|
Guidelines for the use of the University's IT-resources.
1.0 Definitions
An explanation of the expressions used in the guidelines.
- Users
- Anyone who has access to and takes advantage of the university's IT-resources. This includes employees, students and others who are granted access to the IT-resources.
- Data
- The content of the University net, which includes both data files and software.
- Network
- Hardware and/or software that make it possible to connect two or more computers. Includes private, local, national and international networks accessed through the university's IT-resources.
- Operative disturbances
- Disturbances and/or irregularities restraining the users' use of the university's IT-network.
- IT-resources
- Includes hardware, data, services and computer-network.
- Hardware
- Physical components used in data processing.
- Private data
- Data saved in an area labelled as private.
2.0 Purpose
The purpose of the guidelines is to contribute to a developing IT-milieu where the possibilities given by IT-resources can be maximised, to benefit society and the university community. This will promote education and research, in addition to spread knowledge about scientific methods and results.
3.0 Use
These guidelines cover use of the university's IT-resources and are valid for all users with access to these resources. The guidelines are accessible in appropriate places, for instance computer laboratories. Use of the IT-resources also requires the user's knowledge of any supplementary regulations.
4.0 Loyalty
A user shall always appear under full name, and there shall be no doubt of his/her identity, or the connection to the university. Therefore, a user shall identify him-/herself with name, user identity, password or other appropriate means when using services on the computer net. The use of the university's IT-resources is not permitted without permission in advance. Being a user with the university implies that permission is granted for appropriate use.
External milieus shall not be abused by the user, including the acquisition of information not intended for private use and the misuse of services.
A user shall follow guidance given by IT-staff members concerning the use of IT-resources. He/she shall also acquire the appropriate level of knowledge concerning user manuals, documentation, etc., to prevent ignorance being the cause of operative disturbances or the loss of data or equipment.
When finalising employment or studies the user is responsible for securing copies of data either belonging to or at the disposal of the university.
5.0 Data security
A user is obliged to take preventive measures to minimise damage should a loss of data or similar items occur, through back-ups and responsible storage of media, etc.. IT-staff members can upon request assist in applying proper safety measures.
Personal files are as a starting point private, but should be protected against being read by others.
A user is responsible for keeping passwords or other safety measures secret, and to prevent access to the IT-resources by unwanted individuals. This also applies to giving away username and password to computers outside of the university, i.e. by saving them to browsers.
Importing data often involves the risk of unwanted elements, for instance viruses, worms and Trojans, and it is the users obligation to take safety measures against such objects. All computers, (also laptops and at-home computers) connected to the university's IT-resources must be protected with relevant safety-measures (ant-virus, firewall, systems for regular up-dates, etc.).
A user is obligated to report conditions that could have an impact on the systems security or integrity to the nearest superior or the person in charge of computer-safety.
6.0 Respect for other users, protection of privacy
A user must not seek the acquisition of others' password or similar, or seek the unauthorised access to others' data, irrespective of whether they are protected or not. It is important to emphasise that to use IT-resources under another persons name is strictly forbidden, as several IT-related acts can be penalised under criminal law or can incur compensation payments.
A user who manages, or who are planning to manage the private information of others electronically, either administratively or for research purposes, is obligated to familiarise him/herself with Privacy law. The user should also attain the university guidelines concerning the treatment of sensitive information. Before the user starts to manage the private information of others for research purposes, it has to be reported to The Norwegian Social Science Data Services (NSD). A copy must be sent to the department (faculty/NFH).
The user has to commit to professional secrecy, as stated in The Norwegian administration acts of 1967 and 1969 §13, concerning knowledge attained through the use of the university's IT-resources.
7.0 Proper use
The university's IT-resources must not be used to put out defamatory or discriminative statements, pass on pornographic material or spread information under professional secrecy, disturb privacy or encourage or contribute to illegal acts. In addition to this the user should refrain from improper communication.
The IT-resources should be used in a direct accordance with the University's purpose. This excludes for profit use.
8.0 Resource concioussness
The university's IT-resources shall be used to strengthen and support professional activities, administration, research and education. The user shares a collective responsibility for optimal resource utilisation. Use not related to the purpose of the institution is considered private, and will usually be allowed unless it occupies great resources or occur at the cost of research, education, communication or administrative related duties.
9.0 Rights
The user should be aware of issues relating to copyright law, as most computer programs have owners. The rights of other people must be respected, which includes terms and conditions, and especially Licence agreements the University have entered into.
Copying computer programs (software?) through the University net is only allowed if the user has the right to use the program.
It is illegal to make computer files, including music files, accessible through the university net without the consent of the owner of the right. It is not allowed to put out links, including to file-share systems, on the university net to illegal material.
10.0 Liabilities
The user is responsible for data accessed through use of the IT-resources. The university renounces responsibility for economic losses due to errors or shortcomings relating to the IT-system. This includes defect data, the use of data from accessible databases or other data sourced through the computer net, etc.
The university is not responsible for damage to the user due to a lack of safety measures maintaining private data.
11.0 Private use
As the employer, the university has the right to inspect all the information an employee receives because of his/her position, including e-mails. At the same time the University has full rights to inspect university-owned computer equipment, and its saved information. In case of absence the university has the right to access data saved to the employee's area, to make sure duties are performed on time and on the best possible grounds. If the employee receives private e-mail, or saves private data on the university equipment, this should be labelled "Private". The university will respect such labels and will not gain access to data saved in such areas except under special circumstances.
12.0 Logging
Every log-on to the university's IT-system is logged. Monitoring is used to support the operation of the university's IT-systems. Logs on traffic data or communication content can be released to the police authorities, public prosecution or a third party on the demands of a Norwegian court.
13.0 Professional secrecy
The operations manager is committed to professional silence regarding information about the user or the user's activities gained through professional duties, with the exception of acts in breach of the guidelines, which are reported to superiors.
14.0 Release and deletion of data at the end of a user relationship
When the user terminates the relation to the university, for instance at the end of studies or a terminated employee relationship, the user shall remove data stored on University IT-resources. The data will be deleted three months after termination of the relationship.
Should the user die the private folder stored on university IT-resources will be deleted after three months. The files will not be released except under special circumstances.
15.0 Sanctions
In case of a breach of existing rules/guidelines for the use of university IT-resources reactions will be considered. Methods of reaction, i.e. possible expulsion or limited access to computer systems/IT-resources, shall be considered on the grounds of the seriousness of the action(s) or inaction(s). Employees can receive reactions varying from an oral orientation on existing guidelines to other reaction regulated by laws regarding public service people. Students will be sanctioned by expulsion from their user accounts, either for a limited time or forever. In case of security breaches, incurring significant economic losses to the university, all user groups can be held liable for their actions.
Sanction shall be given grounds for, and shall only be processed by the proper authorities, according to university rules. A student's expulsion from a user account will be decided by the University Director.
16.0 Complaints procedures
Complaints to sanctions (for instance expulsion and denial of access) shall be directed to the authority that mulcted the sanctions. If complaints are dismissed, they will be forwarded to the University complaints committee for final decisions. Complaints to surveillance follow the same procedures as sanctions.
|
