E-Mail Auto Forwarding

Purpose and Background:

Auto-forwarding of CUNY email is the automated re-sending of email from a CUNY email service to a non-CUNY email service. Auto-forwarding is typically requested to avoid separately accessing multiple email accounts (e.g., personal and university-related). Auto-forwarding raises concerns, however, regarding security, privacy and reliability and risks potential legal and public institution governance implications. Auto-forwarding can also be technically problematic.

Potential issues posed by auto-forwarding include:

• Inappropriate disclosure of Non-Public University Information (NPUI), including personally identifiable information such as social security numbers. (Additional examples of NPUI are included below.) Although email is not generally appropriate for the transmission of unencrypted NPUI, risks increase when NPUI in any form leaves CUNY’s systems
• Significantly increases the complexity of complying with New York State Freedom of Information Law (FOIL) and e-discovery
• External (non-CUNY) email providers can block CUNY email or mail servers when too much spam is auto-forwarded.  If a major email provider blocks email from CUNY, it can result in a broad and extended impact to CUNY
• Non-CUNY email providers can impose terms of service that reserve them the right to collect, read, use, distribute or even claim ownership of email that is sent to their system
• Senders may not receive a non-delivery receipt (“bounce back”) even when delivery to an auto-forwarded address does not occur
• Important email from CUNY may be delayed or fail to be delivered
• CUNY IT may take longer or be unable to diagnose or resolve delivery problems with a non-CUNY email provider
• Interferes and introduces complexity with anti-spam measures such as Sender Policy Framework (SPF)

CITY UNIVERSITY OF NEW YORK INFORMATION SECURITY PROCEDURE

Email Auto-Forwarding

Scope:

This procedure applies to CUNY College and Central Office email systems that facilitate CUNY academic and administrative communication by faculty, staff and students.

Statement:

Email sent to a CUNY email address mailbox shall not be forwarded through an automated means to a non-CUNY destination email address. Selected email may be manually forwarded by a CUNY user to a non-CUNY destination when such forwarding:

• will not result in an inappropriate disclosure of NPUI
• does not also automatically delete the email from the CUNY mail server
• complies with the requirements of the CUNY Policy on Acceptable Use of Computer Resources

Full consideration of the use of POP, IMAP, ActiveSync and similar protocols used to retrieve or synchronize mail with mobile devices and non-CUNY email accounts is not within the scope of this procedure, nevertheless, any such use must comply with a, b and c above.

Procedure(s):

A cuny.edu (i.e., CUNY provided) email account should be used to issue and receive CUNY- related email communications. University email systems must be configured to prevent or disallow auto-forwarding where technically feasible.

CUNY email can be accessed using mobile devices with no use of auto-forwarding required. Mobile devices, desktop email applications, etc., support concurrent access to multiple email accounts by combining email from separate accounts into a consolidated view. In this way, the need to auto-forward email from one account to another is conveniently avoided.

For email setup and support information, contact the campus IT department.

Responsibility:

CUNY faculty, staff and students and affiliates of CUNY

Related Information:

Acceptable Use of Computer Resources IT Security Procedures

(Found at security.cuny.edu) Effective Date:    Back to Policiy Directory>>

Effective upon issue. Where necessary to provide an initial period of notification and implementation, compliance must be achieved by June 1, 2016.