Policy for Responsible Computing
at William Paterson University
System Administrator Responsibilities
Misuse of Computing and Information
Resource Privileges
User Confidentiality and System Integrity
Judicial Process
for Cases of Alleged Misuse of Computing and Information
Resource Privileges and Penalties for
Misuse of Computing and Information Resource Privileges
. . . I wish that we lived in a golden age, where ethical behavior was assumed; where technically competent programmers respected the privacy of others; where we didn't need locks on our computers. . . .
Fears for security really do louse up the free flow of information. Science and social progress only take place in the open. The paranoia that hackers leave in their wake only stifles our work.
One of the interesting facets of Cliff Stoll's The Cuckoo's Egg is his growing awareness of the responsibilities all computer users have to each other. It is our hope that this set of Guidelines can foster that same understanding in the William Paterson University community.
It is imperative that all users of the University's computing and information resources realize how much these resources require responsible behavior from all users. Simply put, we are all responsible for the well-being of the computing, network, and information resources we use.
Colleges do try to promote the open exchange of ideas; however, an open, cooperative computing network can be vulnerable to abuse or misuse. As more and more schools, colleges, universities, businesses, government agencies, and other enterprises become attached to the world-wide computing and information networks, it is more important than ever that this University educate its students, faculty, and staff about proper ethical behavior, acceptable computing practices, and copyright and licensing issues. A modern university must also educate its students, faculty, and staff about how how computer abuse can interfere with the exchange of ideas that is integral to a modern education.
The first item in the body of this document is the Policy for Responsible Computing at the William Paterson University, under review for acceptance by the Faculty Senate and the Student Government. The remainder of this document consists of recommended guidelines for implementing this policy. If you have any questions about the policy or the guidelines, please consult with the staff in Information and Research Technology (Coach House).
In support of its mission of teaching, research, and public service, the William Paterson University provides access to computing and information resources for students, faculty, and staff, within institutional priorities and financial capabilities.
The Policy for Responsible Computing at the William Paterson University contains the governing philosophy for describing faculty, student, and staff rights and responsibilities associated with use of the University's computing resources. It spells out the general principles regarding appropriate use of equipment, software, and networks. By adopting this policy, the University recognizes that all members of the community are also bound by local, state, and federal laws relating to copyrights, security, and other statutes existing and future regarding electronic media.
All members of the University community who use the University's computing and information resources must act responsibly. These responsibilities include respect for the rights of other computing users, respect for the integrity of the physical facilities and controls, and compliance with all pertinent license and contractual agreements. It is the policy of the William Paterson University that all members of its community act in accordance with these responsibilities, relevant laws and contractual obligations, and the highest standard of ethics.
University computing facilities and accounts are to be used for the University-related activities for which they are assigned. University computing resources are not to be used for commercial purposes or non-University-related activities without written authorization from the University. In these cases, the University will require payment of appropriate fees. This policy applies equally to all University-owned or University-leased computers.
Access to the University's computing facilities is a privilege granted to University students, faculty, and staff. Access to University information resources may be granted by the stewards of that information based on the steward's judgement of the following factors: University policies, relevant laws and contractual obligations, the requestor's need to know, the information's sensitivity, and the risk of damage to or loss by the University.
The University reserves the right to limit, restrict, or extend computing privileges and access to its information resources. Data stewards--whether departments, units, faculty, students, or staff--may allow individuals other than University faculty, staff, and students access to information for which they are responsible, so long as such access does not violate any license or contractual agreement; University policy; or any relevant laws.
All users are responsible to protect systems from abuses that disrupt or threaten appropriate use of computing resources, including those at the University and those on networks to which the University's systems are connected. Access to information resources without proper authorization from the data steward, unauthorized use of University computing facilities, and intentional corruption or misuse of information resources are direct violations of the University's standards for conduct as outlined in this document, and the University Policy Manual, current edition, and the Student Handbook and may also be considered civil or criminal offenses.
ImplementationAppropriate University administrators will adopt guidelines for the implementation of this policy and regularly revise these guidelines as circumstances, including--but not limited to--changes in technology, warrant. The directors of the campus-wide computing units shall, from time to time, issue recommended guidelines to assist departments and units with this effort.
EnforcementAlleged violations of this policy shall be processed according to the judicial processes outlined in the William Paterson University Policy Manual, the Faculty and Staff Handbook, University collective bargaining agreements, and the Student Handbook. The William Paterson University treats access and use violations of computing facilities, equipment, software, information resources, networks, or privileges seriously and may also prosecute abuse under the appropriate State and Federal laws.
If you use the University's computing resources or facilities, you have the following responsibilities:
Use the University's computing facilities and information resources,
including hardware, software, networks, peripherals and computer
accounts, responsibly and appropriately, respecting the rights of
other computing users and respecting all contractual and license
agreements.
Use only those computers and computer accounts for which you have
authorization.
Use server accounts only for the purpose(s) for which they have been
issued. Use University-owned microcomputers and advanced workstations for
University-related projects only.
Be responsible for all use of your accounts and for protecting each account's
password. In other words, do not share computer accounts. If someone else
learns your password, you must change it.
Report unauthorized use of your accounts to your project director,
instructor, supervisor, system administrator, or other appropriate University
authority.
Cooperate with system administrator requests for information about computing
activities. Under certain unusual circumstances, a system administrator is
authorized to access your computer files.
Take reasonable and appropriate steps to see that all hardware and software
license agreements are faithfully executed on any system, network, or server
that you operate.
Each user is ultimately responsible for his or her own computing and his or her own work using a computer. Take this responsibility seriously. For example, users should remember to make backup copies of their data, files, programs, diskettes, and tapes, particularly those created on microcomputers and those used on individually- or departmentally-operated systems. Furthermore, users with desktop computers or other computers that they operate themselves must remember that they may be acting as the system administrators for those computers and need to take that responsibility very seriously.
If you are a project director for a server group users, a supervisor whose staff use computers, or a faculty member whose students use computers, you must help your project members, staff, or students learn more about ethical computing practices. You should also help your project members, staff, or students learn about good computing practices and data management.
This document uses the phrase system administrator to refer to all of the following University personnel:
staff employed by a computing agency such as Instruction and Research
Technology whose responsibilities include system, site, or network
administration
staff employed by other University departments whose duties include system,
site, or network administration.
A system administrator's use of the University's computing resources is governed by the same guidelines as any other user's computing activity.
However, a system administrator has additional responsibilities to the users of the network, site, system, or systems he or she administers:
A system administrator manages systems, networks, and servers to provide
available software and hardware to users for their University computing.
A system administrator is responsible for the security of a system, network,
or server.
A system administrator must take reasonable and appropriate steps to see
that all hardware and software license agreements are faithfully executed on
all systems, networks, and servers for which he or she has responsibility.
A system administrator must take reasonable precautions to guard against
corruption of data or software or damage to hardware or facilities.
A system administrator must take reasonable precautions to guard against
abuse of peripherals, including all lab-based printers, paper and toner.
A system administrator must treat information about and information stored by
the system's users as confidential.
As an aid to a better understanding of responsible computing practices, all departments that own or lease computing equipment are encouraged to develop "Conditions Of Use" or "Guidelines for Responsible Computing" documentation for all systems that they operate and to make these documents available to users. These documents should be consistent with the "Policy for Responsible Computing at the William Paterson University " (reprinted on pages 1-2 of these Guidelines) and should be approved by the department's administrative officer or other individual designated by that administrative officer.
Misuse of Computing and Information Resource Privileges
The University characterizes misuse of computing and information resources and privileges as unethical and unacceptable and as just cause for taking disciplinary action. Misuse of computing and information resources and privileges includes, but is not restricted to, the following:
attempting to modify or remove computer equipment, software, or peripherals
without proper authorization
accessing computers, computer software, computer data or information, or
networks without proper authorization, regardless of whether the computer,
software, data, information, or network in question is owned by the University
(That is, if you abuse the networks to which the University belongs or the
computers at other sites connected to those networks, the University will treat
this matter as an abuse of your William Paterson University computing privileges.)
circumventing or attempting to circumvent normal resource limits, logon
procedures, and security regulations,
using computing facilities, computer accounts, or computer data for purposes
other than those for which they were intended or authorized
unauthorized 'broadcast' distribution of email messages to users on or off campus
sending fraudulent computer mail, breaking into another user's electronic
mailbox, or reading someone else's electronic mail without his or her
permission
sending any fraudulent electronic transmission, including but not
limited to fraudulent requests for confidential information, fraudulent
submission of electronic purchase requisitions or journal vouchers, and
fraudulent electronic authorization of purchase requisitions or journal
vouchers
violating any software license agreement or copyright, including copying or
redistributing copyrighted computer software, data, or reports without proper,
recorded authorization
violating the property rights of copyright holders who are in possession of
computer-generated data, reports, or software
using the University's computing resources to harass or threaten other users
taking advantage of another user's naivete or negligence to gain access to
any computer account, data, software, or file that is not your own and for
which you have not received explicit authorization to access
physically interfering with other users' access to the University's computing
facilities
encroaching on others' use of the University's computers (e.g., disrupting
others' computer use by excessive game playing; by sending
excessive messages, either locally or off-campus [including but not limited to
electronic chain letters]; printing excessive copies of documents, files,
data, or programs; modifying system facilities, operating systems, or disk partitions; attempting to crash or tie up a University computer; damaging or vandalizing University
computing facilities, equipment, software, or computer files)
disclosing or removing proprietary information, software, printed output or
magnetic media without the explicit permission of the owner
reading other users' data, information, files, or programs on a display
screen, as printed output, or via electronic means, without the owner's
explicit permission.
If a system administrator is an eyewitness to a computing abuse; notices an unusual degradation of service or other aberrant behavior on the system, network, or server for which he or she is responsible; or receives a complaint of computing abuse or degradation of service, he or she should investigate and take steps to maintain the integrity of the system(s). If a system administrator has evidence that leads to a user's computing activity as the probable source of a problem or abuse under investigation, he or she must weigh the potential danger to the system and its users against the confidentiality of that user's information.
While investigating a suspected abuse of computing; a suspected hardware failure; a disruption of service; or a suspected bug in an application program, compiler, network, operating system, or system utility, a system administrator should ordinarily ask a user's permission before inspecting that user's files, diskettes, or tapes. The next two paragraphs outline exceptions to this rule.
If, in the best judgement of the system administrator, the action of one user threatens other users or if a system or network for which the system administrator is responsible is in grave, imminent danger of crashing, sustaining damage to its hardware or software, or sustaining damage to user jobs, the system administrator should act quickly to protect the system and its users. In the event that he or she has had to inspect user files in the pursuit of this important responsibility, he or she must notify, as soon as possible, his or her own administrative officer or other individual designated by that administrative officer of his or her action and the reasons for taking that action. The administrative officer needs to be certain that one of the following are also notified as soon as practical (ordinarily within one business day): the user or users whose files were inspected; the user's supervisor, project director, administrative officer, or academic advisor.
In cases in which the user is not available in a timely fashion, in which the user is suspected of malicious intent to damage a computer system, or in which notifying the user would impede a sensitive investigation of serious computer abuse, the system administrator may inspect the information in question so long as he notifies his or her own administrative officer or other individual designated by the administrative officer of his or her actions and the reasons for taking those actions. The administrative officer needs to be certain that the user's supervisor, project director, administrative officer, or academic advisor is notified of the situation. In the case of suspected malicious intent, the administrative officer may also need to refer the matter to the appropriate University judicial body or to the Campus Police.
A system administrator may find it necessary to suspend or restrict a user's computing privileges during the investigation of a problem. The system administrator should confer with his or her administrative officer or other person designated by that administrative officer before taking this step. A user may appeal such a suspension or restriction and petition for reinstatement of computing privileges through the University's judicial system, through the grievance procedures outlined in University collective bargaining agreements, or by petition to the Dean of Students.
In general, then, a system administrator should
protect the integrity of the system entrusted to his or her care
respect the confidentiality of the information users have stored on the
system
notify appropriate individuals when the above two aims have come into
conflict
assist his or her administrative officer in referring cases of suspected
abuse to the appropriate University judicial process.
If staff Campus Police or system administrators have a preponderance of evidence that intentional or malicious misuse of computing resources has occurred, and if that evidence points to the computing activities or the computer files of an individual, they have the obligation to pursue any or all of the following steps to protect the user community:
Take action to protect the system(s), user jobs, and user files from
damage.
Notify the alleged abuser's project director, instructor, academic advisor,
dean, or administrative officer of the investigation.
Refer the matter for processing through the appropriate University judicial
system. If necessary, staff members from a campus-wide computing agency such as
Instruction and Research Techology as well as faculty members with computing
expertise may be called upon to advise the University judicial officers on the
implications of the evidence presented and, in the event of a finding of guilt,
of the seriousness of the offense.
Suspend or restrict the alleged abuser's computing privileges during the
investigation and judicial processing. A user may appeal such a suspension or
restriction and petition for reinstatement of computing privileges through the
University's judicial system, through the grievance procedures outlined in
University collective bargaining agreements, or by petition to the Dean of
Students.
Inspect the alleged abuser's files, diskettes, and/or tapes. System
administrators must be certain that the trail of evidence leads to the user's
computing activities or computing files before inspecting any user's files.
(See
"User Confidentiality and System Integrity"
of these Guidelines for more information.)
Ordinarily, the administrative officer whose department is responsible for the computing system on which the alleged misuse occurred should initiate judicial proceedings. As the case develops, other administrative officers may, by mutual agreement, assume part of the responsibility for prosecuting the case.
Abuse of computing privileges is subject to disciplinary action. Disciplinary action may include the loss of computing privileges and other disciplinary sanctions up to and including non-reappointment, discharge, and/or dismissal. An abuser of the University's computing resources may also be liable for civil or criminal prosecution.
It should be understood that nothing in these guidelines precludes enforcement under the laws and regulations of the State of New Jersey, any municipality or county therein, and/or the United States of America.
Faculty and students are reminded that computer-assisted plagiarism is still plagiarism. Unless specifically authorized by a class instructor, all of the following uses of a computer are violations of the University's guidelines for academic honesty and are punishable as acts of plagiarism:
copying a computer file that contains another student's assignment and
submitting it as your own work
copying a computer file that contains another student's assignment and using
it as a model for your own assignment
working together on an assignment, sharing the computer files or programs
involved, and then submitting individual copies of the assignment as your own
individual work
knowingly allowing another student to copy or use one of your computer files
and to submit that file, or a modification thereof, as his or her individual
work.
For further information on this topic, students are urged to consult the William Paterson University Student Handbook, and to consult with their individual instructors.
Faculty members are urged to develop specific policies regarding all aspects of academic honesty and to communicate those policies to their students in writing.
The University is not responsible for loss of information from computing misuse, malfunction of computing hardware, malfunction of computing software, or external contamination of data or programs. The staff in campus-wide computing units such as Information Systems and all other system administrators must make every effort to ensure the integrity of the University's computer systems and the information stored thereon. However, users must be aware that no security or back-up system is 100.00% foolproof.
William Paterson University Home Page
Please direct questions to Robert A. Harris