50

I am a PhD student at a German university. Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases. My computer is owned by the institute, but I am the only one using it, and I have completely installed and configured it to my liking. In particular, I am encrypting my data. I do have some private data on that computer as well, e.g. emails since my private email account is linked in my email program, but also some music, and perhaps a few photos, my private PGP key, etc. The setup is pretty similar to some of my colleagues.

Now, I was asked to either physically or digitally hand over my private encryption key (or password) in order to get access in some emergency case. Apparently, my colleagues have done so already. I feel very strange about this, since I grew up learning that passwords should never be given away. I have raised my concerns, e.g., that this would also enable access to private emails or other data, and allow to send emails in my name. But these were marked invalid, since private data has nothing to do on my work computer (even though everyone uses it that way). Alternatively, I was told I could unencrypt my hard drives.

My questions are:

  • Am I required to hand over my private encryption key by law?
  • Morally, how would I best act in this situation?
  • Should I hand over a wrong (digital) private key and hope that this situation would never happen?
  • Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).

It is probably worth to note that no one is really involved in my research topic, i.e., no one really depends on my data. I could however imagine someone to be interested in possible (unpublished) results in the case I am gone.

  • 145
    You make a great argument for keeping your personal stuff separate (completely) from your professional stuff. – Buffy Jan 9 at 12:55
  • 10
    You must, of course, consider local laws and university regulations. It is possible you have been ignoring this and it has now come back to bite you. The university owns the hardware, and may have a valid claim on all of the data etc. It may be theirs, not yours. – Buffy Jan 9 at 13:27
  • 13
    Your institution likely has a Data Protection Officer (Datenschutzbeauftragte). Find them, talk to them. Invasive practices such as password escrow, even for a work device, likely need to be signed off by them anyway. Your right to privacy and the university's right to keep business running without you must be balanced, and neither right can be assumed to automatically prevail. If you really want to fight this, also talk with your Personalrat. They are responsible for negotiating general institution–employee relations, such as personal use policies for work devices. – amon Jan 9 at 21:38
  • 2
    If it's not your computer, the disk encryption key does not belong to you. If you also have a personal encryption key, my advice is to put it somewhere else, e.g. a usb stick you own. – Ben Jan 10 at 15:52
  • 8
    @Buffy In Germany it's more likely that OP is right and the University is wrong. In particular, the University definitely does not own all of the data on that computer. The question was additionally about ethics, and I believe that the ethics in this case match German law. As in, it's not always practical nor necessary to physically segregate work and private documents. – Konrad Rudolph Jan 11 at 10:17

21 Answers 21

104

This seems like an X-Y problem. Why is important work data only kept on a computer on your desk, in the first place? I would expect it to be on a Git repository, or on the shared storage space of a workplace server.

Once you fix this problem, the issue you mention becomes irrelevant: your data will not be lost if your disk suddenly becomes inaccessible.

So a practical way to address the issue could be offering to put more of your work data in shared servers and git repositories, so that the problem disappears. Ask your superiors which data they are worried about, and offer to keep them online preemptively.

|improve this answer|||||
  • 4
    I use duplicity to push my data (or more accurately the deltas) nightly to an offsite server for backup. The server is then backed up to tape and the tapes moved to a third site on a regular basis. Everything is encrypted. If everyone with the passphrases to a data set were to die, the data would be lost (maybe a government agency could break the encryption, but the $5 wrench wouldn't be of any use). – StrongBad Jan 9 at 19:35
  • 5
    @emma Enough discussion on that the way you use IT infrastructure is not professional. I also hope you agree with the many voices suggesting to make the work related data available. Instead of handing over the key, this is the moment to change data handling. I suggest to talk to your university IT if they can give you some (automatically backed up) shared network storage used at least for work related data backup for you and co-workers. We have it like that at a German university and even work most of the time directly on that storage. The university network is sufficiently fast in many cases. – Snijderfrey Jan 10 at 8:43
  • 14
    This is not a X-Y problem at all because we are answering the OP's issue (how to respond to a request for encryption keys) not the university's issue (whether or not to ask for the encryption keys). Telling OP that the university's set-up is wrong doesn't help her solve her problem. – JBentley Jan 10 at 11:56
  • 4
    @JBentley It does if it provides an alternative to handing over private keys – Lightness Races in Orbit Jan 10 at 13:07
  • 3
    @JJMDriessen this is a great example of how not answering the (literal) question can sometimes result in the best actual answer. – Dan Romik Jan 11 at 22:47
54

I am going to (partially) disagree with some of the answers here. I think it really depends on who is asking for your key, and based on what policy.

First of, I am more than confused by the many answers here assuring that the university has in general no business accessing information on the computer they provided you - the IT usage policy in all institutions I worked at so far (in Austria, Switzerland, and Sweden) would certainly disagree with this stance. Sure, the lived practice is that they give you a computer and then don't care much about what you do with it, but the fact remains that it is the university's computer, and that you also use it for private things (maybe with their explicit permission) does not change this fact.

However, if the (somewhat silly) plan of requesting private keys is appropriate depends on who made this request - if this is actually part of the written IT policy (very unlikely) your options are to give them the key or stop using the equipment they provide, but if it's just a wild idea of your PI you have all the right in the world to just say no. "Your" computer isn't really yours, but it also isn't your PI's. Even if they paid for it through their grants, the computer belongs to the university, and university policy governs how they are managed. I am also fairly sure that your IT department would back you up on this if push comes to shove, because a supervisor (or whoever) storing a bunch of private keys or passwords sounds like a liability / traceability nightmare that nobody wants to deal with.

