Got the Compliance Blues? How to More Effectively Influence Your Policy Landscape

25 March, 2009

  • Rodney J. Petersen, Government Relations Officer and Security Task Force Coordinator, EDUCAUSE
Educause has a focus area on Policy Analysis and Advocacy. Interest in trying to interpret federal and state directions and to advocate for appropriate changes at the institutional level, as well as providing feedback into the legal process.  See "negotiated rule-making" as an example of where policy analysis and advocacy apply.

Examples of making sense of policy
  • RIAA notifies you of peer-to-peer filesharing
  • economic stimulus bill requires notification for breahes of health information
  • the Red Flags Rule requires identity theft programs by 1 May, 2009
  • emergency communication systems are deemed useful for emergency situations
  • the government wants to limit the private sector's use of Social Security Numbers
Below, are some of the issues that Educause is keeping an eye on in what they're calling the "discussion and debate" stage:
  • competition and innovation
  • Internet regulation and taxation
  • national broadband policy
  • network neutrality
  • patent reform
  • privacy framework
  • strategy to secure cyberspace
Educause has taken direct political action in:
  • hearings on campus safety and security
  • President's report on Virginia Tech incident
  • Government Accountability Office studies
    • peer to peer filesharing
    • security breaches and identity theft
    • national cybersecurity strategy
  • President's identity theft task force
  • AG's initiative to prevent child exploitation
So far, it seems like the session is more about how Educause is working with the federal government to provide advocacy and analysis with regard to emerging policy and in response to incidents (which is good).  Some of the legislative proposals that Educause is currently tracking:
  • Internet Stopping Adults Facilitating the Exploitation of Today's Youth (SAFETY) Act
    • mentioned that the act tries to follow precedent set by European Union, forcing providers to keep all logs for a minimum of 2 years
  • informed P2P user act
  • the Social Security Number Protection act
  • the Securely Protect Yourself Against Cyber Trespass Act (or SPY Act)
  • the Data Accountability and Trust Act (or DATA)
At the local or campus level, it is very important to know your campus academic experts.  They can help keep you informed, and are generally already involved in the political process, providing testimony and expertise to the policy-making process. You should also make time to understand your institution's approach to government relations, it is generally unwise to approach the process directly.  You can have much stronger and more constructive influence by providing insight and expertise and informing a larger advocacy effort as an institution, where as an individual you may actually be working in a way that is counterproductive to a larger effort.

Twitter at Midwest Regional Educause 09

24 March, 2009

There has been a lot of talk about the use of Twitter here at the conference.  The #mwrc09 hash-tag has been very well-promoted by the conference staff, and it sounds like there has been a significant amount of traffic... even beating out SXSW.  You can take a look at the activity that has been properly tagged at Twemes.

Personally, I see the value in the Twitter facet of the conference as entirely social.  It makes it possible for conference participants to meet and connect with one another, but it's not really plausible to discuss most of these topics in non-threaded bursts of 140 characters (not to mention the obligatory hash-tag[s] and any @replies cut down on the number of characters).

Mobile Computing and Learning Space Design

  • Ken Graetz, Director of E-Learning, Winona State University
  • Kenneth D. Janz, Associate Vice President for Academic Affairs and Chief Information Officer, Winona State University
Looks like "mobile computing" is focused on laptop-based, not mobile phone, etc - they have programs to provide laptop for students.  They are starting to consider Apple mobile devices in design.  Very much a moving target... devices are constantly changing, the resources & media they use are changing, and the pedagogy is changing.

I like this quote "It's becoming less about stuff, and more about what you're doing to do in that classroom."  Getting faculty involved in the classroom design process has been absolutely invaluable.  IT Governance has also been very important.

Have made a strong effort to get away from a laptop focus, and really moving more toward digitizing and making resources available.  Have also used enhanced the wireless infrastructure (using multiple funding sources).

Out of the things that are working, some of the most important are standardization, rotation schedule for hardware, and ongoing funding.  Virtual meeting tools are also working out very well (they are using Adobe Connect).  For this session, they are using Breeze as a back-channel during the session so that participants can interact.

Demonstrating Adobe Connect, DimDim, Dino and another particpant has brought up Poll Everywhere as a viable alternative to clickers in the classroom - using mobile phones (texting) instead.

