jossey-bass

Ensure your institution's policies are legally sound with guidance on:

  • Designing a hiring process that lessens the chance of discrimination
  • Balancing students’ free speech rights with your institution’s legal obligations
  • When flirtatious behavior crosses the line into sexual harassment or your institution may be liable for a student’s off-campus rape
  • And much more!
Use discount code CLAW5 and save 20%! SUBSCRIBE NOW!

Other Products of Interest

College Athletics and the Law
guides development of a legally sound “game plan” for your institution's athletics programs! Each month, you get expert coaching on how to meet NCAA and Title IX requirements, negotiate coaching contracts, support athletes with disabilities, and more. Read More
Disability Compliance for Higher Education
Learn how to keep your institution in compliance with disability laws while ensuring the best policies and programs for effectively serving students with disabilities. Read More
Liability
5/22/2015 12:00 AM

Whether or not you think attorneys have a place in your institution’s conduct system, wouldn’t you love to know what those attorneys are actually thinking so you can better prepare for the inevitable?

Whether or not you think attorneys have a place in your institution’s conduct system, wouldn’t you love to know what those attorneys are actually thinking so you can better prepare for the inevitable?

“The lawyers are coming to a campus near you and they’re coming quickly and they’re working on manipulating the money out of your pocket and into theirs while hopefully helping someone along the way. I deal in manipulation every single day — it’s what I do, it’s what I teach,” said Charles H. Rose III, professor of excellence in trial advocacy and director of the Center for Excellence in Advocacy at the Stetson University College of Law.

“If you’re not aware of the way a lawyer works, then you’re missing an opportunity,” Rose said.

He shared a glimpse into the inner workings of the typical attorney’s mind during his presentation at Stetson University’s National Conference on Law & Higher Education.

Understand attorney’s perspective

“Every time I talk to a decision-maker, whether it’s a university administrator or a judge, I’m thinking about how I can use the law to get you to do what I want you to do. For the uninformed person who approaches a lawyer, it’s not a question of if they’ll be taken advantage of, it’s when they’ll be taken advantage of,” Rose said.

“I’ve come up with the story or the hook or the piece that I need to and I set it all up structurally from the very beginning so that I get you to believe the promise I made to my client,” he said. That “promise” might be to get a student kicked off the baseball team or allowed back onto campus, or to convince you to launch a particular program instead of the one you had planned, he said.

“This is the way lawyers think that have been trained properly. They’re looking at everything through the lens of their client. Lawyers are taught adversarily from the very beginning to win for someone. It’s literally what we teach and what we breed,” Rose said.

“Lawyers are very good at finding the thing that bothers you, the thing that you’re hiding,” he said. And when you hide something from attorneys, they know it’s something that could benefit their client, and that you’re obstructing justice. And lawyers learn to read body language so they can achieve justice on behalf of their clients, he said.

Practice, rehearse, prepare

Before any legal process, Rose practices. He re-creates the environment before going into it so it’s not happening for the first time when he talks to the other lawyer, Rose said.

If you say “I’m not going to tell you that” or “I don’t have to share that with you,” even if your statement is legally accurate, you’ve just clued the attorney in that you don’t want him to have that information. And that will lead the attorney to want, seek and find that information, Rose said.

He said you can increase your chances of a better outcome if instead you respond with something like “We have privacy concerns, which are XYZ. And this is not the appropriate avenue for you to receive that information because of XYZ, but you can properly request that information through such and such.”

Remain calm

Rose said he teaches his students to create, manage and benefit from conflict. That includes knowing how to push people over the edge so they say the thing they don’t want to say that the attorney wants to get them to say, and to force people to be truthful when they don’t want to be, he explained.

“When I get conflict and confrontation, I get information and compare it to the law and get you to do what I want you to do,” to serve the client, Rose said.

“Whenever you talk to a lawyer and you get on your emotional high horse and tell them how things are in your world, the lawyer is provoking a response. Whenever you’re on a roll, stop, take a breath and recalibrate,” Rose said. Remember, that lawyer is listening for that opportunity to push you over the edge, he said.

Develop victim advocacy programs

As you’re developing or modifying your procedures, make sure you have processes in place for the rights of the alleged victims and the accused, Rose said. And always have a vibrant victim’s advocate program, but ensure the program staff aren’t involved in your adjudication process because you can’t advocate for the victim and investigate at the same time, he said.

