Article View: comp.security.misc
Article #438Re: Security Policy
From: Carl M. Kadie
Date: Fri, 21 Aug 1992 10:56
Date: Fri, 21 Aug 1992 10:56
278 lines
10856 bytes
10856 bytes
=============== ftp.eff.org:pub/academic/faq/email.policies ===============
q: Do any universities treat email and computer files as private?
a: Yes, many universities treat email and computer files as private.
Here are excerpts from their policies or policy drafts.
# University of Illinois at Urbana-Champaign
Network and system administrators are expected to treat the contents
of electronic files as private and confidential. Any inspection of
electronic files, and any action based upon such inspection, will be
governed by all applicable U. S. and Illinois laws and by University
policies.
# Ohio State University - Computer and Information Science Department
It is recognized that computer files are a new form of property
separable from the media with which they are recorded, and that close
analogies can be found between the uses of computer files and of
various other forms of physical property. The Department shall use
these analogies in making decisions about the appropriate use of
computer files and the protection of their privacy, extending as
nearly as possible exactly the same protection to computer files as is
traditionally extended to the analogous physical property.
The spirit of this policy is that the file space provided by the
University to individuals has exactly the same status as analogous,
more tangible facilities also provided by the University. Such
facilities as private library carrels, dormitory rooms, and gym
lockers are technically owned by OSU, and may be entered only for
''administrative'' purposes such as building maintenance. Similarly,
the computers and computer files of students, staff, and faculty
members, being electronic extensions of their personal work areas, may
not be inspected, copied, changed, or otherwise tampered with without
the permission of the owner, except for purposes relevant to the
administration of the computer system. Notice that copying (i.e.,
stealing or ''pirating'') computer software is also prohibited under
this policy.
# Dalhousie University
Nothing in this Guide diminishes the responsibility of system
administrators of computing services to take remedial action in the
case of possible abuse of computing privileges. To this end, the
system administrators with the approval of the President and with due
regard for the right of privacy of users and the confidentiality of
their data, have the right, to suspend or modify computer access
privileges, examine files, passwords, accounting information,
printouts, tapes, and any other material which may aid in an
investigation of possible abuse. Whenever possible, the cooperation
and agreement of the user will be sought in advance. Users are
expected to cooperate in such investigations when requested. Failure
to do so may be grounds for cancellation of computer access
privileges.
# Draft - James Madison University
c. Students, faculty and staff who use the computer have
the right to privacy and security of their computer
programs and data. Computer users should not tamper
with files or information that belong to other users or
to the operating system.
# Draft - Michigan State University College of Engineering
3.2 Staff should at all times respect the privacy of user files,
mail, and printer listings (but see Staff Rights below).
# University of California at Berkeley Open Computing Facility
7.6. Privacy
Individuals' rights of privacy shall not be violated without
reasonable cause.
# University of Michigan
The University characterizes as unethical and unacceptable, and just
cause for taking disciplinary action up to and including
non-reappointment, discharge, dismissal, and/or legal action, any
activity through which an individual:
[...]
(e) without authorization invades the privacy of individuals or
entities that are creators, authors, users, or subjects of the
information resources,
This policy is applicable to any member of the University community,
whether at the University or elsewhere, and refers to all information
resources whether individually controlled, or shared, stand alone or
networked.
# New Mexico State University
All computer users have two basic rights -- privacy
and a fair share of resources.
# University of Pittsburgh
Every member of the University of Pittsburgh has two basic rights
regarding computing -- privacy and a fair share of resources.
# Washington University Center For Engineering Computing
PRIVACY
All user accounts are considered the private domain of the user who
owns them. All users should expect that, regardless of the
protections set on their files, they will not be read by others.
System Management personnel will only view users' files under
exceptional circumstances.
# Draft - University of New Mexico
UNM recognizes that files and mail messages are confidential.
Appropriate UNM employees may access computer users' files during
normal maintenance and will report unlawful activities to the proper
authorities.
# Purdue University Computer Center (Staff regulations)
* Don't inspect private user files and mailboxes unless the
administration of a Computing Center system requires it.
# Kansas State University
The third category is access to another user's account and/or files or
electronic mail for the purpose of invading an individual's privacy.
This is considered breach of privacy and is prosecutable under Kansas
law.
ANNOTATED REFERENCES
(All these documents are available on-line. Access information follows.)
=================
faq/email.privacy
=================
q: Can (should) my university monitor my email?
=================
policies/uiuc.edu
=================
This is the University of Illinois's Interim E-Mail and Computer File
Privacy Policy. It says that "network and system administrators are
expected to treat the contents of electronic files as private and
confidential." and "Any inspection of electronic files, and any action
based upon such inspection, will be governed by all applicable U. S.
and Illinois laws and by University policies."