Efforts to put power outlets at every seat have not worked. It's been too expensive and the power is never in the right place.  They're also having no luck getting instructors to go to training on how to use technology-enhanced classrooms.  Clickers are not working (partly because they didn't have a single, standardized clicker for the campus).

Some other resources that they recommend include:

Federating Identity to Support Collaboration in the CIC

  • Rahul Doshi, Lead Analyst / Programmer, Indiana University
  • Timothy D. Newcomb, Network Analyst, Committee on Institutional Cooperation (CIC)
  • Marko Stojkovic, Information Technology Specialist, Committee on Institutional Cooperation (CIC)
Federated identity allows collaboration between schools in the Committee on Institutional Cooperation (CIC) via a Microsoft Sharepoint instance.  Started process in spring of 2008, all CIC member institutions joined InCommon (UNL is a member of InCommon).  Migrated their Sharepoint instance to authenticate against Shibboleth by February.  Used ASP.NET Shibboleth forms authentication - refers back to an SQL membership database that contains users and roles. They use a "lazy session" in Shibboleth, use eduPersonPrincipalName as username, which is their most important factor.  They still use direct authentication for non-federated users.

Shibboleth was chosen over upcoming standards like Microsoft's Geneva because it already exists, and many of their schools were already members of InCommon. As things evolve, there could possibly be changes if it makes sense.

From the user side, they hit the service, choose their institution, authenticate, and then the system checks to see if they have authorization.  If they authenticate and don't yet have a role, they do get to see a form and request access.  They have a role management interface that seems to be manual.  They have groups of roles which makes it easier to manage blocks of users and permissions.

Next steps are to facilitate the development of a CIC-wide attribute release standardization.  Also looking at federating more CIC-wide applications.

Innovative Technology-Enhanced Learning Spaces: A Mixed-Methods Investigation

  • Christopher Brooks, Research Fellow, University of Minnesota
  • JD Walker, Manager, Research and Evaluation Services, University of Minnesota
Overall research question, to what extent, if any, do formal and informal learning environments shape the way that students interact with the learning material, with each other, etc?

Pilot research, 2007-2008 - one of the interesting outcomes was that round tables were much more effective than theater-style seating.  Encouraged collaboration and interaction.  Also (from pictures they showed) better suited to laptop-use.  A photo of a bio-science course showed 4 or 5 large round tables (looked like they sat 9 comfortably) with power and data ports.  Lighting, color, external noise, etc were considered as factors.

Their course research teams included faculty member, a research professional, and an undergraduate student.  Controls included time, approach to instruction, material covered, assignments, and characteristics of students.

Really need to check the slide deck for this one... too many graphics and too much data that I'm just not able to capture while still absorbing what they're saying. Observed that there were more laptops that were brought in to the enhanced classroom environments - because they were more conducive to technology and collaboration.  People don't really like to keep laptops on their laps.

Their research should help to provide empirical justification for changes and for funding.

Information Security from the Ground Up

23 March, 2009

  • David Seidl, Information Security Professional, University of Notre Dame
In 2005 the University of Notre Dame suffered a serious incident that brought information security into the campus spotlight. In response, they partnered with a Big Four consulting firm to conduct a comprehensive IT risk assessment. Three years later, they're almost done with a four-year risk management program.

Small department consisted of 5 FTE by 2006.  PCI credit card account compliance was a driver for security - but then breach that exposed donor information changed the game.  Spent about 6 months recovering from that, then were awarded a budget.  Not an ideal way to get funded.  University leadership requested a capus wide IT risk assessment which came to be called CITRA, or Campus IT Risk Assessment.  Partnered with big-4 consulting firm (Ernst & Young).  Network assessment, interviews, really dug in to everything.  Was very helpful to have consultants helping.

The result was 68 findings covering 10 key areas.

Planning workshop consisted of cross-functional team.  Analyzed CIRTA results and created project specifications designed to remediate findings rated medium or higher.  Discussed objectives with resource managers.  Working with resource managers has helped him to not go over budget in several years.

Outcome is projects sequenced to prioritize high-risk findings and balance resource consumption.  Overall costs $4.6 million over 4 years.

Objectives: Information Security typically looks at confidentiality, integrity of data, and availability.  Establish and implement controls to fill critical gaps (determined by risk tolerance).  Awareness of security and proper data handling practices.  Establish and communicate security-related procedures and standards to regular users.

