Acceptable Use of University Information Technology Policy

AUDIENCE

All constituents utilizing Thomas More University Information Technology Resources.  This includes all University employees, students, vendor partner employees and University guests.

PURPOSE STATEMENT

The purpose of this Policy is to notify Authorized Users of Thomas More University’s Information Technology Resources of their responsibilities.  This Policy provides guidance about the nature of acceptable and unacceptable uses of the University’s Information Technology Resources.  It is not an exhaustive list.  The determination of unacceptable use will be made at the sole discretion of school administration.

DEFINITIONS

Authorized User(s): are all users of the University’s Technology Resources including, but not limited to, employees, temporary employees, students, alumni, campus visitors, contractors, vendors, consultants and their related personnel, and other users authorized by the University to access its Technology Resources systems and networks.

Institutional Data: is any information that can be linked to any individual, including but not limited to, students, faculty, staff, patients, or contractors.  Institutional Data and all applications storing and transmitting such data, regardless of the media on which they reside, are valuable assets, which the University has an obligation to manage, secure, and protect.

University Information Technology Resources: are assigned computer accounts, email services, and the shared University network(s), which includes resources, staff and facilities operated by the University, whether owned, leased, used under license or by agreement, including, but not limited to: telephones (including mobile devices) and telephone equipment, voice mail, SMS, desktop laptop computers, mobile devices, hardware, software, networks, computing laboratories, databases, files, information, software licenses, computing-related contracts, network bandwidth, usernames, passwords, documentation, disks, CD-ROMs, DVDs, magnetic tapes, and other electronic media or storage devices.  Email, chat, facsimiles, mail, any connection to the University's network(s) or use of any part of the University’s network(s) to access other networks, connections to the Internet that are intended to fulfill information processing and communications functions, communication services, hardware, including printers, scanners, facsimile machines, any off-campus computers and associated equipment provided for the purpose of University work or associated activities.

THE POLICY

I.          Introduction

Thomas More University provides Information Technology Resources in order to support the University and campus community in fulfilling their missions.  This technology is primarily intended to be used for teaching, learning, research, communication, marketing and general operations of the University.  These uses are acceptable and encouraged.  It is expected that each Authorized User will use the University’s Information Technology Resources in accordance with the responsibilities and requirements of their role within the campus community.  It is expected that each Authorized User will use the University’s Information Technology Resources in a manner that is ethical, responsible, cooperative, and in compliance with all applicable policies and laws.

Requests for technology assistance or questions about this policy can be made via the University's IT Services Help Desk, http://helpdesk.thomasmore.edu

II.        Ownership of Systems

Thomas More University provides technology systems to its employees for the performance of their job-related functions and to its students for use while enrolled at the University.  All data and e-mail on the University's network or systems are the property of Thomas More University, except as otherwise defined by the Intellectual Property Policy.  The University will not gather or give data to employees or students upon separation.  Backup of personal data is an Authorized User responsibility.

III.       Monitoring

Thomas More University respects the privacy of its constituents, however access to and monitoring of computer accounts and systems by an IT Services system administrator may be required to comply with administrative or legal requests.  Such access or monitoring will be handled in a professional and confidential manner.

IV.        Policy Requirements and Responsibilities

Use of the University's Information Technology Resources is a privilege granted by the University.  By using the University's Information Technology Resources, Authorized Users agree to abide by all policies and requirements in this Policy, other applicable University and department policies (see e.g., the Employee Policies, Saint’s Community Standards, Copyright Policy, etc.), federal, state and local laws, Title IX, software license agreements, and contracts.  This includes but is not limited to laws pertaining to defamation, privacy, civil rights, trademark, obscenity, and pornography, the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, which prohibit “hacking,” “cracking,” and similar activities.

The University’s Technology Resources may be used for legitimate University purposes only.  While the University makes Technology Resources available primarily to achieve its goals of education and for administrative activities, limited occasional personal use of such resources is permitted to the extent that the activity is within the limits prescribed by this Policy.  Personal information, messages, and data stored in these systems will be treated no differently from other business-related data.

Authorized User must also use the University's Information Technology Resources in a courteous way that does not prevent others from using shared Technology Resources.  This includes using the University's internet connection for any high consumption purposes that will interrupt others from utilizing the same resources.  Thomas More University seeks to provide a welcoming environment, especially to the University’s resident population.  The University also ask that any difficulties with the WiFi or internet connection are reported to IT Services so it is aware and can make appropriate adjustments.

Unacceptable use is prohibited.  In addition to the above, unacceptable use may include, but is not limited to, the following:

• Gambling, pornography, hate, dating services, advertising, commercial use, copyright violation, peer-to-peer file sharing, software license violation, intellectual property right violation, harassment, stalking, Title IX violations, hacking, cracking, etc.
• Sharing passwords - Usernames and passwords are intended to ensure the privacy and confidentiality of Institutional Data. In an academic setting, they are also used to confirm the identity of the student submitting work.  Any password sharing is strictly prohibited.  Authorized Users who suspect unauthorized use of an assigned account are responsible for reporting this to IT Services.
• Any activity deemed to not be in accordance with the mission or values of the University.
• Purposefully introducing malicious programs to the University’s network, computers, or storage areas (e.g., viruses, worms, Trojan horses, etc.) or otherwise attempt to intentionally damage, destroy, or disrupt Technology Resources or the integrity of such resources or waste human or electronic resources as they relate to Technology Resources.
• Deleting or tampering with another Authorized User’s files or with information stored by another user on any information-bearing medium. Even if the Authorized User’s files are unprotected, with the exception of files obviously intended for public reading, such as Webpages, it is improper for another user to read them unless the owner has given permission (e.g., in an announcement in class or on a computer bulletin board).
• Tapping phone or network transmissions, including wireless transmissions.
• Using the University’s Information Technology Resources for private business, commercial or political activities, fundraising or advertising on behalf of non-University organizations or making fraudulent offers of products, items, or services originating from any University account.
• Using a wireless router or other routing or electronic device that has not been authorized for use on the University Network or in conjunction with other University Technology Resources.
• Effecting security breaches or disruptions of network communication. Disruption includes, but is not limited to, network sniffing, ping floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
• Accessing data of which the Authorized User is not an intended recipient or logging into a server or account that the Authorized User is not expressly authorized to access as a function of his/her University position.
• Executing any form of network monitoring which will intercept data not intended for the Authorized User, unless this activity is a part of Authorized User’s normal job or duty.
• Circumventing user authentication or security of any host, network, or account.
• Using any program, script, or command or send messages of any kind, with the intent to interfere with, or disable, an Authorized User’s session.
• Downloading or installing non-academic or non-University business related data or programs unless explicitly authorized by IT Services.
• Abusing email activities, including, but not limited to sending unsolicited email messages, junk mail, spam, or advertising material to individuals who did not specifically request such material; forging or the unauthorized use of email header information; or sending mass emails without proper approval. Please refer to the Mass Email Policy for more information.

Along with the privilege to use Thomas More's technology comes the following responsibilities:

• Protect passwords and do not share;
• Notify IT Services of any suspected data breach;
• Keep confidential information confidential;
• Notify IT Services in any case of lost or stolen computer equipment containing Personally Identifiable Information; and
• Request technology support from IT Services

V.       Email

Thomas More University provides the e-mail system to its employees for the performance of their job-related functions and to its students enrolled at the University.  Email and data on the University's network or systems by its employees is the property of Thomas More University.  Also, pursuant to the Email and Communications policies, email is the official communication mechanism of the University.  As such, all University business, including e-mail communication between students and faculty, shall be conducted via Thomas More University e-mail accounts.

Pursuant to the Mass Email Policy, individuals may not send mass emails without proper approval. Please refer to the Mass Email Policy for more information.

VI.       Security

Using and/or accessing the University’s Technology Resources without proper authorization is strictly prohibited.  All access is denied unless expressly granted.  The University’s Information Technology department generally grants access in the form of computer and network accounts to Authorized Users.  Passwords and/or personal identification numbers protect University accounts.  Authorized Users should use reasonable efforts to keep passwords secure and shall not share accounts.  Authorized Users should also log out or lock their computer at all times when they are away from their computers, laptops, or other devices.

Authorized Users should be aware that authorized administrative personnel can and will take appropriate steps to investigate when there is a suspicion of unacceptable use of the University’s Technology Resources.  This may include monitoring network traffic, its contents, and examining files on any computer system which is connected to the network. The University may also access such electronic mail or files for a number of reasons, including but not limited to the following:

• Spam Blocking;
• Retention of Electronic Mail;
• Access for University Business.

An account may also be inspected or monitored when:

• Activity from an account prevents access to computing or networking resources by others;
• General usage patterns indicate that an account is responsible for illegal activity;
• There are reports of violations of University policy or any local, state or federal law;
• It is necessary, in the judgment of the administration, to do so to protect the University from liability or undue harm;
• The University receives a public records request, a valid subpoena, or it is required by law.

Authorized Users should also know that all files on shared (i.e., networked) systems, including e-mail, are backed up periodically on schedules determined by IT Services. 

VII.     Consequences

Policy violations will be determined at the sole discretion and judgment of school administration. Thomas More University reserves the right to limit, restrict, or extend computing privileges as appropriate to comply with policy and laws and to allow for optimal operation of its systems. Violations by employees are treated as a breach of ethical and professional conduct and will be handled following established disciplinary procedures.  Policy violations traced to faculty will be referred to the Provost.  Violations traced to staff will be referred to the Human Resources Department. Violations traced to students will be referred to the Dean of Students for implementation of the judicial process. Violations traced to vendor partners will be referred to the Vice President of Finance and Operations. Violations traced to guests will be managed by the IT Services and could result in the loss of privileges. If policy violation is also unlawful, infractions may be reported to the proper authorities.

RELATED POLICIES AND APPLICABLE LEGAL OR ACCREDITATION STANDARDS

Copyright Infringement and File Sharing Policy
Harassment in the Workplace Policy
Mass Email Policy
Record Retention Policy
Sexual Misconduct Policy
Standards of Ethical Conduct
18 U.S.C. 1030 (1986) Computer Fraud and Abuse Act
18 U.S.C. 2510 (1986) Electronic Communications Privacy Act

PROCEDURES

Constituents will acknowledge receipt and agreement to this policy prior to being granted full access to Thomas More University Information Technology Resources.  This is currently handled via the password portal: http://password.thomasmore.edu.

Current users of the system will be notified of policy changes and continued use of the technology will serve as acknowledgment and acceptance of this Policy.

REFERENCING THE POLICY

Saints Community Standards

HISTORY

APPENDIX

Acceptable Use of University Information Technology Policy employee signoff

APPROVALS

Signatures on File:

Sean Kapsal, Director of Information Technology, June 20, 2018

Rob Munson, Vice President for Finance and Operations, June 25, 2018

David A. Armstrong, President, June 25, 2018