=================
policies/cis.ohio-state.edu
=================
The appropriate use, mail (and Netnews), disk, and printer
policy for the computers labs of OSU's Computer and Information
Science Department (Critiqued)
=================
policies/cis.ohio-state.edu.critique
=================
Critique for the appropriate use, mail (and Netnews), disk, and
printer policy for the computers labs of OSU's Computer and
Information Science Department
Summary: 'The policies are better than most. The privacy policy is
especially good. In my opinion, the weakest policy covers email and
netnews [and due process].
It says that undergrads are prohibited from posting or emailing off
campus. This rule is enforced very selectively. To quote an OSU sys
admin: "it's just something that's usable as a weapon against the
occasional real jerk." (I think such selective enforcement is
despicable.)'
=================
policies/dal.ca
=================
Guide to responsible computing at Dalhousie University (in Halifax,
NS, Canada)
=================
widener/jmadison.u.policy
=================
[No annotation available.]
=================
widener/mich.st.u.policy
=================
[No annotation available.]
=================
statements/ocf.constitution
=================
This is the Constitution of Berkeley's Open Computing Facility, an
organization that democratically manages computer resources for
thousands of users.
=================
policies/umich.edu
=================
POLICY: PROPER USE OF INFORMATION RESOURCES, INFORMATION TECHNOLOGY,
AND NETWORKS AT THE UNIVERSITY OF MICHIGAN
=================
widener/new.mex.st.u.policy
=================
[No annotation available.]
=================
widener/u.pitt.policy
=================
[No annotation available.]
=================
widener/wash.u.engr.policy
=================
[No annotation available.]
=================
widener/u.new.mexico.policy
=================
[No annotation available.]
=================
policies/staff.cc.purdue.edu
=================
Staff policy for Purdue University's Computing Center
=================
widener/kansas.state.policy
=================
[No annotation available.]
=================
=================
These document(s) are available by anonymous ftp (the preferred
method) and by email. To get the file(s) via ftp, do an anonymous ftp
to ftp.eff.org (192.88.144.4), and get file(s):
pub/academic/faq/email.privacy
pub/academic/policies/uiuc.edu
pub/academic/policies/cis.ohio-state.edu
pub/academic/policies/cis.ohio-state.edu.critique
pub/academic/policies/dal.ca
pub/academic/widener/jmadison.u.policy
pub/academic/widener/mich.st.u.policy
pub/academic/statements/ocf.constitution
pub/academic/policies/umich.edu
pub/academic/widener/new.mex.st.u.policy
pub/academic/widener/u.pitt.policy
pub/academic/widener/wash.u.engr.policy
pub/academic/widener/u.new.mexico.policy
pub/academic/policies/staff.cc.purdue.edu
pub/academic/widener/kansas.state.policy
To get the file(s) by email, send email to archive-server@eff.org.
Include the line(s) (be sure to include the space before the file
name):
send acad-freedom/faq email.privacy
send acad-freedom/policies uiuc.edu
send acad-freedom/policies cis.ohio-state.edu
send acad-freedom/policies cis.ohio-state.edu.critique
send acad-freedom/policies dal.ca
send acad-freedom/widener jmadison.u.policy
send acad-freedom/widener mich.st.u.policy
send acad-freedom/statements ocf.constitution
send acad-freedom/policies umich.edu
send acad-freedom/widener new.mex.st.u.policy
send acad-freedom/widener u.pitt.policy
send acad-freedom/widener wash.u.engr.policy
send acad-freedom/widener u.new.mexico.policy
send acad-freedom/policies staff.cc.purdue.edu
send acad-freedom/widener kansas.state.policy
--
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign
Technical Details
Message-ID:
<1992Aug21.105613.2358@m.cs.uiuc.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!ux1.cso.uiuc.edu!m.cs.uiuc.edu!herodotus.cs.uiuc.edu!kadieReferences:
<3748@wzv.win.tue.nl> <BtB4vu.JDB@solbourne.com> <66496@hydra.gatech.EDU> <1992Aug21.082446.29014@nntp.nta.no>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!ux1.cso.uiuc.edu!m.cs.uiuc.edu!herodotus.cs.uiuc.edu!kadie From: kadie@herodotus.cs.uiuc.edu (Carl M. Kadie) Subject: Re: Security Policy Message-ID: <1992Aug21.105613.2358@m.cs.uiuc.edu> Sender: news@m.cs.uiuc.edu (News Database (admin-Mike Schwager)) Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL References: <3748@wzv.win.tue.nl> <BtB4vu.JDB@solbourne.com> <66496@hydra.gatech.EDU> <1992Aug21.082446.29014@nntp.nta.no> Date: Fri, 21 Aug 1992 10:56:13 GMT Lines: 278