B - Regulations Relating to the Use of Information Technology Facilities

Headlines

• Governance
  Don’t break the law, do abide by the University of Exeter’s regulations and policies, and do observe the regulations of any third parties whose facilities you access.
• Identity
  Don’t allow anyone else to use your IT credentials, don’t disguise your online identity and don’t attempt to obtain or use anyone else’s.
• Infrastructure
  Don’t put the institution’s IT facilities at risk by introducing malware, interfering with hardware or loading unauthorised software.
• Information
  Safeguard personal data, respect other people’s information and don’t abuse copyright material.  Remember that mobile devices may not be a secure way to handle information.
• Data breaches
  If you suspect a data breach has occurred report to the Student Information Desk as a matter of urgency.

• All users of computing, telecommunication and / or networking systems and services provided by, or for which access is facilitated by, the University of Exeter.
• All computing, telecommunication and / or networking equipment owned by the University of Exeter, or equipment or services for which access has been facilitated by the institution.
• Use of computing, telecommunication and / or networking systems and services owned by other bodies, access to which has been provided or facilitated by the University of Exeter. In such cases, the regulations of both bodies apply. In the event of a conflict of the regulations, the more restrictive takes precedence.

• University Information Security Policy (www.exeter.ac.uk/infosec/policy) and Data Protection Policy
• Other acceptable use policies that apply (e.g. JANET Acceptable Use Policy if accessing the Internet)
• Additional College regulations (clause 1.3)

1. These regulations
2. Applicable University policies (eg for Information Security or Data Protection)
3. Other acceptable use policies that apply (e.g. JANET Acceptable Use Policy if accessing the Internet)
4. Additional College regulations (clause 1.3)

Any infringement of these regulations may constitute a disciplinary offence under the applicable procedure for members of staff or students. The University may commence disciplinary proceedings against a member of staff or a student following a breach or alleged breach of the regulations. Minor infringements of these regulations may be dealt with informally without recourse to the formal disciplinary procedure. Breaches of these regulations that have a serious or potentially serious adverse consequence for the University’s operation, business / academic activities or reputation, or for the security / integrity of the IT systems, may constitute gross misconduct and render the offender liable to dismissal without notice or to expulsion from the University.

The ‘designated authority’ referred to throughout these regulations is as follows:

• For all academic facilities and services: The Director of ESE
• For all administrative facilities and services: Registrar and Secretary
• For facilities wholly managed by a Faculty: Pro-Vice-Chancellor and Executive Dean

IT facilities are provided solely to support research, learning and teaching, and administration. Although not a right, limited personal use is permitted, provided it does not interfere with a member of staff's work nor adversely affect a student's studies. Personal / recreational use of the IT facilities may be subject to temporary or permanent suspension if necessary to ensure service continuity or the availability of adequate resources for research, learning and teaching, and / or administrative use. Staff should not normally use IT facilities for personal use during their regular working hours without prior permission. Users must not use a University email address for purposes other than those permitted by this clause unless special permission has been granted. In particular, users must not use or advertise their University email address for any non-University business or for campaigning or any party political purpose without the prior permission of the designated authority.

Users must not act in any way that puts the security of the IT facilities at risk. In particular, usernames and passwords must be kept safe and secure and only used by those authorised to do so. Passwords must never be divulged to others by any means. Users must never use login details other than their own to access the IT facilities nor allow others to use the IT facilities they are connected to without logging out and disconnecting first. Users must not store University IT account credentials in such a way that their access rights could be used by any other user of the device. In the case of a legitimate multi-user account, it may be necessary for authorised users to share the password for the account. Users must not use the password for their University IT account as the password for any other account they use. Users with system administration accounts must use a different password to their user account.  The University of Exeter reserves the right, without prejudice, to issue a warning to, or take other appropriate action (including disciplinary action) against, users who are responsible for security breaches. Advice on using strong passwords is available at change your password.

The University has a statutory duty, under the Counter Terrorism and Security Act 2015, termed ‘PREVENT’.  The purpose of this duty is to aid the process of preventing people being drawn into terrorism.

You must not create, download, store or transmit unlawful material, or material that is indecent, offensive, defamatory, threatening, discriminatory or extremist.  The University reserves the right to block or monitor access to such material.  The interpretation will normally be the responsibility of the Registrar and Secretary. Any such material that is introduced to the IT facilities will be removed forthwith. Where access to such material is deemed necessary, prior permission must be sought from the designated authority. See Appendix B for clarification.