If it is on machines that the university controls, they can install a root certificate of their own and then MITM the encrypted web traffic.<p>I&#x27;ve seen this a few times at large companies.  All work provided machines will have the company&#x27;s root cert installed and this allows them to intercept and monitor all the traffic.<p>I&#x27;m not a lawyer but I assume that this is legal.  The company is monitoring their own network and their own machines.  The employees may have even signed some document during their on-boarding which further stated that the company is allowed to monitor any activity on their own equipment.<p>I consider this an ethically grey area.  It starts to become <i>unethical</i> in my mind if the users of the network are not explicitly told in plain language that all of their web traffic will be monitored.