From: kadie@eff.org (Carl M. Kadie)
Subject: Computers and Academic Freedom News 02.59 2/2 (Digest)
Originator: kadie@eff.org
Organization: The Electronic Frontier Foundation
Date: Fri, 11 Dec 1992 21:03:36 GMT

Computers and Academic Freedom News
Vol. 02, No. 59


----------------------------------------------------------------------
From caf-talk Caf Nov 29 16:25:25 1992
Newsgroups: alt.comp.acad-freedom.talk
From: kadie@cs.uiuc.edu (Carl M. Kadie)
Subject: Article 10--Louisiana Tech University Computer Policies
Date: Sun, 29 Nov 1992 09:25:12 GMT


[To access this item via gopher, try typing:
    gopher -p "1/Other Gopher and Information Servers/all" gopher.tc.umn.edu 70
Then choose:
    Louisiana Tech University/
    Policies/
- Carl]

                      Louisiana Tech University

                           Computer Policies

The computing facilities at Louisiana Tech are provided for the use of 
Louisiana Tech students, faculty and staff in support of the programs of the
University.  All students, faculty and staff are responsible for seeing that
these computing facilities are used in an effective, efficient, ethical and
lawful manner. 

The following policies relate to their use.

1.
  
Computer facilities and accounts are owned by the University and are to be 
used for university-related activities only.  All access to central computer 
systems, including the issuing of passwords, must be approved through the
Computer Center.  All access to departmental computer systems must be approved
by the department head or an authorized representative.

2.
  
Computer equipment and accounts are to be used only for the purpose for which 
they are assigned and are not to be used for commercial purposes or
non-university related business.

3.
  
An account assigned to an individual, by the Computer Center or a department, 
must not be used by others without explicit permission from the instructor 
or administrator requesting the account and by the Computer Center or 
department assigning the account.  The individual is responsible for the
proper use of the account, including proper password protection.

4.
  
Programs and files are confidential unless they have explicitly been made 
available to other authorized individuals.  Computer Center personnel may
access others' files when necessary for the maintenance of central computer
systems.  When performing maintenance, every effort is made to insure the
privacy of a user's files.  However, if violations are discovered, they will
be reported immediately to the appropriate Vice President.

5.
  
Electronic communications facilities (such as MAIL) are for university-related 
activities only.  Fraudulent, harassing or obscene messages and/or other
materials are not to be sent or stored.

6.
  
No one may deliberately attempt to degrade the performance of a computer
system or to deprive authorized personnel of resources or access to any 
university computer system.

7.
  
Loopholes in computer security systems or knowledge of a special password must 
not be used to damage computer systems, obtain extra resources, take resources 
from another user, gain access to systems or use systems for which proper
authorization has not been given.

8.
  
Computer software protected by copyright is not to be copied from, into, or 
by using campus computing facilities, except as permitted by law or by the 
contract with the owner of the copyright.  This means that such computer and 
microcomputer software may only be copied in order to make back-up copies, 
if permitted by the copyright owner.  The number of copies and distribution 
of the copies may not be done in such as way that the number of simultaneous 
users in a department exceeds the number of original copies purchased by that 
department.

An individual's computer use privileges may be suspended immediately upon the 
discovery of a possible violation of these policies.  Such suspected 
violations will be confidentially reported to the appropriate faculty,
supervisors, department heads, Computer Center staff, and Vice Presidents.

The appropriate administrative staff or supervising department head will judge 
an offense as either major or minor.  A first minor offense will normally be 
dealt with by the Computer Center administrative staff or supervising 
department head after consultation with the instructor or administrator 
requesting the account.  Additional offenses will be regarded as major
offenses.  Appeals relating to minor offenses may be made to the supervising
Vice Presidents. Major offenses will be dealt with by the supervising
Vice Presidents.

Violations of the policies will be dealt with in the same manner as violations 
of other university policies and may result in disciplinary review.  In such 
a review, the full range of disciplinary sanctions is available including the 
loss of computer use privileges, dismissal form the University, and legal
action. 

Violations of some of the above policies may constitute a criminal offense. 
Individuals using campus computer facilities should be familiar with the 
Louisiana Revised Statutes 14:73, Computer Related Crimes.


 




------------------------------

From caf-talk Caf Nov 29 16:25:56 1992
Newsgroups: alt.comp.acad-freedom.talk
From: kadie@cs.uiuc.edu (Carl M. Kadie)
Subject: Article 11--University of North Texas Computer Policy
Date: Sun, 29 Nov 1992 09:25:42 GMT


[Reference: gopher -p "1/UNT Procedures & Policies" gopher.unt.edu]

               COMPUTER RESOURCES SECURITY POLICY

 1.  PURPOSE:

     The purpose of this document is to:

        * Establish policy for the protection of University
          computer resources;

        * Assign general responsibility for establishing,
          implementing, and administering security policies,
          standards, and procedures; and

        * Establish the associated sanctions for loss,
          corruption, misuse and/or unauthorized disclosure of
          University computer resources.


 2.  SCOPE:

     This policy applies to:

        * centrally administered computer systems, departmental
          computer systems, and personal computers, including all
          means of accessing the preceding;

        * all computerized institutional data regardless of the
          office in which it resides or the format in which it is
          used;

        * any and all users of University computer resources; and

        * all aspects of computer resource security including,
          but not limited to, accidental or unauthorized
          destruction, disclosure, misuse, or modification of or
          access to University computer resources.

     In addition to or in lieu of the above:

        * Use of computer resources which are entrusted to the
          University by other organizations (e.g., foundations
          and government agencies) is governed by the terms and
          conditions agreed upon with those organizations.

        * Use of copyrighted data, software, and materials is
          governed by the terms and conditions of the copyright.

        * Use of external resources accessed via University
          computer resources is subject to the guidelines of
          those external resources.        * All use of University computer resources is subject to
          federal and state regulations and laws, including, but
          not limited to:

             * the Texas Computer Crimes Statute (Section 1,
               Title 7, Chapter 33 of the Texas Penal Code);
             * Federal Copyright Law, Title 17, Section 117; and
             * the Family Educational Rights and Privacy Act of
               1974.

        * Use of University computer resources is subject to all
          other applicable University policies.


 3.  DEFINITION OF TERMS:

    3.1.  Computerized institutional data - Data owned by the
          University and used to conduct University business,
          which is captured, stored, maintained, and/or accessed
          using University computer systems, including all forms
          of machine-readable data produced using University
          computer systems.

    3.2.  Computer hardware assets - Any and all equipment
          involved in the operation of a computer system,
          including, but not limited to, computers, data
          communications equipment, workstations, and various
          peripherals such as printers and plotters.

    3.3.  Computer software assets - Any and all programs
          involved in the operation of a computer system,
          including, but not limited to, operating systems, data
          communications software, data base management systems,
          and applications software.

    3.4.  University computer resources - any and all
          computerized institutional data, computer hardware
          assets, and computer software assets owned or licensed
          by the University.

    3.5.  Centrally administered computer system - a computer
          system, including the supporting data communications
          network, used for capturing, storing, maintaining, and
          accessing computerized institutional data under the
          direct management of the Computing Center.  This
          includes campus-wide data communications networks such
          as the broadband and fiber optics networks which span
          departmental computer systems.
    3.6.  Departmental computer system - any computer system,
          including the supporting data communications network,
          not under the direct management of the Computing Center
          which contains multiple workstations connected by some
          type of data communications network, including, but not
          limited to, departmental minicomputers and the common
          resources of local area networks (LANs), such as file,
          database, and print servers, but not including personal
          computers which can also be used as standalone
          workstations.

    3.7.  Personal computer - a microcomputer which may be used
          as a standalone device and/or a workstation on a
          network.

    3.8.  Computer installation - the department responsible for
          the operation of a computer system, that is, a
          University office that maintains computer hardware,
          software, and services for capturing, storing,
          maintaining, and accessing computerized institutional
          data.  The Computing Center is the computer
          installation for centrally administered computer
          systems.  The department which owns a departmental
          computer system is that system's computer installation.
          
    3.9.  Workstation - any device capable of receiving data from
          or transmitting data to a computer system.

    3.10. Administrative application - a specialized automated
          system used by an office/ department for administrative
          purposes.  It does not include software tools for
          microcomputers such as word processing, data base, and
          spreadsheet software, but does include specialized
          administrative applications developed using these tools
          to capture, store, maintain, and/or access computerized
          institutional data.

    3.11. Data/application steward - The individual(s)
          responsible for establishing the rights to access
          specific data elements, a file and/or application.  In
          this document data steward applies to stewardship of
          data elements and/or files and application steward
          applies to stewardship of applications.

    3.12. Data custodian - A person who has de facto control over
          access to computerized institutional data regardless of
          medium.  In other words, a person who has a copy of a
          report is a custodian of the data on that report.  A
          person who has a copy of data on a diskette is
          custodian of the data on that diskette.
    3.13. Computer resources guardian - The person charged with
          enforcement of security policies and procedures for the
          computer installation.

    3.14. Computer resources security committee - The committee
          assigned the responsibility to review policy
          recommendations for computer resources security for
          University computer installations.

    3.14. Computer resources security coordinator - A person in
          the Computing Center (the Associate Vice President for
          Computing or his/her designee) assigned the
          responsibility for the formulation of computer security
          procedures for the centrally administered computer
          system and for the coordination of procedures for the
          departmental computer systems and personal computers.


 4.  GENERAL POLICY STATEMENTS:

    4.1.  University computer resources -- general:

            *  University computer resources shall be used solely
               for legitimate University-related purposes.

            *  University computer resources may not be
               transported without appropriate authorization.

            *  University security measures must take into
               account local, state, and federal reporting and
               auditing requirements, as well as provisions to
               eliminate, as far as is feasible, the incidence of
               theft, fraud, destruction, or other abuses of the
               University computer resources.

            *  Violations or suspected violations of computer
               measures or controls must be reported at once to
               management and/or those responsible for computer
               security.

    4.2.  Access to University computer resources:

            *  Access to University computer resources is
               considered a privilege granted by the University. 
               Users of University computer resources must not
               abuse or allow others to abuse their access to
               University computer resources.

            *  Access to the University computer resource of any
               computer installation must be approved by the
               management of that computer installation.

            *  All individuals authorized to use University
               computer resources are responsible for all usage
               of their logon access and should keep their
               passwords confidential to protect University
               computer resources.

            *  Users may not access University computer resources
               without appropriate authorization and then only
               for the purposes for which their access is
               authorized.

            *  Any attempt to access or to assist in the access
               of University computer resources via an
               unauthorized means is a violation of this policy
               and may subject the perpetrator(s) to sanctions
               hereunder.

    4.3.  Computerized institutional data:

            *  All computerized institutional data is considered
               to be an asset of the University and shall be
               protected from loss, corruption, misuse, and
               inappropriate disclosure.

            *  Certain computerized institutional data, by law,
               is confidential and may not be released.  Other
               computerized institutional data, by University
               policy, is confidential and likewise may not be
               released.  Users of University computer resources
               are responsible for the protection, privacy and
               control of all data, regardless of the data
               storage medium.

    4.4.  Copying of computer software, data, and manuals:

            *  Computer software, computer data, and/or software
               manuals may not be copied or transmitted
               electronically without appropriate prior consent.

            *  Computer installations will take appropriate and
               reasonable steps to inhibit attempts to obtain
               unauthorized copies of computer software, computer
               data, and/or software manuals.


 5.  GENERAL RESPONSIBILITIES:

    5.1.  Information Resources Council

       a. The Information Resources Council will review and make
          recommendations to the Information Resources Steering
          Committee concerning proposed changes to this policy.       b. The Information Resources Council will have the
          authority to adopt a set of standards to implement this
          policy and to approve changes to that set of standards. 
          These standards will be subject to review by the
          Information Resources Steering Committee.

    5.2.  Standing Computer Resources Security Committee

       a. The Chairman of the Information Resources Council will
          appoint a Computer Resources Security Committee to be
          chaired by a member of and reporting to the Information
          Resources Council.  The committee membership should
          include representatives of the major areas of the
          University.  The committee membership should include as
          ex-officio members the Computer Resources Security
          Coordinator and other persons who are knowledgeable of
          the various computer hardware and software platforms
          used by the University.

       b. The Computer Resources Security Committee will:

            1. Serve as a forum for the exchange of security
               information.

            2. Promote discussion of possible computer security
               policies and procedures.

            3. Make recommendations to the Information Resources
               Council regarding security issues.

    5.3.  Computer Resources Security Coordinator

       a. The Associate Vice President for Computing or his/her
          designee will function as computer resources security
          coordinator for the University.

       b. Among the responsibilities of the Computer Resource
          Security Coordinator will be:

            1. Ensuring that adequate security procedures,
               including backup, disaster recovery, and
               contingency planning, have been formulated for the
               centrally administered computer systems.

            2. Coordinating the implementation of security
               procedures, including backup, disaster recovery,
               and contingency planning, for the departmental
               computer systems and personal computers.

            3. Establishing mechanisms for monitoring compliance
               with and violations of University computer
               resource security policies and standards. 
               Establish procedures for investigation, logging,
               and management reporting and follow-up of access
               violations.

            4. Performing periodic risk assessments and security
               audits of existing and proposed systems.

            5. Overseeing the development and maintenance of a
               comprehensive Computer Resource Security Policy
               Manual to include security procedures to implement
               University computer resource security policies and
               standards.

            6. Overseeing the development of training courses for
               training employees in University computer resource
               security policies, standards, and procedures.

    5.4.  Department Heads

       a. Department heads shall ensure that their departmental
          computer systems follow University computer security
          policies and standards.

       b. Department heads shall ensure that all employees in
          their department have access to this policy and are
          familiar with its provisions.

       c. Department heads shall ensure that employees of that
          department are trained in security measures in their
          use of University computer resources and that their
          employees abide by University computer resource
          policies and standards.

       d. Department heads will take corrective action on
          security violations within the department and will
          report serious violations to the Computer Resources
          Security Coordinator.

       e. Department heads will ensure that computer resource
          security responsibilities are included in the
          performance evaluation criteria of appropriate
          personnel, including the computer resource guardians,
          data/application stewards, and data custodians.

       f. Department heads will inform appropriate computer
          resource guardians when employees have terminated so
          that the terminated employee's access to University
          computer resources may be disabled.

       g. Department heads will identify data and/or application
          stewards and computer resource guardians for their
          departments.    5.5.  Data/Application Stewards

       a. Data/application stewards shall establish the rights to
          access specific data elements, files, and/or
          administrative applications via University computer
          resources.

       b. Data/application stewards shall ensure that the access
          rights they have designated are enforced by the
          security mechanisms of the computer system(s) on which
          the data resides.

       c. Data stewards shall establish the guidelines for
          dissemination of the data on machine- and human-
          readable forms within their purview of responsibility
          and within the context of University policy and State
          and federal regulations and laws.

    5.6.  Data Custodian

          Data custodians shall ensure that any computerized
          institutional data in their custody, whether in
          machine- or human-readable form, is disseminated and/or
          disclosed in accordance with University policy and the
          guidelines established by the data steward.

    5.7.  Computer Resource Guardians

       a. Computer resource guardians shall ensure that
          procedures are put in place for the computer
          installation to implement University computer resource
          policies and standards.

       b. Computer resource guardians shall ensure that, if
          possible, the process by which a user accesses the
          resources of their computer installation displays a
          message advising users of their responsibility to
          comply with the provisions of this policy.

       c. Computer resource guardians are responsible to enforce
          compliance with provisions of licensing agreements and
          other computer resource contracts for the computer
          installation.

    5.8.  Individual Employees/Students

       a. All individuals, whether faculty/staff employees or
          students, may be required to sign a confidentiality
          agreement upon receiving the privilege of using
          University computer resources.       b. All individuals must comply with University computer
          resource policies and standards.

       c. All individuals authorized to use University computer
          resources are responsible for all usage of their logon
          access and should keep their passwords confidential to
          protect University computer resources.

       d. All individuals who use wide-area network services
          (such as BITNET or the Internet) provided via
          University computer resources shall abide by the
          policies of those networks.

       e. All individuals shall not attempt to access University
          computer resources for which they have no
          authorization.


 6. SANCTIONS:

    6.1.  Penalties for violation of this policy range from loss
          of computer resource usage privileges to dismissal from
          the University, prosecution, and/or civil action.  Each
          case will be determined separately on its merits. 
          Referrals for legal action will be made through the
          Office of the General Counsel.

    6.2.  If the offender is a faculty member, his or her
          supervisor (usually the department chair) shall
          initially recommend to the dean and thereafter to the
          Provost the appropriate sanction.  When termination is
          recommended, the faculty member may appeal to the
          University Review Committee or to the University Tenure
          Committee, whichever is appropriate per the University
          of North Texas Faculty Handbook.

    6.3.  If the offender is a staff member, the procedures to be
          followed are those specified in the "Discipline and
          Discharge Policy" of the University of North Texas
          Personnel Policy Manual.

    6.4.  If the offender is a student, the procedures to be
          followed are those specified in the "Code of Student
          Conduct and Discipline" as printed in the University of
          North Texas Student Guidebook.  If the student in
          violation of this policy is also an employee of the
          University, sanctions may include termination of
          employment.

 




------------------------------

From caf-talk Caf Nov 29 16:26:23 1992
Newsgroups: alt.comp.acad-freedom.talk
From: kadie@cs.uiuc.edu (Carl M. Kadie)
Subject: Article 12--U. of Nebraska at Omaha - Computer Policies
Date: Sun, 29 Nov 1992 09:26:10 GMT


[reference: gopher -p "1/Policies" odin.unomaha.edu 70]

                     UNIVERSITY OF NEBRASKA AT OMAHA (UNO)

             OFFICE OF COMPUTING AND DATA COMMUNICATIONS (C & DC)

                            POLICIES AND PROCEDURES


COMPUTER AND NETWORK USE

BACKGROUND:    The University of Nebraska at Omaha has the responsibility for
               securing its computing and networking systems (both academic and
               administrative) to a reasonable and economically feasible degree
               against unauthorized access, while making the systems accessible
               for legitimate and innovative uses.  This responsibility
               includes informing persons who use the UNO computer and network
               systems of expected standards of conduct and encouraging their
               application.  It is important for the user to practice ethical
               behavior in computing activities because the user has access to
               many valuable and sensitive resources and the user's computing
               practices can adversely affect the work of other people. 
               Although most people act responsibly, the few who do not, either
               through ignorance or by intent, have the potential for
               disrupting every other user's work.  BOTTOM LINE:  For the good
               of all users, improper use and abuse of the computers and
               networks cannot be permitted.

PURPOSE:       This policy provides direction to be used in allowing or denying
               access to UNO computer or network resources.

STATEMENT:     What follows constitutes a policy of computing practice for all
               persons using the UNO computing and network system. 
               Disciplinary action for violating the policy shall be governed
               by (but not limited to) the applicable provisions of student
               handbooks, faculty and staff handbooks, personnel policy manuals
               for the University of Nebraska at Omaha and applicable sections
               of Chapters 28-1343 and 86-707, Statutes of the State of
               Nebraska.  As a minimum, persons who violate this policy will
               have their access privileges to UNO computing systems removed
               pending an evaluation of the alleged violation(s).

               1.  Computer and network system users are responsible for being
                   aware of and following the published procedures for
                   accessing UNO and other University of Nebraska computing
                   systems and networks.
      
               2.  A user must use only the computer accounts which have been
                   authorized for their use.  Users are required to identify
                   all computing work with their assigned account numbers so
                   that responsibility for the work can be determined and so
                   the user can be contacted in unusual situations, e.g., the
                   return of misplaced output.

               3.  Users are responsible for the use of their computer
                   accounts.  Users should make appropriate use of system-
                   provided protection features such as passwords and file
                   protections, and should take precautions against others
                   obtaining access to their computer resources.  Do not make
                   an account available to others for any purpose.  If
                   assistance is needed in using an account, contact the UNO
                   HELP Desk at 554-3282.

               4.  Computer accounts must be used only for the purpose for
                   which they are authorized.  For example, student, faculty
                   and staff accounts, issued for legitimate classroom or
                   office work, must not be used for private consulting and/or
                   personal financial gain.

               5.  Do not access or copy the programs, files, data or data
                   packets belonging to other persons or to the UNO office of
                   C & DC or other U of N campuses or departments without prior
                   authorization.  Do not attempt to access files for which you
                   do not have authorization.  Programs, subroutines and data
                   provided by UNO are not to be taken to other computer sites
                   without permission.  You may use software on computers only
                   if it has been legally obtained and its use does not violate
                   any license or copyright restriction.  Do not inspect,
                   modify, distribute or copy privileged data or software, or
                   attempt to do so, without proper authorization from the
                   Director, C & DC.  Do not use programs at UNO that were
                   obtained from other computer sites unless they are in the
                   public domain or authorization to use them at UNO has been
                   obtained.  (Note:  All software that is in the possession of
                   C & DC is checked for the presence of "viruses.")

               6.  No one should attempt to encroach on others' use of the
                   facilities or deprive them of resources.

               7.  Do not attempt to modify system facilities.  Do not tamper
                   with or obstruct the operation of the computer systems or
                   networks.

               8.  Do not supply, or attempt to supply, false or misleading
                   information or identification in order to access computer
                   systems or networks.

               9.  Do not attempt to subvert the restrictions associated with
                   any computer accounts.

               This policy is intended to work to the benefit of all who use
               the UNO, the UNCSN or other U of N campus or department systems
               by encouraging responsible use of scarce computer resources. 
               Additionally, this policy is intended to supplement Nebraska and
               Federal law.        

              PERSON RESPONSIBLE FOR THIS POLICY:
              Richard M. Snowden, Director of Computing and Data Communications

               DISTRIBUTION:  Users of the UNO computing and network
               facilities, all Computing and Data Communications personnel,
               Campus Security, and the C & DC Policy Book.

               EFFECTIVE DATE:  November 1, 1990

      ________________________________________________

------------------------------

End of Computers and Academic Freedom News (Digest)
************************************

-- 
Carl Kadie -- I do not represent EFF; this is just me.
 =kadie@eff.org, kadie@cs.uiuc.edu =
Newsgroups: alt.good.news