“The best advocacy brings about reconciliation. Inside the heart of most lawyers resides an idealist who believes the world is a place where justice exists and people can treat each other fairly. In their quiet moments, they’re desperately trying to find a way to make that happen. And if you know that about lawyers you can use that to help your cause,” Rose said.

To contact Rose, who conducts advocacy training, email him at crose@law.stetson.edu.

Compliance
4/17/2015 12:00 AM

Facebook, Twitter, LinkedIn, Instagram, Tumblr, Pinterest, Yik Yak. The breakneck speed at which the social-media world continues to grow and change presents an array of challenges for colleges and universities struggling to keep pace. Institutions face a difficult balance between boosting their social-media presence and steering clear of legal hot water and PR nightmares.

Facebook, Twitter, LinkedIn, Instagram, Tumblr, Pinterest, Yik Yak. The breakneck speed at which the social-media world continues to grow and change presents an array of challenges for colleges and universities struggling to keep pace. Institutions face a difficult balance between boosting their social-media presence and steering clear of legal hot water and PR nightmares.

“There’s the feeling that everyone else is doing this, so let’s do this,” said Jacob Rooksby, assistant professor of law at the Duquesne University School of Law in Pittsburgh. But institutions must implement a thoughtful and systematic social-media approach that furthers educational goals while limiting liability, he said. Rooksby recently spoke at Stetson University’s National Conference on Law & Higher Education.

The 140-character limit on Twitter certainly doesn’t limit your institution’s exposure to claims of defamation or other areas of liability, Rooksby said. In fact, your institution won’t get off the hook just by shifting the blame to staff or faculty members who use institutional social-media accounts, he said.

And some students’ posts would make any higher ed administrator cringe. Hateful and disrespectful speech about faculty, staff and other students isn’t anything new. But the platform has changed. Instead of whispers and notes heard and seen by a few, social-media posts instantly appear before thousands on Yik Yak or Twitter, and often anonymously. Banning a particular platform won’t solve the problem, Rooksby said.

Gain perspective

“Some of the most important speech is anonymous. And hate speech is not punishable under the Constitution unless it rises to the level of defamation or a true threat,” Rooksby said.

The best starting point is developing social-media policies/guidelines, he noted. Don’t assume existing policies cover social media. Ensure policies define what’s covered, what’s not, and whether and to what extent policies address student and employee activity, he said.

Your institution should also coordinate its social-media activities, which happens at very few institutions. “There’s really no one in charge. Think of the benefit of brand. Corporations have entire departments overseeing social media,” Rooksby said.

Many institutions have lost track of how many accounts bear their institution’s name or other identifying marks, or which institutional representatives actively represent the institution on social media, he said. Such a lack of awareness could bring all kinds of trouble to bear on the institution, he warned.

Use social media for branding

Instead, your institution can harness the power of social media for branding, promotion and reputation. Here’s how, according to Rooksby:

  • Identify a social-media coordinator and create a social-media hub. For example, Harvard University’s website has a social-media page that lists all its social-media accounts so people can connect to them from one central place.
  • Manage the message. Ensure your institution creates and uses its very own hashtag. It can be a valuable opportunity to take back control, have influence, and overcome the negatives on social media.
  • Reclaim your institution’s name. Find out if student organizations or others use your institution’s name/insignia/logo in their Twitter handle or Facebook page. Then, reclaim it. Otherwise, consumers could reasonably believe the other party is your institution. If your reclaiming efforts are met with free speech concerns, explain they can continue saying whatever they want, but you’re acting to prevent confusion and to protect your trademark.

Conduct social-media training, review

Annual social-media training and review sessions can help ensure your institution has a safe and effective plan for handling social media, Rooksby said. Invite staff and faculty members responsible for maintaining institutional social-media accounts or contemplating creating new ones.

