MEMORANDUM INFORMATION TECHNOLOGY SERVICES DEPARTMENT TO: John Phillips, City Manager Number: 04-020 SUBJECT: Computer Network, Internet and E-Mail Access Policy Date: 9/903 Attached is copy of the Information Technology Services Computer Network, Internet and E- mail Access Policy. The Personnel Department, the City Attorney and the Customer Board of Users have reviewed and approved this document. Some of the reasons for creating this policy are: To provide staff with guidance on the proper use of the City s information technology resources. To limit legal liability. To define the City of Rock Island s email document retention policy. To allow the City of Rock Island to secure the systems used for Internet communications and the data transmitted by these systems. To clarify staff s expectation of privacy To allow the City of Rock Island to monitor and record all IT resources usage To allow the City of Rock Island to utilize software to identify and block access to Internet sites containing sexually explicit or other material deemed inappropriate. Informational meetings will be scheduled at all facilities with all staff that have access to information technology (IT) and data telecommunications resources. RECOMMENDATION: The Information Technology Services Department and the Customer Board of User recommends that the Council approve the attached Computer Network, Internet and E-Mail Access Policy and that this Policy be recognized, distributed, approved and enforced by the City of Rock Island. Submitted by: Claire Dubuisson, Information Technology Services Director APPROVED:
City of Rock Island Computer Network, Internet and E-Mail Access Policy Disclaimer The Internet is a worldwide network of computers that contains millions of pages of information. Users are cautioned that many of these pages include offensive, sexually explicit and inappropriate material. In general, it is difficult to avoid at least some contact with this material while using the Internet. Even innocuous search requests may lead to sites with highly offensive content. Additionally, having an e- mail address on the Internet may lead to receipt of unsolicited e-mail containing offensive content. Employees accessing the Internet do so at their own risk and the City of Rock Island ( The City ) is not responsible for material viewed or downloaded by users from the Internet. To minimize these risks, your use of the Internet at the City is governed by the following policy: 1) SCOPE. The policy applies to all staff that uses the City of Rock Island information technology (IT) and data telecommunications resources. 2) DURATION. Permanent 3) EFFECTIVE DATE. (Insert Date adopted by City Council) 4) OBJECTIVE. The purpose of this policy is to provide staff with guidance on the proper use of the City s information technology resources, including but not limited to the Internet, the Intranet, email, and the City s digital network and supporting systems. POLICY. The computer network is the property of the City of Rock Island and is to be used for legitimate business purposes. The Internet and other information technology resources are important assets that the City can use to gather information to improve external and internal communications and increase efficiency in business relationships. Employees are provided access to the computer network to assist them in the performance of their jobs. Additionally, certain employees may also be provided with access to the Internet through the computer network. All employees have a responsibility to use the City s computer resources and the Internet in a professional, lawful and ethical manner. To encourage the effective and appropriate use of the City s IT resources, the following policies are placed in effect: a. The City of Rock Island Personnel Department shall provide all staff that has access to information technology resources with a written copy of this policy. i. All staff shall sign and date a statement indicating they have received and read this policy. This requirement includes all current and future staff. ii. The Personnel Department shall keep the staff member s signed statement on file throughout the tenure of the staff member. b. For the purposes of this policy, IT resources usage includes but is not limited to all current and future software applications, Internet/Intranet communications services, the World Wide Web, City Intranet, Voice over IP, File Transfer Protocol (FTP) Telnet, email, peerto-peer exchanges, and various proprietary data transfer protocols and other services. c. The City of Rock Island Information Technology Services Department may undertake all prudent and reasonable measures to secure the systems it uses for Internet communications City of Rock Island Internet Access Policy, Standard Page 1
and the data transmitted by these systems and services. d. The City of Rock Island Information Technology Services Department may install software and/or hardware to monitor and record all IT resources usage, including email, all communication sent and received by employees, chat and newsgroups exchanges, file downloads, and Web site visits. The City retains the right to record or inspect any and all files stored on the City of Rock Island s systems. e. The City of Rock Island has the right to utilize software that makes it possible to identify and block access to Internet sites containing sexually explicit or other material deemed inappropriate in the workplace. f. Staff shall utilize the City of Rock Island s IT resources solely for City business purposes (except as described in Section 10) and shall conduct themselves in a manner consistent with appropriate behavior standards as established in existing City policies. All existing City of Rock Island policies relating to intellectual property protection, privacy, misuse of City equipment, sexual harassment, sexually hostile work environment, data security, and confidentiality apply to staff use of IT resources. Staff must also comply with laws governing political speech. g. Staff must not give their USERID and/or PASSWORD to someone else for use by another user. 5) PRIVACY. Staff shall have no expectations of privacy with respect to City IT resource usage. Employees are given computers and Internet access to assist them in the performance of their jobs. Employees should have no expectation of privacy in anything they create, store, send, or receive using the city s IT resources. The network is the property of the City and may be used only for City purposes. Employees are advised that serious disciplinary action up to and including termination of employment may result from evidence of prohibited activity obtained through monitoring or inspection of electronic messages, files, or electronic storage devices. Illegal activity involving City IT resource usage may be referred to appropriate authorities for prosecution. a. Waiver of privacy rights Employees expressly waive any right of privacy in anything they create, store, send or receive using the City s IT resources or Internet access. Employees consent to allow City personnel access to and review of all materials created, stored, sent, or received by employees through any City network or Internet connection. 6) PROHIBITED INTERNET USE. Staff shall not use any City IT resources for anything other than official City business unless otherwise specifically allowed by their supervisor or another authority designated by the City Manager. Personal use of the City s IT resources shall be permitted only in accordance with Section 10 of this policy. a. Staff shall not upload or otherwise transfer out of the City s direct control any software licensed to the City nor data owned or licensed by the City without explicit authorization from the manager responsible for the software or data. b. Staff shall not use IT resources to reveal confidential or sensitive information, client data, or any other information covered by existing city, state or federal privacy or confidentiality laws, regulations, rules, policies, procedures, or contract terms. Staff who engage in the unauthorized release of confidential information via the City s IT resources, including but not limited to newsgroups or chat rooms, will be subject to sanctions in existing policies and procedures associated with unauthorized release of such information. c. Staff shall respect the copyrights, software, licensing rules, property rights, privacy, and prerogatives of others, as in any other business dealings. d. Staff shall not download executable software, including freeware and shareware. If it is required to complete their job responsibilities, a request will be made to the Information City of Rock Island Internet Access Policy, Standard Page 2
Technology Services Department and their staff will take the appropriate steps to acquire the software requested. e. Staff shall not use City equipment to download or distribute pirated software or data, including music or video files. f. Staff shall not use City IT resources to deliberately propagate any malicious code. g. Staff shall not use City IT resources to intentionally disable or overload any computer system or network, or to circumvent any system intended to protect the privacy or security of the City s IT resources. h. Unauthorized dial-up access to the Internet is prohibited from any device that is attached to any part of the City s network. Staff shall not use the City s IT resources to establish connections to non-city internet service providers unless they are authorized to do so in writing by the Information Technology Services Department of the City of Rock Island. To ensure security and avoid the spread of viruses, employees accessing the Internet through a computer attached to the City s network must do so through an approved Internet firewall or other security device. Bypassing the City s computer network security by accessing the Internet directly by modem or other means is strictly prohibited unless the computer you are using is not connected to the City s network. i. Staff shall not access, store, display, distribute, edit, or record sexually explicit material using City IT resources. Violation of this policy may result in immediate disciplinary action as described in Section 11, up to and including termination of employment. The incidental and unsolicited receipt of sexually explicit material, such as might be received through email, shall not constitute a violation of this section, provided that the material is promptly deleted and neither stored nor forwarded to other parties. j. Staff are prohibited from accessing or attempting to access IT resources for which they do not have explicit authorization by means of user accounts, valid passwords, file permissions or other legitimate access and authentication methods. k. Staff shall not use City IT resources to override or circumvent any security mechanism belonging to the City or any other government agency, organization or company. l. Staff shall not use City IT resources for illegal activity, gambling, or to intentionally violate the laws or regulations of the United States, any state or local jurisdiction, or any other nation. 