4:00 – 4:05 p.m. — Announcements
Colin Rundel opened the meeting, noting that Tracy Futhey was unable to attend and that there were no announcements.
4:05 – 4:35 p.m. — Center for Cybersecurity Policy (David Hoffman)
What it is: David Hoffman, the Steed Family Professor of the Practice of Cybersecurity Policy at Duke’s Sanford School of Public Policy, discussed current cybersecurity and privacy challenges and shared updates on Duke’s interdisciplinary cybersecurity and technology policy initiatives.
Why it matters: As global cyber threats intensify and regulatory frameworks evolve, universities must integrate technical, ethical, and policy perspectives. Hoffman’s work bridges these domains and strengthens Duke’s leadership in cybersecurity education and collaboration.
4:35 – 5:05 p.m. — Draft Data Access and Use Statement (John Board, Ken Rogerson, and Sunshine Hillygus)
What it is: A discussion of a draft institutional statement outlining Duke’s principles for responsible data access and sharing, focusing on balancing innovation and protection.
Why it matters: Institutional data—spanning everything from student systems to facilities—offers tremendous potential for improvement and discovery. However, without structure, sharing remains fragmented and risk-averse. The statement aims to guide ethical, consistent data practices.
John Board introduced David, highlighting his long-standing role in convening faculty across Duke to discuss cybersecurity issues and policy.
David began by describing his professional background: after earning his law degree at Duke, he spent 23 years at Intel Corporation, including serving as European General Counsel. He later advised the Department of Homeland Security and the National Security Agency, where he continues to serve on the NSA Director’s Advisory Board for Civil Liberties and Privacy.
Returning to Duke in 2019, David assumed his current endowed chair with the goal of linking the university’s diverse cybersecurity efforts into a coherent, outward-facing framework. Working with Sanford colleagues and Duke’s Office of Information Technology, he has built programs that connect curriculum, research, and executive education to strengthen Duke’s global presence in cybersecurity and technology policy.
Programs and Global Engagement. David explained that with seed funding from the Center for Computational Thinking (CCT), his team launched new curricular offerings and the Technology Policy Lab, co-directed with Ken Rogerson. The lab hosts interdisciplinary research projects that unite faculty from law, engineering, computer science, and business.
Their work includes developing cross-listed courses at both the undergraduate and graduate levels, such as Introduction to Cyber Policy, which counts toward both the Public Policy and Computer Science majors. Enrollment has far exceeded capacity, with over 200 students seeking entry into a 40-student course—evidence, David said, of “tremendous demand for cyber policy education.”
The team also established an Executive Education Program, the Cybersecurity Leadership Program, developed in collaboration with Pratt School of Engineering and industry partners. The program brings together public- and private-sector leaders for three days of in-person instruction at Duke followed by online coursework, culminating in a CISO certificate administered through Pratt.
The initiative has since expanded globally, with training sessions hosted in Latin America, Europe, the Middle East, and Southeast Asia. Plans are underway to offer recurring regional programs in India, the U.K., and Latin America, introducing executives to Duke’s academic pathways such as the Master of Public Administration and Master of Engineering in Cybersecurity.
David noted that the program reflects Duke’s broader Deep Tech Initiative, led by Ronnie Chatterjee of the Fuqua School of Business, which connects cybersecurity with emerging technologies like AI, quantum computing, and semiconductor manufacturing. He serves as Managing Director of the initiative, which is supported by the Provost’s Office.
David explained that their goal is to link education, research, and executive learning into a pipeline that advances cybersecurity as part of global digital transformation.
Curricular Expansion and Student Engagement. Ken Rogerson added that Sanford recently formalized a dual-degree program with Pratt, allowing students to earn both an MEM and MPP. The school also launched a Technology Policy Track within its MPP program, making Duke one of only a few universities offering this specialization.
The initiative has attracted growing national interest, with prospective students frequently discovering Duke’s program through online searches for Tech Policy Master’s.
David also highlighted the success of the Duke Cyber Club, a student-led organization he advised until recently. The club has over 100 participants competing in national cybersecurity and policy competitions. In 2024, the club won two national Capture the Flag titles—an achievement rarely accomplished outside the U.S. service academies.
Gabriel Toscano asked about David’s goals for the next five years. David outlined plans to expand Duke’s collaborations with global universities and government academies, emphasizing the importance of hybrid executive education and joint curriculum design. He cited active partnerships in Costa Rica and India, with additional opportunities under development in other regions.
Steffen Bass asked whether policy considerations could be baked into technology through campus testbeds. David responded that that is exactly what his career at Intel was about—translating policy into design and educating policymakers about technology before it launches.
Steffen also raised concerns about cybercrime in regions like Southeast Asia. David pointed to the Costa Rica government ransomware attack (2022) and the Salt Typhoon intrusion campaign as turning points that have shifted even reluctant governments toward prioritizing infrastructure protection.