Rooksby suggested asking your institution’s social-media coordinator, legal counsel, public relations/marketing staff, or information technology director to give presentations on the following key topics:

  1. Institutional vs. personal accounts.
    • Emphasize that institutional social-media accounts are maintained and operated by faculty or staff for the good of the institution. When using personal social-media accounts, faculty and staff should take care to distinguish they’re not speaking for the institution.
    • Institutional accounts should bear institutional trademarks, but personal accounts should not. Institutional users must not “like” products, candidates or political causes.
    • Some states have laws prohibiting employers from requiring employees to provide log-in/password credentials for social-media accounts or accept their friend requests. Many laws don’t cover shoulder searches, which means a supervisor could ask an employee to pull up her Facebook page at work. But Rooksby discourages that practice because less knowledge is better when it comes to your employees’ private social-media use, he said.
  2. Account logistics.
    • Explain how to select appropriate names for institutional accounts across platforms (e.g., you want @university’s name to be the Twitter handle for the institution, not the fencing team).
    • Review the platforms and accounts your institution uses, as well as known or perceived limitations of activity.
    • Identify the social-media coordinator who keeps the central repository of institutional accounts.
    • Emphasize maintaining accurate, up-to-date access information for all institutional social-media accounts.
    • Establish communication channels between everyone responsible for institutional social-media accounts to encourage uniformity and prevent overlap.
    • Discuss how each institutional account relates to others.
    • Explain procedures for establishing new accounts within established platforms versus establishing new accounts within emerging platforms.
  3. Institutional rules and norms.
    • Review your institution’s social-media policy, guidelines and goals. Note how they intersect with other policies, such as student conduct codes and faculty policies.
    • Discuss positive social-media events that supported your institution’s social-media goals.
    • Review lessons learned from recent negative social-media events involving your institution.
    • Emphasize the importance of accuracy, transparency (of identity), respect, timeliness, sensitivity and interconnectivity in all institutional social-media use.
    • Remind everyone of the permanence of online posts.
    • Address how academic freedom and freedom of speech apply to social media. It doesn’t mean faculty/staff can post whatever they want and the institution can’t object or respond to it.
  4. Legal concerns.
  5. Advise institutional social-media account users to take the following steps to help reduce risk of liability, including defamation and privacy violations:

    • Obtain written consent from photographed individuals whenever possible, or at least verbally ensure they know their images could appear on social media. Avoid portraying the views/beliefs of others.
    • Don’t publicly disclose private facts about others, or anything that’s offensive.
    • Don’t post content that’s negative, derogatory, and could be proven false.
    • Ensure accessibility for all, especially if social-media use is required to fulfill curricular or cocurricular activities.
    • Limit posting others’ material and always provide attribution. Even better, link to the original or ask permission.
    • Don’t rely on disclaimers to prevent defamation claims. For example, it’s not enough to state on your profile page, “All views expressed are my own. Retweets do not imply endorsement,” or to preface insulting posts with “In my opinion….”
    • Balance privacy versus safety concerns. Don’t let unnecessary fears of privacy violations keep you from sharing your concerns about a student’s post. “These are your thoughts about someone else and you can act on those,” especially when it concerns a public post, Rooksby said. In fact, you have a duty to respond, he said. “The risks are definitely greater in not reaching out,” he said.

Craft sound social-media policies, guidelines

The fact that social-media platforms change so quickly only underscores the critical need for carefully crafted social-media policies and guidelines.

“It’s somewhat tricky to write a set of policies that will apply for the future without being so broad that it will be meaningless,” Rooksby said. He said social-media policies/guidelines can play a critical role by:

  • Protecting your institution’s reputation. You don’t want a disgruntled employee using your Twitter handle to send out insulting posts, for example.
  • Promoting brand uniformity and strategic engagement with constituents.
  • Preventing surprise in the event of litigation.
  • Minimizing personnel issues.

To develop effective social-media policies/guidelines for your institution, consider following Rooksby’s tips:

  • Address overarching concerns instead of tying policies/guidelines to any specific platforms.
  • Use wording that’s easy to understand and follow. Steer clear of anything too long or unwieldy to actually enforce, or so vague or broad that it could come across as impinging on academic freedom or values.
  • Consider “time/place/manner” restrictions/guidelines instead of a banned-words list that is difficult to enforce. For example, you might require student-athletes to refrain from social-media posts two hours before or after games.
  • Ensure institution-wide distribution and awareness of the policies/guidelines.
  • Determine how you’ll decide whether questionable posts cross the line and become a violation. Consider whether the posts violate any professionalism codes or rise to the level of a true threat, defamation or harassment.
  • Clearly articulate any ramifications for ignoring applicable policies/guidelines.

