Approved by the Council of Rhode Island College 9 May 1997
Adapted from the University of Delaware Policy for Responsible Computing, dated February 2, 1993.
The Committee on Academic Computer Usage wishes to acknowledge and ascribe
the source of these Guidelines to the University of Delaware "
Guidelines
for Implementing the University of Delaware Policy for Responsible Computing,"
prepared by staff in Computing and Network Services, University of Delaware,
and approved by the Faculty Senate of the University of Delaware on May 11,1992.
The Committee replaced "University of Delaware" and related terms with "Rhode Island College" and related local terms. References to organization units at the University of Delaware were replaced by corresponding, or nearly corresponding, units at Rhode Island College. Some language was changed, but all the remaining text is directly attributable to the University of Delaware Guidelines.
Permission to adapt the University of Delaware Guidelines was received via electronic mail from Susan Allmendinger susan@UDel.edu of the University of Delaware on Wednesday, 06 Dec 1995 14:21:54. The University of Delaware Guidelines are available via:
http://www.udel.edu/ecce/guide.020293.html
The computer has become a common denominator that knows no intellectual, political, or bureaucratic bounds; the Sherwin Williams of necessity that covers the world, spanning all points of view.
...I wish that we lived in a golden age, where ethical behavior was assumed; where technically competent programmers respected the privacy of others; where we didn't need locks on our computers....
Fears for security really do louse up the free flow of information. Science and social progress only take place in the open. The paranoia that hackers leave in their wake only stifles our work.
Cliff Stoll, in The Cuckoo's Egg: Tracking a spy through the maze of computer espionage
One of the interesting facets of Cliff Stoll's The Cuckoo's Egg is his growing awareness of the responsibilities all computer users have to each other. It is our hope that this set of Guidelines can foster that same understanding in the Rhode Island College community.
It is imperative that all users of the College's computing and information resources realize how much these resources require responsible behavior from all users. Simply put, we are all responsible for the well-being of the computing, network, and information resources we use.
Universities and Colleges do try to promote the open exchange of ideas; however, an open, cooperative computing network can be vulnerable to abuse or misuse. As more and more schools, colleges, universities, businesses, government agencies, and other enterprises become attached to the world-wide computing and information networks, it is more important than ever that this College educate its students, faculty, and staff about proper ethical behavior, acceptable computing practices, and copyright and licensing issues. A modern university or college must also educate its students, faculty, and staff about how computer abuse can interfere with the exchange of ideas that is integral to a modern education.
The first item in the body of this document is the Policy for Responsible Computing at Rhode Island College, approved by the Council of Rhode Island College on 9 May 1997. The remainder of this document consists of recommended guidelines for implementing this policy. If you have any questions about the policy or the guidelines, please consult with your system administrator, with the staff in the Computer Center, or with your dean, project director, supervisor, chair, or advisor.
Back to topAdministrative Officer
President, vice-president, dean, chair, or director to whom an individual reports.
Computer Account
The combination of a user number, user name, or user id and a password that allows an individual access to a resource-shared computer or network.
Data Owner
The individual or department who can authorize access to information, data, or software and who is responsible for the integrity and accuracy of that information, data, or software. The data owner can be the author of the information, data, or software or can be the individual or department who has negotiated a license for the College's use of the information, data, or software.
Desktop Computers, Microcomputers, Advanced Workstations
Different classes of smaller computers, some shared, some single-user systems. If owned or leased by the College or if owned by an individual and connected to a College-owned, leased, or operated network, use of these computers is covered by the Policy for Responsible Computing.
Information Resources
In the context of these Guidelines, this phrase refers to data or information and the software and hardware that makes that data or information available to users.
Network
A group of computers and peripherals that share information electronically, typically connected to each other by either cable or satellite link.
Normal Resource Limits
The amount of disk space, memory, printing, etc. allocated to your computer account by that computer's system administrator.
Peripherals
Special-purpose devices attached to a computer or computer network--for example, printers, scanners, plotters, etc.
Project Director
Person charged with administering a group of computer accounts and the computing resources used by the people using those computer accounts.
Resource-shared Computers
"Central" computers usable by several people at once. Also referred to as "time-sharing systems."
