Policies and procedures
*For the purposes of this policy, the term 'staff' includes postgraduate research degree students
These Guidelines are issued by the Director of Information Strategy and Technology Services (ISTS) under authority of Council.
These guidelines provide clarification for staff on the practical application of the University's Policy on Acceptable Use of IT Facilities and they should be read in conjunction with it.
IT facilities includes all computing and communication equipment, software, services, data and dedicated building space used in connection with information technology, which is owned by, leased by or used under licence or agreement by the University.
1. Responsibilities of staff
2. Unacceptable or prohibited use of IT facilities
3. Privacy
4. Monitoring use of IT facilities
5. Email bulletins and distribution lists
6. Other information
The following sections set out requirements that are particularly significant and provide relevant information about some of the legislation that governs the use of IT facilities. All staff who use University IT facilities must comply with the policy, legislation and principles that are referred to here as well as to other directives from the Director of Information Strategy and Technology Services that may be issued.
Information technology facilities may be used only as set out in the Policy on Acceptable Use of IT Facilities.
Staff members must not use IT facilities for the purpose of personal profit making or for commercial activities other than those of the University. Staff use of University IT facilities including email and the internet is conditional upon compliance with all University policies procedures and guidelines, including the Sexual Harassment Policy & Grievance Procedures (C - 12.2) and Equal Opportunity Policy C - 2.2) as well as with State and Commonwealth law.
A list of relevant documents and Government legislation with which staff must comply is set out in Appendix A of the Policy on Acceptable Use of IT Facilities.
Copyright law restricts the copying of software and other material
subject to copyright (documents, music, broadcasts, videos etc) except
with the express permission of the copyright owner.
A more detailed
discussion of copyright.
1.2.1 Software
Staff may not make use of, or copy, software contrary to the provisions of any agreement entered into by the University. The onus is on staff to consult with ISTS to clarify the permitted terms of use if they wish to use any software for purposes other than those for which the University has a licence.
1.2.2 Multiple users
Copies of software used in a multi-access or network environment to allow simultaneous access by more than one user can only be provided if specifically permitted in the contract or software licence, or if a copy of the software has been purchased for every simultaneous user.
More information about copyright.
1.2.3 Email and Copyright
The copyright of an email message is owned by the sender, or the sender's employer. Copyright owners have a variety of rights, including the right to reproduce their work and the right of communication to the public. Forwarding something to an email discussion list would be construed as "to the public". Consider the expectations of the originator; did that person set any conditions on the further communication of their email, or expect that it would not be forwarded to anyone else, or would not be forwarded to a particular recipient?
1.2.4 Spam Act 2003
All email messages sent from a University email account must comply with the Spam Act 2003. This Act sets up a scheme for regulating commercial e-mail and other types of commercial electronic messages. The Spam Act refers to spam as "unsolicited commercial electronic messaging". "Electronic messaging" includes emails, instant messaging, SMS and other mobile phone messaging. A single message may be spam. The message does not need to be sent in bulk, or received in bulk.
There are a large number of commercial electronic messages that can be sent legitimately. They are only considered to be spam if they are sent without the prior consent of the recipient - as unsolicited messages. The rules for sending commercial electronic messages are:
1.3.1 User Identification
On request of relevant University managers and supervisors, a member of staff must provide evidence of their eligibility to use the University's IT facilities.
1.3.2 User Misrepresentation
Staff must not under any circumstance, in messages or otherwise, represent themselves as someone else, fictional or real, without providing their real identity or username.
1.3.3 Public statements on behalf of the University
Communications using University IT facilities should not give the impression that the writer is representing, giving opinions or making statements on behalf of the University or any part of it unless appropriately authorised to do so. See the policy on Public Statements by Members of University Staff (C 5.0).
The following practices should be observed to maintain the security of the University's IT facilities.
1.5.1 Inconvenience and damage
Staff must not behave in a manner which, in the opinion of relevant University managers and supervisors, unduly inconveniences other people or which causes or is likely to cause damage to University IT facilities.
1.5.2 Installation of software
Staff must not install software on any University IT facility unless the installation is designated as part of their authorised work.
IT facilities are provided for use in the University's teaching and learning, research, administrative and business activities. They are not provided for private personal use, although it is recognised that, as with the telephone, there will be limited use for personal purposes (see below section 2.5).
Some types of unacceptable use, for example transmission of material of an obscene nature, are specifically prohibited by the Policy on Acceptable Use of IT Facilities and by State and Commonwealth law. The policy contains an appendix listing relevant legislation and University policy and procedures.
Unacceptable use of IT facilities is set out in section 5.3 of the Policy on Unacceptable Use. Further examples of unacceptable use include:
In relation to use of the web, it may not always be possible to tell if a web page is relevant until it has been read and web search engines and links can sometimes lead to irrelevant and inappropriate websites. In these cases usage logs may be used to demonstrate that access to inappropriate sites was inadvertent.
Where staff have doubt concerning their authorisation to use any IT facility or about whether a particular use is acceptable, they should seek the advice of their supervisor, a member of Information Strategy & Technology Services (ISTS) or their Division/School IT officer.
There may be some use of University IT facilities for personal purposes that are unrelated to work (eg. internet banking). Such use must be limited, reasonable and appropriate and it must not:
The amount of personal use is at the discretion of a staff member's supervisor or manager and therefore, seek advice from them about using the internet for personal purposes. For information about how use of the internet is monitored, see section 3 on Privacy and Monitoring (below).