Morally, how would I best act in this situation? Should I hand over a wrong (digital) private key and hope that this situation would never happen?

Certainly not - that's just as silly as asking for the key in the first place, and if your PI wants to test it (every backup solution is only as good as the last time you tested it) you may run into major conflicts. It's much better to acknowledge that their concern is per se not unfounded, even if their solution approach is bad, and to work with them on a better solution. Having a cloud service for data backup would be an obvious approach.

Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).

Unless there is some deep distrust between you and however is requesting this key I don't see why they would mind if you had a separate "non-work" partition (assuming that they allow private usage in the first place). That said, as I mentioned before the whole idea of collecting private keys / passwords is a bad solution to the problem anyway.

|improve this answer|||||
  • 8
    If it is about a private encryption key that anyone asks from me, I do have deep distrust towards this person, because this just does not sound like the right solution to any problem, as you mention. The idea with contacting the IT department of the university is a good one. – emma Jan 9 at 18:13
  • Why can't the PI ask for the password? The person is the principal investigator, the head of that particular research. So it doesn't make sense that PI wouldn't have access to the computer even if it was paid by grants. I don't think @emma has the authority to go to IT and request something above her supervisor. Collection of passwords is supposed to be kept in a password software with high encryption. Simple. I agree, that any colleague, without supervisory request, should ask her for her computer's password. – Mugé Jan 9 at 18:33
  • 6
    @Mugé No one should ask for anyone's password. Data that is required to be accessible in case of emergencies should be stored in some place where certain people (PI, professor,...) have access. If this place is understood as my hard drive, well then I feel like an encrypted non-work partition on this computer is the solution to my problem. – emma Jan 9 at 18:47
  • 3
    @Mugé PI != dictator. Workplace policies also apply to PIs, as much as some PIs wish this were not the case. As for why the PI should not have the password: consider the case that emma's laptop / account gets used for something illegal, how do you determine who of the two actually did it? No IT department wants to deal with this. – xLeitix Jan 10 at 8:15
  • 1
    @Mugé Let's use a realistic example - say the computer / account has been used to download copyrighted movies, and the copyright holder threatens to sue. Who does the university blame? (or, if you want a more drastic example, replace copyrighted movies with child pornography) – xLeitix Jan 10 at 8:30
36

Morally, how would I best act in this situation?

The moral thing to do is first of all to recalibrate your somewhat immature (in my opinion) attitude towards this question and stop trying to think about dishonest solutions like giving an incorrect password or undoing the system-wide encryption but hiding encrypted content on your system and not telling anyone about it. Whether or not you should agree to give the password is a separate question where the answer would be more nuanced, but certainly if you care about behaving morally, do not lie to your supervisors. Any option that involves dishonesty should be unconditionally off the table.

As for the question of whether to give the (correct) password: first, I think it’s reasonable of you to find the policy a bit draconian. I myself am a person who cares a lot about privacy, and as most academics do, I sometimes use my work email for private purposes, so I get where you’re coming from. I wouldn’t want my employers going through my emails. But I also am perfectly aware that they have the right (and technical means) to do that, so if I need to send something especially private or sensitive, I use a different, private email that is protected by a separate password and is not physically stored on my work computer.

What I find unreasonable however is that you are complaining about the policy and how it infringes on your privacy rights, without looking at things from the institute’s point of view, acknowledging that they are trying to solve what is a real problem for them, or offering a solution that might make the violation of your privacy unnecessary. It would be completely reasonable and honorable for you to go to your department chair (or other relevant administrator), say you object to the policy and offer them an alternative plan that ensures accessibility of your work data in unexpected events. A smart administrator would be willing to negotiate a solution that keeps their researchers happy while still meeting the institution’s needs, so I’m optimistic that a solution can be found. And if they don’t agree and just insist that you hand over the password? Well, then, the mature, professional thing to do is to follow your institution’s policies, even if you disagree with them, and vow to behave more reasonably in the future when you yourself someday become an administrator.

Finally, I want to share with you an insight I had one time during the years I was a department chair. I noticed that regular employees have a different approach to risk (of all different kinds) than administrators do. A regular employee will often be willing to ignore the possibility of low-probability events happening and choose a more risky path when making a decision, but administrators are much more sensitive to such things. The reason is that from your point of view, the low probability event of you falling very ill (to use your example) or otherwise not being available to provide coworkers access to your data seems like an outlandishly unlikely event that is like nothing you have experienced happening in your lifetime. But from the administrator’s point of view, they actually see low probability events happening all the time, somewhere in the organization. Those events are not at all “low probability” from their point of view, and it is precisely the administrator’s job to put in place policies that protect the organization in the actually very likely event that such things end up happening to someone.

So what I’m saying is, the administrators aren’t necessarily being as unreasonable as you think with their data protection policies. But of course, it’s reasonable to want to have some privacy as I said, so it isn’t obvious to me that your objections are completely wrong or misguided. Anyway, good luck.

