Tending the Net

A female student at the University of Maryland at College Park has been getting

ALSO SEE: Colloquy: Join an online discussion on whether colleges should create offices to deal with ethical and legal issues raised by students' computer use.

unsettling, unwelcome e-mail messages from an anonymous admirer for the past two years. He had been sending these messages to her Hotmail account, but just recently he sent his first note to her student account. That was the last straw.

A few weeks ago, the student went to see Kara Reuter, who deals with a variety of online problems for the university -- problems like theft, threats, deceptions, and obsessions. "This person seems to think that he has a relationship with her," Ms. Reuter says, adding that she tracked his e-mail messages -- she calls them "creepy" -- to a computer lab on campus. Right away, Ms. Reuter met with the student to tell her where the e-mail messages were coming from, where she could go for counseling or protection, and that she might consider talking to the student judiciary or the police.

It's just another day at work for the folks at the university's Project NEThics program, which handles crimes and near-crimes, human errors, dramas, and assorted foibles on an increasingly Internet-connected campus. When the NEThics office gets a tip that a computer-savvy student has been doing something he or she shouldn't -- like hacking into a company's computer system, or downloading MP3s illegally, or using computer-lab machines to look at pornography -- the staff steps in to deliver stern warnings or, in the worst cases, contacts the police. When students get an online threat, discover that their computers have been hacked, find that they have unwelcome online admirers, or have a problem with another computer user, the NEThics staff is there to offer advice and guidance. It's Miss Manners meets Sam Spade -- but in front of a computer monitor.

Over the past few years, offices like the one at College Park have been established at a handful of colleges, generally larger institutions, such as Northeastern University and the State University of New York at Buffalo. Although the so-called computer-discipline offices vary in name, procedures, and number of employees, their missions are similar. They provide a central office through which the institution can dispense clear and consistent information about computer-use policies on campus. Perhaps more importantly, they provide students and others with empathetic contacts within the institutions' technology offices -- people better trained to deal with human issues than technical ones.

"There are a lot of institutions that don't have these offices, and frankly, they have the mistaken notion that they don't have a need for it," says Harvey S. Axlerod, the computer-discipline officer at SUNY-Buffalo. "Once you get someone in place, you'll see that there is a lot of nonsense going on -- everything from copyright violations to harassment to hacking."

Mr. Axlerod's position evolved from a part-time duty to a full-time job over three years. "The more seriously I pursued it, the better known it became that there was a place to go" when students had problems online. He has lectured MP3 pirates and helped settle heated online disputes. In one of his more memorable cases, he dealt with a 30-year-old student who was sending obscene e-mail messages to a 14-year-old in Arkansas. Mr. Axlerod called the police, and the student ended up in jail.

"Computer discipline is like a box of chocolates," he says wryly. "You never know what you're going to get."

The Human Side

Mr. Axlerod says those who deal with computers and students need to consider the humans who use the computers, rather than just the computers themselves. Not long ago, he says, he got a call from a female student who wanted to know how to block certain addresses from sending messages to her e-mail account. A typical help-desk employee might have given her the blocking procedure and gotten off the phone, Mr. Axlerod says. But he asked her a few questions about the situation and found that a cyberstalker had been sending her messages. He sent her to a university group that helps people deal with stalkers.

Simply telling her how to block the messages would have been "a classic example of the technical solution being the wrong solution," he says. "If you block the messages, you can't assess risk."

Campus-computing offices should do more than tell students how to configure their e-mail, he says. They should also offer counseling and guidance about interactions in the new media. "Anywhere you have humans," he says, "you have complications, disputes, ignorance, and amorality, and you have to deal with that."

Among computer-discipline programs, the University of Maryland's NEThics office was one of the first -- and is still one of the best known. Now six years old, it was formed in part by Rodney J. Petersen, Maryland's director of technology policy and planning, in response to an increasing number of problems on and complaints about the network.

Mr. Petersen is the director of the program, but because he has many other responsibilities he leaves day-to-day operations in the hands of his assistant, Amy Ginther, who worked for years with the campus judicial system. She works part time, both managing the NEThics program and planning occasional educational events.

