IT-regulations
Regulations for the use of IT-equipment at Oslo University College.
By the Head of Oslo University College 6th October 1998, revised 2nd December 2004.
§1.1
These regulations apply to all use of the College's equipment for information technology; IT-equipment. The term `IT-equipment' includes computers, PCs, Macs, end-user equipment, networks, computer programs, data, etc., that is made available to users by the College. This includes local, national and international networks or other computer systems, to which one gains access, through such resources. Any private computer equipment (e.g. laptop computer) is also subject to these regulations when connected to the College network. The regulations apply to staff, students and others given access to the IT-equipment. These groups will, from now on, be referred to as `users'.
§1.2
These regulations shall be available to all users through the College website, and new users are to be made aware of their existence and location, at the time of becoming a member of staff or being assigned an account.
§1.3
Prior to new users being given access to the College IT-equipment, a signature, or receipt on the web, must be provided, testifying that the user is familiar with these regulations and promise to uphold them. The users of IT-equipment are obliged to keep themselves informed of current regulations, and any additional conditions that apply..
§1.4
At each place of study (department), one or more members of staff will be responsible for all, or part of, the College IT-equipment. Such staff will in these directives be referred to as staff in charge of IT.
§2. Access to IT-equipment
§2.1
Persons using the IT-equipment must be in possession of their own approved user name, a.k.a. `user account', and an approved password.
In certain cases groups of people, e.g. student groups may have a shared user account. College staff, and others who are to be granted similar rights of access, will be assigned user accounts on the requisition of the administration of the departments concerned.
Student accounts will be made available on the requisition of the administration of studies (`studieadministrasjon').
§2.2
Users, or user groups, are required to keep their access to the IT-equipment private and unavailable for use by others. Passwords must be kept secret and be changed after six months at the latest. The password must consist of at least six characters and contain at least one character that is not an ordinary letter.
§2.3
The user is responsible for any action carried out when using the user account.
§2.4
Users are required to prevent the unauthorised use of IT-equipment. If the unauthorised use, or an attempt to gain access to such, is discovered, this must immediately be reported to the student on duty (studentvakt) or staff member in charge of IT
§2.5
Users are required to follow the instructions of the staff member in charge of IT, regarding the use of IT-equipment, or of services connected to it. Users are required to familiarize themselves with user manuals and documentation, etc., to such an extent as to reduce the possibility of causing a breakdown of operation, loss of data, failure of programs and damage to equipment, through negligence.
§2.6
Access to the College IT-equipment must not be lent to anyone else.
This includes user accounts, as well as passwords, and the equipment itself. In particular, teaching staff must be aware that the College network is segmented, and that allowing students to use the teaching staff's computers may give them access to parts of the network containing sensitive data.
§2.7
Using, or attempting to use, one's access to College equipment in order to gain further illegal accesses, either to the College equipment itself, or to others' equipment via the net, is not permitted.
§2.8
On termination of employment or studies, the user is responsible for transferring any copies of data or programmes, rightfully belonging to the College, to the staff in charge of IT. Other files, etc., stored under the user's name, user identity or similar, are to be deleted by the user. If this is not done within a reasonable length of time, and within 3 months at the latest, the staff in charge of IT may look into and delete such files etc.
§3 Computer security
§3.1
The user must perform all actions necessary to minimize the consequences of loss of data, programmes and similar. This can be done through back-up copying, appropriate labelling and storage of media etc.
§3.2
Valuable data belonging to staff should be stored in those parts of the network where back-up copies are made. Storage of information on the local hard disc, on the user's computer, and on diskettes, etc. is the user's own responsibility. The IT-staff does not take back-up copies from this kind of equipment.
§3.3
Back-up copies are not normally made of student servers. Students must therefore ensure they make back-up copies of their own data.
§3.4
Users must be aware that programmes or data may contain unwanted elements (viruses etc.) and should play their part in keeping College systems free of such elements.
§3.5
Users should be aware that protection against outside viewing depends on where, on the network, data are stored. Data stored in computers, connected to those parts of the network with student access, must be considered publicly available. Sensitive data, such as grades and exercises set for examinations, must not be stored in these parts of the network; nor must such data be printed out on printers in public areas.
§3.6
In connection with investigations into possible infractions of Norwegian law, the College retains the right to surrender the contents of hard disc drives, back-up tapes etc. to the police or the prosecuting authority, except where this would conflict with other laws and regulations.
