Am I required to hand out private encryption key to head of institute?

Question

I am a PhD student at a German university. Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases. My computer is owned by the institute, but I am the only one using it, and I have completely installed and configured it to my liking. In particular, I am encrypting my data. I do have some private data on that computer as well, e.g. emails since my private email account is linked in my email program, but also some music, and perhaps a few photos, my private PGP key, etc. The setup is pretty similar to some of my colleagues.

Now, I was asked to either physically or digitally hand over my private encryption key (or password) in order to get access in some emergency case. Apparently, my colleagues have done so already. I feel very strange about this, since I grew up learning that passwords should never be given away. I have raised my concerns, e.g., that this would also enable access to private emails or other data, and allow to send emails in my name. But these were marked invalid, since private data has nothing to do on my work computer (even though everyone uses it that way). Alternatively, I was told I could unencrypt my hard drives.

My questions are:

• Am I required to hand over my private encryption key by law?
• Morally, how would I best act in this situation?
• Should I hand over a wrong (digital) private key and hope that this situation would never happen?
• Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).

It is probably worth to note that no one is really involved in my research topic, i.e., no one really depends on my data. I could however imagine someone to be interested in possible (unpublished) results in the case I am gone.

Answer 1

This seems like an X-Y problem. Why is important work data only kept on a computer on your desk, in the first place? I would expect it to be on a Git repository, or on the shared storage space of a workplace server.

Once you fix this problem, the issue you mention becomes irrelevant: your data will not be lost if your disk suddenly becomes inaccessible.

So a practical way to address the issue could be offering to put more of your work data in shared servers and git repositories, so that the problem disappears. Ask your superiors which data they are worried about, and offer to keep them online preemptively.

Answer 2

I am going to (partially) disagree with some of the answers here. I think it really depends on who is asking for your key, and based on what policy.

First of, I am more than confused by the many answers here assuring that the university has in general no business accessing information on the computer they provided you - the IT usage policy in all institutions I worked at so far (in Austria, Switzerland, and Sweden) would certainly disagree with this stance. Sure, the lived practice is that they give you a computer and then don't care much about what you do with it, but the fact remains that it is the university's computer, and that you also use it for private things (maybe with their explicit permission) does not change this fact.

However, if the (somewhat silly) plan of requesting private keys is appropriate depends on who made this request - if this is actually part of the written IT policy (very unlikely) your options are to give them the key or stop using the equipment they provide, but if it's just a wild idea of your PI you have all the right in the world to just say no. "Your" computer isn't really yours, but it also isn't your PI's. Even if they paid for it through their grants, the computer belongs to the university, and university policy governs how they are managed. I am also fairly sure that your IT department would back you up on this if push comes to shove, because a supervisor (or whoever) storing a bunch of private keys or passwords sounds like a liability / traceability nightmare that nobody wants to deal with.

Morally, how would I best act in this situation? Should I hand over a wrong (digital) private key and hope that this situation would never happen?

Certainly not - that's just as silly as asking for the key in the first place, and if your PI wants to test it (every backup solution is only as good as the last time you tested it) you may run into major conflicts. It's much better to acknowledge that their concern is per se not unfounded, even if their solution approach is bad, and to work with them on a better solution. Having a cloud service for data backup would be an obvious approach.

Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).

Unless there is some deep distrust between you and however is requesting this key I don't see why they would mind if you had a separate "non-work" partition (assuming that they allow private usage in the first place). That said, as I mentioned before the whole idea of collecting private keys / passwords is a bad solution to the problem anyway.

Answer 3

Morally, how would I best act in this situation?

The moral thing to do is first of all to recalibrate your somewhat immature (in my opinion) attitude towards this question and stop trying to think about dishonest solutions like giving an incorrect password or undoing the system-wide encryption but hiding encrypted content on your system and not telling anyone about it. Whether or not you should agree to give the password is a separate question where the answer would be more nuanced, but certainly if you care about behaving morally, do not lie to your supervisors. Any option that involves dishonesty should be unconditionally off the table.

