🚀 go-pugleaf

jc@raven.bu.edu (James Cameron) writes:
[...]
>[...here's the ethics policy...]
> 
>     Boston University Information Technology                          ethics
> 
>     Conditions of Use and Policy on Computing Ethics          March 26, 1990
[...]

In the name of protecting privacy, the policy attacks privacy. It says
the University has the power to "without notice, ... inspect ... any data
[or] file"

It imposes speech restricts that would be ridiculed if applied to the
campus as a whole. It says the user may not "mak[e] accessible
offensive [or] annoying material"

It is incomplete, saying that that required behavior "is not
limited to [] the following: [...]"

It is circular. It prohibits users from misusing computer resources by
"misusing system resources".

It is ephemeral, saying that the University has the power "amend these
Conditions and Policies at any time without prior notice."


Imagine this policy generalized to the University as a whole:

* The University has the power to, without notice, inspect any assigned
office space or dorm room.

* Members of the University community may not distribute or make
accessible offensive or annoying material.

* Members of the University community may be punished for infractions
against rules that are not listed here.

* Members of the University community must not "misuse University
property", where "misusing University property" is defined as misusing
University properity.

* The University has the power "amend these Conditions and Policies at
any time without prior notice."
-- 
Carl Kadie -- kadie@eff.org or kadie@cs.uiuc.edu -- But I speak for myself.

In article <JC.91May24115354@raven.bu.edu>, jc@raven.bu.edu (James Cameron) writes:
>      Boston University Information Technology                          ethics
>      Conditions of Use and Policy on Computing Ethics          March 26, 1990
>  
>                                 CONDITIONS OF USE
>      To protect  the integrity of  the University's computing  facilities and
>      the users thereof against unauthorized or  improper use of those facili-
>      ties, Boston University reserves the right, without notice, to: limit or
>      restrict any individual's use, and to inspect, copy, remove or otherwise
>      alter any data, file, or system resource which may undermine the author-
>      ized use of any computing facility.  Boston University also reserves the

 And just how does BU intend to determine if a file "may undermine the
authorized use of any computing facility"???? Great line but it sure
sounds like this is defending the right for some potential scumbag
sysadmin to poke around as he or she pleases - if anyone tried to
set up a rule like this here at Arizona I would expect that even the
faculty would choke on it (but I could be wrong).

>      right periodically to check any system and any other rights necessary to
>      protect its computing  facilities.    The University disclaims responsi-
>      bility for  loss of data or  interference with files resulting  from its
>      efforts to maintain the privacy and  security of those computing facili-

 This is truly revolting in my opinion. Why don't they just say "we can do
any damn thing we like and you can't say anything!" ?

>                             POLICY ON COMPUTING ETHICS
>      4.    You must not access, alter, copy, move or remove information, pro-
>      prietary software or other files (including programs, members of subrou-
>      tine libraries,  data and electronic mail)   without prior authorization
>      from the appropriate University data trustee,  security officer or other

 Huh? You can't remove email without permission? From a "University Data
Trustee" no less? I can only assume that this means others programs and
email right?

>      5.   You must not use any computing facility irresponsibly or needlessly
>      affect the work of others.   This includes transmitting or making acces-
>      sible offensive,  annoying or harassing material;  intentionally,  reck-

 Ah  - now here is where I have been having a problem with most of what I've
read in this group of late, with respect to this issue. Would one of you
care to define what is and what is not "offensive" or "harrassment" or
even better still "annoying" - since when does someone lose his right to
be annoying because he has computer access? Geezuz..... Seems to me this
all reduces to the "I know porn when I see it" argument - rather than
be explicit about what can or cannot be said or done (because that is too
risky!) some sysadmin is going to be given the power to make decisions
about what is harrassment or what is offensive and in effect, this technical
employee will be given the right to influence students - he will be taking
an academic role for which he is most likely not qualified and certainly
wasn't hired to do.

>      6.   You are  encouraged to report any violation of  these guidelines by
>      another individual and  any information relating to a flaw  in or bypass

 Maybe it is just me but I think that there are sections of this "policy" that 
simply reek to high heaven. This whole thing seems to set up an environment
where suspicion is rampant and where people are actually encouraged to
undermine other students/faculty etc. This does make sense in cases of
sabotage and theft and so on - but to tie "net-behavior" into this is
absurd in my opinion...
 
> 					-- James Cameron  (jc@raven.bu.edu)


				gln

In article <1545@caslon.cs.arizona.edu> gln@cs.arizona.edu (GaRY NEweLl) writes:
> Ah  - now here is where I have been having a problem with most of what I've
>read in this group of late, with respect to this issue. Would one of you
>care to define what is and what is not "offensive" or "harrassment" or
>even better still "annoying" - since when does someone lose his right to
>be annoying because he has computer access? Geezuz..... Seems to me this
>all reduces to the "I know porn when I see it" argument - rather than
>be explicit about what can or cannot be said or done (because that is too
>risky!) some sysadmin is going to be given the power to make decisions
>about what is harrassment or what is offensive and in effect, this technical
>employee will be given the right to influence students - he will be taking
>an academic role for which he is most likely not qualified and certainly
>wasn't hired to do.
>
I think the point of having a policy is to define the computing
environment at a particular site. We can't be judging what is a
"restrictive" or "wide-open" environment in this group because of the
wide variety of member site environments. If my user community agrees
to operate in a "restrictive" environment, no one in this group is in
a position to tell me that my regulations are not correct. It really
doesn't matter whether the site is a university, company or government
agency. If the users agree to operate under a particular site's rules,
what does it matter to someone outside of the net?
The existence of a policy statement allows a site to protect its user
environment from within the site and from outside of the site.
I suspect that if you were the victim of some form of "harassment" (not
just confined to email,i.e, someone changes data in your dirs or deletes
a file from your dir) and the offending party when confronted says "Kiss
off" that your opinion would change slightly. There is a famous quote,
"A conservative is a liberal who was mugged." A well thought out policy
statement should PROTECT the user rights by defining their
RESPONSIBILITIES. 
As for the last sentence, I can't resist. I wasn't aware that "technical
employees" had the right to "influence student", etc. Jeez, we better
run out and tell other staff people such as librarians, athletic coaches,
clergy, lab techs, dining hall staff that they're not qualified to 
influence students. :-)
As far as universities go, please remember that students are NOT the
only users of university computer systems. 

>>      6.   You are  encouraged to report any violation of  these guidelines by
>>      another individual and  any information relating to a flaw  in or bypass
>
> Maybe it is just me but I think that there are sections of this "policy" that 
>simply reek to high heaven. This whole thing seems to set up an environment
>where suspicion is rampant and where people are actually encouraged to
>undermine other students/faculty etc. This does make sense in cases of
>sabotage and theft and so on - but to tie "net-behavior" into this is
>absurd in my opinion...
> 
"Net-behavior" most certainly needs to be addressed. A internet site in
AZ could be subject to "sabotage and theft" from a site anywhere in the
world. An environment where "suspicion is rampant" is created when the
"creators" of the environment act in that way. The better approach is
to educate the user community that responsible behavior is critical to
a productive environment.
Point 6 really is no different than someone saying " you should report
a murder being committed". I don't think the intent is to create a
community of spies but to ensure that an injustice is handled properly.
Again, if you as an educator take the "Big Brother" approach, then you
will foster a suspicious environment. On the other hand, if you take the
approach of teaching responsibity, you create a better environment in
the long run. 

	-Randy Marchany
	VA Tech Computing Center
	Blacksburg, VA

"my opinions are mine and mine alone"
>> 					-- James Cameron  (jc@raven.bu.edu)
>
>
>				gln

In article <1803@vtserf.cc.vt.edu>, marchany@vtserf.cc.vt.edu (Randy Marchany) writes:
> In article <1545@caslon.cs.arizona.edu> gln@cs.arizona.edu (GaRY NEweLl) writes:
> > Ah  - now here is where I have been having a problem with most of what I've
> >read in this group of late, with respect to this issue. Would one of you
> >care to define what is and what is not "offensive" or "harrassment" or
> >even better still "annoying" - since when does someone lose his right to
> >be annoying because he has computer access? Geezuz..... Seems to me this
> >all reduces to the "I know porn when I see it" argument - rather than

> I think the point of having a policy is to define the computing
> environment at a particular site. We can't be judging what is a
> "restrictive" or "wide-open" environment in this group because of the
> wide variety of member site environments. If my user community agrees
> to operate in a "restrictive" environment, no one in this group is in
> a position to tell me that my regulations are not correct. It really

I don't buy this for a minute. If you are talking about restricting a
site due to the nature of their work and so forth, then I understand
your point - otherwise I do not see how it relates to you or anyone else
dictating what is "annoying" behavior and making it punishable by 
restricting access - it seems pretty clear to me that one can easily
say - "that is a restrictive organization".

> doesn't matter whether the site is a university, company or government
> agency. If the users agree to operate under a particular site's rules,

Of course it matters - it matters very much. Agreement (a poor choice of
words when one considers that individuals who do not agree must sign on
in order to gain access to the resources - there is no choice involved
what-so-ever) to poorly defined regulations does not give a sysadmin the
right to abuse an individual's rights.  This is particularly true in an
academic setting where, in my opinion, a sysadmin has absolutely *no* 
authority to discipline, or endager the academic standing of any student.
he/she fills a service role (albeit an important one) in the form of
a technical position and is simply not qualified to do more than advise
and inform others who can/should make the judgements (and be willing to
deal with the ramifications of course).

> The existence of a policy statement allows a site to protect its user
> environment from within the site and from outside of the site.

 Again, statements such as "Thou shall not annoy anyone" or "we can
look at any file or piece of email correspondence anytime we feel like
it" simply step beyond the realm of reasonable policies, in my opinion.
This may not hold for some govt sites or private organizations, but
it certainly should at any institution of higher education.