Added two new FTE (Operations & Engineering and Networking positions).  Additional contract staff added in project management.  Some load absorbed internally (5 FTE total).  They have a 4-year rolling plan now (living document).  Dedicated project management software has been a huge help so that projects and details don't get lost in email.  Project reports periodically to senior management.

Student awareness in an important factor, especially in terms of preventing the import of virii.  Incoming students are shown a video, and progress is happening incrementally.  Data stewards (one owner for a particular data set) is critical.

Web development has been a problem because code is often thrown together with an eye on functionality (not security).  They are also frustrated because they have not found instructors for OSX security.

Awareness metrics look at users who saw security training materials at least 2 times per year, and actually remember seeing them.

Using "Tripwire" tool to detect changes on servers.  Lots of political struggles around getting individual server admins to update (per unfunded mandate).  Zoned network and wireless security, segmenting faculty/staff, from student, from servers.  Much more locked down.  Recurring security reviews.

Seems to be less of a balance between usability and security, and heavily tilted toward security.  Probably a result of the power given to security by the compromise event.  Lots of accountability metrics available now.  From what he's seen, there has been no loss in functionality among end-users either, so he's comfortable with a 0 net gain.

A Vision of 21st-Century Teaching and Learning: A New Way of Life

Interesting that she seems to have chosen not to use a slide stack... I like this because it removes distraction - and provides a bit of a contrast as she talks about 21st century teaching & learning.  Hopefully the addiction to Powerpoint just for the sake of Powerpoint will start to die off as we move forward. :)  It does make it more difficult to take notes.

Talking about how the community has become so heavily oriented toward using email as a feedback channel - directly to the President.  One of her dreams, developed by the NSF task force on higher learning, talking about mobile nature of accessing data, using online media to collaborate with peers, and how the instructor can track the progress of the student, and be proactive in making sure that students's don't fall through the cracks.  This is already in place for some, but not for everyone.  Looking at systemic approach to adapting to the needs & communication style of current students.

Educational system, in many places, is lagging behind by about 100 years in method.

Instead of focusing on the teacher, the education of the future must focus on the student.  Instead of lecturing, the instructor will act as a guide and collaborator, etc.  In many large school districts, high school graduation is only achieved by about 5 out of 10 students, and in some it's worse than that.  Those learners who fall through the cracks generally wind up poor, alone, and without adequate resources to even stay healthy.  This has massive societal implications.  1 in 4 freshmen at 4 year colleges, and 1 in 2 in 2-year colleges don't make it through the first freshman year.  Business leaders complain that the schools do not adequately prepare workers.  Teacher retention is also awful - dropout rate as bad as 50% of all new teachers don't continue as teachers.  Over $86 million/year is said to be lost in teacher turnover just in Chicago alone.

It's fine that she's outlining the doom, gloom, and challenges... because it's helpful to put some metrics behind what we know is going on, but I hope she gets to the vision soon.

In her community, they have launched a campaign to attain 100% graduation rate in high school and college.  Many schools all over US have joined this initiative.  One approach of this initiative is to reach out beyond the university and to engage the community - early childhood through workforce development.

Ok, so this is lame, she does have one slide of a timeline, but it's on paper - sheets being passed out among attendees, but doesn't seem to be enough for everyone.  People are now reading and talking together instead of paying attention to her.

I do appreciate that this approach is societal and not technological.  It is far too often that people try to throw technology at a problem as an easy fix, instead of trying to (finally) address the societal issues that really contribute to the problems.  The means by which a community communicates and works has changed, but the structure of society as a whole hasn't begun to adapt to these new changes.  The University of Cincinatti CIO has approached local K-12 schools in an attempt to give them access to Blackboard.  She notes that there is currently no continuity in the flow from primary school through higher-education, everything from teaching methods, access to modern media, funding methods, etc.

Her thesis is that we belong to an educational system that, at every juncture, is disconnected.  The need is to knit this disconnected, somewhat dysfunctional confederation into a somewhat contiguous whole.  It lies upon us, as the experts, to reach out to our community.  She hopes that the current US administration will no longer isolate the different segments of US education, and try to address things wholistically.