As for the question of whether to give the (correct) password: first, I think it’s reasonable of you to find the policy a bit draconian. I myself am a person who cares a lot about privacy, and as most academics do, I sometimes use my work email for private purposes, so I get where you’re coming from. I wouldn’t want my employers going through my emails. But I also am perfectly aware that they have the right (and technical means) to do that, so if I need to send something especially private or sensitive, I use a different, private email that is protected by a separate password and is not physically stored on my work computer.

What I find unreasonable however is that you are complaining about the policy and how it infringes on your privacy rights, without looking at things from the institute’s point of view, acknowledging that they are trying to solve what is a real problem for them, or offering a solution that might make the violation of your privacy unnecessary. It would be completely reasonable and honorable for you to go to your department chair (or other relevant administrator), say you object to the policy and offer them an alternative plan that ensures accessibility of your work data in unexpected events. A smart administrator would be willing to negotiate a solution that keeps their researchers happy while still meeting the institution’s needs, so I’m optimistic that a solution can be found. And if they don’t agree and just insist that you hand over the password? Well, then, the mature, professional thing to do is to follow your institution’s policies, even if you disagree with them, and vow to behave more reasonably in the future when you yourself someday become an administrator.

Finally, I want to share with you an insight I had one time during the years I was a department chair. I noticed that regular employees have a different approach to risk (of all different kinds) than administrators do. A regular employee will often be willing to ignore the possibility of low-probability events happening and choose a more risky path when making a decision, but administrators are much more sensitive to such things. The reason is that from your point of view, the low probability event of you falling very ill (to use your example) or otherwise not being available to provide coworkers access to your data seems like an outlandishly unlikely event that is like nothing you have experienced happening in your lifetime. But from the administrator’s point of view, they actually see low probability events happening all the time, somewhere in the organization. Those events are not at all “low probability” from their point of view, and it is precisely the administrator’s job to put in place policies that protect the organization in the actually very likely event that such things end up happening to someone.

So what I’m saying is, the administrators aren’t necessarily being as unreasonable as you think with their data protection policies. But of course, it’s reasonable to want to have some privacy as I said, so it isn’t obvious to me that your objections are completely wrong or misguided. Anyway, good luck.

Answer 4

In my field this would certainly be a no go. I work with human subjects and our IRB approval lists who has access to our data. These data management plans outline who, how, and where the data are stored and backed up. This means either encrypted files (typical) or encrypted drives/partitions. I have never seen a data management plan that would give IT support permission to access the data. The plans do not go so far as to prevent "evil actors" from accessing encryption keys from RAM or performing cold boot attacks, but they almost all require access to the data to be limited to named individuals.

I also run Linux and all the computers in my lab use full disk encryption. I assume that i the university wants the computer back (or needs access), they will wipe the computer and reinstall the OS. All data and information on the computers are stored in accordance with departmental/institutional storage requirements.

If your department head wants a particular type of data stored in a particular format and in a particular location, you do that (assuming it does not violate other regulations). This might mean all data gets pushed to a USB driver or a server. It might mean you boot and run the computer off a USB stick and never write to the hard drive.

Answer 5

In my experience, academic staff (including PhD students) are usually given great latitude about managing their own computer as long as they are able to take care of it themselves. It can be understood as an effect of academic freedom (in the sense that the researcher is free to use the tools they like), but on a more pragmatic level it also saves the institution some IT resources if most researchers maintain their device themselves. To some extent it's as if there's an unwritten rule in academia that in exchange for not requiring too much IT assistance, the researcher is free to do whatever they want with their computer. In any case this means that strict industry-like standards rarely apply in this domain: researchers commonly use their work and personal devices interchangeably, in the same way that they often don't make a strict distinction between their work time and personal time.

Given the traditional absence of data management in academia, it looks to me like the institution is just trying to apply a questionable quick fix to a sudden problem, instead of taking the time to design a proper solution. I would note that the "solution" is unlikely to work in the long term, because it requires:

1. A well-maintained repository of devices with their corresponding username and passwords/encryption keys
2. Every staff to comply and provide their password every time they change it or re-install the OS (it's unlikely people will remember after a year)
3. The IT staff to check regularly that they can access everybody's device (that's just not going to happen)

Additionally depending how the repository is maintained it could be a serious security risk, since a hacker gaining access would get access to many devices and potentially a lot of sensitive data. If it's stored very securely and only one person can access it, then it doesn't solve the original issue: what if this person gets sick or worse?

I'm not a legal expert, but I doubt this solution has been legally assessed anyway. I would suggest to inquire about the exact details of the policy and ask colleagues how they dealt with it. You might want to suggest alternative solutions: data sharing software and collaborative tools are not in short supply, in my opinion it would be a much more suitable approach. As a PhD student, you should probably discuss this with your supervisor, at least to get a sense of how serious these requirements are (you might want to mention that this policy could hinder your productivity). In case your supervisor tells you not to take this too seriously, you can consider yourself off the hook.

Answer 6

You never give away passwords or private keys. In Germany you cannot be forced by anyone to do so.

Look in your contract. Is private use allowed? (email, surfing, etc). Then ask for a server, external drive and store the property of your institute.

If not (computer may only be used for working purposes). Well then get your private stuff from the computer, decrypt it and hand it over.

But the best place/person to discuss it is the Data Security Officer (german: Datenschutzbeauftragter).

Because the usage of private data is obviously not clearly communicated and the usage of encryption on personal devices seems a bit vague, I would contact him/her on base on Article 39c of the DGSVO (General Data Protection Regulation) --> https://dsgvo-gesetz.de/art-39-dsgvo/. Because there might be some issues in the handling of giving computers in your institute. These need to be solved for the future and for you. (--> https://dsgvo-gesetz.de/art-35-dsgvo/ and https://dsgvo-gesetz.de/erwaegungsgruende/nr-75/)

However the Data Security Guy is normally a nice guy and will find a solution and the solution will never be be to reveal your key.

Answer 7

I do not understand why you want to have private data in a company computer. Your claim of not being able to separate professional from private is highly debatable. Only data that has something to do with the job and acquired according to the IT policy of your institute should be on your workspace computer. For other stuff such as music and private emails, you could use your phone.
From an ethical point of view, using workspace resources for personal gain ( whatsoever) is unprofessional and could harm your reputation. As for your concern, I suggest to remove your private data from your workspace computer and follow the institute IT policy.

Answer 8

I think you have one core misconception: The machine is a work machine, as such it is not your private encryption key, it is a custom encryption you applied to a company/institute machine. It's the institute's machine and primarily their data and their right to determine how you use that machine. They may allow private use and they may allow you encrypt stuff, but that is up to them. If your personal encryption scheme conflicts with their policy, you loose. Now, the typical proper use-case for something like this would be that IT department has a master key that they can under certain regulated conditions use to lookup data needed for professional purposes. Potentially with a 4-eye procedure to make sure they don't look at stuff that is not in their professional interest.

However, as is often the case in academia, things aren't that well organized and a more pragmatic approach is used. This seems to be the case here: There is no standardised encryption in place, and you are allowed to do private stuff on your machine. You are even allowed to manage your security yourself, but they ask to have access to it in case of an emergency. Now, while the method to ask for you password may not be the best, it seems like a reasonable way to satisfy your need for encryption and their need to get to the data.

Of course you can suggest alternative solutions, like having central servers that maintain all data and you not being allowed to have any essential data solely on your machine (you may get quite a bit of an argument from your colleagues, if they prefer to keep their data on their machines) or having separate hard drives/partitions and the like. A personal container with private data might be fine. But ultimately you have to convince them and if you cannot, they have the last word in this. They give you an option to not encrypt, which doesn't involve handing over your password if this is such a big issue for you.

Note: the encryption password should not be the same as your system user password etc. anyway such that misuse should be limited to direct physical access misuse, which you should be able to prevent by having your laptop with you all the time.