> I suspect that if you were the victim of some form of "harassment" (not
> just confined to email,i.e, someone changes data in your dirs or deletes
> a file from your dir) and the offending party when confronted says "Kiss
> off" that your opinion would change slightly. There is a famous quote,

 First, I would never support the theory that one creates and enforces
laws based on one's supposed personal response as a hypothetical
victim. Second, I've received my fair share of what I would call
harrassing msgs. and have had students try to break into my account
and so on (I should add that I have also sent private correspondence in
the form of electronic mail to others which they might have viewed
as harrassment - certainly annoying) .  Also, I am talking about e-mail
not truly harmful actions which can be clearly defined and regulated (such
as your data-changing and file-deletion examples above) - there is
I believe, a difference.
 
> "A conservative is a liberal who was mugged." A well thought out policy
> statement should PROTECT the user rights by defining their
> RESPONSIBILITIES. 

 True - and the policy that I responded to was far from well thought out.
It was an attempt (again in *my* opinion) to cover all of the bases by
assuming broad and general authority to those in charge of the system and
by completely eliminating the rights of users including the right
to privacy and free speech. You can protect a user's files and so forth
without going anywhere near as far as this policy went.

> As for the last sentence, I can't resist. I wasn't aware that "technical
> employees" had the right to "influence student", etc. Jeez, we better
> run out and tell other staff people such as librarians, athletic coaches,
> clergy, lab techs, dining hall staff that they're not qualified to 
> influence students. :-)

 Influence their careers in a negative way - I should have been more clear.
For example, you are hired to keep a system up and running, manage 
equipment purchases perhaps, and so on - you are *not* hired to play judge
and jury over what I would classify as academic issues nor are you
qualified to take actions which could have a negative effect on a student
unless ordered to carry out anothers decision (say a dept. chair) - so
yes of course you can inform the proper individuals that a problem exists,
and yes you can then go ahead and carry out the decision of the dept.
chair or dept. faculty committee or whatever, but you (not you personally
of course - just a sysadmin in general) should have no right, IMHO to
determine that a problem exists and then decide on the penalty that will
be paid.

> As far as universities go, please remember that students are NOT the
> only users of university computer systems. 

 But they are the only ones whom I am interested in arguing for at this
time. Perhaps in a couple of years I'll join you for the faculty version.
 :-)

> "Net-behavior" most certainly needs to be addressed. A internet site in
> AZ could be subject to "sabotage and theft" from a site anywhere in the
> world. An environment where "suspicion is rampant" is created when the
> "creators" of the environment act in that way. The better approach is
> to educate the user community that responsible behavior is critical to
> a productive environment.

 Again - this is not what I mean by net-behavior - I am still referring to
the attempt to legislate what is harrassing or better yet what is
offensive or  (my favorite) annoying - this has little or nothing to do
with sabotage and I see no need to include it in any policy designed
to combat sabotage and theft - the policy did however.

> Point 6 really is no different than someone saying " you should report
> a murder being committed". I don't think the intent is to create a
> community of spies but to ensure that an injustice is handled properly.

NO - when applied to netnews or mail it says "if you are a humorless drip
and someone says something that you do not like, then turn him in to
the local sysadmin for punsihment and justice". Here at Arizona truly
damaging activity is pretty clearly spelled out (sabotage to others files
and so on as well as theft of course) and a similar - "if you see someone
ripping us off - please tell us" approach. However, this same aggressive
approach is not the norm (IMHO) with respect to issues of expressing one's
opinions on the net or through e-mail. I still see no reason to tie the two
together.

> Again, if you as an educator take the "Big Brother" approach, then you
> will foster a suspicious environment. On the other hand, if you take the
> approach of teaching responsibity, you create a better environment in
> the long run. 

Very true - did you find the policy to be designed to teach responsibility?
It sure looked like Big Brother had a hand in drafting it to me.....

> 	-Randy Marchany
				gln

In <1803@vtserf.cc.vt.edu> marchany@vtserf.cc.vt.edu (Randy Marchany) writes:

[...]
>"A conservative is a liberal who was mugged." 
[...]

And a liberal is a conservative who has been arrested.

What is needed is balance. The computer policy at BU and many other
schools is very one-sided. It reminds me of the general student
policies that were in effect at many universities until the late '60s
and early '70s.

In 1967, the Joint Statement on Rights and Freedoms of Students was
adopted by many university-related organizations (like the American
Association of University Professors). Many (most?) universities then
incorporated the principles of the Statement in to their student code.
Here at the U. of I., for example, the principles were recognized in
1971.

The Statement asserts (in contradiction to the BU computer policy)
that Students have free expression rights, privacy rights, and due
process rights. It also asserts that students have the right to
participate in the formulation and application of University policy.
If you are at an academic site, please review the Statement (and your
own Univeristy's general policies) before setting down a computer
policy.

The Statement is available via anonymous ftp from eff.org as file
academic/student.freedoms. The Computers and Academic Freedom archive
also includes a history of general student policy at the U. of I. from
1904 to present. It is as file academic/reg2rights.

- Carl
--
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign