1. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20031 Acceptable Use Policies and UNREN‘s connection to GÉANT via ACOnet Peter Rastl Vienna University Computer Center Kyiv, 3 April 2003

2. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20032 The Creation of UNREN Application of Ukraine to connect the Ukrainian NREN to Géant network via Vienna (letter of 17 Sept 2002), Physical link Kyiv-Vienna available through cooperation of Ukrtelecom with UTA Telekom (Austria), ACOnet offers connectivity to Géant network at 34 Mbps free of charges for one year (Nov 2002 - Oct 2003), Géant Network Consortium approves the ACOnet proposal (meeting of 30 Sept 2002), (contd.)

3. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20033 The Creation of UNREN (contd.) Agreement between the major stakeholders to create Ukrainian National Research and Education Network “UNREN” (Oct 2002), Kyiv-Vienna link connected to Géant on 4 Nov 2002, State visit of President Leonid Kuchma in Austria: Memorandum of Cooperation signed by ACOnet, UTA Telekom and Ukrtelecom (6 Nov 2002), UNREN Management Committee starts its activities.

4. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20034 Géant Topology

5. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20035 Current Traffic Statistics: GREEN ### Ukraine  ACOnet (Géant) BLUE ### ACOnet (Géant)  Ukraine DARK GREEN### Ukraine  ACOnet (Géant) (maximal 5 min traffic) MAGENTA### ACOnet (Géant)  Ukraine (maximal 5 min traffic)

6. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20036 What is an AUP? AUP = Acceptable (Appropriate) Use Policy An AUP is the set of guidelines determining what a particular network (or computer system) can be used for and what is considered appropriate by the specific institution providing the service. Funding bodies may require restriction of use (e.g. no commercial use, no private use, no reselling)

7. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20037 ”Typically, an acceptable use policy touches upon a variety of legal and policy issues ranging from e-mail etiquette to child pornography, from copyright infringement to software piracy, from freedom of speech to electronic stalking, from privacy to safety of records and monitoring. An acceptable use policy is phrased broadly so that it may encounter new forms of behavior not specifically contemplated at the time the acceptable use policy was created.” Peter Harter, “High Noon? Laws of electronic communities and their roads”, in “OnTheInternet” Vol.1 No.1 (ISOC, 1995)

8. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20038 Purpose of an AUP Educate users about why certain activities are harmful and, therefore, prohibited, Provide legal notice of proscribed activities, so that violators can be punished, Protect the service provider against being sued by a grieved user (e.g. for alleged violation of privacy).

9. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 20039 Different areas can be regulated by a specific policy: Access policy Policies concerning who and how one may gain access to a specific computer system, including regulations for dial-up access. E-mail policy Policies concerned with the use of electronic mail, e.g. is the use of e-mail for private correspondence permitted? WWW policy Policies concerned with World Wide Web usage and publication on computer systems, e.g. what kind of content is considered inappropriate? Security policy Policies concerning the security of the network or the computer systems, usually through the use of password or access restrictions.

10. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 200310 Who should have an AUP? Every Internet Service Provider should have an AUP RFC 3013: Recommended Internet Service Provider Security Services and Procedures Networking hierarchy: Locally (university network, school network, company intranet): AUP for end users Nationally (NRENs, commercial ISPs): AUP for customer institutions Internationally (commercial backbones, Géant): possibly AUP-free

11. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 200311 The AUP of an NREN should...... reflect the mission of the NREN and characterise the purpose of the NREN’s services,... clearly identify what constitutes acceptable and unacceptable use of the network,... define the user community addressed with the AUP (local network providers vs. end users),... rely on the existence of AUPs for end users at the level of the NREN’s customers and define the responsibilities delegated to them,... serve as a kind of contract between the NREN and its customers,... refer to the applicable national legislation (e.g. data protection, copyright, protection of minors, criminal law), (contd.)

12. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 200312 The AUP of an NREN should... (contd.)... entitle the NREN to sanctions in the case of inappropriate use and describe the consequences of AUP violations,... contain a disclaimer to absolve the NREN – under certain circumstances - from responsibility,... be adequately announced to the users and easily accessible on the Internet,... inform about the procedures how to report network abuse,... be adaptable to future changes in habits of network usage and abuse and to changes of technology or legislation,... allow for modification without prior consent of the NREN’s customers.

13. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 200313 General Code of Conduct No transmission, distribution or storage of material... which is in violation of any applicable law or regulation, that will infringe rights of others (e.g. privacy, intellectual property) that is fraudulent, obscene, defamatory, threatening, abusive or hateful, that contains harmful components (e.g. virus, worm, Trojan horse), that serves to obtain unauthorised access (e.g. port scanning, password probing), that serves to deliberately harm the functioning of the network (e.g. denial of service attacks, attempts to crash computer systems, exploitation of system vulnerabilities).

14. Academic & Research Networking in Ukraine, Kyiv, 2-6 April 200314 Some useful links: RFC 3013: http://www.ietf.org/rfc/rfc3013.txt Ronald B. Standler (2002): “Issues in a Computer Acceptable Use Policy” http://www.rbs2.com/policy.htm A compilation of computer policy documents: http://www.educause.edu/ICPL/policies.asp? AUPs of European NRENs: http://www.dante.net/geant/connect.html