Is handing out the password problematic from a security perspective? yes, in the sense that it lowers security. Is it their decision how to use their machine? Yes! (within lawfulness, but bringing up laws might mean they have to draw up a proper policy that restricts you far more than their current approach).

Answer 9

The institution's solution seems unworkable.

It is well known that professional resources - e.g., equipment (including computers, photocopiers, and shredders) and the mail room (where personal items may be sent) - are used by employees. It is also well known that personal resources - e.g., equipment (including smartphones and texbooks) and home offices - are used for work purposes. Such use benefits both employers and employees.

Rather than caving to the institute's demands, a workable solution could be proposed. For instance, moving shared data to a server accessible by collaborators.

Answer 10

I have helped to manage the IT for an academic group for a while, and students or employees keeping research data only on their individual PCs was a very typical problem. It is important for the university and your PhD supervisor to ensure that they have the data that you produce. This is also a requirement for many grants that actually pay for the research, your supervisor is required to ensure that the data created is stored in some accessible way. This is not an arbitrary request, your supervisor is likely violating the terms of some research grant if they don't ensure proper management of the produced data.

This doesn't mean that you have to give them your private key, a much better way is to ensure that all relevant data is stored somewhere else than only on your PC. For example a central file server with proper backup procedures in place.

What your institute is asking for is a bad way to solve the underlying problem, especially as it doesn't solve a major reason for data loss like hardware failures. But they do have the right to insist on having access to your research data, and you should propose an alternative that fulfills this requirement like e.g. syncing your data to a file server of the institute.

Answer 11

Here is my understanding including the legal situation in Germany. IANAL, but I've had occasion to read up on such issues.

First of all,

Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases.

This sounds to me as if your institute is right now in the process of developing such a strategy. That is good news for you, as it gives you a chance to suggest improvements.

Thus, I think you have the genuine and actually rare chance to contribute constructively to your institute becoming much better than most institutes in this respect. Do that instead of rebelling.

---

I am encrypting my data.

That's fine. Still,

• The bus factor of your PhD is obviously 0 since you are required to hand in a substantial chunk of original own work. However, in case you suddenly leave the project, others may need to access your work in order to save as much of the project as possible. This is probably part of the risk strategy outlined in the grant proposal, and this means your institute signed a contract with the funding agency that they have reasonable means to save the project in case you drop out/get sick.

• The university/your institute/your PI are typically required by the project funding agency to guarantee accessibility of the research data that belongs to the project.
  So it's not only their whim, they have signed that they can show everything from raw measurement data to lab books if needed.

Bottomline: Asking you to ensure others can access your project-related data is reasonable and sensible, and they probably signed contracts that actually require this.

• If you have an employment contract with your university, the university owns your work. In consequence, they have a right to access it and you must provide them with appropriate means to do so. Actually, they may legally ask you to not even keep a copy of your project data when you leave.

  In my experience, some instituates do excercise this right while many institutes are fine with you keeping a backup copy of your data: in case something is needed/there are questions later on, it is often easier to ask you to send them the data (and of course, your ability to answer questions without access to the data is limited) and of course it is a kind of a distributed backup strategy.

  Personally, I'm somewhat uneasy with the request to not keep a copy of anything as my professional reputation potentially depends on whether I can answer questions (and possibly show data) about my papers years later. But legally, there's no choice here: it's the employer's (institute's) responsibility if they choose to excercise their right to exclusive data ownership.

---

Now, I was asked to either physically or digitally hand over my private encryption key (or password) [...] I feel very strange about this, since I grew up learning that passwords should never be given away.

You are right in not sharing your private key or password.

• You probably signed with the IT policy (see below) that you will not give your password to anyone.

• As you correctly point out, someone may gain access to your accounts and may do bad things(TM) in your name: sharing passwords creates a nightmare wrt. responsibility (it's impossible to know who exactly did X - and for you it's impossible to prove that it wasn't you)

• A closely related issue is data integrity. If you grant change/write access to anyone (via password or otherwise), how can you be sure things are as you left them?
  The answer to this however is signing rather than encryption.

