This standard is derived from the Acceptable Use of Information Technology Resources (AUP) and the Information Security Policy, located at https://www.umass.edu/policy
|
Date |
Activity |
Responsible |
|
2024-10-22 |
Recrafted web pages into standards format |
Matthew Dalton |
|
2024-10-24 |
Published on Standards website |
Matthew Dalton |
As with the policy, this standard applies to all users of UMass Amherst information technology resources.
These guidelines are meant to assist the university community in the interpretation and administration of the Acceptable Use of Information Technology Resources Policy. They outline the responsibilities each member of the community (client) accepts when using computing and information technology resources. This is put forth as a minimum set of standards for all areas of the university and may be supplemented with unit specific guidelines. However, such additional guidelines must be consistent with this policy and cannot supersede this document.
Use of University of Massachusetts Amherst Information Technology (UMass Amherst IT) resources is granted based on acceptance of the following specific responsibilities:
For example, it is a violation:
For example, it is a violation:
For example, it is a violation:
For example, it is a violation:
For example, it is a violation:
System Administrators and providers of university computing and information technology resources have the additional responsibility of ensuring the integrity, confidentiality, and availability of the resources they are managing. Persons in these positions are granted significant trust to use their privileges appropriately for their intended purpose and only to fulfill their job duties. Any private information seen in carrying out these duties must be treated in the strictest confidence, unless it relates to a violation or the security of the system.
Users are urged to take appropriate security precautions to reduce risk and to help protect institutional computing resources and information such as:
For additional information, contact your department IT Administrator or IT User Services at it@umass.edu. Report all lost or stolen devices, security incidents, and all breaches of institutional information and/or research data to itprotect@umass.edu.
Every member of the university community has an obligation to report suspected violations of the above guidelines or of the Acceptable Use of Information Technology Resources Policy. Reports should be directed to the unit, department, school, or administrative area responsible for the particular system involved. If ownership is unknown, reports should be sent directly to the Vice Chancellor for IT.
If a suspected violation involves a student, a judicial referral may be made to the Dean of Students Office of the college of the student's enrollment. Incidents reported to the Dean will be handled through the University Code of Student Conduct. If a suspected violation involves a staff or faculty member, a referral will be made to the individual's supervisor.
Employees receive computing, networking, and information resources as tools for fulfilling their employment duties. Employees assume responsibility for appropriate usage and must exercise good judgment regarding the reasonableness of personal use.
Employees must be careful, honest, responsible, and civil in the use of computers and networks. They must respect the rights of others, respect the integrity of the systems and related resources, and use these resources in strict compliance with the law, university policies, and contractual obligations.
Using IT resources inappropriately or in ways that diminish employee performance, even if such use does not explicitly violate any university policy, may affect employee performance evaluations.
Any use of IT resources that is inappropriate to the workplace, or otherwise contributes to creating a harassing or discriminatory workplace, or creates a legal risk, will subject the employee to formal disciplinary action under applicable university personnel policies and/or collective bargaining agreements.
As stated in the Acceptable Use Policy, all violations of law or institutional policy in physical space are also violations when in the use of University of Massachusetts Amherst's Information Technology resources. A selection of each that are particularly relevant are listed below.
In conjunction with the AUP and the remainder of this standard, this section gives interpretations and procedures that are specific to UMass Amherst IT systems.
In addition to this document, specific computers and labs may have their own rules. These should be posted clearly at the facility, or pointers included in the login message. Violations of those rules are considered violations of Acceptable Use, and may be reported using the procedure in this document.
Both the policy and guidelines documents indicate that computer resources may not be used to interfere with or inhibit other users. However, enough cases have come up recently that it seems worthwhile to elaborate on this point.
Problems often occur when someone creates a program that does something lots of times. For example, if you write a program that looks at the same web page thousands of times, this will normally cause a problem. Both the servers that handle web pages, and the network that gets the pages for you, are designed for normal human use. They are not designed to cope with programs that ask for the same thing many times. Similarly, sending the same request via email a large number of times (even in the same email message) will often cause problems. So will repeatedly opening and closing network connections, continuously sending "ping" packets, etc.
Networks can only handle a limited amount of traffic. UMass Amherst is fortunate to have a fairly robust connection to the Internet. However, smaller educational institutions and commercial sites may not have connections that are as robust. It is possible for a single person at UMass to do things that will effectively shut down network access for a smaller site. If you do this, you are liable not only for university discipline, but also for prosecution. Generally you should be safe if you only use standard system tools in the ways they are intended to be used: viewing web pages yourself, logging in to a computer and using it for legitimate purposes, etc. If you start writing programs or scripts that use these tools repeatedly or in unusual ways, it is your responsibility to make sure that what you are doing will not cause problems for the rest of the network.
Individuals, departments, or students operating computers or networks that consume an excessive amount of bandwidth are subject to having their consumption limited to ensure adequate capacity for the majority of users. For administrative systems, a good-faith attempt will be made to contact a responsible party prior to curtailment or disconnection of a computer or service. In all cases, the legitimate business needs of the university will be considered the highest priority traffic, and the use of resources for entertainment or other personal uses will not be considered essential and may be severely limited.
UMass Amherst IT will be the primary provider of network "services" such as Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP) on UMass Amherst IT networks. Any computer or equipment that replicates or disrupts these services or other network services will be immediately disconnected. Computers or devices that require a static Internet Protocol (IP) address must have one properly assigned through the campus service. All residential computers must use an IP address assigned by DHCP (there are no exceptions). Static addresses may be requested for administrative computers in ServiceNow. Such requests must be made by an employee of the university that is responsible for managing the computer or device.
The university's communications network accommodates many thousands of users on and off campus. The network is constantly monitored to track volume and performance. In the event that the campus network experiences significant degradation due to excessive utilization of resources or a network based attack from internal or external computers or networks, the university reserves the right to take any measure necessary to insure stability and performance. These measures may include rate-limiting, filtering, or disconnection of any computer, network, or building that is involved. Whenever possible, prior notice will be given; however in emergency, after-hours, or widespread network disruptions this may not always be possible.
When the university receives a notice of infringement from a copyright holder or designated agent in compliance with the DMCA (Digital Millennium Copyright Act), the university will take the measures necessary to remove the ability to access the infringing material via the network without prior notice. This activity is illegal, and a violation of the UMass Amherst IT Acceptable Use Policy and will not be tolerated on any University network.
Commercial or political use is covered in both the policy and guidelines documents. This is being mentioned here simply because commercial use is one of the most common violations of acceptable use. Here are some of the most common examples of things we consider commercial use:
There are often ambiguities about what is permitted. Do not plan to "ask forgiveness" after the fact! You are best advised to "ask permission" before starting to develop any information that may be interpreted as "commercial" in nature. In such cases, please feel free to call the UMass Amherst IT Help Center at 413-545-9400 or fill out our Help Request form.
Note: Some commercial uses could be violations of federal tax law and some political uses may be a violation of state law of public funds.
Chain letters are letters that come to you asking that you participate in a pyramid scheme to make money, receive goods, or in some cases simply send well wishes on to "5 of your friends" for good luck. If you know math you will recognize that chain letters attempt to create exponential growth. If not stopped, they will quickly overwhelm any network or mail system. Thus, it doesn't matter whether items of value are involved or not. Chain letters have been illegal if sent through the United States Postal Service (USPS) for many years.
Many Internet chain letters often start out by saying "this is absolutely legal", or "I used to think this was illegal, but I checked with a lawyer and it's not." The USPS and FBI say that this is false. These schemes (and various related ones, including some multilevel marketing scams) are considered to violate Federal laws against both gambling and wire fraud. We (and most Internet Service Providers) will act against any chain letter, or any other form of communication that asks each individual to send something to lots of others.
The best action for you to take is to simply delete any message that appears to be a "chain letter." In this way you protect both yourself and the sender.