Jacob Rooksby provides social-media audits, trainings and consultations for institutions. You may contact him at rooksbylaw@gmail.com.

Risk Management
2/2/2015 12:00 AM

Colleges and universities can learn a lot from the U.S. government when it comes to campus threat assessment and violence prevention. From the 1990s Secret Service study of attacks on public officials to the most recent FBI study of active-shooter incidents, the findings have implications for behavioral intervention and campus incident response.

Colleges and universities can learn a lot from the U.S. government when it comes to campus threat assessment and violence prevention. From the 1990s Secret Service study of attacks on public officials to the most recent FBI study of active-shooter incidents, the findings have implications for behavioral intervention and campus incident response.

“Preventing Assassination: A Monograph: Secret Service Exceptional Case Study Project” details the findings from analyzing 83 attempted attacks on public officials that occurred from 1949 to 1996. Key findings from this report include:

  • Violence is the end result of an understandable process of thoughts and behavior.
  • People who engage in violence don’t fit a single or specific profile.
  • There are often identifiable behaviors of concern exhibited prior to the act of violence, including the planning and preparation.

The resulting implication of this study is that many acts of violence are potentially preventable. After Eric Harris and Dylan Klebold’s violent acts at Columbine High School in 1999, the same question was asked about violence in the school setting. “The Final Report and Findings of the Safe School Initiative: Implications for the Prevention of School Attacks in the United States,” a study by the U.S. Secret Service and Department of Education, reviewed the behaviors leading up to 37 school shootings occurring between 1974 and 2000. The same themes emerged, including:

  • Attacks are rarely sudden or impulsive.
  • Most of the time, someone knew about the idea or plan before it happened.
  • Most attackers exhibited a behavior that caused concern for others before the attack.

So why don’t people report these concerns? The answers are simple:

  1. No one wants to believe their friend or their son or daughter could be capable of such violence.
  2. There isn’t a singular, definitive profile, predictor or cause of violence. This is illustrated in a student bystander study by the U.S. Secret Service, “Prior Knowledge of Potential School-Based Violence: Information Students Learn May Prevent a Targeted Attack,” that found that people often misjudge the likelihood, immediacy and actuality of an attack, so they don’t report it.

Understand the history

The Virginia Tech incident in 2007 became the deadliest shooting on a college campus since 1966, when Charles Whitman killed 14 people and wounded many more at the University of Texas-Austin in what’s now known as the “clock-tower shooting.” Then in 2008, the violence at Northern Illinois University led officials at colleges and universities throughout the country to ask, “Are we next?”

Campus threat assessment and behavioral intervention teams emerged, attempting to connect the dots to understand student behavior across the silos that frequently exist at academic institutions. The Handbook for Campus Threat Assessment & Management Teams emerged as a resource to help campuses put the threat assessment research into practice through the creation of multidisciplinary behavioral intervention teams. These teams are designed to identify behaviors that reflect where someone falls on the escalation of violence spectrum (from ideation to implementation).

“Campus Attacks: Targeted Violence Affecting Institutions of Higher Education,” published in 2010 by the U.S. Secret Service, reviewed 272 incidents of targeted deadly violence that occurred at colleges and universities, ranging from sexual violence to gunshots. Most of the time, the violence comes from a member of the campus community. The triggers for violence vary. But in the current national landscape focused on sexual violence on college campuses, it’s worth noting that more than half of the incidents were triggered by an intimate relationship, refused advances, obsession or sexual violence. Other triggers included retaliation, academic stress/failure, bias and workplace dismissal.