• And moreover, it is not necessary as you can grant rights (e.g. group-readable) according to the required access level.
  So that's what you should do: possibly create a "project" user, make the relevant data readable to that user and hand over that login to your PI.

  An alternative is to have a shared drive on a file server for the project - but that's IT infrastructure that is outside your control. If it exists it's probably good to use that as these are in my experience typcially run with backups etc..

---

I'd like to exand a bit on my understanding of the legal situation in Germany wrt.:

I do have some private data on that computer as well

You have probably signed an "IT use" document when starting as PhD student. Time to review that.

Regardless of whether the IT policy of your university does allow small-scale private use of university IT, IMHO the best container for your private private data is a private external storage which you keep.

However, you may also have work-related private data => see below.

AFAIK, two scenarios are common in Germany wrt. IT use policy:

• Employer/university allows small-scale private use. They are not allowed to access your private data. As they allow private use, the default assumption is that your computer contains private data, and it should therefore not be accessible to everyone.
  So in case that's the policy at your institute, you can keep such personal data in your own encrypted storage.

• However, AFAIK employers can also mandate that their IT infrastructure is strictly for work/research purposes only. In that case, you may be expected to have almost everything at least readable to other employees.

• Still, As @StrongBad points out, it is actually quite common to have encryption (or physical access restriction) mandated e.g. by

  • Privacy requirements for projects involving human subjects,
  • Certain professional positions also mean that part of the work data should not be accessible to your whole group, and possibly not even to your PI/professor. Examples are data related to positision as ombudsperson, Fachschaft [student union] or Personalrat [employee committee] work, and everything related to grading students.

The conclusion is that the institute actually needs a more fine-grained access policy than just "everyone can access everything if need be".

Answer 12

1) You own only what is in your head.

2) The least secure place you can put things you move out of your head is to a place you do not own (your employer's, for example), followed by one you do own.

3) There are various ways (legal and/or ethical) of compelling you to move things out of your head and into the world, and of compelling you to move things from place you own to places you do not. Knowing them is important.

@buffy's excellent comment refers to 3. Your idea to hide an encrypted container with a password you know is an interesting extraction of #1: the location and password would presumably exist in your head. See #3.

Answer 13

Talk to your works committee ("Betriebsrat"). They should know what you are legally obligated to and what not. And they are not the voice of your employer (the university) but the employees.

Most of what you ask depends on the IT policy relevant to your institute. In general, if not prohibited by institute policies, you are allowed to have private data on your work machine. You maybe also allowed to use Internet access for private purposes. This is also the agreement at our institute, and any access to an employee computer by a third party (any colleague, boss, IT, the institute director) without them being present must be supervised by an employee representative to make sure that only work-related documents (and e-mails) are accessed. And it is suggested that we keep any personal documents in a clearly marked folder (e.g., "private").

Concerning the encryption key: Any work communication must be accessible by your employer for legal reasons! Concerning key escrow, again, ask your works committee.

Answer 14

My computer is owned by the institute

Well then, you have to follow the policies of the institute, whatever those might be. If you don't like those policies, then give them back their computer and do all of your work on your own personal device.

Think about it from the institute's point of view. You are probably working on a research project that is being funded from somewhere. Maybe the government gave your institute a 10 million Euro grant for example. It is very important to the institute that they show the government that they did something useful with the money so that they can get the next 10 million Euro grant. Imagine that you get hit by a bus. If nobody can get your data, then they have to go tell the government, "sorry, all the data we generated with that 10 million Euro grant is on this one computer and we don't have the password, may we please have another 10 million Euros to start over?" That will make the institute look extremely bad. So they have this policy that everyone must make their data accessible just in case.

Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access?

This seems a reasonable compromise to me. Make sure your research data is accessible and encrypt the private stuff.

Answer 15

Morally, how would I best act in this situation?
Should I hand over a wrong (digital) private key

Morally it is not okay to deliberately produce a fraudulent work

My computer is owned by the institute, ... and I have completely installed and configured it to my liking.

Then you're tech enough for this:

Get a low cost cloud computer for your personal stuff (Azure, AWS, etc.)
Remote into that computer through the university computer and you can do/store whatever you like (encrypted + anonymous).

Or even remote through your smart phone (if you buy one).

This is completely portable.
It completely complies with your university's policy

Also you'll never have the heartache and/or expense of trying to get data off of a computer that has been stolen, dropped on edge because a rogue firework was coming at you, was run over, caught fire, etc.

Implement this, and you can give them the private key they've asked for
(more work if you have reused this private key... but that's on you).

---

It is also a failing of every person with technical ability to not have (work) stuff backed up where others can get to it.
That's my opinion, but it is widely shared in 2020.

For completeness I'll mention that getting a smart phone would make your life easier.
Since you are tech savvy I'll assume this option isn't appealing to you for some reason (and there are a few good reasons).

Answer 16

I have talked to the data protection officer of my university, who seemed very sensitive with regards to my concerns. So in fact, the university officially allows a small amount of private usage of computers - without explicity defining small amount. There also is a policy for emergency cases, where the head of the instite is not allowed to simply access the computer, but instead the data protection officer (or some member of his team) makes sure that no private / sensitive data is made accessible, and only then allows the head of the institute to access the data. He then basically confirmed, that this is an infrastructure problem, and that the university offers tools to circumvent any kind of password hand out (e.g. backup and server-storage with fine-grained access control, mailing lists, etc.).

He also mentioned that there are different ways to proceed (which I can chose from): He could generally talk to my institute without referencing me or any details of the current discussion, just for a general clarification. Or instead reference me and talk to the institute. Or do not talk to the institute at all, and I will figure out what I need to do by myself.

Anyway, he did say that handing out private keys or passwords is the wrong solution to a problem that should not even exist when using the correct tools that the university offers.

Answer 17

Since the computer belongs to the university, you will need to think in terms of the following limitations. Even if you bring your own laptop to work to do your private emailing, etc., many work places today, will not allow you to use their network for private matters.

I am surprised to read you have configured your computer to your liking. As to why, this means your workplace/ academia setup is open to intruders. As an IT professional, even I when I use my computer, I do not use the administrator screens. I assign myself like a guest screen and password protect the Admin site, because, even if you do not see it visibly, stuff can download itself on your computer and through your network, spread to other computers. Workplaces today, will not allow you to download stuff. The IT professionals will do it within academia policies.

Secondly, although everyone else may check their private email at work, we all do, but some work places will not allow you to use your work computer for private matters. It will be shut off to 'private stuff' as it not only can cause a security issue, but also loss of work hours. Just saying.

Third, let's say, you do not have good intentions and use the university network to hack places. You will not be identified unless you log in to some system that records who you are and when you are logged in and your activities.

I am sorry to say, I don't get how your university can allow such lose practices, especially in our era. Wow! AND you are trying to hold on to your work computer as if it is your own.

Answer 18

Since I am no lawyer or remotely active in that space, so I'll refrain from answering the first question.

Then in general I am a huge advocate of honesty. It's your best bet, anytime, at least in the long term. Therefore I think that handing over a wrong key is waiting for a conflict to happen. And hiding a container might not even be necessary in the first place.

However I do sympathize strongly with the feeling of privacy. I had similar concerns and issues before. To be clear: I do think it is a bad idea to share authentication credentials in general. So the question remains: how to comply with the policy and keep your private data private.

