Trellix Departing - CrowdStrike Arriving

Does "Trellix" ring a bell? Here is a reminder from an AI summary:

UC Systemwide Trellix Dispute

• The Mandate: UC President Michael Drake ordered the systemwide deployment of Trellix EDR cybersecurity software on university-managed devices.

• Faculty and Academic Senate Opposition: Faculty members and the UC Academic Senate Assembly formally protested the rollout. They argue the administration bypassed shared governance consultation.

• Privacy and Surveillance Concerns: Faculty raised alarms that root-level access could allow file monitoring, alteration, or deletion, infringe on academic freedom, and expose sensitive research data or government collaboration channels (such as the Joint Cyber Defense Collaborative).

• Administration Stance: The UC Office of the President (UCOP) maintained that Trellix limits data collection strictly to system-level threat indicators without monitoring personal browsing or emails.

• Phase-out Plans: For instance, UCLA Transitioning from Trellix to CrowdStrike scheduled a full retirement of Trellix by May 2027 in favor of CrowdStrike.

==

Trellix Corporate Data Breach Investigation

• The Incident: Trellix disclosed a security and source code repository incident in 2026, followed by notification letters sent to affected individuals in August 2026.

==

UCLA Transitioning from Trellix to CrowdStrike for Endpoint Security

October 27, 2026  Security

https://dts.ucla.edu/news/ucla-transitioning-trellix-crowdstrike-endpoint-security

--

Protecting UCLA's systems, information and digital environment is essential to supporting our university's teaching, research and service missions.

As part of a University of California-wide initiative, the UC Office of the President (UCOP) is replacing the current systemwide endpoint security solution, Trellix HX (formerly known as FireEye), with CrowdStrike Falcon, a modern cybersecurity platform providing antivirus and other detection and prevention capabilities designed to protect computers and university information from evolving threats.

In alignment with UC expectations, UCLA will retire Trellix by the end of May 2027, making a timely transition to CrowdStrike essential to maintaining supported endpoint protection. While the security software is changing, the cybersecurity requirements established by UC in 2024 remain in effect. UCLA is committed to making this transition in consultation with both campus academic and administrative governance to develop the detailed rollout plan and necessary adjustments.

No action is required at this time, as your local IT team will provide instructions as the project gets underway.

--

What Is CrowdStrike?

CrowdStrike is an Endpoint Detection and Response solution designed to detect, prevent and respond to cybersecurity threats, including malware, ransomware and unauthorized access.

Compared with Trellix, CrowdStrike is designed to provide enhanced protection, support a broader range of devices and operate more efficiently in the background, minimizing the impact on everyday device use.

CrowdStrike is not intended to monitor your work, research or productivity. Its purpose is cybersecurity threat detection and response, and UCLA's use of the technology remains subject to UC privacy and data-use policies. This includes any use of CrowdStrike for remote cyber threat remediation in alignment with university consent procedures. As part of the governance process, a formal academic committee dedicated to cyber transparency has been requested to ensure ongoing alignment with these policies and to review activity.

What Should I Expect?

UCLA has begun deploying CrowdStrike through a pilot with select campus units to test and refine the installation process. The broader rollout will occur in phases, in conjunction with ongoing IT and academic governance review:

October 2026 – January 2027: Campus IT teams will prioritize installing CrowdStrike on servers and administrative staff computers.

January 2027 – May 2027: Deployment will tentatively expand to faculty, researchers, and other applicable devices across campus following consultation with the Academic Senate.

Beginning June 1, 2027: Duo Desktop will no longer recognize Trellix as an approved endpoint security solution. Devices without CrowdStrike may be unable to access certain high-risk UCLA applications and services.

Depending on your device, CrowdStrike may be installed automatically by your IT team or require you to complete additional installation steps. Your local IT team will communicate the timing, instructions, and support available if action is needed.

What Happens Next?

As UCLA prepares for the transition, your local IT team will share additional details about timing, expectations, and any steps you may need to take. Again, no action is required at this time. Please wait for further instructions from your local IT team before installing CrowdStrike or removing Trellix from your computer.

For more information, including frequently asked questions about deployment, device compatibility, privacy and upcoming access requirements, visit the OCISO CrowdStrike website:

https://ociso.ucla.edu/crowdstrike-falcon-endpoint-security-antivirus

Sincerely,

Darnell Hunt

Executive Vice Chancellor and Provost

--

Michael J. Beck

Administrative Vice Chancellor

==

NOTE 1: Blog readers may recall that Trellix became an issue both at the UCLA campus level and systemwide at the Academic Senate's Assembly. The issue for faculty involved personal cybersecurity. There is a general reference to this concern in the Hunt-Beck memo above. It is highlighted in boldface.

NOTE 2: (from AI) - CrowdStrike is headquartered in Austin, Texas — 206 East 9th Street, Austin, TX 78701 — after relocating from Sunnyvale, California in 2021. Beyond Austin, the company runs a significant global footprint: regional hubs in Washington D.C., London, Sydney, Tokyo, and Singapore, plus smaller offices across Europe, the Middle East, and Asia-Pacific.

NOTE 3: If you are reading this blog through the older 

https://uclafacultyassociation.blogspot.com/, 

typing in "Trellix" will bring you references to concerns raised by faculty. (The newer parallel blog

https://danmitchellsblogcontinues.blogspot.com/ 

does not go back far enough to have those references.

