Scary Software May be Watching You

On Tuesday, November 9, the infrastructure committee of The New School’s faculty senate will give an update on a newly adopted software program that has caused controversy among both students and faculty.

Ever since The New School switched to Impulse Point’s Safe Connect to control wireless Internet access, people on campus have been concerned that the new program, which the university requires Wi-Fi users to download, could be gathering users’ private information.

One of the concerned groups is the University Student Senate. According to Alex Cline, Lang senator, at the meeting on October 20, student senators came to a unanimous agreement that they did not feel comfortable with the program. “It accumulates data, sends it to an anonymous company that the privacy policy doesn’t technically cover,” Cline said.

The student senate is planning a formal presentation about the program at a town hall meeting tentatively scheduled for November 30.

The faculty senate became aware of the issue in June when Ted Byfield, the associate chair of the communication design and technology at Parsons, sent the senate co-chairs a twenty-page report raising concerns about the program. Subsequently, the co-chairs asked its infrastructure committee to look into Safe Connect.

In the report, Byfield’s primary concern was that technically Safe Connect has the ability to “surveil any and every file on the computer.” In other words, a student’s computer running Safe Connect can potentially be monitored. “It raises serious questions about what information this system discloses, to whom, and to what end, ” Byfield wrote in the report.

However, Byfield emphasized that just because Safe Connect has the ability to breach privacy does not mean that The New School uses it to do so. “I’m absolutely certain that [The New School] isn’t doing anything wrong,” Byfield wrote in an e-mail to the Free Press. “On the contrary, I’m certain that Academic Technology adopted [Safe Connect] in a good-faith effort to comply with legislation and to address other, very real concerns.”

Federal law requires that universities have certain security standards for their networks.  Software such as Safe Connect — called network access controls — is one method to meet these requirements. Byfield argues that an invasive program like Safe Connect is not necessary for The New School. “I disagree with this approach to network services, and wrote.

The Safe Connect program has a variety of security and enforcement features (Impulse Point calls them “policy modules”) that can be activated by the network administrators. “They are options, rather than required components for any particular installation,” pointed out Shelley Reed, senior vice president for information technology at The New School. She was adamant that The New School only uses Safe Connect for three things: to authenticate the people using the network, make certain areas of the network secure, and ensure that Windows users are running an anti-virus application. “No user data is ever shared with or sent to Impulse Point,” she wrote in an e-mail.

Regardless of how The New School is using the program, Byfield does not think the school should require it. Among other features, Safe Connect allows the network administrator to set custom policies which can scan the computer for specific files or programs on the computer.

In 2005, the web site advertised one module that was able to scan a user’s computer for music files as well as monitor any that are added. Any that it deemed illegal could be made unplayable. This functionality is no longer advertised explicitly, but Safe Connect’s literature implies that the program’s “custom policy module” could be configured to do something similar.

Byfield was troubled by this functionality in conjunction with many references in the company’s literature to the RIAA — the organization that lobbies on behalf of the music industry and in recent years has sued many people who have illegally downloaded music.  “Impulse Point has cited the RIAA as a legal authority, which it is not,” Byfield told the Free Press.

Though The New School has not activated any of Safe Connect’s more invasive features, Byfield wishes the school did not use it. “It’s reasonable to ask whether the potential ethical, legal and reputational risks of this system outweigh the limited benefits that [The New School] has offered as justification for adopting it,” he wrote in his report.