Server
A computer that contains information shared by other computers on a network.
Software
Programs, data, or information stored on various media, usually magnetic and/or optic. Normally used to refer to computer programs.
System Administrator
Staff employed by a central computing agency such as the Computer Center whose responsibilities include system, site, or network administration and personnel employed by other College departments whose duties include system, site, or network administration. System administrators perform functions including, but not limited to, installing hardware and software, managing a computer or network, and keeping a computer operational. If you have a computer on your desk, you may be acting, in whole or in part, as that system's system administrator.
User
Someone who does not have system administrator responsibilities for a computer system or network but who makes use of that computer system or network. A user is still responsible for his or her use of the computer and for learning proper data management strategies.
Back to topIn support of its mission of teaching, research, and public service, Rhode Island College provides access to computing and information resources for students, faculty, and staff, within institutional priorities and financial capabilities.
The Policy for Responsible Computing at Rhode Island College contains the governing philosophy for regulating faculty, student, and staff use of the College's computing resources. It spells out the general principles regarding appropriate use of equipment, software, and networks. By adopting this policy, the Council of Rhode Island College recognizes that all members of the College are also bound by local, state, and federal laws relating to copyrights, security, and other statutes regarding electronic media. The policy also recognizes the responsibility of faculty and system administrators to take a leadership role in implementing the policy and assuring that the College community honors the policy.
Back to topAll members of the College community who use the College's computing and information resources must act responsibly. Every user is responsible for the integrity of these resources. All users of College-owned or College-leased computing systems must respect the rights of other computing users, respect the integrity of the physical facilities and controls, and respect all pertinent license and contractual agreements. It is the policy of Rhode Island College that all members of its community act in accordance with these responsibilities, relevant laws and contractual obligations, and the highest standard of ethics.
Access to the College's computing facilities is a privilege granted to College students, faculty, and staff. Access to College information resources may be granted by the owners of that information based on the owner's judgment of the following factors: relevant laws and contractual obligations, the requestor's need to know, the in formation's sensitivity, and the risk of damage to or loss by the College.
The College reserves the right to limit, restrict, or extend computing privileges and access to its information resources. Data owners -- whether departments, units, faculty, students, or staff -- may allow individuals other than College faculty, staff, and students access to information for which they are responsible, so long as such access does not violate any license or contractual agreement; College policy; or any federal, state, county, or local law or ordinance.
College computing facilities and accounts are to be used for the College-related activities for which they are assigned. College computing resources are not to be used for commercial purposes or non-College-related activities without written authorization from the College. In these cases, the College may require payment of appropriate fees. This policy applies equally to all College-owned or College-leased computers.
Users and system administrators must all guard against abuses that disrupt or threaten the viability of all systems, including those at the College and those on networks to which the College's systems are connected. Access to information resources without proper authorization from the data owner, unauthorized use of College computing facilities, and intentional corruption or misuse of information resources are direct violations of the College's standards for conduct as outline d in the Rhode Island College College Handbook of Policies, Practices, and Regulations, the Rhode Island Board of Governors for Higher Education Personnel Policy Manual, College collective bargaining agreements, and the Student Handbook and may also be considered civil or criminal offenses. Under certain unusual circumstances, a system administrator is authorized to access computer files.
Back to topAppropriate College administrators should adopt guidelines for the implementation of this policy within each unit and regularly revise these guidelines as circumstances, including--but not limited to--changes in technology, warrant. The Director of the Computer Center shall, from time to time, issue recommended guidelines to assist departments and units with this effort.
Back to topAlleged violations of this policy shall be processed according to the judicial processes outlined in the Rhode Island College College Handbook of Policies, Practices, and Regulations, the Rhode Island Board of Governors for Higher Education Personnel Policy Manual, College collective bargaining agreements, and the Student Handbook. Rhode Island College treats access and use violations of computing facilities, equipment, software, information resources, networks, or privileges seriously and may also prosecute abuse under the General Laws of Rhode Island, Title 11, Chapter 52: Computer Crime, the Computer Fraud and Abuse Act of 1986, or other appropriate laws.
RIC Policy Drafted: 15 December 1995
RIC Policy Approved: 9 May 1997.
