The day ASU announced the new service, students converted their e-mail accounts to Gmail for ASU at the rate of 300 per hour. In the first two weeks, several thousand more made the switch. "In almost no time at all, Gmail for ASU accounts had been created for a student community of more than 65,000," adds Sannier.
This case study about ASU's incredible 10-day implementation has been used by e-mail outsourcing proponents ever since to pique the interest of top executives and convince undecided IT administrators in many institutions.
At Case Western Reserve University (Ohio), the ASU implementation was cited as an example in the business case--available online on the Case Wiki--built to review all available options after the university's e-mail system vendor, Sun Microsystems, announced that the version of the product they used was at its "end of life" and would not be patched in the future. Case Western administrators finally wound up choosing Google Apps for Edu as the university's e-mail solution.
While these early adopters have been satisfied by their decision to outsource all or part of their e-mail operations to Microsoft or Google, administrators at most IHEs are probably wondering if their own institutions should follow these trailblazers.
Are there any downsides to what could be the miracle solution to a campus administrator's worst e-mail nightmares?
It all depends on the "e-mail problem" that needs to be solved at the institution, but it's crucial to address the following questions before making a decision.
If our e-mail servers aren't ours anymore, who will own our data? Who will be legally responsible for its integrity, security, and privacy?
These aren't small questions for any institution that must comply with specific laws and directives such as the Family Education Right Privacy Act (FERPA) and e-discovery, requiring a stricter control of certain type of data. It can even get more complex for public universities, as other state regulations may apply.
Although the final answers to these questions will have to be specifically addressed in contractual terms, Google and Microsoft offer several blanket guarantees in terms of server backup, redundancy, security, and privacy. As the leaders of the e-mail market, both companies are used to protecting huge amounts of data and, as a result, have implemented very reliable and secure systems. "By partnering with a company like Google for our student e-mail system, we have been afforded a system reliability and security level that is beyond what a public institution would reasonably deploy," confirms Sannier.
Privacy requirements can be slightly different in higher education to what Microsoft and Google were used to. For example, with the protection of educational records under FERPA, both companies quickly understood that compliance was a crucial condition to service adoption among institutions. Tracy Mitrano, director of IT policy at Cornell University, says the best way to handle concerns over privacy issues in the case of e-mail outsourcing is to make clear in the contract that the vendor will follow the set of rules defined by the institution itself.
Microsoft and Google also provide access to end-user accounts to help administrators deal with discovery requests or other internal processes. "In fact, our acquisition of Postini, and the subsequent release of Google Apps Security and Compliance products, can be a big help for universities on this front," says Keltner.
At Microsoft, the introduction of Exchange Labs as an alternative to Hotmail has resulted in a lot more control over the content of student inboxes. Administrators can confirm if an e-mail was delivered. "They can create filters that locate certain types of e-mails, and they can access the content of a student's inbox for auditing and compliance reasons," says Gabrielle.
Are these services really free? What are the real costs or savings associated with their implementation and their maintenance?
Microsoft Live@edu and Google Apps for Edu are indeed offered at no cost to colleges and universities. While Google indicates on its website that no server, no hardware, and no consulting are required, Microsoft does mention a premium option offering a more automated "set it and forget it" synchronization, Microsoft Identity Lifecycle Manager, which comes with some software requirements and attached costs.