7) Prohibited Email Use. Email is a business communication tool and users are obliged to use this tool in a responsible, effective and lawful manner. Although by its nature email seems to be less formal than other written communication, the same laws apply. Therefore, it is important that users are aware of the legal risks of email. By following this policy, the email user can minimize the legal risks involved in the use of email. If any user disregards the rules set out in this policy, the user will be considered by the City to be liable and the City of Rock Island will disassociate itself from the user as far as legally possible. a. Staff shall not send or forward emails with any libelous, defamatory, offensive, racist or obscene remarks. b. Staff shall not forward confidential information they receive. c. Staff shall not send or forward an attachment that contains a virus. d. Staff shall not forge or attempt to forge email messages. e. Staff shall not disguise or attempt to disguise your identity when sending mail. f. Staff shall not send email messages using another person s email account. If you receive an email that violates any of the above, you must promptly notify your supervisor. Violation of this policy may result in immediate disciplinary action as described in Section 11, up to City of Rock Island Internet Access Policy, Standard Page 3
and including termination of employment. Illegal activity involving City IT resource usage may be referred to appropriate authorities for prosecution. 8) Frivolous Use Computer resources are not unlimited. Network bandwidth and storage capacity have finite limits, and all employees connected to the network have a responsibility to conserve these resources. As such, employees must not deliberately perform acts that waste computer resources or unfairly monopolize resources to the exclusion of others. These acts include, but are not limited to, sending/forwarding mass mailings or chain letters, spending excessive amounts of time on the Internet, playing games, engaging in online chat groups, installing and using instant messenger software such as ICQ or MSN/YAHOO Messenger, accessing streaming audio and/or video content such as Morpheous, Napster, or similar for personal use, or otherwise creating unnecessary loads on network traffic associated with non-work-related uses of the Internet. 9) Virus detection Files obtained from sources outside the city, including disks brought from home, files downloaded from the Internet, newsgroups, bulletin boards, or other online services, files attached to e-mail, and files provided by customers or vendors, may contain dangerous computer viruses that may damage the City's computer network. Users should never download files from the Internet, accept e-mail attachments from outsiders, or use disks from non-city sources, without first scanning the material with City-approved virus checking software. If you suspect that a virus has been introduced into the City's network, notify the City immediately. 10) PERSONAL USE OF THE INTERNET. Occasional and incidental personal use of the City s IT resources and Internet access is allowed subject to limitations. a. Personal use of the Internet is prohibited if: i. It materially interferes with the use of IT resources by the City; or ii. Such use burdens the City with additional costs; or iii. Such use interferes with the staff member s employment duties or other obligations to the City; or iv. Such personal use includes any activity that is prohibited under this policy. 11) ENFORCEMENT AND SANCTIONS. a. Staff to be designated by the City Manager shall investigate violations of this policy promptly. b. Staff suspected of violating this policy shall be given notice of an investigation and an opportunity to present any relevant, exculpatory evidence or mitigating circumstances regarding the charge of the violation. c. If the investigation shows the staff member violated this policy, the staff member may be subject to suspension or termination of access to IT resources, as well as disciplinary action up to and including termination of employment. If the investigation shows the staff member to have engaged in any of the activities prohibited in this policy, disciplinary proceedings will commence in accordance with the City Personnel Act and Rules and/or Labor Agreements. Document Retention Policy The State of Illinois recommended E-Mail Retention Policy for Local Government Agencies in Illinois is as follows: City of Rock Island Internet Access Policy, Standard Page 4
The agency may delete all messages from the server thirty (30) days after they have been opened. Employees have the same responsibilities for e-mail messages as they do for any other public record and must distinguish between records and non-record information. Non-record messages should be deleted from files as soon as they have fulfilled their purpose, while messages determined by users to be records should be properly preserved and disposed of as specified in this approved records retention schedule. Messages and attachments determined to be records may be saved to electronic files or printed and retained in paper format if the printout fully documents the electronic mail record (time, date, sender and receiver). For determination of what constitutes a record, please refer to your Department s record retention manual. The City of Rock Island Information Technology Services Department can assist you in proper archival techniques should you have need. Be advised that backups of the entire Email System are not required and therefore not every message on the system is retained. City of Rock Island Internet Access Policy, Standard Page 5
This Page is intentional left blank City of Rock Island Internet Access Policy, Standard Page 6
Acknowledgement of Understanding I have read and agree to comply with the terms of this policy governing the use of the City of Rock Island s Information technology (IT) and data telecommunications resources. I understand that violation of this policy may result in disciplinary action, including possible termination and civil and criminal penalties. Signature Date Printed name City of Rock Island Internet Access Policy, Standard Page 7