Back to topIf you use the College's computing resources or facilities, you have the following responsibilities:
Use the College's computing facilities and information resources, including hardware, software, networks, and computer accounts, responsibly and appropriately, respecting the rights of other computing users and respecting all contractual and license agreements. [The software made available by the College has been licensed by the College for your use. As a result ,its use may be subject to certain limitations.]
Use only those computers and computer accounts for which you have authorization.
Use resource-shared computer accounts only for the purpose(s) for which they have been issued. Use College-owned microcomputers and advanced workstations for College-related projects only.
Be responsible for all use of your accounts and for protecting each account's password. In other words, do not share computer accounts. If someone else learns your password, you must change it. or have it changed by your system administrator if you cannot do it yourself.
Report unauthorized use of your accounts to your project director, instructor, supervisor, system administrator, or other appropriate College authority.
Cooperate with system administrator requests for information about computing activities. Under certain unusual circumstances, a system administrator is authorized to access computer files. See User Confidentiality and System Integrity
Take reasonable and appropriate steps t o see that all hardware and software license agreements are faithfully executed on any system, network, or server that you operate.
Each user is ultimately responsible for his or her own computing and his or her own work using a computer. Take this responsibility seriously. For example, users should remember to make backup copies of their data, files, programs, diskettes, and tapes, particularly those created on microcomputers and those used on individually- or departmentally-operated systems. Further more, users with desktop computers or other computers that they operate themselves must remember that they may be acting as the system administrators for those computers and need to take that responsibility very seriously.
If you are a project direct or for a group of resource-shared computing users, a supervisor whose staff use computers, or a faculty member whose students use computers, you must help your project members, staff, or students learn more about ethical computing practices. You should also help your project members, staff, or students learn about good computing practices and data management.
Back to topThis document uses the phrase system administrator to refer to all of the following College personnel: staff employed by a central computing agency such as the Computer Center whose responsibilities include system, site, or network administration personnel employed by other College departments whose duties include system, site, or network administration.
A system administrator's use of the College's computing resources is governed by the same guidelines as any other user's computing activity. However, a system administrator has additional responsibilities to the users of the network, site, system, or systems he or she administers:
A system administrator manages systems, networks, and servers to provide available software and hardware to users for their College computing.
A system administrator is responsible for the security of a system, network, or server.
A system administrator must take reasonable and appropriate steps to see that all hardware and software license agreements are faithfully executed on all systems, networks, and servers for which he or she has responsibility.
A system administrator must take reasonable precautions to guard against corruption of data or software or damage to hardware or facilities. The College is not responsible for loss of information from computing misuse, malfunction of computing hardware, malfunction of computing software, or external contamination of data or programs. The staff in central computing units such as the Computer Center and all other system administrators must make every effort to ensure the integrity of the College's computer systems and the information stored thereon. However, users must be aware that no security or back-up system is 100.00% foolproof.
A system administrator must treat information about and information stored by the system's users as confidential.
As an aid to a better understanding of responsible computing practices, all departments that own or lease computing equipment are encouraged to develop "Conditions Of Use" or "Guidelines for Responsible Computing" documentation for all systems that they operate and to make these documents available to users. These documents should be consistent with the Policy for Responsible Computing at Rhode Island College and should be approved by the department's administrative officer or other individual designated by that administrative officer.
Back to topThe College characterizes misuse of computing and information resources and privileges as unethical and unacceptable and as just cause for taking disciplinary action. Misuse of computing and information resources and privileges includes, but is not restricted to, the following:
If a system administrator is an eyewitness to a computing abuse; notices an unusual degradation of service or other aberrant behavior of the system, network, or server for which he or she is responsible; or receives a complaint of computing abuse or degradation of service, he or she should investigate and take steps to maintain the integrity of the system(s). If a system administrator has evidence that leads to a user's computing activity as the probable source of a problem or abuse under investigation, he or she must weigh the potential danger to the system and its users against the confidentiality of that user's in formation.
Back to topWhile investigating a suspected abuse of computing; a suspected hardware failure; a disruption of service; or a suspected bug in an application program, compiler, network, operating system, or system utility, a system administrator should ordinarily ask a user's permission before inspecting that user's files, diskettes, or tapes. The next two paragraphs outline exceptions to this rule.