Slipping

Story from EdSource: https://edsource.org/2026/uc-freshmen-math-failure-doubled/767983.
 

Straws in the Wind - Part 508

From the Chronicle of Higher Education: ...The Survey of Earned Doctorates [is] an annual survey by the National Center for Science and Engineering Statistics on research doctorate recipients at American institutions... The 2025 survey found that the number of doctorates earned in the humanities dropped 20 percent since 2015, while the number of doctorates earned in the social sciences saw a smaller decline of 3 percent. Over all, the number of doctorates increased by 8 percent. This survey also found that these two disciplinary areas are among the longest doctorates to complete...

Full story at https://www.chronicle.com/article/humanities-dissertations-have-declined-far-more-steeply-than-those-in-the-social-sciences-report-finds.

Wayback

We have in the past supported the non-profit Internet Archive and its Wayback Machine as a means of preservation of the historical record. As blog readers will know, we preserve UC Regents meetings, UCLA budget files, and other documents that might otherwise disappear. Unfortunately, some news publishers are limiting access to the Wayback Machine, hoping to prevent AI companies from using their articles, even as their own journalists use it to develop their stories. 

From The Atlantic: ...People all over the world use the Wayback Machine all the time. What began as an effort to preserve the web has become an essential tool for journalists, researchers, historians, and the broader public.

Yet the future of this tool has become extremely vulnerable. The New York Times is now blocking the Internet Archive’s ability to preserve its articles. The Guardian has restricted our access to its published articles and removed articles from some of the Wayback Machine’s interfaces. USA Today and a growing number of other news organizations have also placed barriers in the path of web archivists (even, yes, The Atlantic). As of May 2026, Harvard’s Nieman Journalism Lab had identified more than 340 local-news sites that were limiting the Internet Archive’s ability to preserve their journalism.

The publishers taking these steps have all pointed to one reason: the unauthorized use of their work by AI companies to train large language models. They complain that our library serves as a back door around paywalls, licensing negotiations, and technical restrictions. The Times has said that it is blocking us because the Wayback Machine allegedly provides “unfettered access” to its work. But this fear-based approach does not take into account that the Internet Archive is taking steps to prevent AI companies from scraping the materials we preserve.

I understand why publishers are angry. Journalism is expensive. Reporting requires skilled people, time, courage, legal support, and institutions willing to withstand pressure. Journalists have watched advertising revenue disappear and subscription growth slow while technology companies build enormously profitable products using material created by others. Publishers have every right to challenge commercial businesses that they believe are inappropriately exploiting their work.

But blocking a nonprofit library is the wrong response to this problem. Impeding the Wayback Machine’s preservation work will not prevent powerful AI companies from gathering training data. It will certainly not restore the advertising-based business model that supported newspapers in the 20th century, a business model that has long since collapsed. What it will do is prevent historians, researchers, courts, ordinary readers—and, most ironic, journalists themselves—from consulting an accurate record of what once appeared on the web. It is difficult to quantify the scale of what we stand to lose. A continuous record of web activity is an enormously powerful accountability tool, especially at a time when seeking the truth and reporting it has become ever more complicated and the informational environment is growing only more complex...

Full essay at https://www.theatlantic.com/technology/2026/10/blocking-internet-archive-will-not-stop-ai/689065/.

Will Harvard Continue to Lead the Charge? - Part 208

From the Harvard Crimson: Harvard Law School raised a record $135 million dollars in fiscal year 2026, surpassing its two most recent fundraising years by more than $50 million, according to a person briefed on the giving. The Law School rode to the record fundraising year on the back of a $31.4 million gift from former Board of Overseers President Morgan Chu, an intellectual property attorney who graduated from HLS in 1976. The gift — the largest in HLS history — endows six new professorships across the school.

The fundraising haul follows two slower years of giving for the Law School. The School brought in roughly $73 million in 2025 and roughly $84 million in 2024...

Full story at https://www.thecrimson.com/article/2026/10/26/harvard-law-record-donations/.

No Hastings - Part 3

The last time we looked at the legal case aimed at restoring the Hastings name to the law school in San Francisco run by the Regents was back in February. This appears to be the end of the line for that effort. From the San Francisco Chronicle:

The U.S. Supreme Court rejected a challenge... by Serranus C. Hastings’ descendants to the removal of his name from San Francisco’s 148-year-old law school after revelations that he ordered troops to slaughter thousands of Native Americans in the 1860s...

Full story at https://www.sfchronicle.com/politics/article/u-s-supreme-court-lets-hastings-name-change-22484142.php. 

Straws in the Wind - Part 507

From the Daily Pennsylvanian: An emeritus Penn professor was arrested last week after blocking an Uber Eats robot in Center City. Carolyn Marvin, a professor emeritus at the Annenberg School of Communication, was approached by police on Oct. 14 after repeatedly standing in the path of one of the food delivery company’s sidewalk robots. Marvin described the act, which resulted in a criminal violation notice for disorderly conduct, as an exercise of her First Amendment rights... She criticized the “cute little robots flashing googly hearts,” writing that they “distract us from thinking about the real people they displace.” ...

She emphasized the importance of being able to “protest these abuses in the same public space the robots are occupying.” Police arrested Marvin on the 1200 block of Filbert Street after receiving a report of criminal mischief involving a robot...

Full story at https://www.thedp.com/article/2026/10/penn-uber-eats-robots-artificial-intelligence-arrest.