Policy on University Computer Usage and Information Security

EFFECTIVE DATE
June 1, 2000
Winfred Jones
Director Information Technology Center

I. PURPOSE

To ensure that members of the Grambling State University community recognize and adhere to all standard policies and procedures established to support the usage of information technology and associated applications.

II. OBJECTIVES

1. This policy sets forth the privileges of and restrictions on students, faculty, staff, and other users with respect to the computing and telecommunications systems located at the Grambling State University.
2. It attempts to define and give examples of various sorts of activities which are detrimental to the welfare of the overall community and which are therefore prohibited.
3. It describes the process by which violators are identified, investigated, and disciplined.

Several committees or individuals provide regulation of the use of information technology:

• Information Technology Policy Council - establishes and refines as necessary the definitions of appropriate use policies with respect to the use of information technology at Grambling State University.
• University Web Planning Committee - Oversees the design of and policies concerning Grambling State University's Web site
• Judicial Affairs Disciplinary committee - Oversees student affairs judicial affairs relating to student conduct and activities on the campus.

The appearance of this policy in the Faculty/Staff and Student Handbook makes its provisions binding on all members of the Grambling State University user community.

II. STATEMENT OF POLICY

The computing facilities at Grambling State University are provided for the use of Grambling State University students, faculty and staff in support of the programs of the University. All students, faculty and staff are responsible for seeing that these computing facilities are used in an effective, efficient, ethical and lawful manner.

The following policies relate to their use.

1. Computer facilities and accounts are owned by the University and are to be used for university-related activities only. All access to central computer systems, including the issuing of passwords, must be approved through the Information Technology Center.
2. Computer equipment and accounts are to be used only for the purpose for which they are assigned and are not to be used for commercial purposes or non-university related business.
3. Others must not use an account assigned to an individual, by the Information Technology Center without explicit permission from the instructor or administrator requesting the account and by the Information Technology Center. The individual is responsible for the proper use of the account, including proper password protection.
4. Programs and files are confidential. They may be made available to other authorized individuals by the appropriate authority permission. Information Technology Center personnel may access others' files when necessary for the maintenance of central computer systems. When performing maintenance, every effort is made to insure the privacy of a user's files. However, if violations are discovered, they will be reported immediately to the appropriate Vice President.
5. Electronic communications facilities (such as EMAIL) are for university-related activities only. Fraudulent, harassing or obscene messages, pictures and/or other materials are not to be sent, retrieved or stored.
6. No one may deliberately attempt to degrade the performance of a computer system or to deprive authorized personnel of resources or access to any university computer system.
7. Loopholes in computer security systems or knowledge of a special password must not be used to damage computer systems, obtain extra resources, take resources from another user, gain access to systems or use systems for which proper authorization has not been given.
8. Computer software protected by copyright is not to be copied from, into, or by using campus computing facilities, except as permitted by law or by the contract with the owner of the copyright. This means that such computer and microcomputer software may only be copied in order to make back-up copies, if permitted by the copyright owner. The number of copies and distribution of the copies may not be done in such as way that the number of simultaneous users in a department exceeds the number of original copies purchased by that department.

An individual's computer use privileges may be suspended immediately upon the discovery of a possible violation of these policies. Such suspected violations will be confidentially reported to the appropriate faculty, supervisors, department heads, Information Technology Center staff, and Vice Presidents.

The appropriate administrative staff or supervising department head will judge an offense as either major or minor. The Information Technology Center Security Administrator and supervising department head will investigate the first offense after consultation with the instructor or administrator requesting the account. Additional offenses will be regarded as major offenses. Appeals relating to minor offenses may be made to the supervising Vice Presidents. The supervising Vice Presidents will address all major offenses once reported.

Violations of the policies will be dealt with in the same manner as violations of other university policies and may result in disciplinary review. In such a review, the full range of disciplinary sanctions is available including the loss of computer use privileges, dismissal form the University, and legal action.

Violations of some of the above policies may constitute a criminal offense. Individuals using campus computer facilities should be familiar with the Louisiana Revised Statutes 14:73, Computer Related Crimes.

NOTICE OF POLICY CHANGE

All policies and procedures outlined are intended to serve for the current school year; however, Grambling State University reserves the right to make such modifications as are deemed necessary. If and when changes are made, appropriate effort such as faxing updates to all campus departments, posting changes on the University's web page and/or placing a notice in The Gramblinite will be made to notify the university community.

PLEDGE TO STUDENTS, FACULTY AND STAFF

Grambling State University is committed to maintaining its leadership position in the use of computer and communication technology to facilitate learning. The University promises to provide, as rapidly, as economically, and as feasible, the following:

• To students, access to their information anywhere on campus.
• To faculty, the resources necessary to enhance teaching, learning and research.
• To staff, the tools necessary for a responsive service environment.

The University will normally respect privacy and attempt to safeguard information but cannot guarantee these privileges absolutely: the University can examine, at any time, anything that is stored on or transmitted by University-owned equipment.

PROVISIONS

You are entitled only to one person's fair share of University resources unless written the Information Technology Center Director to the contrary has granted permission. The examples given below are examples of prohibited activities, not a listing of all violations.

* YOU MAY NOT steal, forge, lie or cheat with; snoop on; tamper with; misuse, damage, harass with; threaten with; hoard or monopolize; interfere with; violate the confidentiality of; masquerade with; or destroy any information, resource, equipment or software. This includes using your personal computer for these activities against other users or against their information resources.

Examples: You must not access the account of another; you must not generate activities which consume more than your share of either system time or network bandwidth (including chain letters); you must not fraudulently log into any computer, etc.

* YOU MAY NOT access, change, correct, copy or expose your record, the record of any student or former student without expressed permission and identified instructions from the department which has jurisdiction of the information or said record.

* YOU MAY NOT possess any software, resource, or equipment whose purpose is to effect one of the violations listed in the first Provision.

Example: You must not have in your account on any University-owned system or on your personal computer programs which attempt to determine the passwords of others or obtain privileges on any computer to which you are not entitled.

* YOU MAY NOT attempt to violate the first Provision. Any such attempt will be considered to be the same as a violation.

Example: If you attempt to obtain system privileges to which you are not entitled, you are as guilty as if you had succeeded.

* YOU MAY NOT possess, willingly receive, willing view or distribute obscene material.

Examples: Child pornography is absolutely against the law. It is a violation of Federal free/statutes to transmit this material across state lines, even electronically, and certain obscene materials are in violation of the Louisiana Code.

* YOU MAY NOT violate the Policy on Computer Usage and Security of Information off-campus anywhere in the world using University resources.

Example: An attempt to gain unauthorized entry to any computer off the University campus is as if you attempted to gain access to a computer here.

* YOU MAY NOT copy, install or use any equipment, service, information, data, image, recording, or other work in violation of applicable copyrights or license agreements.

Example: If you use material created by or belonging to others, you must have their permission to do so.

* YOU MAY NOT use any University facility for non-University commercial business or advertising, including unsolicited commercial e-mail without written permission from the Provost and the Information Technology Center Director. This includes partisan political activities; however, any officially sanctioned University student group may maintain an official web page, which presents objective information about the group itself.

Examples: You may not use the statistics software on the academic shared systems to do work for off- campus entities for which you are paid. The Young Democrats/Republicans may have a page, which presents information about their activities and goals; they may not attempt to influence voter’s choices through that page. The sending of unsolicited bulk e-mail (spamming) is not allowed.

* YOU MUST connect all equipment and install all software in a manner that meets the technical, security, and fair use standards set by Information Technology Center.

Examples: All IP addresses and domain names are owned and assigned by the Information Technology Center. World Wide Web, ftp, and other network services that interfere with fair network use by others may be restricted by the Information Technology Center.

YOU MUST TAKE FULL RESPONSIBILITY FOR WHAT YOU PUBLISH, TRANSMIT, OR POSSESS. PENALTIES

If you are suspected of violating this Policy, the University can impound any equipment, device, software, documents, or data that is involved. The University will obtain a search warrant before impounding anything.

If you have violated the Policy, you will incur the same types of disciplinary measures as violations of other University policies. Violation of state or federal free/statutes may lead to criminal or civil prosecution.

• Students: Campus disciplinary measures may include, but are not limited to, failure in a class, permanent or temporary loss of information technology privileges, suspension or expulsion from the University, and restitution of expenses as well as charges for damages, as listed in the Student Handbook. The Vice President for Student Affairs, designated by the University President, is responsible for the administration of the Student Code of Conduct.
• Faculty and Staff: Campus disciplinary measures may include, but are not limited to, reassignment of duties, transfer, censure, suspension, termination, and restitution of expenses as well as charges for damages, in accordance with guidelines outlined in the University Faculty/Staff Handbook.

INVESTIGATION AND DISCIPLINARY ACTION

Violations are most likely to be observed in two ways:

1. A System Administrator detects an anomaly and, in determining the cause of the problem, finds evidence of a violation.
2. An individual observes what is perceived to be a violation. Suspicious activities are then reported to Security Administrator.

Reports will be investigated promptly with attempts to resolve minor infractions (anything which is deemed not serious and which should be correctable by pointing out the infraction to the offender) within a reasonable time period. If not resolved, the violators are reported through the Security Administrator to their administrative office for disciplinary action. The System Administrator is free at any time to take immediate action to safeguard the University's infrastructure, including working with campus security to obtain a search warrant at the first sign of suspicious activity. IRC personnel will also document the actions taken from the point of discovery and will prepare a non-technical narrative for the use of the University. The Security Administrator, with the consent of the Information Technology Center Director, may investigate any activity on University-owned equipment or services. Investigative activities will be logged by the System Administrator when undertaken and will be conducted in an appropriate manner approved by the Information Technology Center Director.

The Security Administrator, with the approval of the Information Technology Director, will report incidents to the appropriate Vice President for disciplinary consideration. The disciplinary committee will notify the individuals involved that are under investigation. If non-University service providers are involved, the committee will consult with the University Attorney and the Information Technology Center Director to notify them as soon as it is prudent to do so.

The collected evidence and the documents that record the actions of the (Security Administrator, System Administrator and IRC staff,) will be forwarded to the disciplinary committee for adjudication together with a recommendation on any loss of privileges with respect to computing and telecommunications systems. The disciplinary committee will report the outcome of the case the Information Technology Center Director. In the case of suspected criminal violations, the University Police will be notified.

The accused has the right to petition the disciplinary committee for the release of impounded material and the restoration of privileges. That decision may or may not precede the disposition of the case. In any event, any such decision must be communicated the Security Administrator. Faculty and staff members may follow the prescribed methods for the resolution of work-related conflicts, including the filing of a grievance.