The grunt work -- the unenviable task of calling students to scold them -- falls to two part-time graduate-student assistants. This year, they are Ms. Reuter and Elizabeth Walker, who are both seeking master's degrees from the university's library- and information-studies program. Ms. Walker has a background working as a computer-systems analyst, and Ms. Reuter studies electronic media.

But that much computer expertise isn't essential: Ms. Ginther says that she and Mr. Petersen hire assistants based more on their skills in dealing with people than on their technical skills. Assistants in the past have come from the student-affairs program with little computer knowledge; a candidate for next year comes from the psychology program.

"We draw from more counseling-oriented programs," Ms. Ginther says. For help with heavily technical matters, the NEThics office consults members of the network-security staff, who work down the hall.

'Good Cop-Bad Cop'

The NEThics staff members operate primarily on the basis of complaints -- unlike their network-security colleagues, who monitor the university network for anomalous activity that might indicate a hacker attack or excessive downloading. (They say they never monitor the content of the traffic.) When unusual activity is reported to the NEThics office, it investigates.

At its regular Monday-morning meeting, the NEThics staff discusses recent and emerging cases, along with the university's network policies, which NEThics has a hand in forming. The rest of the week is spent on the phones and computers, processing cases. The staff members handle a range of complaints, such as e-mail spam and cyberstalking, and act as advocates, educators, and authority figures.

The NEThics staff also works with the university police department every week, teaching officers how to interpret technical information. "We have a few self-proclaimed computer experts here," says Maj. Paul Dillon, the university's police-services commander, "but they don't have the knowledge that the NEThics staff has." Lately, he has seen more campus crimes occurring online, and he says that he is glad to have the NEThics office's guidance.

But the majority of the cases that come to the NEThics office involve students who need an education in Internet etiquette or copyright law, and those cases never reach the police or the campus judicial system. Face-to-face contact is important, Ms. Walker and Ms. Reuter say, adding that they take a "good cop-bad cop" approach to the job. Ms. Walker, who will soon be a grandmother, calls offending students and harangues them with lectures she says she practiced during motherhood. "I like to strike the fear of God in them," she says. She once gave a student such an earful in a copyright case that he repeatedly called back to detail the various files that he was deleting on his hard drive.

Ms. Reuter takes a more laid-back approach, which can be just as effective, she says. In cases of copyright infringement, she talks about the moral and legal issues surrounding file sharing, sometimes leaving it up to the student to figure out what to do. She tells them that most students get caught when they distribute files, and not when they simply download them, then concludes by adding: "You know it's illegal, and you have to choose whether you want to be involved in that activity. Someday you might get caught, and you have to decide whether it's worth the risk."

This easygoing method doesn't seem to bother copyright holders like the record industry. "We think that centralized Internet-ethics offices, like those at the University of Maryland and other colleges, are a positive development," says Jonathan Lamy, a spokes-man at the Recording Industry Association of America. "Anything that colleges and universities can do to educate their students about the values of copyrights and address infringing conduct is definitely encouraged."

Sometimes NEThics scares students off trouble before it starts. Recently, someone off-campus wrote to NEThics to say that a computer on campus, which belonged to a student, was being used in attempts to hack into his computer system. Ms. Reuter checked with the security staff and found that the computer was displaying unusual activity, which might indicate that the student who owned it was trying to hack into other computers, but neither NEThics nor the security staff was certain. Ms. Reuter says she called the student who owned the computer and took an indirect approach: Isn't this strange? she said. We've noticed all this activity coming from your computer, so what do you suppose that's all about?

The student feigned ignorance, she recalls, but the unusual activity then stopped.

A file is created for every case, and NEThics staff members check the files to see if an accused student has been called in more than once. The university's computer policy says that punishments can be more severe for repeat offenders. The NEThics staff doesn't dole out punishments, instead passing information on to campus judicial authorities or the police.

On average, the NEThics staff receives about 50 complaints a day, but not all of them merit investigation -- some complaints are inaccurate or better suited for the computer help desk. So far this year, the office has handled about 250 cases, about half of which were allegations of excessive downloading (which could slow the campus network for other users, and could mean students are violating copyright law) or of sending out mass, unsolicited e-mail messages. Other common violations include using the university network for business reasons or hacking into other accounts.