§3.7
Users should be aware that data sent over the network, e.g. in the form of E-mail, are not secure against outside viewing. Private or secret information (e.g. passwords,) or sensitive information (e.g. personal data) must never be transmitted this way.
§3.8
Users are required to report any circumstances, which might have consequences for the security or integrity of the system, to their nearest superior and to the person in charge of computer security.
§3.9
Oslo University College is required to follow the security regulations of Uninett. In particular, the College network must be segmented into a `secure' network and a `student' network. The user is not allowed to perform any action which might alter or weaken this segmentation. For instance, it is not permitted:
1. To have more than one network card installed in a computer, where the cards are connected to segments at different levels of security.
2. To connect a modem or other units for external communication to the College network, without specific permission from the IT-manager.
3. To make alterations to the physical or logical cabling structure without specific permission from the IT-manager.
§3.10
If there is a change of usage, making a room with a secure network available to others than staff, IT-services must be informed immediately, so that the network may be adjusted.
§3.11
Using Internet services for any activity that might damage or prevent the normal operation of any computer connected to the network is not permitted, either at the College or elsewhere.
§4 Regulations on access, protection of personal data
§4.1
A user account confers the right to use certain parts of the network: the right to log on to certain servers, to store and read data from certain areas and units, the retrieval of print-outs from certain printers, and so on. Users are not allowed to trespass outside these areas. The same applies if, for whatever reason, a restricted area is technically open for access, when it is understood that it should not be.
§4.2
A user must not try to gain unauthorized access to others' data, programmes etc. Obtaining access to the IT-equipment using another person's user account is not allowed, even with this person's permission. The IT-staff are exempt from this when conditions related to the technical operation make it necessary.
§4.3
The files of other users are to be considered their private property.
Reading, copying, printing etc. of such files is only permitted with the permission of the owner.
§4.4
The processing of personal data, wholly or partially using electronic equipment, is regulated by the Personal Data Act. Each user must ensure that the protection of personal data is dealt with in accordance with these regulations and routines established for this.
Questions concerning the Personal Data Act in general can be made to the Department of Human Resources (Personalseksjonen). Questions regarding the processing of personal data in connection with research can be made to Norsk Samfunnssvitenskapelig Datatjeneste (NSD), which is also the College Ombudsman for protection of the personal data of researchers and students. Queries concerning points in the
IT-regulations can be made to the Technical Department of the IT-services.
§4.5
Users must maintain confidentiality in any personal matters they acquire knowledge of through the use of the computer system.
§5 The use of Resources
§5.1
Users must ensure that the College equipment is not used for any activity that is deemed in conflict with Norwegian law, or common decency. For example, illegal or indecent data or information must not be downloaded to, stored at, or sent from the computer system.
§5.2
Users should show restraint in using the system for activities not directly connected to professional activities, administration, personal research or studies.
§5.3
Games and other entertainment software are not forbidden, but must always be used in such a way, and at such times, as will not command resources that could better have been used for the proper activities of the College. IT staff or students on duty may order the use of such applications to cease, and that the software and its data files be removed from the College system.
§5.4
The College network, and other networks connected to it, must be used in such a way that the load does not become unnecessarily heavy. Large amounts of data must only be transferred or downloaded when there is a serious need, and this must, if possible, be done at times when the network is not otherwise busy.
§5.5
The College equipment, or other equipment connected to it, must never be used in such a way that the College, or others, incur expenses in the form of telephone charges, surcharges or similar, without these expenses being cleared in advance.
5.6
Neither IT nor telephone equipment should be moved from one room to another, except with the agreement of IT-services. This is necessary, to safeguard both the inventory and segmentation of the network.
§6 Rules for the use of e-mail, conference systems, HiO-web etc.
§6.1
The College E-mail system has several address lists that distribute to many people. These lists should only be used for the dissemination of messages which are relevant to the administrative or professional considerations of the College.
§6.2
E-mails with attachments should preferably not be sent to address lists. If files are to be made available to many people, this should be done using shared data areas on disc, the world-wide web, or other methods through which everybody can gain access to the same file.
§6.3
Using the HiO-network to send E-mails to address lists or other mass distribution mechanisms at other institutions is not allowed without the permission from the recipient institution.
§6.4
Messages of a social nature, invitations to social gatherings, parties, arrangements etc. may be sent to address lists where the recipient group is relevant for the arrangement. If there's doubt, the Director of Communication (informasjonsdirektøren) will decide which lists are relevant in any given case.