|improve this answer|||||
  • 2
    I find the solution to be a very bad one - though the easiest from a technical point of view, since there is no need to solve the real problem: An institute wide backup infrastructure with good access control. And maybe this is also the reason for suggesting this in the first place.. – emma Jan 9 at 19:00
  • 4
    @emma understood, and I commend you for being open to hearing people’s opinions and wanting to learn about your options. At the same time, the fact that you still consider lying an option reinforces my opinion that your approach to the problem is a bit immature. Anyway, if you want to lie, it’s not my job to stop you. Hope you find a good solution! – Dan Romik Jan 9 at 19:17
  • 10
    P.S. re: “I do not think it is a policy to hand out private encryption keys, anywhere”, I think that’s a misleading statement to make. It was you who set up a “private encryption key”, and there isn’t any sense in which you are automatically entitled to set up such a key on a work-owned computer. So as I said in my answer, I think you are suffering from a blind spot here and are seeing a one-sided view of the situation that focuses on your own rights and own sense of entitlement while ignoring the legitimate rights and concerns of the institution. – Dan Romik Jan 9 at 19:21
  • 9
    @emma sure, I understand why you think the policy is unwise. I’m not even saying you’re wrong about that. But the fact remains the policy is what it is. Your options are some combination of: 1. comply, 2. argue to have the policy changed or be granted an exception, 3. buy a laptop with your personal money and use it to write down the half-baked thoughts you want to keep private. What you said doesn’t change my opinion about you having a blind spot. – Dan Romik Jan 9 at 20:59
  • 4
    I think your observations regarding risk are very apt. What's even more is that we all know deep down that if something happens that would require somebody else to gain access to your computers, work would probably be the least of our worries. So even when we do think about catastrophic life events, we rarely do it in terms of "how will the department get access to the mid-term grades of my students?". – xLeitix Jan 10 at 12:06
26

In my field this would certainly be a no go. I work with human subjects and our IRB approval lists who has access to our data. These data management plans outline who, how, and where the data are stored and backed up. This means either encrypted files (typical) or encrypted drives/partitions. I have never seen a data management plan that would give IT support permission to access the data. The plans do not go so far as to prevent "evil actors" from accessing encryption keys from RAM or performing cold boot attacks, but they almost all require access to the data to be limited to named individuals.

I also run Linux and all the computers in my lab use full disk encryption. I assume that i the university wants the computer back (or needs access), they will wipe the computer and reinstall the OS. All data and information on the computers are stored in accordance with departmental/institutional storage requirements.

If your department head wants a particular type of data stored in a particular format and in a particular location, you do that (assuming it does not violate other regulations). This might mean all data gets pushed to a USB driver or a server. It might mean you boot and run the computer off a USB stick and never write to the hard drive.

|improve this answer|||||
  • 9
    I have never seen a data management plan that would give IT support permission to access the data ... in the specific field you work in. In other places this is the obvious solution (in case something goes wring with the encrypted data) – WoJ Jan 9 at 21:59
  • 3
    @WoJ IRBs are field independent and data management is about protecting PII and PHI. Of course there are other concerns (e.g., HIPPA and FERPA come to mind), but human data under IRB control is a chunk of the data produced in academia. – StrongBad Jan 9 at 22:08
  • 3
    human data under IRB control is a chunk of the data produced in academia yes, this is certainly true and an example of many possible cases. The OP has a generic question and their systems seem to be quite far from that case ("It is probably worth to note that no one is really involved in my research topic, i.e., no one really depends on my data. I could however imagine someone to be interested in possible (unpublished) results in the case I am gone.") – WoJ Jan 9 at 22:11
  • 1
    HIPAA (not HIPPA) and FERPA are irrelevant to OP, although Germany may have similar laws. Not sure how the demand for access relates to GDPR. – WGroleau Jan 10 at 2:19
  • 2
    I would bet that somebody else has access to the encrypted data on your disk, even in the medical field. Because otherwise what happens to it if you die? – DJClayworth Jan 10 at 17:27
8

In my experience, academic staff (including PhD students) are usually given great latitude about managing their own computer as long as they are able to take care of it themselves. It can be understood as an effect of academic freedom (in the sense that the researcher is free to use the tools they like), but on a more pragmatic level it also saves the institution some IT resources if most researchers maintain their device themselves. To some extent it's as if there's an unwritten rule in academia that in exchange for not requiring too much IT assistance, the researcher is free to do whatever they want with their computer. In any case this means that strict industry-like standards rarely apply in this domain: researchers commonly use their work and personal devices interchangeably, in the same way that they often don't make a strict distinction between their work time and personal time.

Given the traditional absence of data management in academia, it looks to me like the institution is just trying to apply a questionable quick fix to a sudden problem, instead of taking the time to design a proper solution. I would note that the "solution" is unlikely to work in the long term, because it requires:

  1. A well-maintained repository of devices with their corresponding username and passwords/encryption keys
  2. Every staff to comply and provide their password every time they change it or re-install the OS (it's unlikely people will remember after a year)
  3. The IT staff to check regularly that they can access everybody's device (that's just not going to happen)

Additionally depending how the repository is maintained it could be a serious security risk, since a hacker gaining access would get access to many devices and potentially a lot of sensitive data. If it's stored very securely and only one person can access it, then it doesn't solve the original issue: what if this person gets sick or worse?

I'm not a legal expert, but I doubt this solution has been legally assessed anyway. I would suggest to inquire about the exact details of the policy and ask colleagues how they dealt with it. You might want to suggest alternative solutions: data sharing software and collaborative tools are not in short supply, in my opinion it would be a much more suitable approach. As a PhD student, you should probably discuss this with your supervisor, at least to get a sense of how serious these requirements are (you might want to mention that this policy could hinder your productivity). In case your supervisor tells you not to take this too seriously, you can consider yourself off the hook.

|improve this answer|||||
6

I do not understand why you want to have private data in a company computer. Your claim of not being able to separate professional from private is highly debatable. Only data that has something to do with the job and acquired according to the IT policy of your institute should be on your workspace computer. For other stuff such as music and private emails, you could use your phone.
From an ethical point of view, using workspace resources for personal gain ( whatsoever) is unprofessional and could harm your reputation. As for your concern, I suggest to remove your private data from your workspace computer and follow the institute IT policy.