The job is Sisyphean, with more complaints and new students rolling in every day. Ms. Ginther says the office is just beginning to put together some standards to measure the success and value of the NEThics program, which costs about $50,000 a year in part-time salaries.

For now, success is measured anecdotally. Before NEThics, if students received threatening e-mail messages and called the university's computer help desk, "they were told to turn their computer off -- just delete the mail, don't worry about it, and it'll go away," Ms. Ginther says.

Other Paths to Discipline

Not many institutions -- and especially not many of those smaller than the University of Maryland or SUNY-Buffalo -- have set up formal computer-discipline offices. At the University of California at Santa Cruz, one staff member handles all of the cases of copyright violations and bandwidth consumption, and leaves other infractions to administrators in residential offices.

At Lehigh University, the technical-staff members pass most egregious network violations to the office of the dean of student affairs and the student judiciary. Christopher J. Mulvihill, an assistant dean of student affairs, handles technology-related issues along with other student-related infractions, like drinking in the dorms and cheating. If Lehigh were a larger campus, he says, administrators might consider creating a centralized office for computer discipline. But as it stands, "things move pretty swiftly," Mr. Mulvihill says. "My office has a good relationship both with the university police and our information-resources people, so it's not like there's a lot of bog-down."

At Reed College, complaints about students misbehaving on the network are few and far between, so there's little need for an independent office to handle discipline, says Marianne Colgrove, the college's associate director of computing and information services. When infractions occur, they are usually handled in a chat between members of the technology staff and the student. "We're not very formal here," Ms. Colgrove says, adding that she hopes never to set up a computer-discipline office. "I suspect that if we did need to come to a greater level of formality, we would try to work within existing structures."

A NEThics-like office is one way of processing computer infractions, but it is not the only way, says Tracy B. Mitrano, the director of Cornell University's computer policy and law program. "Each institution is going to implement policies in different ways, according to the structure and culture of the institution," she says.

Although there are advantages to having people in technology offices who are specially trained to deal with sensitive issues like cyberstalking, institutions can deliver the same services through, say, the office of student affairs. "If you have a good judicial administrator who has a knowledgeable and good relationship with people in the IT organizations, they can share information," Ms. Mitrano says.

Still, more and more large universities are establishing central computer-discipline offices, in part to help with the public-relations problems that misbehaving computer users can cause. Darrin Printy is creating one such program at Minnesota's St. Cloud State University, where he is the residential-network coordinator. He says it is a "public relations" necessity for large universities. "If someone sends in a complaint and no one responds, then they'll go to the president or the newspapers."

But the need to maintain good relationships with students, as well as with faculty and staff members, is also driving these programs, says Glenn C. Hill, who runs a discipline office at Northeastern University. He says a network-ethics office "demonstrates value" in the security and education of the students. Under the old way of handling network trouble, he says, complaints went to a network administrator who had a "peripheral interest" in computer discipline and no training in investigation, policy, or human relations.

"People's [network connection] would get shut off, and that's kind of where it ended," he says, adding: "The response of shutting someone's access off is really not effective. It doesn't help state what the expectations are, it doesn't help modify behavior, and it doesn't help the community get a sense of how they can work together to create a better experience."

As for the student at Maryland, her experience has been helpful, if not entirely pleasant. "I think every college should have something like NEThics," the female student writes in an e-mail message. NEThics' search for the stalker was "constant," she adds. "They did whatever they could have done."

It appears that the stalker is another student. Because the student wrote from a public computer lab, the NEThics staff members at first weren't sure whether they could track him down. "I thought that was the end of it," the female student writes. However, after four days, NEThics had a lead: A male student returned to the computer lab and asked an attendant whether messages could be traced back to him. He was someone the woman knew and had suspected.

For now, she is trying to figure out where to go from here. She says she talked to representatives of the campus judicial system between final exams. "I just came to know the identity of the person yesterday, so I guess I need time."