From time-to-time activities may interfere with operation of the system, even though they may not clearly be prohibited by the Acceptable Use Policy. In such cases, the system administrator or other UMass Amherst IT staff person may contact you and require you to discontinue the practice. You are expected to comply with such instructions. Once you have received such a warning, any further activity of the same kind will be treated as a violation of Acceptable Use.
This is intended to allow staff to intervene when immediate action is required to stop a concrete problem, such as overloading a system or network, interfering with other users' normal use of the system, or a security breach. It is not intended to give system administrators arbitrary authority. If you think a staff member has acted inappropriately in asking you to discontinue a practice, you may ask for the decision to be reviewed by the Vice Chancellor of IT, in accordance with university policies and procedures. However, you will be expected to comply with the ruling of the staff while this review is happening.
Any activity that is illegal is a violation of UMass Amherst policy. Alleged violations by students will be referred to Dean of Students; cases involving faculty or staff will be referred to the department supervisor, UMass Amherst IT, or Human Resources, depending upon the violation. In addition, offenders may be investigated and/or prosecuted by the appropriate local, state, or federal authorities.
The Office of the President of the University of Massachusetts under Internal Audit operates an Ethics & Fraud Awareness Center for anonymous reporting.
Almost all forms of original expression that are fixed in a tangible medium are subject to copyright protection, even if no formal copyright notice is attached. Written text (including e-mail messages, news posts, and web pages), recorded sound, digital images, and computer software are some examples of works that can be copyrighted. Responsibilities exist related to copyright ownership and fair use of materials. Copyright ownership rights (campus and individual) are detailed in the UMass Amherst Intellectual Property Policy.
Copyright holders have many rights, including the right to reproduce, adapt, distribute, display, and perform their work. Reproducing, displaying, or distributing copyrighted material without permission infringes on the copyright holder's rights. However, "fair use" applies in some cases. If a small amount of the work is used in a non-commercial situation and does not economically impact the copyright holder it may be considered fair use. For example, quoting some passages from a book in a report for a class assignment would be considered fair use. Linking to another web page from your web page is not usually considered infringement. However, copying some of the contents of another web page into yours or use of video clips without permission would likely be infringement. See Copyright & Fair Use Knowledge Base Articles for details.
Child pornography, material that depicts minors in a sexually explicit way, is illegal. Under the federal child pornography statute (18 USC section 2252), anyone under the age of 18 is a minor. States also have child pornography statues and the age of minority varies by state.
Knowingly uploading or downloading child pornography is a federal offense. It is also illegal to advertise or seek the sale, exchange, reproduction, or distribution of child pornography. Lewd exhibition of genitals can constitute sexual conduct and therefore, any graphic files containing images of naked children could violate the federal child pornography statute.
Possession of non-obscene adult pornography is legal, but it is illegal to distribute to minors.
Obscenity is illegal. Virtually every state and municipality has a statute prohibiting the sale and distribution of obscenity, and the federal government prohibits its interstate transportation. The Supreme Court in Miller v. California, 413 U.S. 15, (1973), narrowed the permissible scope of obscenity statutes and applied this three part test to determine constitutionality: (a) whether the average person applying contemporary community standard would find the work, taken as a whole, appeals to the prurient interest; (b) whether the work depicts or describes in a patently offensive way sexual conduct specifically defined in applicable state law; and (c) whether the work taken as a whole lacks serious literary, artistic, political, or scientific value.
Beware of money-making "opportunities" on the Internet. A common scam is the pyramid scheme. You get an e-mail message with a subject like "MAKE MONEY FAST" and it instructs you to send money to the people on the list and then add your name to the bottom of the list and send it on to some number of people. It is also illegal under 18 U.S.C section 1302. The US Postal Service and the Federal Trade Commission provide information to help individuals identify scams and report them. Pyramid schemes that use US Postal mail to send money are considered mail fraud and can be reported to the USPS.
The primary federal statute regarding computer fraud 18 U.S.C section 1030 was amended in October 1996 to protect computer and data integrity, confidentiality, and availability. Examples of violations are:
It is illegal to send a message via e-mail that threatens other persons or property.