If, in the best judgment of the system administrator, the action of one user threatens other users or if a system or network for which the system administrator is responsible is in grave, imminent danger of crashing, sustaining damage to its hardware or software, or sustaining damage to user jobs, the system administrator should act quickly to protect the system and its users. In the event that he or she has had to inspect user files in the pursuit of this important responsibility, he or she must notify, as soon as possible, his or her own administrative officer or other individual designated by that administrative officer of his or her action and the reasons for taking that action. The administrative officer needs to be certain that one of the following are also notified as soon as practical (ordinarily within one business day): the user or users whose files were inspected; the user's supervisor, project director, administrative officer , or academic advisor.
In cases in which the user is not available in a timely fashion, in which the user is suspected of malicious intent to damage a computer system, or in which notifying the user would impede a sensitive investigation of serious computer abuse, the system administrator may inspect the information in question so long as he notifies his or her own administrative officer or other individual designated by the administrative officer of his or her actions and the reasons for taking those act ions. The administrative officer needs to be certain that the user's supervisor, project director, administrative officer, or academic advisor is notified of the situation. In the case of suspected malicious intent, the administrative officer may also need to refer the matter to the appropriate College judicial body.
Back to topA system administrator may find it necessary to suspend or restrict a user's computing privileges during the investigation of a problem. The system administrator should confer with his or her administrative officer or other person designated by that administrative officer before taking this step. A user may appeal such a suspension or restriction and petition for reinstatement of computing privileges through the College's judicial system, through the grievance procedures outlined in College collective bargaining agreements, or by petition to the Dean of Students.
In general, then, a system administrator should:
If staff in the Computer Center, or office of Security and Safety, or system administrators have a preponderance of evidence that intentional or malicious misuse of computing resources has occurred, and if that evidence points to the computing activities or the computer files of an individual, they have the obligation to pursue any or all of the following steps to protect the user community:
Guidelines for Implementing the University of Delaware
Policy for Responsible Computing, prepared by staff in Computing and Network
Services University of Delaware, and approved by the Faculty Senate of the
University of Delaware on May 11, 1992.
The General Laws of Rhode Island, Title 11, Chapter 52: Computer Crime.
Rhode Island Board of Governors for Higher Education Personnel Policy Manual.
Rhode Island College College Handbook of Policies, Practices, and Regulations, Revised July, 1993.
Rhode Island College Student Handbook, 1994-96.
Back to topAugustine, Charles. The Pieces of a Policy: Categories for Creation of a Computer Ethics Policy. Capitalizing on Communication: Proceedings of ACM SIGUCCS User Services Conference XVII. 1989.
Baylor University. Computer Policies. 1989. Copy located in the computer file ethics/Baylor.policy on ariel.unm.edu.
Catholic University of America, The. Statement of Ethics in the Use of Computers. 1988. [Reprinted in ACM SIGUCCS Newsletter. Volume19, Number 1. 1989.]
Chapman, Gary. CPSR [Computer Professionals for Social Responsibility] Statement on the Computer Virus. Communications of the ACM. Volume 32, Number 6. 1989.
Colgate University. Agreement for use of Computing Facilities. 1989.Copy located in the computer file ethics/ColgateU.policy on ariel.unm.edu.
Columbia University. Administrative Policies [of the Center for Computing Activities]. No date. Copy located in the computer file ethics/ColumbiaU.policy on ariel.unm.edu.
Corporation for Research and Educational Networking. Acceptable Use of CSNET and BITNET. 1990. Received via electronic mail from BernardA. Galler, March 23, 1990.
Delaware Code (Annotated). Computer Related Offenses. Title 11, 931939. 1987.
Delaware Code (Annotated), 1989 Supplement. Computer Related Offenses. Title 11, 937. 1989.
EDUCOM and ADAPSO. Using Software: A guide to the ethical and legal use of software for members of the academic community. EDUCOM. 1987.
Eichin, Mark W. and Jon A. Rochlis. With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988. Paper presented at1989 IEEE Symposium on Research in Security and Privacy. Copy located in the file pub/virus/mit.PS on bitsy.mit.edu.
Ermann, M. David; Mary B. Williams; and Claudio Gutierrez. Computers, Ethics, and Society. Oxford University Press. 1990.
