided by Yahoo! Inc. is used by 22 universities, including the University of Tokyo, and Microsoft Corp.'s service is used by 10, according to the survey.

Two universities use the services of multiple companies, the survey found.

Cloud computing is also used by many university hospitals, including Kyoto University Hospital, which began using Google Apps in 2009.

However, having servers located overseas puts information security at risk, according to some cloud computing critics.

For example, if information is illegally accessed from an overseas server, Japanese law would not apply.

In the United States, the law allows investigators to access data in cloud computing servers without a warrant if authorities deem there is a risk of a terrorist act or other serious crime.

It is possible therefore that U.S. investigators could in such a case read e-mails containing personal information of cloud computing users.

The universities surveyed said the physical location of cloud computing servers was up to the provider companies.

Google and Microsoft have not revealed in which country the servers used to store the universities' data are located.

Hisamichi Okamura, a lawyer who specializes in telecommunications and information technology, asked, "Is it really OK that important information about people involved in universities--who can be said to be Japan's brightest brains--is stored in places where Japanese law can't protect it?"

He added: "European Union countries and some provinces of Canada impose strict regulations on how cloud computing systems store personal information. The Japanese government should consider how it will respond if a [data security] problem occurs."

(Jan. 18, 2011)
http://www.yomiuri.co.jp/dy/national/T110117003565.htm

No comments: