Document Control Table Document Title: IT Monitoring Notice Author(s) (name, job title and Division): Ruth Robertson, Deputy Director, Governance and Compliance Division Version Number: Version 4 Document Status: Approved Date Approved: 29th September 2013 Approved By: Chief Operating Officer Effective Date: 29th September 2013 Date of Next Review: July 2014 Superseded Version: Version 3 - September 2012 Document History Version Date Author Notes on Revisions Version 1 Approved Senate 13_06_2007 Corporate Compliance Unit with Information Services Substantive review and updates relating to software asset management. Version 3 September 2012 Information Rights Manager- Governance and Compliance Division Addition of new section concerning content filtering as at section 3. Version 4 Approved COO 29_09_13 Deputy Director, Governance & Compliance Division with input from IT Services, Campus Services and the Students Union Amendment to section 3 re RESLAN IT Monitoring Notices The University is required by law to to the attention of all users the following notices. (1) Regulation of Investigatory Powers Act 2000 As required by legislation, draws to the attention of all users of the University's Data and Telephones Networks the fact that their communications may be intercepted as permitted by legislation. The legislation (including the Lawful Business Practice Regulations) provides that interceptions are authorised for: monitoring or recording communications: - to establish the existence of facts, to ascertain compliance with regulatory or self-regulatory practices or procedures or to ascertain or demonstrate standards which are or ought to be achieved (quality control and training); - in the interests of national security (in which case only certain specified public officials may make the interception); - to prevent or detect crime; - to investigate or detect unauthorised use of telecommunication systems
or; - to secure, or as an inherent part of, effective system operation; monitoring received communications to determine whether they are business or personal communications; monitoring communications made to anonymous telephone helplines. The University does not need to gain consent before intercepting for these purposes although we need to inform staff and students that interceptions may take place. (2) Data Protection Act 1998 - Monitoring IT Services hold user registration data and various information on the use of the University's computer systems and network; this includes log-in and log-out times, printing logs, World Wide Web cache logs and network traffic logging. While normally only used for resolving operational problems, these logs will be analysed (under paragraphs 7 and 8 of the University's IT Regulations) down to the individual user where a breach of the Regulations or other University rules is suspected. The information will also be used to communicate with individuals to alert them to malfunctions within the Cardiff University IT facilities or to request action to correct the malfunctions which may be putting the normal operation of the IT facilities in jeopardy. The University may also deploy the use of manual or automatic searches in order to ascertain compliance with software licensing as well as terms and conditions relating to software usage. This may entail a search of all software programs installed on University IT equipment in both the physical and virtual environment. This data may be used for investigation of breaches of the University IT Regulations in addition to management of the University’s IT facilities. In addition, statistical analysis may take place to provide management information on computer laboratory, software, printing, cache, network and general computer usage for the purposes of management of the University’s IT facilities. (3) Web Content Filtering Cardiff University filters web content into the University as it passes through the University firewalls for the purpose of protecting the reputation of the University and ensuring that the acceptable use policy of our network provider (JANET) is safeguarded. Content classified as "Adult and Pornographic” will be restricted as follows, in order to safeguard academic freedom. Open Access or Classroom Computers Due to their open plan 'communal' nature, there is potential for offence to be caused by accidental viewing of material that is being accessed by others in these venues. Access to websites identified as containing adult or pornographic material will be blocked from these communal spaces. Non-Open Access or Classroom PC's (e.g. Staff Office computers)