Effective: July 1, 2004
Contact: Information Security Policy Committee (ISPC)
Iowa State University's Code of Computer Ethics and Acceptable Use Policy provides for access to information technology resources and communications networks within a culture of openness, trust, and integrity. In addition, Iowa State University is committed to protecting itself and its students, faculty, and staff from unethical, illegal, or damaging actions by individuals using these systems.
The purpose of this policy is to outline the ethical and acceptable use of information systems at Iowa State University. These rules are in place to protect students, faculty, and staff, i.e., to ensure that members of the Iowa State University community have access to reliable, robust IT resources that are safe from unauthorized or malicious use.
Insecure practices and malicious acts expose Iowa State University and individual students, faculty, and staff to risks including virus attacks, compromise of network systems and services, and loss of data or confidential information. Security breaches could result in legal action for individuals or the university. In addition, security breaches damage the university's reputation and could result in loss of services. Other misuses, such as excessive use by an individual, can substantially diminish resources available for other users.
The Code of Computer Ethics and Acceptable Use Policy is an integral part of the ISU Information Technology Security Policy (link to ISU Information Technology Security Policy) and applies to faculty, staff, and students as well as any other individuals or entities who use information and information technology at Iowa State University. This policy applies to all equipment owned or leased by Iowa State University and to any privately owned equipment connected to the campus network and includes, but is not limited to, computer equipment, software, operating systems, storage media, the campus network, and the Internet.
Securing and protecting these significant and costly resources from misuse or malicious activity is the responsibility of those who manage systems as well as those who use them. Effective security is a team effort involving the participation and support of every member of the Iowa State University community who accesses and uses information technology.
Therefore, every user of university IT resources is required to know the policies and to conduct their activities within the scope of the ISU Code of Computer Ethics and Acceptable Use Policy, the ISU Information Technology Security Policy, and the Standards, Guidelines, and Best Practices for IT Security. Failure to comply with this policy may result in loss of computing privileges and/or disciplinary action.
Iowa State University desires to provide the highest level of privacy possible for users of its information technology systems and to assure their rights of free speech and intellectual freedom are protected and uninhibited. At the same time Iowa State University is required by federal and state laws to keep certain information confidential. To the extent permitted by law and university policy, Iowa State University maintains and protects both the privacy of individuals and the confidentiality of official information stored on its information technology systems. Privacy and confidentiality must be balanced with the need for the university to manage and maintain networks and systems against improper use and misconduct.
Iowa State University may access, monitor, or disclose confidential or personal information residing on its information networks and systems in the following situations:
The development of policy and practices to protect information and to increase security of information technology resources is an ongoing process. This document along with the ISU Information Technology Security Policy is intended to identify key security issues for which individuals, colleges, departments, and units are responsible. The third document, Policies, Standards, and Guidelines for Best Practices for IT Security, is an extension of the first two and includes the most current security requirements and recommendations adopted by the university. This Code of Computer Ethics and Acceptable Use Policy highlights acceptable and unacceptable use policies. Individuals are responsible for understanding these basic principles as well as for familiarizing themselves with and complying with additional policies and practices as they are defined in Policies, Standards, and Guidelines for Best Practices for IT Security.
In a university environment students, faculty, and staff create, store and have access to many sources of information. The level of security practices required for various information types depends on who has created the information, who is maintaining the information, the nature of the information itself, and whether there are specific federal and/or state laws or university requirements or guidelines associated with the use and distribution of the information. Information can be defined very generally in many ways such as public, private, confidential, personal, academic, etc. For the purposes of this policy, information is categorized as either university information or individual information. Within university information, there are also very specific definitions for certain types of information.
As an institution, the university has many types of official information including student records, financial records, health and insurance records, personnel records, and other business records. In addition, colleges, departments, and other units may have other types of internal business information specific to their areas.
Individual information includes academic, research, personal and business correspondence, and other records created and managed by individual students, faculty, or staff. As creators and managers of this information, individuals are responsible for securing and protecting their information.
