INTEGRITY OF COMPUTER-BASED INFORMATION AND SYSTEMS 5
FILE TRANSFER PROTOCOL (FTP) 5
LIMITED PERSONAL USE – (ON-LINE RESOURCES) 5
E-MAIL PRIVACY 6
SIGNATURE BLOCK 6
PUBLICATION OF E-MAIL ADDRESSES 6
INTERNET RELAY CHAT 7
IMPROPER COMMUNICATION 7
CONSERVATION OF ELECTRONIC RESOURCES 7
CONSERVATION OF PRINT RESOURCES 8
CORPORATE CREDIT CARDS 8
FURTHER INFORMATION AND ASSISTANCE 8
ANNEXURE A 9
APPLICATION FOR FULL ACCESS TO THE INTERNET 9
In June 1999 Cabinet endorsed the Use of the Internet and Electronic Mail Policy and Principles Statement, and further instructed all government agencies to develop local guidelines to assist staff to better understand the proper use of on-line services.
This document sets out the necessary on-line usage guidelines by underpinning Cabinet’s 9 Principles, and will ensure ADCQ staff are fully aware of their individual and collective responsibilities toward the proper use of the Commission’s electronic services including e-mail, Intranet and Internet.
There will however be occasions where ADCQ staff will in the course of their delegated duties be required to access restricted sites or engage in communication (contrary to these guidelines) in order to legitimately progress Commission operational investigations. These actions will however be subject to more stringent guidelines and will be closely monitored by relevant Commission staff.
CABINET APPROVED PRINCIPLES
Communication and information devices are provided for officially approved purposes only.
Use of communication and information devices must be able to survive public scrutiny and / or disclosure, comply with applicable laws and regulations, and agency policies.
Information must not be transmitted or made available via communication or information devices except under agency approved protocols.
Agencies may permit employees to use communication and information devices for limited personal use. Limited personal use will be in keeping with individual agency policies and relevant State and Federal guidelines.
Agencies have a responsibility to ensure that employees are made aware of communication and information policies and know where to find information on policy and practices. Agencies also have a responsibility for having systems in place to reduce risk associated with the use of these devices.
Employees have a responsibility to be ethical and efficient in their use of communication and information devices.
Employees may be called upon to explain their use of communication and information devices. Employees’ use of the internet, email and electronic storage of material will be monitored by agencies.
Electronic messages, telephone and facsimile bills and electronic files may be subject to records keeping, archiving, freedom of information and audit requirements.
Agencies have responsibility for applying appropriate internal disciplinary procedures for inappropriate use of communication and information devices. Agencies also have responsibility for referring potential breaches of the law to the relevant law enforcement authority and for reporting suspected official misconduct to the Criminal Justice Commission.
ADCQ personnel must at all times remain ethical and professional when using the Commission’s on-line resources, consistent with Cabinet Principle 6. In addition, further instructions on the appropriate manner in which to conduct Commission business is laid out in the Code of Conduct.
The Code of Conduct covers respect for the law and system of government, respect for persons; integrity; diligence, and; economy and efficiency; and is based on obligations set out in the Public Sector Ethics Act 1994.
Complementing the Cabinet endorsed principles and the Code of Conduct is the Freedom of Information Act 1992, the principles of which encompass all Internet and Intranet related activity. The issues within the Freedom of Information Act 1992 most relevant to Internet and Intranet usage are:
Matters affecting legal proceedings
Matters affecting personal affairs
Matters relating to research
Matters communicated in confidence
‘Matters affecting personal affairs’ is the area most likely to be contravened by Internet and Intranet users. As such, users need to be particularly aware of the sensitivity of the material they access and disseminate. ADCQ has established quite specific guidelines on dissemination of information, and staff must ensure they follow the current dissemination guidelines in accordance with ADCQ instructions.
At present only the Commissioner and Deputy Commissioner hold the formal delegation (pursuant to section 35 of the Crime Commission Act 1997) to approve/authorise the dissemination of ADCQ operational information.
Other legislation which is particularly relevant to Internet/Intranet applications includes:
Anti-Discrimination Act 1991
Classification of Computer Games and Images (Interim) Act 1995
Copyright Act 1968
Defamation Act 1889
Invasion of Privacy Act 1971
COMMISSION OWNERSHIP OF E-MAIL MESSAGES
The concept that e-mail residing on a system is the property of the organisation that owns the system has been supported in recent legal cases. All electronic files are therefore presumed to be the property of the Anti-Discrimination Commission Queensland and e-mail users should presume they will be held accountable for every message issued from their accounts.
As outlined in Cabinet Principle 7, the Commission reserves the right to monitor any and/or all Internet and Intranet related activity undertaken by employees using Commission infrastructure, including:
Activity relating to its Internet and Intranet sites
Activity relating to Internet access
ACCEPTABLE USE ISSUES
Acceptable use issues may be broadly categorised as personal conduct including but limited to:
legal impact on the Commission;
ethical use of Commission resources;
adherence to ADCQ and Public Service provisions; and
the perception of internal and external personnel.
SUMMARY OF REQUIREMENTS
ADCQ employees should abide by all of the following specific conduct requirements in their use of the e-mail, internet and intranet services. Employees should not purposely, in or by their use of Commission Internet/Intranet resources:
Violate any State, Commonwealth or international law, or state or Commission regulation, or fail to comply with Commission policies and procedures.
Violate generally accepted social standards, including netiquette, for the use of a publicly owned and operated communication vehicle. Conduct any business or activity for commercial purposes or financial gain, including publishing material that contains any advertising or any solicitation of other network users or discussion group or list members to use goods or services.
Transmit or cause to be transmitted communications that may be construed as harassment or disparagement of others based on the criteria of the anti-discrimination legislation, defamation legislation and Commission policy.
Download information from the Internet/Intranet for the purpose of providing to an unauthorised third party.
Violate Commission or third party copyright, license agreements or other contracts.
Seek to gain unauthorised access to any resources within or outside of the Commission
Disrupt or interfere with the intended use of the Commission's Internet and /or the global Internet and/or resources.
Without authority destroy, alter, dismantle, disfigure, prevent rightful access to or otherwise interfere with the integrity of computer-based information and/or information resources, including, but not limited to, uploading or creating computer viruses.
Compromise or without authorisation invade the privacy of individuals or entities that are creators, authors, users, or subjects of the information resources.
Waste resources (people, capacity, computer).
Post to a discussion group or other public forum personal communications without the author's consent.
Transmit or knowingly receive obscene or inappropriate material.
PERSONAL RESPONSIBILITY FOR SYSTEM SECURITY
System security is the individual and collective responsibility of all Commission employees. All suspected security violations should be treated seriously and consistent with the Commission’s IT Security policies.
ADCQ employees who suspect a security problem on the Internet or Intranet should immediately notify the IT Administrator, and not demonstrate the problem to others.
Employees who suspect their account has been tampered with should immediately change their password, and contact the IT Administrator with specific details.
A common means of gaining illegal access to computer-based information is to crack a legitimate user's password. ADCQ employees should select passwords that are not easy to guess or find using a password-cracking program. The following guidelines are provided to assist staff in selecting and safeguarding appropriate passwords:
Keep passwords confidential
Do not write passwords down
Change passwords regularly
When constructing a password use 6 or more characters chosen from a combination of letters, cases, numbers and symbols (use at least two categories). Avoid use of words which can be found in the dictionary, birthdays, pay or employee numbers, position numbers, addresses or any other identification code which might be easily guessed or found in other information about the work unit or the account holder.
Immediately notify the IT Administrator of loss, or theft of password, or where they have reason to believe that someone has obtained unauthorised access to their account.
INTEGRITY OF COMPUTER-BASED INFORMATION AND SYSTEMS
ADCQ employees must not in any way disrupt or interfere with the intended use of the Commission's E-mail, Internet and Intranet resources.
Employees must not without authority destroy, alter, dismantle, disfigure, prevent rightful access to or otherwise interfere with the integrity of computer based information and/or information resources, belonging to the Commission or to any other entity or individual, including, but not limited to, uploading or creating computer viruses.
ADCQ employees should not download executable files (i.e. software) from the Internet without proper authorisation from the IT Administrator. After downloading an executable file all users should run the virus checker before executing the file.
FILE TRANSFER PROTOCOL (FTP)
ADCQ employees should not FTP to any machine, which does not provide anonymous FTP services unless they have obtained prior approval and an appropriate username.
ADCQ employees should not telnet to machines on which they do not have a username, or where there is no guest username. If in doubt staff should, in the first instance seek assistance from the IT Administrator.
Employees should observe any posted restrictions on the machine to which you have connected.
Employees should not telnet to ports other than the default telnet port.
LIMITED PERSONAL USE – (ON-LINE RESOURCES)
ADCQ employees should always seek prior approval before obtaining limited personal use of the Commission’s e-mail, intranet and internet services, consistent with Cabinet Principle 4, and in their own personal time.
The Commission encourages staff to develop their individual skills by appropriately utilising ADCQ resources in their personal time. However any use of resources must be able to withstand public scrutiny.
Personal time is defined as before and after work, during lunchtime and other official breaks.
Appropriate activities include, but are not limited to:
Corresponding with friends, colleagues and contacts around the world via electronic mail;
Connecting to resources that provide a variety of information; and
Exploring the Internet looking for information resources useful in carrying out their duties.
Electronic mail is not a secure medium, particularly with e-mail sent via the Internet. Electronic mail is a Commission resource and is provided as a communications tool. Staff with legitimate business purposes may have the need to view an employee's e-mail messages. Others may view e-mail messages inadvertently, since there is no guarantee of privacy for an electronic mail message. E-mail, along with other parts of the system, will continue to be regularly backed up and may therefore be preserved for some period of time on back-up tapes.
ADCQ employees must not, without authorisation, invade the privacy of individuals or entities that are creators, authors, users, or subjects of the information resources.
Employees must not attempt to read another person's electronic mail or other protected files.
The IT Administrator or others who, in the course of their work, have access to records, files, or data belonging to others shall, take reasonable precautions to avoid invading the privacy of individuals without their knowledge. In addition, employees must not divulge or disclose such information to others, unless required by Commission policy or State or Commonwealth law.
ADCQ employees should attach a signature block containing the following minimum details to every Internet message/posting and e-mail:
Full name of the Commission E-mail address
Work phone and fax
When not officially representing the Commission, it is appropriate to add the following disclaimer to the signature block:
Unless explicitly attributed, the opinions expressed do not necessarily represent the official position of the Anti-Discrimination Commission Queensland.
PUBLICATION OF E-MAIL ADDRESSES
Where appropriate include e-mail addresses on official stationery, including compliment slips and fax sheets. ADCQ employees should include personal e-mail addresses where available on business cards and on correspondence where appropriate.
Employees may provide personal e-mail addresses where available for inclusion in directories of office bearers of relevant professional organisations where, they hold office in such organisations. Personal e-mail addresses for Commission accounts must not be included in personal listings such as the white pages of the telephone book.
Employees should not reveal personal addresses or phone numbers, or personal addresses or phone numbers of other Commission employees in any e-mail communication.
ADCQ employees should adhere to the following guidelines concerning Listservs:
Not subscribe to Listservs concerned with purely personal interests, unconnected with the goals and purpose of their work unit or the Commission.
Should unsubscribe or suspend mail from listservs for periods in which they will be absent.
Should keep discussion, questions and comments relevant to the focus of the list.
Should observe the common etiquette of the workplace and of the Internet in postings to listservs.
Unless Anti-Discrimination Commission Queensland employees are formally and officially representing the Commission (as, for example, the Commission's nominee on an inter-agency committee which is conducting its business wholly or partially through a special-purpose electronic discussion group) they must add the following disclaimer to their signature block when responding to a listserv:
Unless explicitly attributed, the opinions expressed do not necessarily represent the official position of the Anti-Discrimination Commission Queensland.
ADCQ employees should not participate in Newsgroups concerned with purely personal interests, unconnected with the goals and purpose of their work unit or the Commission.
ADCQ employees should not participate in Internet Relay Chat groups or sessions unless such session has been specifically set up to facilitate the communication between participants in a project or working group authorised by the Commission.
Improper communications are defined as chain letters or harassing mail. Sending of improper communications by Commission employees may expose the Commission to risk of legal action or adverse publicity.
ADCQ employees who receive e-mailed chain letters or a harassing message, should not delete it, and should immediately notify the IT Administrator who will collect evidence to allow appropriate action to be taken steps to halt the communications and deal with the sender.
ADCQ employees must not publish, post or include in e-mail messages, material which might be deemed to defame, harass, abuse or otherwise offend other internet and e-mail users, individuals, companies or organisations.
ADCQ employees must not transmit, or cause to be transmitted, communications that may be construed as harassment or disparagement of others based on the criteria of the anti-discrimination legislation and Commission policy.
ADCQ employees must not send, anonymous messages, defined either as messages that do not contain details of the sender's name and affiliation, or messages sent through an anonymous remailing service. Alternatively, employees must not attempt to obscure the origin of any message or download material under an assumed Internet address or otherwise disguise their user identity.
ADCQ employees should not wastefully use finite resources or obstruct the work of other Commission employees by consuming gratuitously large amounts of system resources (disk space, bandwidth) or causing congestion of the networks. Waste includes, but is not limited to:
Sending broadcast messages to lists or individuals.
Attaching files larger than 5mb to e-mail messages.
Unbridled and open-ended use of the Internet in terms of access time.
The content and maintenance of an account holder's electronic mailbox is the responsibility of its owner
Anti-Discrimination Commission Queensland employees should actively conserve electronic resources by:
Keeping e-mail messages short
Checking e-mail daily
Deleting unwanted messages immediately
Keeping messages remaining in electronic mailboxes to a minimum
Downloading or extracting to files and then to disks mail messages required for future reference.
CONSERVATION OF PRINT RESOURCES
Where it is necessary to update frequently consulted Internet material ADCQ employees should make hand-written changes to paper documents rather than downloading and reprinting.
CORPORATE CREDIT CARDS
To protect the Commission all Internet purchases are to be limited to merchant sites that utilise Secure Socket Layer (SSL) security. Check that the site contains a lock symbol in the bottom right hand corner of the screen. Double click on this icon to view whether the certificate dates are still valid. If the certificate is not valid do not purchase from the site.
For the ADCQ to meet both the government’s productivity requirements under the Enterprise Agreement, and public expectation for service delivery, the Commission must adopt new and more efficient means of communication like E-mail, Intranet and Internet. The guidelines above set out the framework in which all staff will conduct themselves when utilising the Commission’s electronic services. Employees should embrace the guidelines and ensure its adherence in the workplace.
Given the constantly changing environment, in which we operate within, these guidelines will require regular reviewing in order to maintain pace with public standards and the rapid change in electronic communications.
This policy will be reviewed 12 months from the date of approval.
FURTHER INFORMATION AND ASSISTANCE
Employees requiring further information about this policy should contact the IT Administrator.
APPLICATION FOR FULL ACCESS TO THE INTERNET You do not need to complete this form to gain access to:
Other Queensland Government sites (accessible through the Intranet)
ADCQ Staff connected to the ADCQ Network must fill out the following information in order to apply for full Internet connection. Please return completed form to the Administration Officer, Support Services, Brisbane.
Network User ID:
Fileserver (if known):
Justification for access to the Internet (must be completed):
I acknowledge that I have read and accepted all the conditions of the ADCQ Internet/E-mail Access and Use Guidelines.
I understand that all Internet usage is monitored and logged. I understand that I may be required to justify my Internet usage.
Signed:Date: Supervisor’s Declaration:
I acknowledge that I have read the ADCQ Internet/E-mail Access and Use Guidelines. I have verified that the above officer understands the implications of these guidelines, and certify that the requirements of this officer’s position warrants regular and frequent access to Internet resources.