And a few possible solutions come to mind:

• Shared repositories / backups for the work related data.
  • Pro: no need to break into your device at any time. Kind of convenient in general. What if the hardware fails completely? (Struck by lightning.)
  • Con: you will be responsible to keep this in sync.
• An encrypted container solution (E.g.: Veracrypt) No need to hide it really.
  • Pro: Very convenient for files and backup of private keypairs.
  • Con: Might not integrate very well with mail configuration and such.
• Use an external drive with an automatic mount to keep the container on.
  • Pro: Physically separates the data.
  • Con: Might not cover all use cases. (E.g.: the mail configuration) And could be a bit cumbersome.
• You could use a security key (E.g.: Yubikey, but have your pick, plety exist.)
  • Pro: It's hardware, the one holding the key can log in. You don't need to hand them a password or decryption key, but you could get in writing that if you get in a coma (hopefully not!) the can get access to the key.
  • Con: If you lose the key, you're also out.
• Use your own hardware.
  • Pro: You can have it just the way you like, and there is nothing they can say about it.
  • Con: It could be expensive. And if data loss is the underlying problem, you haven't solved it.

In the end I think the institute's end goal (having access to the research data?) is very reasonable and justified. But maybe there are better solutions to be suggested to solve the problem. So maybe your strategy could be to find out what their biggest fear is. If it is data loss, clearly there are way better solutions to this, and maybe they are willing to listen for other solutions.

Answer 19

You are right to be concerned. Private keys are called private for a reason.

The institute also has a legitimate concern, that they won't be able to access the data if you're unavailable. Problem is that when you hand over the key, someone will be able to impersonate you. You don't have to be especially important to be impersonated; if you have a credit card you're a target already. The meta-threat is that, just like with credit card info, if you give it out you may have a difficult time dealing with a future breach, because you're the one who gave out the data.

Solution:

Key escrow: Speak to your IT department about setting up a key escrow. It's possible they're already doing that but I doubt it, because they asked for the key in plaintext. So, ask the IT department and get some technical documentation from them with the details of the scheme. This is not so much to get the details, but to signal to them this is how you expect this to be done.

Automated Backups: Exactly what it sounds like. Backup your ~/project directory, have IT validate the solution. Or, use a shared workspace (ie a git repository).

Separate Keys You might ask the uni to supply you with a public key into which all work-related emails can be BCC'd. This way they get the data and your key is not compromised.

Answer 20

It is not 1990's anymore and both Internet access and personal digital devices are not that much scarse. Back then, it was normal or even expected for an employer to allow some personal use of computers and internet access. And the Internet was a lot safer place, back then.

Now, there is still some acceptance of this practice and even some expectation of privacy regarding personal matters, but the general trend is exactly the opposite. Private matters are private and done on private devices (laptop, tablet, phone), work is work and is kept separate on a work computer.

There can always be matters of competition between different employees (esp. in research or marketing) that have to be kept secret or data that is part of your work, but you are personaly responsible for keeping it safe. Spare for these (and they can be kept in a separate encrypted container) the employer is pretty much in a position to tell you what to do and what not to do, with any computer, or any other tool, or any work-related data.

What's more, your employer is probably responsible for a lot of things related to "your" computer (say, unlicensed or malicious software). When employees are left on their own to manage their computers, it is only because of the brave assumption that they know what they are doing. Today, this assumption is almost always wrong (hey, it is even wrong for most of the IT people I know, but that's completely another matter).

In short, the best strategy is to segregate personal (or, at least, sensitive personal) matters to different device. It may as well be an external USB flash or disk that connects to the work computer when needed or a completely separate device (laptop or tablet). Then, comply to whatever management asks regarding your work computer - be it decryption or "key escrow".

p.s. regarding these matters, student is the same as employee.

Answer 21

First of all, if IT is correctly managed, your private data may very well already be available because they are backed up.

Then, the ability to have private data on your device is dependent on the local law. You can have the case where everything belongs to the company/school, up to the case where you have the right to have personal data and they are legally protected.

For the first case, you are deliberately working against your institution by defending them access. It does not matter what you think, how they handle their data is their decision.

In the second case it gets more complicated. There is the part where you actively work against your institution like above - for the portion which belongs to the institution (because I guess there is something which belongs to them, right?). You must not encrypt that part.

If you have legally personal data then you can do whatever you want with them and your institution would not access them anyway (again, if this is the legal framework). The complicated part is email, when personal and professional data is mixed.