Farber, David J. NSF [National Science Foundation] Poses Code of Networking Ethics. Communications of the ACM. Volume 32, Number 6.1989.
Fraser Valley College. DRAFT: Fraser Valley College Computing and Ethics Policy, April 23, 1991. Copy received via electronic mail,April 24, 1991, from Paul Herman, Fraser Valley College.
Hafner, Katie and John Markoff. Cyberpunk: Outlaws and Hackers on the Computer Frontier. Simon and Schuster. 1991.
Hoffman, W. Michael and Jennifer Mills Moore, eds. Ethics and the Management of Computer Technology: Proceedings of the Fourth National Conference on Business Ethics Sponsored by the Center for Business Ethics, Bentley College. Oelgeschlager, Gunn, and Hain. 1982.
Indiana University, Academic Computing Policy Committee, Subcommittee on Ethical Use of Computers. Computer Users' Privileges and Responsibilities: Indiana University. 1990. Copy received via electronic mail April 25, 1990, from Mark Sheehan, Indiana University Computing Services.
Internet Activities Board. Ethics Policy Statement. 1988. [Reprinted in Purdue University's PUCC Newsletter. March 1989.]
Internet Engineering Task Force. Site Security Handbook: RFC 1244. P. Holbrook and J. Reynolds, eds. July 1991. Copy located in the file pub/ssphwg/rfc1244.txt on cert.sei.cmu.edu.
Johnson, Deborah G. Computer Ethics. Prentice Hall. 1985.
Lees, John. [Michigan State University] College of Engineering Computer Use Policy - DRAFT. 1990. Received via electronic mail April 23, 1990, from John Lees.
Mason, Margaret Loy. Students, Ethics & Electronic Communication:An Adventure in User Education. New Centering in Computing Services:Proceedings of ACM SIGUCCS User Services Conference XVIII. 1990.
National Science Foundation. NSFNET Interim Conditions of Use Policy.LINK LETTER. Volume 3, Number 3. 1990. Also available in the file nsfnet/netuse.txt on nis.nsf.net.
Parker, Donn B.; Susan Swope; and Bruce N. Baker. Ethical Conflicts in Information and Computer Science, Technology, and Business. QED Information Sciences, Inc. 1990.
Ryland, Jane N. Security--A Sleeper Issue Comes into its Own.CAUSE/EFFECT. Volume 12, Number 4. 1989.
Software Publishers Association. Software Use and the Law: A guide for individuals, educational institutions, user groups, and corporations. No date.
Spafford, Eugene H. Some Musings on Ethics and Computer Break-Ins. 1989. Copy located in the file pub/virus/spaf.PS.Z on bitsy.mit.edu.
Stoll, Cliff. The Cuckoo's Egg: Tracking a spy through the maze of computer espionage. Doubleday. 1989.
Syracuse University. Computer Use Policy. No date.
Temple University. Rules of Conduct for Using Computing Resources at Temple University. 1988.
University of Delaware. Academic Honesty & Dishonesty: Important information for faculty and students. 1989.
University of Delaware. Code of Conduct. Official Student Handbook. 1991.
University of Delaware. Code of Ethics. Personnel Policies and Procedures for Professional and Salaried Staff. 1991.
University of Delaware. Computer Software. University of Delaware Policy Manual. Policy 6-9. 1989.
University of Delaware. Misconduct in Research. University of Delaware Policy Manual. Policy 6-11. 1989.
University of Delaware. University of Delaware Faculty Handbook. 1991 [on-line edition consulted].
University of Delaware. 1989-1990 Residence Halls Handbook. 1989.
University of Delaware Libraries. Circulation Procedures and Services. No date.
University of Michigan, Ann Arbor. Think About It: The Proper Use of Information Resources, Information Technology, and Networks at the University of Michigan. No Date.
University of New Mexico. UNM Ethics Code for Computer Use [Draft].1989. Copy located in the computer file ethics/UofNewMexico.policy on ariel.unm.edu.
Weissman, Ronald F. E. Ethical and Responsible Computing. The OPENWINDOW (Brown University), Volume 3, Number 1. 1989. [Cited in Ryland's article.]
Back to top