Follow key steps

As our campuses strive every day to answer that dreaded question “Are we next?” consider these key guiding concepts:

  • Create a culture of reporting. Looking back at the behaviors leading to the Columbine shooting or other incidents, we can identify warning behaviors. However, would we each report the behavior if it involved one of our own friends, students or children? That’s why we need to make it easy for our campus community members to report concerns, and build trust by sharing information with reporting parties whenever you can. While the team’s risk assessment model should remain confidential, the campus community needs to know what kinds of things to report, what will happen with the information, and what will happen to the person of concern. Your team’s eyes are the campus community. Without referrals, you’re blind to what’s happening on your campus.
  • Get the right people at the right table at the right time. Once you learn of a concern, arrange for the best people you have to investigate and review it. While there’s no “right” number, effective teams generally include four to seven members to ensure multiple perspectives and timely action. Consider ad-hoc meetings or a core and extended team if you have a larger campus or team. Quality training and use of a mutually understood risk assessment model should ensure that if only a few team members convene, then decisions should still be made as if the whole team made them.
  • Focus on prevention, not prediction. Don’t try to determine which one of your highest-risk cases might be the one that actually results in violence. Once you determine someone has a risk level for violence, take appropriate steps to intervene to lower the risk no matter how high or low that risk seems. This is where the team also supports the overall institutional mission of student success and completion.
  • Balance research and campus context in decision-making. Use the team to evaluate behaviors, risk factors and protective/supportive factors impacting an individual, and use a consistent model based on research to guide investigations, evaluate information, and determine a level of risk and any appropriate interventions.
  • Intervene before a threat. If the team is spending all its time on high-level-threat cases, or if the team chooses to meet only once or twice a year, there isn’t enough time being spent on the low-level cases such as argumentative or isolated students. Ideally, teams spend most of the time deciding whether the behavior is simply an isolated concern or whether it’s an indicator that the person poses a low threat for violence. This often means a lot of case management and follow-up, rather than a lot of detailed investigations.
  • Don’t try to exist in a vacuum. Just as The Handbook for Campus Threat Assessment & Management Teams notes, the process is about threat assessment and management. Violence is a process, not a snapshot. Keep good records. Follow up on leads and confirm your interventions are effectively managing the threat. Employ monitoring strategies to make sure certain individuals don’t rise back to a threat level. Take the campus into the context of the larger society, considering when to alert someone outside the campus about a possible threat, especially if you’re separating a student or employee from your campus.

Even though we often ponder the question “Are we next?” the reality is that we must ask it again every day and after every new incident that occurs throughout the country. Even the FBI recognizes that “[o]ur success will always be hard to quantify, since success is defined as the lack of an event,” as stated by Andre Simons, a supervisory special agent with the FBI, in “Why Mass Shootings Keep Happening: A Radical New Look at Mass Shooters. Why They Do It and How to Stop Them.”

While we continue daily efforts to prevent violence on college campuses, we can take solace in the 2013 “Gun Violence: Prediction, Prevention & Policy, APA Panel of Experts Report,” which found that behavioral threat assessment and management teams are “the most effective tool currently available to prevent workplace violence or insider threats.”

Although we may not be able to fully quantify our success, there’s a certain measure of success found in being able to sleep at night and come to work ready to ask the question through an intentional campus process based in government research and strategies.

Check out threat assessment resources

—Compiled by Laura Bennett

Of Counsel
3/23/2016 12:00 AM

Students invest increasingly more money and time to earn a college degree. Meanwhile, colleges vigorously market the long-term value of a two-year, four-year or graduate degree by pointing out postdegree income differentials.

So when a student has spent three, five or even seven years in higher education, has amassed six figures of debt, and envisions enjoying the postgraduate life as advertised but is dismissed for academic reasons, the student often feels as though the rug has been pulled out from under him by a secret faction of faculty.

Students invest increasingly more money and time to earn a college degree. Meanwhile, colleges vigorously market the long-term value of a two-year, four-year or graduate degree by pointing out postdegree income differentials.

Education costs create high stakes for academic progress

So when a student has spent three, five or even seven years in higher education, has amassed six figures of debt, and envisions enjoying the postgraduate life as advertised but is dismissed for academic reasons, the student often feels as though the rug has been pulled out from under him by a secret faction of faculty.

To attempt to protect his investment, the student will likely lawyer up. Students are likely to demand damages in the form of not only tuition and fees (maybe $100,000 or more), but also future lost wages of another few hundred thousand dollars, and in some cases legal fees.

If faculty members determine a student doesn’t show enough intellectual or practice capability to earn a degree, they typically determine she shouldn’t receive that degree. But resting comfortably in the belief that a jury will defer to faculty judgment can prove dangerous for colleges.

