Acceptable use policy

Last updated

An acceptable use policy (AUP) (also acceptable usage policy or fair use policy (FUP)) is a set of rules applied by the owner, creator, possessor or administrator of a computer network, website, or service that restricts the ways in which the network, website or system may be used and sets guidelines as to how it should be used. AUP documents are written for corporations, [1] businesses, universities, [2] schools, [3] internet service providers (ISPs), [4] and website owners, [5] often to reduce the potential for legal action that may be taken by a user, and often with little prospect of enforcement.

Contents

Acceptable use policies are an integral and critical part of the framework of information security policies; it is often common practice to ask new members of an organization to sign an AUP before they are given access to its information systems, just in case. For this reason, an AUP must be concise and clear. While at the same time covering the most important points about what users are, and are not allowed to do with the IT systems of an organization, it should refer users to the more comprehensive security policy where relevant. It should also, and very notably define what sanctions will be applied if a user breaks the AUP. Compliance with this policy should as usual, be measured by regular audits.

In some cases a fair usage policy applied to a service allowing nominally unlimited use for a fixed fee simply sets a cap on what may be used. This is intended to allow normal usage but, prevent what is considered excessive. For example, users of an "unlimited" broadband Internet service may be subject to suspension, termination, or bandwidth limiting for usage which is continually excessive, unfair, affects other users enjoyment of the broadband service. Also, it is not consistent with the usage typically expected on a particular access package. [6] The policy is enforced directly, without legal proceedings.

Terminology

AUP documents are similar to and often serve the same function as the Terms of Service document (e.g., as used by Google Gmail and Yahoo!), although not always. In the case of IBM for instance, the Terms of Use are about the way in which IBM presents the site, how they interact with visitors of the site and little to no instruction as to how to use the site.

In some cases, AUP documents are named Internet and E-mail Policy, Internet AUP, Network AUP, or Acceptable IT Use Policy. These documents, even though named differently, largely provide policy statements as to what behavior is acceptable from users of the local network/Internet connected via the local network.

Common elements of AUP statements

In general, AUP statements/documents often begin with a statement of the philosophy of the sponsoring organization and intended reason as to why Internet use is offered to the users of that organization's network. For example, the sponsoring organization adopts a philosophy of self-regulation and offers the user connection to the local network and also connection to the Internet providing that the user accepts the fact she/he is going to be personally responsible for actions taken when connected to the network or Internet. This may mean that the organization is not going to provide any warning system should the user contravene policy, maintaining that it is up to the user to know when his/her actions are in violation of policy.[ citation needed ] Often Acceptable Use Policy documents provide a statement about the use of the network and/or Internet and its uses and advantages to the business, school or other organisation sponsoring connection to the Internet. [7] Such a statement may outline the benefit of email systems, ability to gain information from websites, connection with other people through the use of instant messaging, and other similar benefits of various protocols including the relatively new VoIP services.

The most important part of an AUP document is the code of conduct governing the behaviour of a user whilst connected to the network/Internet. The code of conduct may include some description of what may be called netiquette which includes such items of conduct as using appropriate/polite language while online, avoiding illegal activities, ensuring that activities the user may embark on should not disturb or disrupt any other user on the system, and caution not to reveal personal information that could be the cause of identity theft.

Most AUP statements outline consequences of violating the policy. Such violations are met with consequences depending on the relationship of the user with the organisation. Common actions that schools and universities take is to withdraw the service to the violator and sometimes if the activities are illegal the organization may involve appropriate authorities, such as the local police. Employers will at times withdraw the service from employees, although a more common action is to terminate employment when violations may be hurting the employer in some way, or may compromise security. Earthlink, an American Internet service provider has a very clear policy relating to violations of its policy. [8] The company identifies six levels of response to violations:

Central to most AUP documents is the section detailing unacceptable uses of the network, as displayed in the University of Chicago AUP. Unacceptable behaviours may include creation and transmission of offensive, obscene, or indecent document or images, creation and transmission of material which is designed to cause annoyance, inconvenience or anxiety, creation of defamatory material, creation and transmission that infringes copyright of another person, transmission of unsolicited commercial or advertising material and deliberate unauthorised access to other services accessible using the connection to the network/Internet. Then there is the type of activity that uses the network to waste time of technical staff to troubleshoot a problem for which the user is the cause, corrupting or destroying other user's data, violating the privacy of others online, using the network in such a way that it denies the service to others, continuing to use software or other system for which the user has already been warned about using, and any other misuse of the network such as introduction of viruses.

Disclaimers are often added in order to absolve an organisation from responsibility under specific circumstances. For example, in the case of Anglia Ruskin University a disclaimer is added absolving the University for errors or omissions or for any consequences arising from the use of information contained on the University website. While disclaimers may be added to any AUP, disclaimers are most often found on AUP documents relating to the use of a website while those offering a service fail to add such clauses.

Particularly when an AUP is written for a college or school setting, AUPs remind students (or when in the case of a company, employees) that connection to the Internet, or use of a website, is a privilege not a right. [9] Abuse of privileges can result in legal action from the school. [10]

In a handbook for writing AUP documents, the Virginia Department of Education indicate that there are three other areas needing to be addressed in an AUP: [7]

Enforceability

Example:

6.3 This Policy shall be governed by the laws of England and the parties submit to the exclusive jurisdiction of the Courts of England and Wales.

Due to the many jurisdictions covered by the Internet, the AUP document needs to specify the jurisdiction, which determines the laws that are applicable and govern the use of an AUP. Even if a company is only located in one jurisdiction and the AUP applies only to its employees, naming the jurisdiction saves difficulties of interpretation should legal action be required to enforce its statements.

AUP can be effectively enforced with Content and URL filters.

See also

Related Research Articles

An Internet filter is software that restricts or controls the content an Internet user is capable to access, especially when utilized to restrict material delivered over the Internet via the Web, Email, or other means. Such restrictions can be applied at various levels: a government can attempt to apply them nationwide, or they can, for example, be applied by an Internet service provider to its clients, by an employer to its personnel, by a school to its students, by a library to its visitors, by a parent to a child's computer, or by an individual user to their own computers. The motive is often to prevent access to content which the computer's owner(s) or other authorities may consider objectionable. When imposed without the consent of the user, content control can be characterised as a form of internet censorship. Some filter software includes time control functions that empowers parents to set the amount of time that child may spend accessing the Internet or playing games or other computer activities.

Spyware is any software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user by violating their privacy, endangering their device's security, or other means. This behavior may be present in malware and in legitimate software. Websites may engage in spyware behaviors like web tracking. Hardware devices may also be affected.

<span class="mw-page-title-main">Proxy server</span> Computer server that makes and receives requests on behalf of a user

In computer networking, a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. It improves privacy, security, and possibly performance in the process.

The National Science Foundation Network (NSFNET) was a program of coordinated, evolving projects sponsored by the National Science Foundation (NSF) from 1985 to 1995 to promote advanced research and education networking in the United States. The program created several nationwide backbone computer networks in support of these initiatives. It was created to link researchers to the NSF-funded supercomputing centers. Later, with additional public funding and also with private industry partnerships, the network developed into a major part of the Internet backbone.

Terms of service are the legal agreements between a service provider and a person who wants to use that service. The person must agree to abide by the terms of service in order to use the offered service. Terms of service can also be merely a disclaimer, especially regarding the use of websites. Vague language and lengthy sentences used in these terms of service have caused concerns about customer privacy and raised public awareness in many ways.

A waiver is the voluntary relinquishment or surrender of some known right or privilege.

Internet privacy involves the right or mandate of personal privacy concerning the storage, re-purposing, provision to third parties, and display of information pertaining to oneself via the Internet. Internet privacy is a subset of data privacy. Privacy concerns have been articulated from the beginnings of large-scale computer sharing and especially relate to mass surveillance.

A privacy policy is a statement or legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Personal information can be anything that can be used to identify an individual, not limited to the person's name, address, date of birth, marital status, contact information, ID issue, and expiry date, financial records, credit information, medical history, where one travels, and intentions to acquire goods and services. In the case of a business, it is often a statement that declares a party's policy on how it collects, stores, and releases personal information it collects. It informs the client what specific information is collected, and whether it is kept confidential, shared with partners, or sold to other firms or enterprises. Privacy policies typically represent a broader, more generalized treatment, as opposed to data use statements, which tend to be more detailed and specific.

Bandwidth throttling consists in the limitation of the communication speed, of the ingoing (received) or outgoing (sent) data in a network node or in a network device such as computers and mobile phones.

<span class="mw-page-title-main">Be Un Limited</span> Internet service provider in the UK

Be Unlimited was an Internet service provider in the United Kingdom between 2004 and 2014. Initially founded as an independent company by Boris Ivanovic and Dana Tobak in 2005, it was bought by Spanish group Telefónica Europe in 2006 before being sold on to BSkyB in March 2013 in an agreement which saw BSkyB buy the fixed telephone line and broadband business of Telefónica Europe which at the time traded under the O2 and BE brands. The deal saw BSkyB agree to pay £180 million initially, followed by a further £20 million after all customers had been transferred to Sky's existing business. The sale was subject to regulatory approval in April 2013, and was subsequently approved by the Office of Fair Trading on 16 May 2013.

<span class="mw-page-title-main">Internet censorship</span> Legal control of the internet

Internet censorship is the legal control or suppression of what can be accessed, published, or viewed on the Internet. Censorship is most often applied to specific internet domains but exceptionally may extend to all Internet resources located outside the jurisdiction of the censoring state. Internet censorship may also put restrictions on what information can be made internet accessible. Organizations providing internet access – such as schools and libraries – may choose to preclude access to material that they consider undesirable, offensive, age-inappropriate or even illegal, and regard this as ethical behavior rather than censorship. Individuals and organizations may engage in self-censorship of material they publish, for moral, religious, or business reasons, to conform to societal norms, political views, due to intimidation, or out of fear of legal or other consequences.

File sharing is the practice of distributing or providing access to digital media, such as computer programs, multimedia, program files, documents or electronic books/magazines. It involves various legal aspects as it is often used to exchange data that is copyrighted or licensed.

The Internet is accessible to the majority of the population in Egypt, whether via smartphones, internet cafes, or home connections. Broadband Internet access via VDSL is widely available.

Hart v. Comcast was a suit filed by Jon Hart, a citizen of California against Comcast in Alameda County. Comcast is a provider of internet access and services. The suit alleged that Comcast was illegally interfering with certain types of internet traffic, such as BitTorrent. The suit alleged that Comcast is guilty of false advertising for advertising high speed services yet deliberately using technology to interfere with access speeds. The suit also claimed Comcast's actions violated established Federal Communications Commission policies on Net Neutrality. The case has since been settled out of court.

<i>Perfect 10, Inc. v. CCBill, LLC</i>

Perfect 10, Inc. v. CCBill LLC, 488 F.3d 1102, is a U.S. court case between a publisher of an adult entertainment magazine and the webhosting, connectivity, and payment service companies. The plaintiff Perfect 10 asserted that defendants CCBill and CWIE violated copyright, trademark, and state law violation of right of publicity laws, unfair competition, false and misleading advertising by providing services to websites that posted images stolen from Perfect 10's magazine and website. Defendants sought to invoke statutory safe harbor exemptions from copyright infringement liability under the Digital Millennium Copyright Act, 17 U.S.C. § 512, and from liability for state law unfair competition, false advertising claims and right of publicity based on Section 230 of the Communications Decency Act, 47 U.S.C. § 230(c)(1).

<i>Comcast Corp. v. FCC</i> 2010 US Court of Appeals for the District of Columbia case

Comcast Corp. v. FCC, 600 F.3d 642, is a case at the United States Court of Appeals for the District of Columbia holding that the Federal Communications Commission (FCC) does not have ancillary jurisdiction over the content delivery choices of Internet service providers, under the language of the Communications Act of 1934. In so holding, the Court vacated a 2008 order issued by the FCC that asserted jurisdiction over network management policies and censured Comcast from interfering with its subscribers' use of peer-to-peer software. The case has been regarded as an important precedent on whether the FCC can regulate network neutrality.