If the incident is happening Report the incident directly to University Security
If the incident has happened Report it to the IT Help Desk (x25000)
Where an alleged misuse has been reported to the IT Help Desk or brought to the attention of the Director: Information Strategy & Technology Services or staff members responsible for managing any part of the University's information technology facilities, the Director (or nominee) may:
If an investigation of alleged misuse requires a staff member's use of IT facilities to be examined or monitored they will not necessarily be notified. If the investigation of alleged misuse requires access to the contents of a staff member's computer or e-mail, approval of the Vice Chancellor is required beforehand.
Allegations that constitute misconduct or breaches of the law will be referred to the appropriate authority for investigation. The University will give that authority all reasonable assistance requested including disclosing:
Staff members who do not abide by University policy when using IT facilities, may have their access to IT facilities suspended or be subject to disciplinary action, or civil or criminal legal action. See the Policy on Acceptable Use of IT Facilities.
A member of staff may expect some privacy in relation to their use of the computer and email and internet resources the University makes available to them at work. Despite the use of individual passwords, privacy is limited in the following ways:
Besides technological limitations on privacy, there are other factors that can impinge on privacy. The Office of the Privacy Commissioner provides information on the privacy legislation and how it applies to use of IT by employees. It shows that there are exemptions to the Privacy Principles and an employer's logging of staff activities (email and internet) is not contrary to the legislation as long as it is done lawfully and fairly.
To ensure fairness, the University has provided these Guidelines to inform staff about its practice of monitoring and accessing records relating to use of University IT facilities, including computers, email and the internet.
For information about how the University protects the privacy of information it holds in relation to its students, see the Policy on Confidentiality of Student Information (A 46.1).
The University also informs members of the public about how the University monitors their use of the University web site. See the Privacy statement.
Another limitation on privacy arises from the University's obligation to comply with Freedom of Information legislation.
Under the Freedom of Information (FOI) Act of South Australia, a document is defined as "anything in which information is stored or from which information may be reproduced". Email messages created in the course of fulfilling duties relating to employment are official records covered by the State Records Act (1997) and the Freedom of Information Act (1991), and are subject to the same requirements as hardcopy records. The content of email messages arising from this use remains the property of the University and may be subject to release in accordance with the FOI Act. For further information or advice, contact the Records and Copyright Officer.
The University provides IT facilities for use by staff in relation to the University's teaching and learning, research, administrative and business activities. Routine monitoring of the use of IT facilities is conducted to monitor the costs and acceptable use of University resources. The type of information automatically collected includes:
| Internet | |
|---|---|
|
|
The University routinely monitors the level of usage to control costs. Cost centres contribute towards these costs and cost centre managers receive summary information that allows them to monitor usage by staff in their cost centre. The costs associated with individual use of IT resources, specifically an individual's use of the internet, are recorded. Information about an individual's level of use of the internet.
Under the GST legislation, use of University resources for other than University business requires apportionment to determine what part of the GST paid for the goods or service can be claimed back by the University. This is another reason why use of University internet or email or other IT facilities for personal purposes must only be incidental and why compliance with law (in this case A New Tax System legislation) may require the University to monitor and inspect records of use.
In normal circumstances, staff supporting IT services will not monitor the contents of electronic mail messages or other communications or files they access as a result of their work (eg auditing operations). However, whenever the Vice-Chancellor decides it is appropriate, the University will inspect, copy, store and disclose the contents of email to prevent or correct improper use, satisfy a legal obligation, or to ensure proper operation of IT facilities.
General notice bulletins to public groups, news groups, or specific work groups can only be sent for the purposes of University business associated with work and staff must comply with the Public Statements by University Staff Policy (C 5.0) as well as with the provisions of the Spam Act outlined above.
To reduce the amount of unwanted and unsolicited email received by staff, approval of the intended message must be obtained from a manager who has approval to send to these lists. The following approvals are required:
All staff:
All Academic Staff:
All General Staff:
All students:
Staff must not circumvent this approval process by intentionally combining many smaller distribution lists to achieve a recipient list similar to All Staff, All Academic Staff or All General Staff.
Distribution lists containing email Addresses are provided as part of the email service. Cost centres each designate a distribution list manager who is responsible for maintaining the accuracy of the cost centre's General Staff and Academic Staff distribution lists. Global Distribution Lists may be created with the approval of cost centre managers. The owners of these lists are responsible for their accuracy.
To help staff use IT resources responsibly, the following information is provided.
Generally, the University is charged for use of the internet involving external (non UniSA) internet sites. It is not charged for use involving only sites within the University. Each area of the University pays for the internet use of staff. The more internet sites a staff member views and the more material downloaded, the more an organisational area pays.
As a result, heads or managers of areas have online access to information regarding the amount and cost of internet use for each individual or group of computers in their area. If a member of staff has used the internet more than a manager expects given the staff member's role, the manager can request ISTS to provide the details of the internet sites the individual has accessed. If the manager believes the amount of use and /or the content of some sites is inappropriate, the matter may be raised with the individual.
More information on level of use.
The most common use of the internet is for accessing world wide web sites. Cost can be minimised by following this advice:
