Computer and Computer and Network Use PoliciesNetwork Use Policies

ITSS 4201 Internet Insurance and ITSS 4201 Internet Insurance and Information HidingInformation Hiding

► University of PalestineUniversity of Palestine► Eng. Wisam ZaqootEng. Wisam Zaqoot► Feb 2010Feb 2010

Computer and Network Use Computer and Network Use PoliciesPolicies

We have laws. Why do we need Policies?We have laws. Why do we need Policies?

- Laws are - Laws are general principles that admit general principles that admit no contextno context, because they are , because they are supposed to apply in any context. supposed to apply in any context.

- Policies - Policies depend on particular depend on particular personalities, on particular institutions, personalities, on particular institutions, on particular situations; it is immensely on particular situations; it is immensely context-dependantcontext-dependant. .

How to communicate the use How to communicate the use policypolicy::

Word of mouthWord of mouthEmployee manualsEmployee manualsBannersBanners

What a Network Use Policy may What a Network Use Policy may includeinclude::

* It may * It may state that the use of the state that the use of the network constitutes consent to network constitutes consent to monitoring.monitoring.

- This helps establish consent for- This helps establish consent for:: ►Provider monitoringProvider monitoring►Law enforcement monitoringLaw enforcement monitoring

What a Network Use Policy may What a Network Use Policy may includeinclude::

* It may * It may state that the use of the state that the use of the network constitutes consent to network constitutes consent to retrieval and disclosure of information retrieval and disclosure of information stored on the stored on the networknetwork..

What a Network Use Policy may What a Network Use Policy may includeinclude::

* It may * It may state that the use of the state that the use of the network constitutes consent to network constitutes consent to retrieval and disclosure of information retrieval and disclosure of information stored on the stored on the computercomputer..

Example: Example: An employee sued An employee sued Univ. of NebraskaUniv. of Nebraska::

►Search of employee computer done in Search of employee computer done in response to a civil suit.response to a civil suit.

►Employee sued for breach of privacy.Employee sued for breach of privacy.►Court found:Court found:

No reasonable expectation of privacy No reasonable expectation of privacy because computer use policy indicated because computer use policy indicated computer could be searched when computer could be searched when university was responding to discoveryuniversity was responding to discovery

Concurring opinion noted that university Concurring opinion noted that university policy were to some degree privatepolicy were to some degree private

What a Network Use Policy may What a Network Use Policy may includeinclude::

* With government networks, the policy * With government networks, the policy may state that the user of the network may state that the user of the network shall have no reasonable expectation shall have no reasonable expectation of privacy in the network. of privacy in the network.

- This helps establish that user lacks a - This helps establish that user lacks a reasonable expectation of privacy.reasonable expectation of privacy.

What a Network Use Policy may What a Network Use Policy may includeinclude::

* * In the case of non-government In the case of non-government network, the policy may make clear network, the policy may make clear that the network system administrator that the network system administrator may consent to a law enforcement may consent to a law enforcement search.search.

-This gives the system administrator’s -This gives the system administrator’s common authority to consent to a common authority to consent to a

search.search.

What a Network Use Policy may What a Network Use Policy may includeinclude::

* It may contain * It may contain limitations or limitations or authorizations relating to the purpose of authorizations relating to the purpose of any monitoring / search, and what will be any monitoring / search, and what will be done with the fruits of any monitoring / done with the fruits of any monitoring / search.search.

- Do you want to limit why you can - Do you want to limit why you can monitor?monitor?

- Where do you want to be able to use - Where do you want to be able to use the the information found?information found?

What a Network Use Policy may What a Network Use Policy may includeinclude::

* It may * It may state what users are state what users are unauthorized to access the network, unauthorized to access the network, and the consequences of unauthorized and the consequences of unauthorized use of he network?use of he network?

- Makes it easier to determine what use is - Makes it easier to determine what use is unauthorized?unauthorized?

An example of a policy An example of a policy bannerbanner::

► WARNING! This computer system is the property of WARNING! This computer system is the property of the University of Palestine and may be accessed only the University of Palestine and may be accessed only by authorized users. Unauthorized use of this system by authorized users. Unauthorized use of this system is strictly prohibited and may be subject to criminal is strictly prohibited and may be subject to criminal prosecution. The University may monitor any activity prosecution. The University may monitor any activity or communication on the system and retrieve any or communication on the system and retrieve any information stored within the system. By accessing information stored within the system. By accessing and using this computer, you are consenting to such and using this computer, you are consenting to such monitoring and information retrieval for law monitoring and information retrieval for law enforcement and other purposes. Users should have enforcement and other purposes. Users should have no expectation of privacy as to any communication on no expectation of privacy as to any communication on or information stored within the system, including or information stored within the system, including information stored locally on the hard drive or other information stored locally on the hard drive or other media in use with this unit (e.g., floppy disks, flash media in use with this unit (e.g., floppy disks, flash memories, CD-ROMs, etc.)memories, CD-ROMs, etc.)

- What do you think?- What do you think?

The following topicsThe following topics::

* Internet laws* Internet laws

* Computer and Internet privacy* Computer and Internet privacy

* Case study: Data Protection Act 1998 * Case study: Data Protection Act 1998 (UK)(UK)

* Computer Crimes * Computer Crimes

* Software licensing* Software licensing