Increasingly, lawyers who specialize in individual rights are becoming savvier about how to attack academic decisions on behalf of students who feel wrongfully dismissed.

Courts will defer to academic judgment — to a point

In many cases, students have challenged academic dismissals in which the courts have recognized that a judge or jury shouldn’t substitute its judgment for that of the faculty.

For example, in a Washington Court of Appeals case, the court stated, “The decision not to award a degree is one uniquely within the expertise of the faculty members most familiar with the student’s abilities. Courts should not interfere unless the action is arbitrary and capricious or taken in bad faith” (Enns v. Bd. of Regents of Univ. of Wash., 650 P.2d 1113, 1116 (Wash Ct App 1982)). This type of deference is bound up in concepts of academic freedom.

Other courts have taken pains to point out that academic freedom doesn’t preclude a court “from vindicating the contractual rights of a plaintiff.” In one case, a court allowed a student-plaintiff to proceed past early dismissal when the plaintiff alleged, for example, that a faculty member had incorrectly relied on a “C” grade in a course, even though the student had achieved a “B.” The student also asserted that faculty members relied on an evaluation of the student stating his performance was “substandard,” even though the plaintiff had received an “A” (Paulin v. George Wash. Univ. Sch. of Med. & Health Scis., 878 F. Supp. 2d 241 (DDC 2012)).

In other words, if a student is dismissed and can point to mistakes that led to a dismissal decision, he can attack the decision and deference to faculty will dissipate.

Because academic dismissal cases aren’t particularly common (although becoming more so), judges may be wary of dismissing claims based solely on the grounds of academic deference. This is particularly true in cases in which processes or standards aren’t clearly written or lack the appearance of proper application.

Dismissal of cases is also difficult if faculty or administrators have engaged in wide-ranging email communication about the strengths and weaknesses of a student who wasn’t given the chance to see the email chain or respond.

If a case isn’t dismissed, jurors unfamiliar with higher education may be asked to evaluate whether an academic dismissal was legal.

What would a jury think?

If a case reaches a jury, the jury will care about whether the student was treated fairly. The demeanor of key faculty witnesses, the accuracy of information on which faculty relied, and the clarity of and adherence to procedures will matter to a jury.

To increase the likelihood of successful defense of a claim challenging an academic dismissal, colleges should take the following steps:

  • Examine catalogs and recruitment brochures for language that overstates what the college can deliver. Statements such as “The faculty of this program will ensure that every student is supported every step of the way to achievement of a degree” may not completely ruin an academic-deference defense because of other statements (and common sense) showing that a student isn’t guaranteed a degree, but a good advocate can take such a statement and try to get a jury to think that faculty members should have done more to help a student achieve.
  • Establish clear academic standards. And ensure consistency across all publications.
  • Develop clearly worded academic dismissal policies. And apply them consistently.
  • Train faculty and administrators in proper email communication. Stress the importance of using extreme caution and care.
  • Show compassion, not frustration. Jurors understand dismissal has very high stakes for a student, so they’re likely to understand a student’s strong reactions. But jurors are less likely to empathize with faculty or administrators who feel personally offended by a student’s approach to contesting an academic decision.

In today’s litigious society, colleges must consider how their actions will be viewed outside the academic environment.

Of Counsel
2/24/2016 12:00 AM

Colleges and universities are a treasure trove of information for hackers, from intellectual property rights and research data collection to student and staff financial information and Social Security numbers.

Indeed, what makes colleges and universities such remarkable laboratories of innovation and learning also renders them fruitful targets for hackers. Moreover, colleges and universities are particularly susceptible because they’re often deeply decentralized and function in silos — each department containing disparate information-processing protocols and internal cultures of data-sharing.

Colleges and universities are a treasure trove of information for hackers, from intellectual property rights and research data collection to student and staff financial information and Social Security numbers.

Indeed, what makes colleges and universities such remarkable laboratories of innovation and learning also renders them fruitful targets for hackers. Moreover, colleges and universities are particularly susceptible because they’re often deeply decentralized and function in silos — each department containing disparate information-processing protocols and internal cultures of data-sharing.