Individual information should be protected based on the level of risk associated with its loss or misuse. Colleges, departments, central information technology providers and other units may assist individuals by offering services including secure storage of files with systematic copying of data and/or archiving. Nonetheless, individual students, faculty and staff are ultimately responsible for securing their own information and should take action to assure their individual data is protected to the level they deem adequate.
Users are responsible for the security of computer systems passwords, personal account passwords (Net ID passwords) and personal identification numbers (PINs) and will be held accountable for any activities linked to their accounts. Users must follow established university standards for maintaining and managing passwords.
Users are required to be aware of and employ security practices established by the university and their colleges, departments or administrative offices to prevent unauthorized access to their computers. Security breaches can often be linked to the actions individuals take or fail to take when using information technology resources (e.g., leaving their computers logged into applications while away from their desks, storing written copies of passwords in obvious places, using insecure methods for transferring information).
Computer systems can become transmitters of viruses, denial of service attacks, open file exchange services, and other malicious electronic activities. Email messages, websites, inter-relay chat, and other applications used by faculty, staff, and students are often the sources of these problems. To prevent these malicious activities, individuals are required to be aware of and comply with university policies relating to the use of these applications. Among specific requirements are the ongoing use of approved virus-scanning software, the timely application of security patches and upgrades to operating systems and other software, and prompt implementation of security measures posted by university, colleges, departments, or units in response to specific security threats.
Effective security practice includes the prompt and appropriate response to breaches in security. It is, therefore, incumbent upon all individuals to report incidents in which they believe computer or network security has been jeopardized. In some cases local action is sufficient; in others, where the risk to confidential information or university-wide security is high, a university-level response will be implemented. Individuals are responsible for reporting security incidents and for taking action as recommended or directed by the security response team.
Users are prohibited from engaging in any activity illegal under local, state, federal, or international law or in violation of university policy. The categories and lists below are by no means exhaustive, but attempt to provide a framework for activities that fall into the category of unacceptable use.
Priority for the use of information technology resources is given to activities related to the university's missions of teaching, learning, research, and outreach. University computer and network resources are limited in capacity and are in high demand. To conserve IT resource capacity for all users, individuals should exercise restraint when utilizing computing and network resources. Individual users may be required to halt or curtail non-priority use of information technology resources, such as recreational activities and non-academic, non-business services.
Unacceptable system and network activities include:
Users may not use university facilities or networks to violate the ethical and legal rights of any person or company protected by copyright, trade secret, patent, or other intellectual property, or similar laws or regulations. Violations include, but are not limited to:
Inappropriate or malicious use of IT systems includes:
Electronic mail (email) and communications are essential in carrying out the activities of the university and to individual communication among faculty, staff, students and their correspondents. Individuals are required to know and comply with the university's Mass E-Mail Policy and Effective e-Communication. Some key prohibitions include:
The University Code of Computer Ethics and Acceptable Use Policy is enforced through the following mechanisms.
The university may temporarily disable service to an individual or a computing device, when an apparent misuse of university computing facilities or networks has occurred, and the misuse:
An attempt will be made to contact the person responsible for the account or equipment prior to disabling service unless forbidden by law enforcement authorities or central IT providers (AIT, ATS, and Telecommunications) determine immediate action is necessary to preserve the integrity of the university network. In any case, the user shall be informed as soon as possible so that they may present reasons in writing why their use is not a violation or that they have authorization for the use.
Users may be issued warnings, may be required to agree to conditions of continued service, or have their privileges suspended or denied if:
For minor first-time violations the expectation is that a warning will be sufficient. For repeat violations temporary or permanent denial of access to or suspension of computing or network services will be considered.
Violations of the ISU Code of Computer Ethics and Acceptable Use Policy may be referred for disciplinary action as outlined in the Student Information Handbook and applicable faculty and staff handbooks or collective bargaining agreement.