§6.5
E-mail lists must not be used to impose political, religious or other private expressions of opinions on others. The College network is available for such material, but conferencing, discussion groups etc should be used for this.
§6.6
Using the College E-mail system to impose sales and marketing material on others is not permitted.
§6.7
Using the College E-mail system for spamming (bombarding others with messages) through E-mail or news groups is not permitted. Nor is it permitted to function as a conduit for, or in any way support, such activities. Nor must information about E-mail lists etc. at HiO be given to outsiders who are involved in such activities.
§6.8
When publishing private web pages on the College equipment, users are required to keep themselves informed of the guidelines for the construction of web pages, which are published on the HiO-web. The guidelines, among other things, place restrictions on how the HiO logo and other design elements may be used on personal web pages.
§7 The rights of others
§7.1
Both the use computer programs and the use of data (text as well as collections of information, e.g. databases) can involve rights which make usage dependent on an agreement with the copyright holders.
Users are obliged to respect the rights of others. If the user is in doubt as to whether a license is required, this must be discussed with the member of staff in charge of IT.
§7.2
Users who install software on the College equipment, for personal use, or who make such software available to others, are required to make sure that the necessary licences for use are secured. This also applies to games and other entertainment software.
§7.3
When users make information available to others, e.g. through the World Wide Web, they are required to find out if anybody owns the copyright to this information, and if so to obtain the necessary permissions. The copyright holders may be authors, musicians, visual artists, photographers or others.
§7.4
When the College makes programmes and data etc. available, the user is obliged to respect the limitations of usage in accordance with the College's agreement with the copyright holders. The agreement will always be available through the person in charge of the network.
§7.5
Users are not permitted to copy computer programs using College equipment, if such copying contravenes licensing agreements.
§7.6
Material with copyright must never be installed on, or distributed from the College equipment, without the permission of the copyright holder. Nor is it allowed to install or run peer-to-peer file sharing software (e.g. Napster, BitTorrent or DC++) on the College computer equipment, or on personal equipment attached to the College network, without specific permission. Permission may be granted by the IT-manager or by proxy. This kind of delegation and permission is only granted in writing.
§8 The quality of service, compensation liability.
§8.1
Users carry the burden of responsibility for their own use of information, programmes, etc. made available through the system. The College assumes no liability for any financial losses due to faults or shortcomings in programmes, data, use of information from available databases, or use of other information acquired through the network, etc.
§9 The right of access to reserved areas (for the staff in charge of IT)
§9.1
The staff in charge of IT may rightfully access any user's private areas in the system, with the aim of
1. securing the functionality of the system, or
2. verifying that the user is not infringing, or has already infringed, the conditions of these regulations.
It is understood that such access will only be sought when it is deemed to be of significant importance to the operations, or the responsibilities or reputation of the College.
§9.2
If IT staff obtain such access to private staff areas, the user must be immediately and reliably informed of this.
§9.3
If, the use of a workstation, terminal or other end-user equipment should be subject to surveillance, for reasons of security or other diagnostics, this shall be made clear by labelling the unit or other appropriate measures.
§9.4
The IT staff shall maintain the confidentiality of all information about the user, or the activities of the user, acquired by such surveillance, except under such circumstances as may represent an infringement of these regulations, whereupon it may be reported to a superior.
§10 The use of private equipment connected to the College network
§10.1
When a user's own computing equipment is connected to the College network by cable, this shall be done via connectors designed for this purpose and labelled as such.
It is not permitted to disconnect College computing equipment and replace it with private equipment, even if the equipment concerned is faulty or not in use.
§10.2
When private equipment is connected to the College computer network, internet addresses automatically provided by the network (DHCP) must be used. Circumventing this, without the written permission of the IT-services, is not permitted. The computer must always be visible to the staff supervising the network (e.g. it should answer to PING).
§10.3
Setting up permanent services (servers) on the College network is not allowed, without the permission of the IT-services.
§10.4
Connection to the HiO network is made at the user's own risk. The college assumes no liability for equipment which is physically damaged, stolen, or otherwise destroyed, in connection with usage pertaining to the College network or in the College premises.
§11 Sanctions
§11.1
On infringement, or suspicion of infringement, of these regulations, staff in charge of IT may, with no further ado, withdraw a user's right to access the system for up to a week. The College Director or the authority which requisitioned the user account (cf. §2.1) may withdraw user rights permanently. Subsequent sanctions may then apply in accordance with other College regulations, or Norwegian Law.
28.01.2005