This concern isn’t lost on the U.S. Department of Education, which highlighted the obligation of colleges and universities to protect data and student information in a “Dear Colleague Letter.” The ED’s letter centered on the security of financial aid information and third-party handling and access to such information. However, there’s no doubt the ED expects institutions to develop and implement comprehensive campuswide cybersecurity practices.

Unfortunately, you won’t find a stand-alone policy or program that works for all colleges and universities. Instead, to address your cybersecurity needs you’ll have to start with established policies and procedures and invest in sophisticated technical solutions.

And policies serve as only one piece of the solution. The implementation of your policies along with smoothly running processes and operations is the true test of whether your institution is prepared to handle a cybersecurity attack and whether your cyber program complies with the ED’s mandate.

Consider these 5 keys to help ensure your institution has an effective cybersecurity program:

  1. Classify information and identify your risks. A cybersecurity program begins with classifying the data that comes into your institution and leaves your institution. For universities, that could include intellectual property, proprietary research, student information (such as Social Security numbers, health records and financial information) and employee data. Without an inventory of data and how it’s used, shared and stored, risk mitigation and security become impossible. Appropriate staff members must also understand the statutes that govern and impose special requirements over your institution’s most sensitive data. For instance, student education records must be treated and retained according to the dictates of the Family Educational Rights and Privacy Act. Similarly, if you issue student debit cards or cash cards for use at dining halls, you may be subject to the strictures of the Gramm-Leach-Bliley Act.
  2. Develop a centralized cybersecurity position. Given the decentralized nature of colleges and universities, the development of a centralized position responsible for your institution’s cybersecurity program must become a priority. The person in this position should have the authority to delegate and manage these operations as well as develop a cross-functional team to support the program.
  3. Scrutinize third-party vendors. The ED letter made it clear that higher ed institutions are responsible for data breaches caused by third-party vendors. That’s why colleges and universities must ensure that vendors meet the institution’s own security standards and communicate and handle data incidents and breaches in accordance with the statutes governing the institution’s own conduct. In other words, because FERPA applies to the school, it also applies to vendors handling FERPA-covered records. You can mitigate this risk by limiting third-party vendors’ access to only data that falls within the nature and scope of the third-party contract.
  4. Taking inventory of your third-party vendors and determining the levels of access to secure data is a vital first step in assessing your data-security program. Third-party vendors might oversee your cloud-computing operations or email platform. And researchers might host data from study results on servers hosted by third-party vendors. Scrutinizing your third-party vendor data-security responsibilities is a critical part of your data-security program.

  5. Provide training to staff members. All employees of a college or university are responsible for data security. To that end, it’s imperative that staff members, even those outside the internal response team, receive periodic training regarding security protocols and steps they can take to keep institutional and student data secure. In fact, the majority of data-security incidents are caused by employee mistakes, failure to follow protocol, and even purposeful misuse.
  6. Monitor security systems and practice data-breach responses. Accept the premise that a data incident or breach will happen. In light of that, all cybersecurity programs must include regular monitoring and testing. Data breaches are stressful and can be extremely chaotic, from containing the damage to determining the root cause of the actual breach. It’s critical for your systems and protocols to run seamlessly when the inevitable happens. Testing can help alleviate some stress and identify vulnerability gaps. Although no data-breach response plan will go perfectly, routine practice will help your institution be as prepared as possible when an incident does strike your campus.
Of Counsel
1/27/2016 12:00 AM

Many campuses have seen a significant uptick in vigorous verbal exchanges, protests and demonstrations, particularly related to race relations. This activity tests colleges’ desire to create open dialogue while also fulfilling their obligations to provide a campus environment focused on learning and the safe exchange of ideas.

Many campuses have seen a significant uptick in vigorous verbal exchanges, protests and demonstrations, particularly related to race relations. This activity tests colleges’ desire to create open dialogue while also fulfilling their obligations to provide a campus environment focused on learning and the safe exchange of ideas.

Although issues involving the University of Missouri, Columbia, have probably garnered the most attention by the mainstream media because its football team helped bring national publicity to student concerns on its campus, it’s only one example of many recent student protests across the nation.

Campuses that anticipate vigorous demonstrations and debates should keep in mind the key legal parameters related to free speech. But, equally important, they should also trust their own judgment to guide their practical efforts and decisions related to expressive activity on their campuses.

Legal issues key part of equation

Higher ed administrators charged with maintaining the balance between free expression and keeping order on campus must remain cognizant of key legal issues.

Administrators know that under the First Amendment, public institutions have limited ability to restrict speech. Courts have issued innumerable opinions about the contours of those limitations. First Amendment law is complex, and legal counsel should usually be involved when considering specific free-speech issues.

Although private institutions aren’t subject to the constitutional requirements for restricting speech, most private institutions still take into account how public institutions address campus speech issues when making decisions about protests and disruptions, and often hold themselves out as recognizing the value in robust expressive activity.

Some speech not protected

Campus officials have some leeway to restrict truly threatening expressive activity — such as speech that could incite violence. And campus officials may restrict obscene speech and defamatory speech. But most speech doesn’t fall into these categories, and determining what constitutes speech that isn’t protected can be difficult.

Time, place, manner restrictions

Colleges may create reasonable time, place and manner restrictions on speech, and campus officials often know that speech that is (or is reasonably predicted to become) substantially disruptive can allow administrative action to regulate time, place and manner. But what one person would deem a substantial disruption could easily qualify as another person’s example of academic freedom and free speech at its best.

Anti-harassment codes

Hate-speech codes have been rejected by courts, usually because they’re overbroad (capturing speech that can’t be restricted) or vague (unclear so as to chill individuals from exercising speech rights).

But campuses typically have policies that allow discipline for speech that actually infringes on the rights of others, such as harassment toward an individual or individuals based on protected characteristics, and these policies, if properly drafted, are legal and can be invoked to address harassment.

Keep in mind that it can be tempting to overreach in any of the legal parameters. When seeking to quell unrest, administrators must be wary of First Amendment challenges when addressing expressive activity. Courts will often respond to restrictions on speech with a time-honored response that the answer to speech one doesn’t like is more speech, not less. In other words, courts encourage enhancing opportunities for opposing viewpoints instead of restricting speech.

Accordingly, the best way to address offensive speech is to respond with more speech, rather than attempting to quiet the offensive speech altogether. It’s worthwhile to ask whether providing an avenue for more speech may be an acceptable response to vigorous expressive activity before taking steps to attempt to restrict it.

Practical concerns play most critical role

Legal challenges related to the exercise of speech may correlate to the campus environment and administrative mindset. In other words, if an administration’s initial reaction to students seeking to be heard is a “law and order”–type approach, that approach is likely to play out through individual administrators’ restrictive views.

Campuswide emails that threaten students with discipline or arrest for hateful speech, for example, may have good intentions, but they may expose a college to legal challenges. More importantly, generalized threats of discipline may backfire by pushing students to test the outer limits of protected speech and increase the likelihood of actual substantial disruption.

Campus leaders looking to reduce legal risk and engender understanding from courts (and others) are often best served by the following key components:

  • Transparency. Provide up-to-date and accurate information on issues that students seem concerned about.
  • Planning and sharing. Develop a plan for dealing with controversial issues that’s reviewed by counsel and demonstrates a thoughtful approach to ensuring that students have an opportunity to express their views but permits necessary restrictions on activities to avoid sustained substantial disruption and real risks of harm to students.
  • Ongoing, open communication. Create credibility by demonstrating a real commitment to hearing students’ views if and when you must implement restrictive decisions for the sake of operations or safety.

When campus leaders start from the practical and principled approach to enhance opportunities for students to speak in a safe environment, they also increase the likelihood that when it’s necessary to address speech with some restrictions, those efforts will be understood and upheld if subjected to legal challenge.

  • LOGIN HERE

    Username: Password:
  • Content Directory

    CLA subscribers can now log in to browse all articles online!
    Browse Content
    Free Content
  • Free E-Alerts

    Sign up to receive exclusive content and special offers in the areas that interest you.
    Send
  • Subscription Formats

  • Meet the Editor

    Aileen Gelpi, Esq.
    Co-Editor

    Aileen Gelpi has been practicing law since 2008.
    Claudine McCarthy
    Co-Editor

    Claudine McCarthy brings more than two decades of extensive and varied experience in journalism and publishing to Campus Legal Advisor.
Copyright © 2000-2015 by John Wiley & Sons, Inc. or related companies. All rights reserved.