Internet bottlenecks are places in telecommunication networks in which internet service providers (ISPs), or naturally occurring high use of the network, slow or alter the network speed of the users and/or content producers using that network. A bottleneck is a more general term for a system that has been reduced or slowed due to limited resources or components. The bottleneck occurs in a network when there are too many users attempting to access a specific resource. Internet bottlenecks provide artificial and natural network choke points to inhibit certain sets of users from overloading the entire network by consuming too much bandwidth. Theoretically, this will lead users and content producers through alternative paths to accomplish their goals while limiting the network load at any one time. Alternatively, internet bottlenecks have been seen as a way for ISPs to take advantage of their dominant market-power increasing rates for content providers to push past bottlenecks. The United States Federal Communications Commission (FCC) has created regulations stipulating that artificial bottlenecks are in direct opposition to a free and open Internet.

Net bias is the counter-principle to net neutrality, which indicates differentiation or discrimination of price and the quality of content or applications on the Internet by ISPs. Similar terms include data discrimination, digital redlining, and network management.

<i>Maritz, Inc. v. Cybergold, Inc.</i>

Maritz, Inc. v. Cybergold, Inc., 947 F. Supp. 1328, was a personal jurisdiction case in which the United States District Court for the Eastern District of Missouri ruled that operator of website, for which server was located in California, was subject to personal jurisdiction in Missouri under "commission of a tortious act" provision of Missouri's long-arm statute, §506.500 RSMo. The case was brought before the court by Marits, Inc. alleging that the Cybergold's use of mark for advertising internet site was a trademark infringement. Cybergold moved to dismiss the suit for lack of personal jurisdiction, but the court found that the operational nature of the Internet based service provided a connection for Cybergold to be sued in Missouri.

Network eavesdropping, also known as eavesdropping attack, sniffing attack, or snooping attack, is a method that retrieves user information through the internet. This attack happens on electronic devices like computers and smartphones. This network attack typically happens under the usage of unsecured networks, such as public wifi connections or shared electronic devices. Eavesdropping attacks through the network is considered one of the most urgent threats in industries that rely on collecting and storing data. Internet users use eavesdropping via the Internet to improve information security.

References

  1. "IS.SEC.005". Hospital Corporation of America. 2007-12-01. Archived from the original on October 30, 2006. Retrieved 2008-12-13.
  2. "Policy on Acceptable Use of Electronic Resources". University of Pennsylvania. Archived from the original on 18 December 2008. Retrieved 2008-12-13.
  3. "2008-2009 Code of Student Conduct" (PDF). Charlotte County Public Schools. Archived from the original (PDF) on 2019-01-20. Retrieved 2008-12-13.
  4. "EMBARQ ACCEPTABLE USE POLICY & VISITOR AGREEMENT". 2006-10-20. Archived from the original on 20 November 2008. Retrieved 2008-12-13.
  5. "MySpace.com Terms of Use Agreement". Myspace. 2008-02-28. Archived from the original on 16 December 2008. Retrieved 2008-12-13.
  6. TalkTalk Fair Usage Policy Archived 2015-10-20 at the Wayback Machine "Tiscali UK Ltd - Fair usage policy". 2014-03-01. Archived from the original on 2014-03-01., typical fair usage conditions for
  7. 1 2 "Acceptable Use Policies: A Handbook". Virginia Department of Education. Archived from the original on 31 March 2007. Retrieved 27 June 2021.
  8. "ACCEPTABLE USE POLICY". EarthLink. Retrieved 2020-11-08.
  9. For example, Loughborough University's "Acceptable Use Policy". May 2005. Archived from the original on 6 May 2007. Use for other purposes, such as personal electronic mail or recreational use of the World Wide Web or Usenet News, is a privilege, which can be withdrawn, not a right.
  10. For example, Northern Illinois University's "Information Technology Resources - Acceptable Use Policy". 29 August 2000. Archived from the original on 18 April 2007. Like any other campus facility, abuse of these privileges can be a matter of legal action or official campus disciplinary procedures.