One tool they are looking at in Cincinatti is something they are calling a "virtual backpack"(Fordham Institution) that contains complete educational records for each students... kind of like tracking on steroids, that can be share with parents, school systems that they transfer to, etc.  Seems to me like this will have to be an overwhelmingly massive undertaking to try to make this kind of data universal and relevant to so many discontiguous entities.  There is already a gap between levels of education, let alone regional differences (or even differences between individual schools in the same system in some cases).

Advocating for partnerships with local corporate partners like GE (whom they're working with in Cincinatti) to take advantage of their expertise.  GE is a heavy user of the Six Sigma methodology which has proved very useful to the effort in making decisions based on concrete evidence.  Based on the fact that they've used such transparent and data-based methods, they can now prove that they have gotten better than 80% retention between the freshman and sophomore years.

One need (infrastructure-wise) for the "backpack" idea to work is a replacement for SSN, and a way to track individual learners and determine factors like whether they've had access early childhood development, in-home assessments, etc.  Need for information and tracking also leads to "exchanging ignorace" with regard to 3rd party institutions that are rushing in to help students, but who have no access to the educational background and history of the learner.  At the very least, so much assessment and background information has to be re-collected and recreated every time a new group touches the student, and that is highly inefficient.

She is less concerned about privacy issues than she is about students falling through the cracks and getting lost.

As far as tools, she mentions everything from Blackboard to social media tools like Twitter, YouTube, and Facebook, as well as specifically mentioning Starfish for advising and retention.

More than 1/3 of the world's population is under 20.  Without major changes, it will be impossible for Universities to meet the needs of this community to provide advanced training to all of them.  Centers of learning must be life-affirming organizations for learners, their families, and their communities.  Learners must be prepared so that they can give back and contribute to their communities to meet the economic, environmental, societal, and political challenges facing the world today.

Question: Who should be the drivers of this initiative?
Answer: We've tried it other ways, but it really needs to be driven by the communities.  Starting small, and having a local success that leads by example and shares with other communities is probably the best method.

Question: How much data should go in to virtual backpack?
Answer: Just about everything, but like all systems it should be focused and applicable.  She hopes that teacher comments (and student comments) can be included.  Should probably be backpacks for teachers as well.

Kindling

05 March, 2009

Amazon has just released a Kindle application for Apple's mobile platform (iPhones and iPod Touch devices).  I've been working with the original Kindle for quite a while now, and I really like it.  Battery life is fantastic, the display is wonderful, and the Amazon Kindle Store has gotten me to read books that I never would have otherwise.  Overall, it's been a great experience.  Once you've forked out the initial capital to buy the Kindle device, the books are generally much cheaper than dead-tree books (like, $9.99 instead of $25.95).

The biggest drawback to the Kindle device (other than the up-front cost) is the fact that it's definitely a version 1.0 device (even the new Kindle seems to be about a version 1.5, and not really a major update).  It's rarely crashed, but the device is slow, the network connection is slow... it's even slow to mount as a USB volume when you connect it to your computer.  The speed is mostly forgivable because, 90% of the time, all you're doing is turning pages - it doesn't need to be speedy, but it takes some of the shine off.

Another problem is that the Kindle is really set up for reading things sequentially and it doesn't really perform well if you want to use it to read reference material.  This is especially compounded if you take a Word document or a .PDF and convert it (using Amazon's service... they may be better tools I haven't discovered yet) to Kindle format.  While regular books purchased from the Kindle store have adequate chaptering and navigation, the conversion process for documents strips out any chaptering or navigation in the file, and you're left with a 7,000 page novel on administering a server.  Not helpful in any way.

The Kindle application for the iPhone is good so far, but I doubt I'll use it much.  Apple's mobile devices are just too small to read lots of content comfortably and the backlit LCD display is nowhere near as comfortable to read as the digital ink display on the Kindle.  I also know that I'm eating up precious battery life eating away at me while I read on the iPhone. The interface is decent; you swipe your finger across the screen to turn the page and there is no scrolling up and down, but they've taken out the annotation functionality (which I used very rarely) - and even though I am able to adjust the type size, I can't find a size that doesn't feel awkward. I do like having access to the same books that I've already purchased on the Kindle now on my iPhone, too.  I always have my iPhone with me, and I don't usually carry the Kindle around with me, so that's very cool - I can see myself whipping out some Christopher Moore to pass the time.  If I get my choice though, I strongly prefer to read on the Kindle device.