• Home
• About
• Initiatives, Plans, and Policies
• Policies
• CUNY Computer Use Policy

CUNY Computer Use Policy

Computer Resource Use

The university's computer resources are dedicated to the support of the university's mission of education, research and public service. In furtherance of this mission, the university respects, upholds and endeavors to safeguard the principles of academic freedom, freedom of expression and freedom of inquiry.

The university recognizes that there is a concern among the university community that because information created, used, transmitted or stored in electronic form is by its nature susceptible to disclosure, invasion, loss and similar risks, electronic communications and transactions will be particularly vulnerable to infringements of academic freedom. The university's commitment to the principles of academic freedom and freedom of expression includes electronic information. Therefore, whenever possible, the university will resolve doubts about the need to access university computer resources in favor of a user’s privacy interest.

However, the use of university computer resources, including for electronic transactions and communications, like the use of other university-provided resources and activities, is subject to the requirements of legal and ethical behavior. This policy is intended to support the free exchange of ideas among members of the university community and between the university community and other communities, while recognizing the responsibilities and limitations associated with such exchange.

Applicability

This policy applies to all users of university computer resources, whether affiliated with the university or not, and whether accessing those resources on a university campus or remotely.

This policy supersedes the document entitled "CUNY Computer User Responsibilities" and any college policies that are inconsistent with this policy.

Definitions

"University computer resources" refers to all computer and information technology hardware, software, data, access and other resources owned, operated or contracted by the university. This includes, but is not limited to, personal computers, handheld devices, workstations, mainframes, minicomputers, servers, network facilities, databases, memory and associated peripherals and software, and the applications they support, such as e-mail and access to the internet.

"E-mail" includes point-to-point messages, postings to newsgroups and list servers, and other electronic messages involving computers and computer networks.

Authorization

Users may not access a university computer resource without authorization or use it for purposes beyond the scope of authorization. This includes attempting to circumvent university computer resource system protection facilities by hacking, cracking or similar activities, accessing or using another person’s computer account, and allowing another person to access or use the user’s account. This provision shall not prevent a user from authorizing a colleague or clerical assistant to access information under the user's account on the user’s behalf while away from a university campus or because of a disability. University computer resources may not be used to gain unauthorized access to another computer system within or outside of the university. Users are responsible for all actions performed from their computer account that they permitted or failed to prevent by taking ordinary security precautions.

Purpose

Use of university computer resources is limited to activities relating to the performance by university employees of their duties and responsibilities. For example, use of university computer resources for private commercial or not-for-profit business purposes, for private advertising of products or services, or for any activity meant solely to foster personal gain, is prohibited. Similarly, use of university computer resources for partisan political activity is also prohibited.

Except with respect to university employees other than faculty, where a supervisor has prohibited it in writing, incidental personal use of computer resources is permitted so long as such use does not interfere with university operations, does not compromise the functioning of university computer resources, does not interfere with the user's employment or other obligations to the university, and is otherwise in compliance with this policy.

Compliance With the Law

University computer resources may not be used for any purpose or in any manner that violates university rules, regulations or policies, or federal, state or local law. Users who engage in electronic communications with persons in other states or countries or on other systems or networks may also be subject to the laws of those other states and countries, and the rules and policies of those other systems and networks. Users are responsible for ascertaining, understanding, and complying with the laws, rules, policies, contracts and licenses applicable to their particular use.

Examples of applicable federal and state laws include the laws of libel, obscenity and child pornography, as well as the following:

• Family Educational Rights and Privacy Act
• Electronic Communications Privacy Act
• Computer Fraud and Abuse Act
• New York State Freedom of Information Law
• New York State Law with respect to the confidentiality of library records

Examples of applicable university rules and policies include the following:

• Sexual Harassment Policy
• Policy on Maintenance of Public Order
• Website Privacy Policy
• Gramm-Leach-Bliley Information Security Program
• University Policy on Academic Integrity
• Information Security policies

Licenses and Intellectual Property

Users of university computer resources may use only legally obtained, licensed data or software and must comply with applicable licenses or other contracts, as well as copyright, trademark and other intellectual property laws. Much of what appears on the Internet and/or is distributed via electronic communication is protected by copyright law, regardless of whether the copyright is expressly noted. Users of university computer resources should generally assume that material is copyrighted unless they know otherwise, and not copy, download or distribute copyrighted material without permission unless the use does not exceed fair use as defined by the federal Copyright Act of 1976. Protected material may include, among other things, text, photographs, audio, video, graphic illustrations and computer software.

False Identity and Harassment

Users of university computer resources may not employ a false identity, mask the identity of an account or computer, or use computer resources to engage in abuse of others, such as sending harassing, obscene, threatening, abusive, deceptive, or anonymous messages within or outside the university.

Confidentiality

Users of university computer resources may not invade the privacy of others by, among other things, viewing, copying, modifying or destroying data or programs belonging to or containing personal or confidential information about others, without explicit permission to do so. University employees must take precautions to protect the confidentiality of personal or confidential information encountered in the performance of their duties or otherwise.

Integrity of Computer Resources

Users may not install, use or develop programs intended to infiltrate or damage a computer resource, or which could reasonably be expected to cause, directly or indirectly, excessive strain on any computing facility. This includes, but is not limited to, programs known as computer viruses, Trojan horses and worms. Users should consult with the information technology director at their college before installing any programs that they are not sure are safe.

Disruptive Activities

University computer resources must not be used in a manner that could reasonably be expected to cause or does cause, directly or indirectly, unwarranted or unsolicited interference with the activity of other users. This provision explicitly prohibits chain letters, virus hoaxes or other intentional e-mail transmissions that disrupt normal e-mail service. Also prohibited are spamming, junk mail or other unsolicited mail that is not related to university business and is sent without a reasonable expectation that the recipient would welcome receiving it, as well as the inclusion on e-mail lists of individuals who have not requested membership on the lists, other than the inclusion of members of the university community on lists related to university business. The university has the right to require users of CUNY computer resources to limit or refrain from other specific uses if, in the opinion of the information technology director at the user’s college, such use interferes with efficient operations of the system, subject to appeal to the president or, in the case of central office staff, to the chancellor.

University Names and Trademarks

University names, trademarks and logos belong to the university and are protected by law. Users of university computer resources may not state or imply that they speak on behalf of the university or use a university name, trademark or logo without authorization to do so. Affiliation with the university does not, by itself, imply authorization to speak on behalf of the university.

Security

The university employs various measures to protect the security of its computer resources and of users' accounts. However, the university cannot guarantee such security. Users are responsible for engaging in safe computing practices, such as guarding and not sharing their passwords, changing passwords regularly, logging out of systems at the end of use, and protecting private information, as well as for following the university's Information Security policies and procedures. Users must report incidents of Information Security policy noncompliance or other security incidents to the university's chief information officer and chief information security officer, and the information technology director at the affected user’s college.

Filtering

The university reserves the right to install spam, virus and spyware filters and similar devices if necessary in the judgment of the university's Office of Information Technology or a college information technology director to protect the security and integrity of university computer resources. Notwithstanding the foregoing, the university will not install filters that restrict access to e-mail, instant messaging, chat rooms or websites based solely on content.

Confidential Research Information

Principal investigators and others who use university computer resources to store or transmit research information that is required by law or regulation to be held confidential or for which a promise of confidentiality has been given, are responsible for taking steps to protect confidential research information from unauthorized access or modification. In general, this means storing the information on a computer that provides strong access controls (i.e., passwords) and encrypting files, documents and messages for protection against inadvertent or unauthorized disclosure while in storage or in transit over data networks. Robust encryption is strongly recommended for information stored electronically on all computers, especially portable devices such as notebook computers, Personal digital assistants (PDAs), and portable data storage (e.g., memory sticks) that are vulnerable to theft or loss, as well as for information transmitted over public networks. Software and protocols used should be reviewed and approved by the university's Office of Information Technology.

User Accounts and Usage Records

The university does not routinely monitor, inspect or disclose individual usage of its computer resources without the user’s consent. In most instances, if the university needs information located in a university computer resource, it will simply request it from the author or custodian. However, university information technology professionals and staff do regularly monitor general usage patterns as part of normal system operations and maintenance and might, in connection with these duties, observe the contents of websites, e-mail or other electronic communications. Except as provided in this policy or by law, these individuals are not permitted to seek out contents or transactional information, or disclose or otherwise use what they have observed. Nevertheless, because of the inherent vulnerability of computer technology to unauthorized intrusions, users have no guarantee of privacy during any use of university computer resources or in any data in them, whether or not a password or other entry identification or encryption is used. Users may expect that the privacy of their electronic communications and of any materials contained in computer storage in any university electronic device dedicated to their use will not be intruded upon by the university except as outlined in this policy. The university may specifically monitor or inspect the activity and accounts of individual users of CUNY computer resources, including individual login sessions, e-mail and other communications without notice, in the following circumstances:

a) Instances not subject to annual reporting:

• (i) When the user has voluntarily made them accessible to the public, as by posting to Usenet or a Web page
• (ii) When it is reasonably necessary to do so to protect the integrity, security or functionality of university or other computer resources, as determined by the college chief information officer or his or her designee, after consultation with the university's chief information officer or his or her designee
• (iii) When it is reasonably necessary to diagnose and resolve technical problems involving system hardware, software or communications, as determined by the college chief information officer or his or her designee, after consultation with the university's chief information officer or his or her designee

b) Instances subject to annual reporting:

• (i) When it is reasonably necessary to protect the university from liability, or when failure to act might result in significant bodily harm, significant property loss or damage, or loss of significant evidence, as determined by the college president or a vice president designated by the president, after consultation with the Office of General Counsel — and the chairperson of the University Faculty Senate if a university faculty member's account or activity is involved, or vice chairperson if the chairperson is unavailable
• (ii) When there is a reasonable basis to believe that university policy or federal, state or local law has been or is being violated, as determined by the college president or a vice president designated by the president, after consultation with the Office of General Counsel — and the chairperson of the University Faculty Senate if a university faculty member's account or activity is involved, or vice chairperson if the chairperson is unavailable
• (iii) When an account appears to be engaged in unusual or unusually excessive activity, as indicated by the monitoring of general activity and usage patterns, as determined by the college president or a vice president designated by the president and the college chief information officer or his or her designee, after consultation with the university's Chief Information Officer or his or her designee, the Office of General Counsel — and the chairperson of the University Faculty Senate if a university faculty member’s account or activity is involved, or vice chairperson if the chairperson is unavailable
• (iv) As otherwise required by law

In those situations in which the chairperson of the University Faculty Senate is to be consulted prior to monitoring or inspecting an account or activity:

a) The college president shall report the completion of the monitoring or inspection to the chairperson and the university employee affected, who shall also be told the reason for the monitoring or inspection, except where specifically forbidden by law

b) If the monitoring or inspection of an account or activity requires physical entry into a faculty member’s office, the faculty member shall be advised prior thereto and shall be permitted to be present to observe, except where specifically forbidden by law

A university employee may apply to the general counsel for an exemption from some or all of the circumstances under which the university may inspect and monitor computer resource activity and accounts without notice — except those circumstances where such inspection and monitoring is otherwise required by law — with respect to a university computer resource used solely for the collection, examination, analysis, transmission or storage of confidential research data. In considering such application, the general counsel shall have the right to require the employee to affirm in writing that the computer resource will be used solely for the confidential research. Any application for exemption should be made prior to using the computer resource for the confidential research.

The university, at its discretion, may disclose the results of any general or individual monitoring or inspection to appropriate university personnel or agents, or law enforcement or other agencies. The results may be used in college disciplinary proceedings, discovery proceedings in legal actions, or otherwise as is necessary to protect the interests of the university.

In addition, users should be aware that the university may be required to disclose to the public under the New York State Freedom of Information Law communications made by means of university computer resources in conjunction with university business. Any disclosures of activity of accounts of individual users to persons or entities outside of the university, whether discretionary or required by law, shall be approved by the general counsel and shall be conducted in accordance with any applicable law. Except where specifically forbidden by law, university employees subject to such disclosures shall be informed promptly after the disclosure of the actions taken and the reasons for them.

The Office of General Counsel shall issue an annual statement of the instances of account monitoring or inspection subject to annual reporting in accordance with this policy. The statement shall indicate the number of such instances and the cause and result of each. No personally identifiable data shall be included in this statement.

Enforcement

Violation of this policy may result in suspension or termination of an individual's right of access to university computer resources, disciplinary action by appropriate university authorities, referral to law enforcement authorities for criminal prosecution, or other legal action, including action to recover civil damages and penalties.

Violations will normally be handled through the university disciplinary procedures applicable to the relevant user. For example, alleged violations by students will normally be investigated, and any penalties or other discipline will normally be imposed, by the Office of Student Affairs. The university has the right to temporarily suspend computer use privileges and to remove from university computer resources material it believes violates this policy, pending the outcome of an investigation of misuse or finding of violation. This power may be exercised only by the president of each college or the chancellor.

Additional rules, policies, guidelines and/or restrictions may be in effect for specific computers, systems or networks, or at specific computer facilities at the discretion of the directors of those facilities. Any such rules which potentially limit the privacy or confidentiality of electronic communications, or information contained in or delivered by or over university computer resources will be subject to the substantive and procedural safeguards provided by this policy.

The university shall not be responsible for any damages, costs or other liabilities of any nature whatsoever with regard to the use of university computer resources. This includes, but is not limited to, damages caused by unauthorized access to university computer resources, data loss or other damages resulting from delays, non-deliveries or service interruptions, whether or not resulting from circumstances under the university's control. Users receive and use information obtained through university computer resources at their own risk. The university makes no warranties — expressed or implied — with respect to the use of university computer resources.

The university accepts no responsibility for the content of Web pages or graphics that are linked from university Web pages, for any advice or information received by a user through use of university computer resources, or for any costs or charges incurred by a user as a result of seeking or accepting such advice or information. The university reserves the right to change this policy and other related policies at any time. The university reserves any rights and remedies that it may have under any applicable law, rule or regulation. Nothing contained in this policy will in any way act as a waiver of such rights and remedies.