• Sharing of access: Computer accounts, passwords, and other types of authorization are assigned to individual users and must not be shared with others. Users are responsible for any use of their accounts;
• Permitting unauthorized access: Users may not run or otherwise configure software or hardware to intentionally allow access by unauthorized users;

• Use of privileged access: Special access to information or other special computing privileges are to be used in performance of official duties only. Information that a user obtains through special privileges is to be treated as private;

• Abusive Internet usage: Internet access can be used for job related matters only. Abusive downloading of games, photos, music and other entertainment files is prohibited;

1.2.4. Harmful activities prohibited at AUA

Harmful behavior that is subject to sanctions includes, but is not limited to, the following:

• Harassment: No member of the AUA community may, under any circumstances, violate AUA policies and procedures on harassment, discrimination, publicity, hazing, non-academic student conduct and other related policies through use of University -owned or operated computing and network resources. Nor shall any user intentionally disrupt or damage academic, research, administrative, or related pursuits; invade another person's privacy - academic or otherwise; or threaten such an invasion of privacy;

• Academic dishonesty: Users should always use computing resources in accordance with the ethical standards of the AUA community. Academic dishonesty (plagiarism, cheating) is a violation of those standards;

• Harmful activities: Harmful activities such as, but not limited to, the following, are prohibited: creating or propagating viruses; disrupting services; damaging files; and intentionally destroying or damaging equipment, software, or data belonging to AUA or other users. Further, users may not damage computer systems; obtain unauthorized extra resources; deprive other users of authorized resources; gain unauthorized access to systems by using knowledge of a special password, loopholes in computer security systems, or another user's password; or gain unauthorized access to resources used during a previous position at AUA;

• Denial of service: Deliberate attempts to degrade the performance of any computer system or network or to deprive authorized personnel of resources or access to any AUA computer system or network are prohibited.

• Accessing or attempting to access another individual's data or information without proper authorization (e.g., using another person's password to look at their personal information);

• Obtaining, possessing, using, or attempting to use someone else's password without proper authorization;

• Tapping phone or network lines (network sniffers);

• Making more copies of licensed software than allowed;
• Sending an overwhelming number of files across the network (e.g., spamming or e- mail bombing);

• Intentionally releasing a virus or other program that damages, harms, or disrupts a system or network;

• Intentionally preventing others from accessing services;

• Unauthorized use of the AUA resources;

• Sending forged messages under someone else's ID;

• Using AUA resources for unauthorized or illegal purposes;

• Unauthorized access to data or files even if they are not securely protected.

1.2.5. Constrained activities at AUA

Policies listed below have specific application to constrain the types of activities that may be carried on by users of AUA computers and network. AUA constrained behavior includes, but is not limited to, the following:

• Use of copyrighted information and materials: Users are prohibited from using, inspecting, copying, and storing copyrighted computer programs and other material;

• Use of licensed software: No software may be installed, copied, or used on AUA resources except as permitted by the owner of the software. Software subject to licensing must be properly licensed and all license provisions (installation, use, copying, number of simultaneous users, terms of license, etc.) must respect the contractual agreements;

• Political campaigning: The AUA does not permit use of AUA -owned or operated computers and network resources for activities that might be construed as political campaigning;

• Commercial advertising: The AUA does not permit use of AUA -owned or operated computer and network resources for commercial advertising;

• Personal business: Computing facilities, services, and network may not be used in connection with

compensated outside work or for the benefit of organizations or individuals not related to AUA, except in the cases of incidental use, use supporting scholarly pursuits, or other use subject to arrangements between the  user and the user's dean, director, or supervisor. Incidental use for personal business includes occasional communication and other use that has negligible effect on the use of technology by others;

• Network installations: Users may not, without authorization from Computer Services Office, connect any

network equipment to the AUA network. Network equipment includes, but is not limited to, hubs, routers, firewalls, bridges, and switches or any devices that provide network connectivity to more than one individual computer system. In addition, users may not connect to the network any computer that is configured to perform the functions of the aforementioned network equipment;

• Anonymous usage: Users may not run network services that allow the anonymous deposit of data on the AUA network. For any such data transfer services, security must be provided through usernames and passwords that are traceable to individual users.

1.2.6. Control Mechanisms over Computer and Network Use

1.2.6.1. Control of access to information

AUA may control access to its information and the devices on which it is stored, manipulated, and transmitted.

1.2.6.2. Imposition of sanctions

AUA may impose sanctions on those who violate AUA policies applicable to computer and network usage.

1.2.6.3. System administration access

The AUA System Administrator may access others' files or accounts for the maintenance of network and co mputer and storage systems, such as to create backup copies. The AUA System Administrator may access others' files or accounts to investigate allegations of misconduct, violation of AUA policy or procedure. In all cases, however, all individuals' privileges and rights of privacy are to be preserved to the greatest extent possible.

1.2.6.4. Suspension of individual privileges

The ICTS Department may suspend computer and network privileges of an individual for reasons relating to the safety and well being of members of the AUA community or AUA property or for reasons relating to the violation of

AUA policies. Access will be promptly restored when safety and well being can be reasonably assured, unless access is to remain suspended as a result of formal disciplinary action imposed by the Vice President, or an employee's department.

1.2.7. Enforcement of the Appropriate Use Policy

1.2.7.1. Investigative contact

If an AUA employee is contacted by a representative from an external organization who is conducting an investigation of an alleged violation involving AUA computing and networking resources, the user must inform the office of the Vice-President immediately. The employee must refer the requesting agency to the Vice-President who will provide guidance regarding the appropriate actions to be taken.

1.2.7.2. Responding to security and abuse incidents

All AUA users and departments have the responsibility to report any discovered unauthorized access attempts or other improper usage, as described in “Harmful activities prohibited at AUA” and “Constrained activities at AUA”

sections above, of AUA computers, network, or other information processing equipment. If a user observes or receives a report of (other than as in “Investigative Contact” section above), a security or abuse problem with any AUA computer or network facilities, including violations of this policy, the user must:

• Take immediate steps to ensure the safety and well being of information resources. For example, the AUAF System Administrator should be contacted to temporarily disable any apparently compromised computer accounts or to temporarily disconnect or block offending computers from the network;

• Ensure that the System Administrator and the user's department head are notified.

Once notified, ICTS will coordinate the technical and administrative response to such incidents. Reports of all incidents will be forwarded to the Director of ICTS.

1.2.7.3. Range of disciplinary sanctions

Persons violating this policy are subject to sanctions, such as loss of computer or network access privileges, disciplinary action, up to and including, but not limited to, dismissal from AUA or legal action. Some violations may constitute criminal offenses, under local laws. AUA will carry out its responsibility to report such violations to the appropriate authorities.

1.2.7.4. Appeals

Appeals should be directed through existing procedures established for employees and students.