|improve this answer|||||
  • 12
    I have been involved in reputation-related chit chats with dozens of academics. The thought of somebody gaining a bad reputation for storing private information on their computer sounds nothing but silly to me. – lighthouse keeper Jan 9 at 13:54
  • 1
    I do not own a smartphone. A laptop would do, but then I would probably work on my laptop rightaway. Also, I disagree. Listening to music for example benefits my creative thinking which is necessary to come up with solutions. Personal gain? Maybe, but surely a professional gain as well. – emma Jan 9 at 13:56
  • 13
    This is just not how academia works in some many places. If I have dinner and drinks with a colleague is that work or personal? What about when they send me a photo of their kids (possibly playing with my kids)? Most of us mix personal and work much more so than in industry. – StrongBad Jan 9 at 13:57
  • 7
    @sapienswatson we fought IT and got policies changed because IT failed to understand how the work needed to be done. IT just came up with a "policy" that sounded good... – Solar Mike Jan 9 at 14:02
  • 2
    @StrongBad It is even worse at certain institutes where they organize all sorts of leisure time activities for colleges to make them feel as if it is not work, because after all, you would spend more time at work, talking with passionate researchers and finally produce more results too. E.g. they have a "beer hour" every week at some institute that I've worked at where you would expand you horizon, or talk about private stuff if you feel like it..After all, the institute will not complain if you produce good results, no matter how they came up. – emma Jan 9 at 14:05
6

I think you have one core misconception: The machine is a work machine, as such it is not your private encryption key, it is a custom encryption you applied to a company/institute machine. It's the institute's machine and primarily their data and their right to determine how you use that machine. They may allow private use and they may allow you encrypt stuff, but that is up to them. If your personal encryption scheme conflicts with their policy, you loose. Now, the typical proper use-case for something like this would be that IT department has a master key that they can under certain regulated conditions use to lookup data needed for professional purposes. Potentially with a 4-eye procedure to make sure they don't look at stuff that is not in their professional interest.

However, as is often the case in academia, things aren't that well organized and a more pragmatic approach is used. This seems to be the case here: There is no standardised encryption in place, and you are allowed to do private stuff on your machine. You are even allowed to manage your security yourself, but they ask to have access to it in case of an emergency. Now, while the method to ask for you password may not be the best, it seems like a reasonable way to satisfy your need for encryption and their need to get to the data.

Of course you can suggest alternative solutions, like having central servers that maintain all data and you not being allowed to have any essential data solely on your machine (you may get quite a bit of an argument from your colleagues, if they prefer to keep their data on their machines) or having separate hard drives/partitions and the like. A personal container with private data might be fine. But ultimately you have to convince them and if you cannot, they have the last word in this. They give you an option to not encrypt, which doesn't involve handing over your password if this is such a big issue for you.

Note: the encryption password should not be the same as your system user password etc. anyway such that misuse should be limited to direct physical access misuse, which you should be able to prevent by having your laptop with you all the time.

Is handing out the password problematic from a security perspective? yes, in the sense that it lowers security. Is it their decision how to use their machine? Yes! (within lawfulness, but bringing up laws might mean they have to draw up a proper policy that restricts you far more than their current approach).

|improve this answer|||||
6

You never give away passwords or private keys. In Germany you cannot be forced by anyone to do so.

Look in your contract. Is private use allowed? (email, surfing, etc). Then ask for a server, external drive and store the property of your institute.

If not (computer may only be used for working purposes). Well then get your private stuff from the computer, decrypt it and hand it over.

But the best place/person to discuss it is the Data Security Officer (german: Datenschutzbeauftragter).

Because the usage of private data is obviously not clearly communicated and the usage of encryption on personal devices seems a bit vague, I would contact him/her on base on Article 39c of the DGSVO (General Data Protection Regulation) --> https://dsgvo-gesetz.de/art-39-dsgvo/. Because there might be some issues in the handling of giving computers in your institute. These need to be solved for the future and for you. (--> https://dsgvo-gesetz.de/art-35-dsgvo/ and https://dsgvo-gesetz.de/erwaegungsgruende/nr-75/)

However the Data Security Guy is normally a nice guy and will find a solution and the solution will never be be to reveal your key.

|improve this answer|||||
4

The institution's solution seems unworkable.

It is well known that professional resources - e.g., equipment (including computers, photocopiers, and shredders) and the mail room (where personal items may be sent) - are used by employees. It is also well known that personal resources - e.g., equipment (including smartphones and texbooks) and home offices - are used for work purposes. Such use benefits both employers and employees.

Rather than caving to the institute's demands, a workable solution could be proposed. For instance, moving shared data to a server accessible by collaborators.

|improve this answer|||||
  • Yeah, this is kind of what was meant with unencrypting the hard drive I guess (=making it accessible by certain members of the institute). – emma Jan 9 at 13:43
  • 2
    @emma I think a server provides a better solution than a personal computer can – user2768 Jan 9 at 14:09
  • But it requires administration of a server. – emma Jan 9 at 14:18
  • Centralised solutions provide more accessibility (which is the goal here) and administration can be delegated to IT. – user2768 Jan 9 at 14:39
  • 1
    If done right, the case you currently have can be used to strongly advocate for a server. Just imagine if the person was not only gone for a few weeks but suddenly leaves the institute. Or if one of your machines crashes and is not recoverable. Or you accidentally delete all your stuff. Or ... Every work environment should have a proper storage and backup procedure, if possible setup and administrated by IT professionals. – Dirk Jan 9 at 15:22
4

I have helped to manage the IT for an academic group for a while, and students or employees keeping research data only on their individual PCs was a very typical problem. It is important for the university and your PhD supervisor to ensure that they have the data that you produce. This is also a requirement for many grants that actually pay for the research, your supervisor is required to ensure that the data created is stored in some accessible way. This is not an arbitrary request, your supervisor is likely violating the terms of some research grant if they don't ensure proper management of the produced data.

This doesn't mean that you have to give them your private key, a much better way is to ensure that all relevant data is stored somewhere else than only on your PC. For example a central file server with proper backup procedures in place.

What your institute is asking for is a bad way to solve the underlying problem, especially as it doesn't solve a major reason for data loss like hardware failures. But they do have the right to insist on having access to your research data, and you should propose an alternative that fulfills this requirement like e.g. syncing your data to a file server of the institute.

|improve this answer|||||
4

Here is my understanding including the legal situation in Germany. IANAL, but I've had occasion to read up on such issues.

First of all,

Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases.

This sounds to me as if your institute is right now in the process of developing such a strategy. That is good news for you, as it gives you a chance to suggest improvements.

Thus, I think you have the genuine and actually rare chance to contribute constructively to your institute becoming much better than most institutes in this respect. Do that instead of rebelling.


I am encrypting my data.

That's fine. Still,

  • The bus factor of your PhD is obviously 0 since you are required to hand in a substantial chunk of original own work. However, in case you suddenly leave the project, others may need to access your work in order to save as much of the project as possible. This is probably part of the risk strategy outlined in the grant proposal, and this means your institute signed a contract with the funding agency that they have reasonable means to save the project in case you drop out/get sick.

  • The university/your institute/your PI are typically required by the project funding agency to guarantee accessibility of the research data that belongs to the project.
    So it's not only their whim, they have signed that they can show everything from raw measurement data to lab books if needed.

Bottomline: Asking you to ensure others can access your project-related data is reasonable and sensible, and they probably signed contracts that actually require this.

  • If you have an employment contract with your university, the university owns your work. In consequence, they have a right to access it and you must provide them with appropriate means to do so. Actually, they may legally ask you to not even keep a copy of your project data when you leave.

    In my experience, some instituates do excercise this right while many institutes are fine with you keeping a backup copy of your data: in case something is needed/there are questions later on, it is often easier to ask you to send them the data (and of course, your ability to answer questions without access to the data is limited) and of course it is a kind of a distributed backup strategy.

    Personally, I'm somewhat uneasy with the request to not keep a copy of anything as my professional reputation potentially depends on whether I can answer questions (and possibly show data) about my papers years later. But legally, there's no choice here: it's the employer's (institute's) responsibility if they choose to excercise their right to exclusive data ownership.


Now, I was asked to either physically or digitally hand over my private encryption key (or password) [...] I feel very strange about this, since I grew up learning that passwords should never be given away.

You are right in not sharing your private key or password.

  • You probably signed with the IT policy (see below) that you will not give your password to anyone.

  • As you correctly point out, someone may gain access to your accounts and may do bad things(TM) in your name: sharing passwords creates a nightmare wrt. responsibility (it's impossible to know who exactly did X - and for you it's impossible to prove that it wasn't you)

  • A closely related issue is data integrity. If you grant change/write access to anyone (via password or otherwise), how can you be sure things are as you left them?
    The answer to this however is signing rather than encryption.

  • And moreover, it is not necessary as you can grant rights (e.g. group-readable) according to the required access level.
    So that's what you should do: possibly create a "project" user, make the relevant data readable to that user and hand over that login to your PI.

    An alternative is to have a shared drive on a file server for the project - but that's IT infrastructure that is outside your control. If it exists it's probably good to use that as these are in my experience typcially run with backups etc..


I'd like to exand a bit on my understanding of the legal situation in Germany wrt.:

I do have some private data on that computer as well

You have probably signed an "IT use" document when starting as PhD student. Time to review that.

Regardless of whether the IT policy of your university does allow small-scale private use of university IT, IMHO the best container for your private private data is a private external storage which you keep.

However, you may also have work-related private data => see below.

AFAIK, two scenarios are common in Germany wrt. IT use policy:

  • Employer/university allows small-scale private use. They are not allowed to access your private data. As they allow private use, the default assumption is that your computer contains private data, and it should therefore not be accessible to everyone.
    So in case that's the policy at your institute, you can keep such personal data in your own encrypted storage.

  • However, AFAIK employers can also mandate that their IT infrastructure is strictly for work/research purposes only. In that case, you may be expected to have almost everything at least readable to other employees.

  • Still, As @StrongBad points out, it is actually quite common to have encryption (or physical access restriction) mandated e.g. by

    • Privacy requirements for projects involving human subjects,
    • Certain professional positions also mean that part of the work data should not be accessible to your whole group, and possibly not even to your PI/professor. Examples are data related to positision as ombudsperson, Fachschaft [student union] or Personalrat [employee committee] work, and everything related to grading students.

The conclusion is that the institute actually needs a more fine-grained access policy than just "everyone can access everything if need be".

|improve this answer|||||
  • Having files with group-readable access rights doesn't really work when the data (or disk) is encrypted. – Paŭlo Ebermann Jan 11 at 2:28
  • @PaŭloEbermann: I'm no encryption specialist, just an interested user, but how about this: a group can have a key pair just like any user. And a user can have multiple key pairs in their key ring, so e.g. their own and group key pairs. The group folder can then be encrypted with/for the group key. Of course, as long as it's encrypted for the private private key, group access won't work. – cbeleites unhappy with SX Jan 11 at 11:28
3

1) You own only what is in your head.

2) The least secure place you can put things you move out of your head is to a place you do not own (your employer's, for example), followed by one you do own.

3) There are various ways (legal and/or ethical) of compelling you to move things out of your head and into the world, and of compelling you to move things from place you own to places you do not. Knowing them is important.

@buffy's excellent comment refers to 3. Your idea to hide an encrypted container with a password you know is an interesting extraction of #1: the location and password would presumably exist in your head. See #3.

|improve this answer|||||
  • 2
    A lot of researchers do not own what is in their head if those ideas came about while they were employeed. – StrongBad Jan 9 at 21:37
  • @StrongBad This gets philosophical..And I disagree. How do you justify your statement? – emma Jan 9 at 21:52
  • 3
    @emma in the UK "An employee who creates intellectual property in the normal course of their duties cannot claim to own that intellectual property" see for Example 2 of someone coming up with the idea in the shower. – StrongBad Jan 9 at 21:57
  • Oh, I see what you mean. That example sounds reasonable.. Though, I am not too big a friend of patents, but rather a friend of open access regarding publications (that sounds a bit contradictory in this discussion). But again, there are good strategic reasons in an academic sense to hold back certain ideas or results, e.g. to think things through, or to wait for a conference with a better audience/reputation, etc. Also, there is a lot of pressure in academia, so everyone is expecting – emma Jan 9 at 22:12
  • 1
    @emma why do you respond in a way that sounds convinced that giving your own IT department access to their equipment will magically mean all your brilliant ideas are released to the public and everyone will see them. It sounds like you are just self-justifying your predetermined stance and refuse to accept that it has no basis in the academic side – user-2147482637 Jan 10 at 12:32
3

Talk to your works committee ("Betriebsrat"). They should know what you are legally obligated to and what not. And they are not the voice of your employer (the university) but the employees.

Most of what you ask depends on the IT policy relevant to your institute. In general, if not prohibited by institute policies, you are allowed to have private data on your work machine. You maybe also allowed to use Internet access for private purposes. This is also the agreement at our institute, and any access to an employee computer by a third party (any colleague, boss, IT, the institute director) without them being present must be supervised by an employee representative to make sure that only work-related documents (and e-mails) are accessed. And it is suggested that we keep any personal documents in a clearly marked folder (e.g., "private").

Concerning the encryption key: Any work communication must be accessible by your employer for legal reasons! Concerning key escrow, again, ask your works committee.

|improve this answer|||||
2

My computer is owned by the institute

Well then, you have to follow the policies of the institute, whatever those might be. If you don't like those policies, then give them back their computer and do all of your work on your own personal device.

Think about it from the institute's point of view. You are probably working on a research project that is being funded from somewhere. Maybe the government gave your institute a 10 million Euro grant for example. It is very important to the institute that they show the government that they did something useful with the money so that they can get the next 10 million Euro grant. Imagine that you get hit by a bus. If nobody can get your data, then they have to go tell the government, "sorry, all the data we generated with that 10 million Euro grant is on this one computer and we don't have the password, may we please have another 10 million Euros to start over?" That will make the institute look extremely bad. So they have this policy that everyone must make their data accessible just in case.

Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access?

This seems a reasonable compromise to me. Make sure your research data is accessible and encrypt the private stuff.

|improve this answer|||||
  • 7
    This answer is oblivious to german labor and privacy laws. – lalala Jan 9 at 13:57
  • 3
    @lalala The relevant law here is that the work he is paid to do does not belong to him but rather to the institute. Hence the institute has a right to access it. The privacy laws say they can't force him to reveal his personal stuff. They don't, he is free to move his personal stuff on his personal IT before giving them access to the computer they own. The privacy laws don't say he has a right to have private things on institute property that the institute can't see, that is not how privacy laws work. – quarague Jan 9 at 15:22
  • 3
    @quarague, if you have some knowledge of German law and university practice there, perhaps you should make a formal answer and lay it out. Much of what is here completely ignores that context and seeks an ideal that doesn't exist. – Buffy Jan 9 at 16:07
  • 3
    -1 for sanctifying ownership of property. If the policies are inappropriate in term of the institute's own goals, or oppressive or harmful to OP personally, their legitimacy - ethically and perhaps legally - is not a given. – einpoklum Jan 10 at 12:15
  • 4
    "If you don't like those policies, then give them back their computer and do all of your work on your own personal device." That's a backwards step. Because now they will insist on full access to your personal device, plus you're using your own equipment for somebody else's work. – Lightness Races in Orbit Jan 10 at 13:08
2

Morally, how would I best act in this situation?
Should I hand over a wrong (digital) private key

Morally it is not okay to deliberately produce a fraudulent work

My computer is owned by the institute, ... and I have completely installed and configured it to my liking.

Then you're tech enough for this:

Get a low cost cloud computer for your personal stuff (Azure, AWS, etc.)
Remote into that computer through the university computer and you can do/store whatever you like (encrypted + anonymous).

Or even remote through your smart phone (if you buy one).

This is completely portable.
It completely complies with your university's policy

Also you'll never have the heartache and/or expense of trying to get data off of a computer that has been stolen, dropped on edge because a rogue firework was coming at you, was run over, caught fire, etc.

Implement this, and you can give them the private key they've asked for
(more work if you have reused this private key... but that's on you).


It is also a failing of every person with technical ability to not have (work) stuff backed up where others can get to it.
That's my opinion, but it is widely shared in 2020.

