1. Computer and Network Use Policies ITSS 4201 Internet Insurance and Information Hiding ► University of Palestine ► Eng. Wisam Zaqoot ► Feb 2010

2. Computer and Network Use Policies We have laws. Why do we need Policies? We have laws. Why do we need Policies? - Laws are general principles that admit no context, because they are supposed to apply in any context. - Policies depend on particular personalities, on particular institutions, on particular situations; it is immensely context- dependant.

3. How to communicate the use policy:  Word of mouth  Employee manuals  Banners

4. What a Network Use Policy may include : * It may state that the use of the network constitutes consent to monitoring. - This helps establish consent for: ► Provider monitoring ► Law enforcement monitoring

5. What a Network Use Policy may include : * It may state that the use of the network constitutes consent to retrieval and disclosure of information stored on the network.

6. What a Network Use Policy may include : * It may state that the use of the network constitutes consent to retrieval and disclosure of information stored on the computer.

7. Example: An employee sued Univ. of Nebraska: ► Search of employee computer done in response to a civil suit. ► Employee sued for breach of privacy. ► Court found:  No reasonable expectation of privacy because computer use policy indicated computer could be searched when university was responding to discovery  Concurring opinion noted that university policy were to some degree private

8. What a Network Use Policy may include : * With government networks, the policy may state that the user of the network shall have no reasonable expectation of privacy in the network. - This helps establish that user lacks a reasonable expectation of privacy.

9. What a Network Use Policy may include : * In the case of non-government network, the policy may make clear that the network system administrator may consent to a law enforcement search. -This gives the system administrator ’ s common authority to consent to a search.

10. What a Network Use Policy may include : * It may contain limitations or authorizations relating to the purpose of any monitoring / search, and what will be done with the fruits of any monitoring / search. - Do you want to limit why you can monitor? - Where do you want to be able to use the information found?

11. What a Network Use Policy may include : * It may state what users are unauthorized to access the network, and the consequences of unauthorized use of he network? - Makes it easier to determine what use is unauthorized?

12. An example of a policy banner: ► WARNING! This computer system is the property of the University of Palestine and may be accessed only by authorized users. Unauthorized use of this system is strictly prohibited and may be subject to criminal prosecution. The University may monitor any activity or communication on the system and retrieve any information stored within the system. By accessing and using this computer, you are consenting to such monitoring and information retrieval for law enforcement and other purposes. Users should have no expectation of privacy as to any communication on or information stored within the system, including information stored locally on the hard drive or other media in use with this unit (e.g., floppy disks, flash memories, CD-ROMs, etc.) - What do you think?

13. The following topics: * Internet laws * Computer and Internet privacy * Case study: Data Protection Act 1998 (UK) * Computer Crimes * Software licensing