> Data Transfer: If your request is approved, you will send a blank 3TB hard drive to the address below.
> We will return the loaded drive to the address specified in your request within 10 business days of receiving it. The data on the drive will be encrypted using TrueCrypt. The password to decrypt the data will be emailed to address that you specified in your request. It will be your responsibility to install and configure TrueCrypt (http://www.truecrypt.org/) on the system where you will be accessing the data.
> 4.) Data Removal: When you have finished using the data, you are responsible for securely and permanently removing the data including the drive that was used to transfer the data. For more information about secure data removal please see: (https://protect.iu.edu/cybersecurity/data/secureremoval) .
> I have read and agree to abide by all University data security practice related to access to University confidential data. To the best of my ability, I will comply, keep secure, or return all information provided to me.
TL:DR they're just crossing their fingers and hoping for the best.