For completeness I'll mention that getting a smart phone would make your life easier.
Since you are tech savvy I'll assume this option isn't appealing to you for some reason (and there are a few good reasons).

|improve this answer|||||
  • I never thought about this. Good answer! Just as a side note, because I am never clear about that, how much would a minimal use of such cloud use cost per month? – Mugé Jan 12 at 17:22
  • 1
    @Mugé Just look around, the pricing may depend on your location. It will depend on what you want to connect to (and whether that is automatically patched). I have used Azure, HostGator, and DigitalOcean. Azure is cheap if you turn it off when not in use - check to see if you qualify for a monthly credit - not the least expensive if you leave it always on (I didn't). There may also be services that offer 'remoting only' on a bare bones machine that are cheaper than what I've mentioned. – J. Chris Compton Jan 13 at 16:01
  • 1
    FYI: I currently use HostGator for my personal stuff... but it has been a couple years since I shopped around. I supplement with Azure machines (can be done by the hour like DigitalOcean) when I need something that is either more powerful or for one-off use/testing. I'm a developer, you may not desire the same type of options. Some of the privacy plays currently offered (I'm thinking of Norton) only direct your browsing through anonimising services - you're still using the 'work pc' which doesn't work for the original poster (OP). – J. Chris Compton Jan 13 at 16:04
2

I have talked to the data protection officer of my university, who seemed very sensitive with regards to my concerns. So in fact, the university officially allows a small amount of private usage of computers - without explicity defining small amount. There also is a policy for emergency cases, where the head of the instite is not allowed to simply access the computer, but instead the data protection officer (or some member of his team) makes sure that no private / sensitive data is made accessible, and only then allows the head of the institute to access the data. He then basically confirmed, that this is an infrastructure problem, and that the university offers tools to circumvent any kind of password hand out (e.g. backup and server-storage with fine-grained access control, mailing lists, etc.).

He also mentioned that there are different ways to proceed (which I can chose from): He could generally talk to my institute without referencing me or any details of the current discussion, just for a general clarification. Or instead reference me and talk to the institute. Or do not talk to the institute at all, and I will figure out what I need to do by myself.

Anyway, he did say that handing out private keys or passwords is the wrong solution to a problem that should not even exist when using the correct tools that the university offers.

|improve this answer|||||
  • 1
    I am glad to hear that; thanks for coming back here to share the solution that worked for you! – Federico Poloni Feb 3 at 13:36
1

Since the computer belongs to the university, you will need to think in terms of the following limitations. Even if you bring your own laptop to work to do your private emailing, etc., many work places today, will not allow you to use their network for private matters.

I am surprised to read you have configured your computer to your liking. As to why, this means your workplace/ academia setup is open to intruders. As an IT professional, even I when I use my computer, I do not use the administrator screens. I assign myself like a guest screen and password protect the Admin site, because, even if you do not see it visibly, stuff can download itself on your computer and through your network, spread to other computers. Workplaces today, will not allow you to download stuff. The IT professionals will do it within academia policies.

Secondly, although everyone else may check their private email at work, we all do, but some work places will not allow you to use your work computer for private matters. It will be shut off to 'private stuff' as it not only can cause a security issue, but also loss of work hours. Just saying.

Third, let's say, you do not have good intentions and use the university network to hack places. You will not be identified unless you log in to some system that records who you are and when you are logged in and your activities.

I am sorry to say, I don't get how your university can allow such lose practices, especially in our era. Wow! AND you are trying to hold on to your work computer as if it is your own.

|improve this answer|||||
  • 3
    We built and ran our own website as researchers at University - external to IT control and it was signed off by all parties. Mind you they came to us for Unix help at the time so that probably had something to do with it - if they had blocked our website they might have lost our help... IT should remember that it is a SERVICE industry... – Solar Mike Jan 9 at 13:30
  • 2
    I should probably mention that my institute is close enough to the computer science faculty that 90+% of my colleges (including me) are deep into linux, encryption, and privacy. We have technical staff that would configure the computers and/or assist, and also an administrative IT department for the whole university for this kind of support. – emma Jan 9 at 13:32
  • 3
    Yet, due to the high technical level we are given the option to install linux by ourselves (for Windows there are different rules). And yeah, I don't use sudo if not necessary (goes without saying). The university has more or less strict rules how to use the network - I believe they are similar to the rules at other universities. And I am allowed to use my personal laptop for personal stuff at the university network according to these rules. – emma Jan 9 at 13:32
  • 2
    I should also add the following situation: Let's say I want to participate at a conference. I do have to pay the conference fee with my private bank account first, and just after the conference I would get the money refunded. So occasionally I need to transfer money through my private bank account which is one of the reasons I have an (encrypted) password database with my bank login on my work computer. Is accessing my private bank at work times for this purpose a private act or a professional act? – emma Jan 9 at 13:37
  • 3
    @Mugé Our IT gives the first password, used for the initial setup of the account, then we are required, and IT forces, us to change the password the very first time we log in. IT can then force a change to the password whenever they wish but don't use ours. Not being able to choose your own password, as long as it has a capital letter a number etc etc seems to be a bit draconian or from the stoneage... – Solar Mike Jan 9 at 13:51
1

Since I am no lawyer or remotely active in that space, so I'll refrain from answering the first question.

Then in general I am a huge advocate of honesty. It's your best bet, anytime, at least in the long term. Therefore I think that handing over a wrong key is waiting for a conflict to happen. And hiding a container might not even be necessary in the first place.

However I do sympathize strongly with the feeling of privacy. I had similar concerns and issues before. To be clear: I do think it is a bad idea to share authentication credentials in general. So the question remains: how to comply with the policy and keep your private data private.

