Upgrade StorageZotero is being removed from university computers, citing refusal to complete HECVAT
https://itanswers.mst.edu/2024/02/why-is-zotero-being-removed-from-the-st-campus/
"S&T IT Security asked for Zotero’s to answer question for a security review. In some cases higher education vendors will have a completed Higher Education Community Vendor Assessment Tool (HECVAT), which is a questionnaire that helps higher education institutions access their vendor risk. This was not the case with Zotero, So an IT Security Review Questionnaire (ITSRQ) was submitted to the developer. They did not respond to the questionnaire, which did not allow S&T IT Security to properly evaluate the risk of cloud storage offered as part of paid subscriptions to Zotero."
Is there are a reason for refusal to complete the HECVAT? It would fulfill bureaucratic requirements and save numerous researchers from being forced to switch to inferior commercial alternatives with much less respect for privacy and security.
"S&T IT Security asked for Zotero’s to answer question for a security review. In some cases higher education vendors will have a completed Higher Education Community Vendor Assessment Tool (HECVAT), which is a questionnaire that helps higher education institutions access their vendor risk. This was not the case with Zotero, So an IT Security Review Questionnaire (ITSRQ) was submitted to the developer. They did not respond to the questionnaire, which did not allow S&T IT Security to properly evaluate the risk of cloud storage offered as part of paid subscriptions to Zotero."
Is there are a reason for refusal to complete the HECVAT? It would fulfill bureaucratic requirements and save numerous researchers from being forced to switch to inferior commercial alternatives with much less respect for privacy and security.
It's true that we're not able to accommodate requests for custom documentation, but they can see Security and Privacy for the information we make publicly available. The HECVAT and similar forms really just aren't applicable to an organization like ours (they want org charts and all sorts of details about on-prem systems that we don't have), and they would seem to eliminate any non-enterprise company from providing services to an institution. Yes…we view the accounts that people create as belonging to them. People can bring Zotero accounts that they already had, as well as keep the Zotero account and their data after they leave an institution. S&T seems to want to assert ownership over people's Zotero accounts.
Furthermore, S&T is referring to paid cloud storage, while seemingly ignoring that Zotero is a free application that doesn't require an account to use and saves all data locally by default. Blocking people from even installing an open-source program from a nonprofit organization that goes to extraordinarily lengths to protect people's privacy, while suggesting that they use alternatives from companies that literally make money by selling people's data, is a strange choice indeed.
We'd be happy to discuss this with them, but, again, no one at S&T has reached out to us.
By this logic, Google should be able to own Zotero accounts created with Gmail addresses. I think you can see how bizarre and unworkable Missouri S&T's reasoning is.
That's certainly the case with my large university (and in any case my Zotero account is not registered with my university email address anyway*). Such IP policies may of course differ in different parts of the world, and for different types of academic institutions. In my experience of different institutions (including having been involved in drafting IP policies), the larger the university, and the more its staff create IP other than just teaching materials (eg the university's research vs teaching focus), the more likely the university is to have detailed IP policies that protect staff rights to their IP in scholarly works (and of course also protecting the university's reasonable interests and liabilities) ... and also for its legal staff drafting such policies to be aware of common practice in academic institutions. Smaller, teaching-only institutions are less likely to have such policies, or make policies up as it suits them, with or without advice from legal professionals with experience of university IP practices.
* reasons for using a university email address would only be convenience, and if your university has purchased institutional Zotero storage that requires use of such an address.
Our campus IT executives are reasonable people, and the problem is most likely to originate from the bureaucrats.
The information you have shared is helpful and I will do my best to convince them to reverse the decision.
Everything else aside, it will be embarrassing to tell my students to stop using a free and open-source solution in favor of an inferior product from a for-profit entity.