PSU works to keep inboxes spam-free

The Oregon Legislature recently passed a resolution excluding student e-mail addresses from the public records law. This anti-spam bill provides additional security for personal information and means companies no longer have an easy way to send mass amounts of junk mail to Portland State students.

Mark Gregory, executive director for the Office of Information Technology (OIT) at PSU, was a driving force behind passing House Bill 2318 into law.

“The reason we went after the law was that private companies were calling the university and asking for student e-mail addresses, basically to send spam,” Gregory said. “The way the law was written, we had to comply with it.”

Under the Federal Educational Rights and Privacy Act (FERPA) and its Oregon equivalent, access to most student information and records is restricted and requires student consent to release. Exceptions are provided for university officials and individuals who have a valid reason to access the information, such as law enforcement agencies.

Some student information – called directory information – is considered public and may be released without student consent. The particular information varies from college to college, and PSU can release the following information on any student: full name, address, telephone number, dates of attendance, degrees received, number of credits earned and enrollment status.

Prior to passage of the law, student e-mail addresses were considered directory information and anyone who asked could access thousands of possible consumers. Usually, PSU doesn’t have a problem complying with reasonable requests for student information, but “when private companies start asking for 40,000 e-mail addresses, that’s not what the law was intended to do,” Gregory said.

Although PSU hasn’t received many requests for student e-mails, the potential for problems was even greater than it seemed.

“It’s not just (limited to) your PSU e-mail address,” Gregory noted. “If we knew your personal e-mail address at any time, like Hotmail, we’d have to give that out, too.”

PSU has about 3,000 staff e-mail addresses and around 40,000 student addresses.

“For spammers, 3,000 e-mails isn’t much, but 40,000 is worth making the call,” Gregory said. “If I got just your name and address, the burden would be on me to send out mail, and even the telephone costs something. But e-mail is so cheap, there’s just no friction” in sending out mass advertisements, he said.

The law doesn’t include faculty or staff e-mail addresses, which means they can be distributed freely, partly because of the intervention of the American Civil Liberties Union (ACLU). The ACLU was concerned that people with a legitimate reason to contact professors, such as students, would have no way to get around the law. Gregory said the only opposition they received during the whole process of changing the law was from the ACLU – everyone else was very supportive.

���

PSU was alerted to the potential for problems recently when the University of Texas at Austin received a request from a Texas lawyer for all of their student e-mail addresses.

“He wanted to advertise seminars that a client of his was putting on. He knew the law and knew that he could get them,” Gregory said. “About a week after it happened, we started getting requests from commercial companies. We had to comply once and then got the law changed before it happened again.”

Gregory noted that although the change in the law is very minor, it should have a good impact on PSU.

“We had the full support of the other universities in Oregon,” he said. “At this point, everyone deals with spam, and the Legislature was very eager to help us with the issue. It just gets rid of one more source of everyone getting your e-mail address.”

PSU publishes a directory of student information yearly, and despite the law, students may request that their information not be released. Currently enrolled students may contact the registrar to make that request, and it remains in effect indefinitely or until the student chooses to release it again. To restrict directory information, contact the Office of the Registrar at 503-725-3435.