And a few possible solutions come to mind:

  • Shared repositories / backups for the work related data.
    • Pro: no need to break into your device at any time. Kind of convenient in general. What if the hardware fails completely? (Struck by lightning.)
    • Con: you will be responsible to keep this in sync.
  • An encrypted container solution (E.g.: Veracrypt) No need to hide it really.
    • Pro: Very convenient for files and backup of private keypairs.
    • Con: Might not integrate very well with mail configuration and such.
  • Use an external drive with an automatic mount to keep the container on.
    • Pro: Physically separates the data.
    • Con: Might not cover all use cases. (E.g.: the mail configuration) And could be a bit cumbersome.
  • You could use a security key (E.g.: Yubikey, but have your pick, plety exist.)
    • Pro: It's hardware, the one holding the key can log in. You don't need to hand them a password or decryption key, but you could get in writing that if you get in a coma (hopefully not!) the can get access to the key.
    • Con: If you lose the key, you're also out.
  • Use your own hardware.
    • Pro: You can have it just the way you like, and there is nothing they can say about it.
    • Con: It could be expensive. And if data loss is the underlying problem, you haven't solved it.

In the end I think the institute's end goal (having access to the research data?) is very reasonable and justified. But maybe there are better solutions to be suggested to solve the problem. So maybe your strategy could be to find out what their biggest fear is. If it is data loss, clearly there are way better solutions to this, and maybe they are willing to listen for other solutions.

|improve this answer|||||
1

You are right to be concerned. Private keys are called private for a reason.

The institute also has a legitimate concern, that they won't be able to access the data if you're unavailable. Problem is that when you hand over the key, someone will be able to impersonate you. You don't have to be especially important to be impersonated; if you have a credit card you're a target already. The meta-threat is that, just like with credit card info, if you give it out you may have a difficult time dealing with a future breach, because you're the one who gave out the data.

Solution:

Key escrow: Speak to your IT department about setting up a key escrow. It's possible they're already doing that but I doubt it, because they asked for the key in plaintext. So, ask the IT department and get some technical documentation from them with the details of the scheme. This is not so much to get the details, but to signal to them this is how you expect this to be done.

Automated Backups: Exactly what it sounds like. Backup your ~/project directory, have IT validate the solution. Or, use a shared workspace (ie a git repository).

Separate Keys You might ask the uni to supply you with a public key into which all work-related emails can be BCC'd. This way they get the data and your key is not compromised.

|improve this answer|||||
1

It is not 1990's anymore and both Internet access and personal digital devices are not that much scarse. Back then, it was normal or even expected for an employer to allow some personal use of computers and internet access. And the Internet was a lot safer place, back then.

Now, there is still some acceptance of this practice and even some expectation of privacy regarding personal matters, but the general trend is exactly the opposite. Private matters are private and done on private devices (laptop, tablet, phone), work is work and is kept separate on a work computer.

There can always be matters of competition between different employees (esp. in research or marketing) that have to be kept secret or data that is part of your work, but you are personaly responsible for keeping it safe. Spare for these (and they can be kept in a separate encrypted container) the employer is pretty much in a position to tell you what to do and what not to do, with any computer, or any other tool, or any work-related data.

What's more, your employer is probably responsible for a lot of things related to "your" computer (say, unlicensed or malicious software). When employees are left on their own to manage their computers, it is only because of the brave assumption that they know what they are doing. Today, this assumption is almost always wrong (hey, it is even wrong for most of the IT people I know, but that's completely another matter).

In short, the best strategy is to segregate personal (or, at least, sensitive personal) matters to different device. It may as well be an external USB flash or disk that connects to the work computer when needed or a completely separate device (laptop or tablet). Then, comply to whatever management asks regarding your work computer - be it decryption or "key escrow".

p.s. regarding these matters, student is the same as employee.

|improve this answer|||||
0

First of all, if IT is correctly managed, your private data may very well already be available because they are backed up.

Then, the ability to have private data on your device is dependent on the local law. You can have the case where everything belongs to the company/school, up to the case where you have the right to have personal data and they are legally protected.

For the first case, you are deliberately working against your institution by defending them access. It does not matter what you think, how they handle their data is their decision.

In the second case it gets more complicated. There is the part where you actively work against your institution like above - for the portion which belongs to the institution (because I guess there is something which belongs to them, right?). You must not encrypt that part.

If you have legally personal data then you can do whatever you want with them and your institution would not access them anyway (again, if this is the legal framework). The complicated part is email, when personal and professional data is mixed.

|improve this answer|||||
  • 4
    This is wrong! The human subjects data I collect is owned by the university, but according to the IRB they do not have the right to see that data. In fact the IRB tells me I must encrypt the data. IT then backs up that encrypted data onto their system, but they do not have the key. – StrongBad Jan 9 at 21:53
  • @StrongBad: what is wrong? Of course you can have zillion of specific cases, from personal data to military technology. What does it have to do with the generic question, and my generic answer? If you have a specific case, other cases are not incorrect by definition. – WoJ Jan 9 at 21:56
  • 3
    First sentence suggests that backed up data must be unencrypted, which is almost comically wrong. The "first case" suggests that if the university owns the data that they get unfettered access, which I pointed out is not generally true. You say you must not encrypt the data that belongs to them, while I point out there is a whole class of data that must be encrypted. – StrongBad Jan 9 at 22:01
  • @StrongBad If you have full disk encryption, the backup will be encrypted (except very exotic cases where you backup raw partitions). I am not sure what is comical in that, you may want to check with actual IT. The first case is by far the most typical one - you may be in a different one. I am not sure how many systems you have supervised but if this is not in hundred of thousands over a few huge companies then we probably have a different view of the word "most". – WoJ Jan 9 at 22:08
  • @StrongBad And then comes the last part where the institution decides what to do with their data - you may be in a special case where YOU decide about THEIR data but this is far from being typical. – WoJ Jan 9 at 22:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.