John Board noted that David’s early work with the U.S. State Department educating developing-nation leaders has clearly informed Duke’s international engagement model. David agreed, saying that while federal funding for such programs has diminished, Duke’s own leadership role and partnerships can now sustain this work.
Colin Rundel asked how Duke tailors its global cybersecurity programs for local contexts. David replied that roughly 60–70% of the curriculum remains consistent across regions, with the rest customized to reflect regional governance structures and threat landscapes.
John then asked where Duke could lead more visibly in cybersecurity policy. David praised OIT’s work during the pandemic and in inter-university threat sharing, calling Duke a national model for balancing ethics, privacy, and innovation. Ken Rogerson echoed that ITAC’s open dialogue exemplifies Duke’s collaborative culture.
David closed by thanking Tracy Futhey for fostering cross-school collaboration and that the connective tissue OIT provides between schools is phenomenal. Other universities simply don’t have that.
John Board introduced the draft, developed at Tracy Futhey’s request, noting Duke’s long-standing struggle to share institutional data effectively. He explained that they have said for 30 years that appropriate data sharing is vital yet they’ve rarely succeeded.
The team reviewed models from other universities, including Indiana, and sought language that emphasizes values rather than restrictions. Sunshine Hillygus emphasized focusing on principles over policies - the more we capture our shared values, the safer ground we stand on.
Ken Rogerson added that the draft intentionally avoids procedural detail to preserve flexibility, giving the statement the moral authority to guide future decisions.
John described the institutional challenges that prevent data sharing: ownership silos, lack of de-identification infrastructure, and risk aversion. He argued for a formal data-sharing review structure, akin to an IRB for non-person data, that would handle sanitization and approvals independently of data owners.
Sunshine recommended involving the new Director of Institutional Research to strengthen coordination and explore models used at peer institutions.
Steffen Bass emphasized the need to allocate resources for data provisioning and cited campus mobility data as an example of valuable yet underused information. Sunshine agreed, noting that Wi-Fi and device-based data could inform student experience improvements.
Victoria Szabo encouraged broader discussion of use cases—from facilities planning to student success analytics—while Sunshine reiterated that all uses should adhere to ethical review processes.
Matthew Hirschey asked whether the principles would extend beyond student data to staff and alumni. Sunshine responded that the framework should apply broadly but must clarify boundaries of purpose and consent.
Nick Tripp and Ed Gomes discussed operational implications, such as automation for grant and payroll management, and the importance of defining data ownership and permissions.
Chris Meyer explained that OIT’s Institutional Data Governance Group is working toward a unified architecture and that the Registrar’s Office already provides a mature request model that could serve as a template.
John summarized the group’s consensus: Duke should continue advancing a principles-based data sharing framework, advocate for the infrastructure needed to operationalize it, and unify compliance-oriented and innovation-oriented policies into one coherent statement.
He concluded that the group will refine the draft, solicit further feedback, and return with recommendations for implementation.
5:05 – 5:15 p.m. — Common Solutions Group (CSG) Update (Charley Kneifel, Mark McCahill, Nick Tripp)
What it is: A report from Duke representatives attending the Common Solutions Group (CSG) meeting—a national forum of higher-education IT leaders discussing shared challenges and emerging technologies.
Why it matters: Participation in CSG helps Duke align with peer institutions on topics such as cybersecurity, identity management, and accessibility, ensuring Duke remains informed and proactive.
Nick Tripp shared that discussions centered on next-generation security models, especially Zero Trust architecture. The University of Nebraska system has already achieved full implementation, micro-segmenting its entire network—something few universities have accomplished. Duke plans to consult with Nebraska to inform its own roadmap.
The meeting also addressed identity management. Arizona State University has moved all identity data into a graph database, allowing dynamic schema design and flexible data relationships. Mark McCahill noted that ASU’s entrepreneurial approach trades complexity for speed, though it introduces significant risk.
Nick connected this to Duke’s own efforts to modernize identity verification, following an incident in which attackers used fabricated IDs to impersonate staff. He outlined plans to adopt NIST-compliant verification with third-party solutions to ensure future resilience.
Mark McCahill summarized a separate session on digital accessibility. Institutions such as UC Berkeley and University of Colorado Boulder shared lessons from federal consent decrees mandating extensive web and course accessibility audits.
He noted that accessibility remediation can cost about $1,800 per course and requires strong prioritization—beginning with a full inventory of websites and ownership contacts.
Nick Tripp added that Duke is close to completing a new web inventory application to help address this need. Mark emphasized that maintaining up-to-date inventories benefits not only compliance but also governance and content management.
Victoria Szabo asked whether accessibility refers to features such as alt-tags and transcripts. Mark confirmed it includes all structural and content accessibility measures.