City of Anaheim Administrative Regulation
CHAPTER 1 - ADMINISTRATIVE
Subject: Information Services Technology A.R. 155
Use Policy Issue Date: September, 17, 2003
Revised: March 25, 2009
September 7, 2011
Page (1) of (9)
Purpose:
The purpose of this Administrative Regulation is to:
1) Establish policies and procedures regarding the proper and authorized use of City resources, including but not limited to computers, services, printers, copiers, fax machines, scanners, software, Internet, phone systems, electronic communication systems (including the E-Mail System) and all other technology-related items (“City Technology”); and
2) Set forth policies for the ownership, retention and destruction of electronic data stored and managed by the City’s Technology system, including the electronic mail system.
This Regulation is intended to supplement Administrative Regulation 410 (Use of Office Communication), Anaheim Municipal Code Sections 1.10.070 and 1.10.080, relating to Electronic Communications and Computer Data Retention, other City personnel policies and regulations that govern rules of conduct and performance in the workplace, as well as regulations pertaining to public records requests, subpoenas and all other related and applicable City codes, policies and regulations.
Scope:
This Regulation pertains to all users authorized to use the City’s Technology while conducting official City business as regular or temporary users, including, but not limited to, City employees, City officials, consultants, contractors and temporary agency employees (hereinafter referred to as “technology users”).
Procedures:
1. General Provisions:
a. All computer systems, network equipment, hardware, software, temporary or permanent files, data, electronic mail and electronic documents, and any related technology or devices, described herein, that are stored on any type of media provided by the City are the City’s property and shall not be deemed the property of, or confidential, private or proprietary information of any City officer or employee. These further include, but are not limited to, printers, phone systems, electronic communication systems and all other technology related items.
City of Anaheim Administrative Regulation 155
Page (2) of (9)
b. The City has provided computer resources to allow for efficient communication in the conduct of official City business. All resources provided are to be used for official business functions. Personal use of city resources that interferes with employee performance; interferes with city business; is illegal, unethical, sexual, or prejudicial in nature; disseminates confidential information; is intended for personal monetary gain or personal political purposes is strictly prohibited. c. The City has the right to monitor all network traffic on the City network and to modify/or restrict access if necessary. “City Technology” resources and the contents thereof are subject to inspection, without notice to technology users, to insure that City technology is being used in a manner that the City deems appropriate. Users cannot expect any degree of privacy in the use of City computer systems and any and all information accessed from, stored on, or created by users, is City property. Violation of any portion of this Regulation by any user of the City’s Technology system could result in loss of access privileges and disciplinary action, up to and including termination of employment.
2. Computers and Network Use:
a. The Information Services Division will coordinate all technology, computer service, equipment, additions, changes, moves and repairs. Computer accounts will be generated and maintained by the Information Services Division.
Department Heads and Division Managers (or equivalent) have the authority to request creation, modification and deletion of their subordinates’ accounts. A Network Access form must be completed and signed for all additions, modifications and deletions of user accounts.
b. Unauthorized access, alteration, deletion, damage, infection, or destruction of any City Technology on the network is prohibited.
c. The Information Services Division has established a standard configuration for computer hardware and software. Deviation by users from this standard configuration is prohibited. Changes to the system configuration must be requested from the Information Services Division.
d. Games used for services such as in the children’s area of the library or for a Recreation and Community Services Department program are permitted. No other games will be allowed on systems. Any material found on the PC that does not directly relate to the job duties of the employee and/or the employee’s department will be deleted and the employee’s manager notified.
e. Technology users are responsible for all activity generated by their accounts.
Users should power off or place their computers/monitors into “sleep-mode” before leaving for an extended period of time (i.e. meetings, lunch etc).
Equipment should not be left on overnight and should be completely powered off. f. Any software, including databases, custom reports, graphics, or other work product developed while using a City Technology or developed for use on the City network shall be deemed the property of the City of Anaheim.
City of Anaheim Administrative Regulation 155
Page (3) of (9)
3. Network Hard Drive:
a. Storing files – The City provides technology users access to networked computer hard drives to store electronic files, including email files. City networked drives may include a drive accessible by all users for sharing files city-wide, a drive for shared departmental use, and a drive for individual access and use. Technology users shall save their electronic files to these network drives for inclusion in nightly backups performed by the Information Services Division (see Section 7(a) for purging schedule). Any files stored on any non-network local drive (i.e. C:
drive etc.) and any portable drive (i.e. thumb drive, USB drive etc.) is not backed up by the Information Services Division and will not be able to be restored if the local hard drive or portable device malfunctions.
b. Due to storage limitations, an increasing number of users, and an increase in data files being created, users have been allocated disk space based on position function and duties. Users are allocated disk space as determined by the Department Head for departmental file and print servers. The primary City file and print server has allocated at least 50mb of disk space per user. Those positions responsible for creation and maintenance of data files for other users have been allocated 500mb of disk space. Information Services Division may increase space on the City’s primary file and print server based on a user’s need and/or system disk space availability, with Department Head approval.
4. Software License Agreements and Installation:
a. Only those software programs where license agreements exist by which manufacturers permit the use of their programs and where the City has valid City- owned licenses, shall be installed.
b. All software installations will be performed by Information Systems staff. c. All licensed City software media will be stored in the Information Systems Division.
d. All City software and all purchases of software to be installed on City computers must be approved by the Information Services Manager.
e. Employees may not install City licensed software on any computer not owned by the City. Exceptions to this guideline may apply if allowed by the software license agreement and approved in advance by the Information Systems Manager and Department Head.
5. E-Mail Policy:
a. Use of the City e-mail system is a privilege, not a right, and can be revoked at any time for unacceptable use as described in this policy. Users are prohibited from using the e-mail system to interfere with or disrupt other network users, services, or equipment or for direct personal gain. Disruptions include, but are not limited to, distribution of unsolicited advertising, the propagation of computer viruses, submission of large volumes of messages to other users or networks, and unauthorized entry to any other computer system.
City of Anaheim Administrative Regulation 155
Page (4) of (9)
b. All electronic data placed on the City’s information systems are the property of the City. Accordingly, employees should have no expectations of privacy in their email messages (or any data files residing on City-owned technology), whether sent or received. This includes files that may be designated as “private” or “personal”.
c. Technology users should make diligent efforts to conserve the City’s system resources by frequently deleting unneeded email messages from all folders in the Users’ mailbox. Technology users should empty their folders regularly (“inbox”, “sent items” and “deleted items”).
d. The email system is capable of transmitting information to “all department users” of the email system. Broadcasting messages shall be avoided; the City Intranet has a bulletin board that may be used for broadcast purposes. e. General interest work-related messages and announcements shall be sent to smaller, rather than larger audiences where appropriate. The City’s Intranet bulletin board may be used for certain broadcast purposes. f. Creation of archived folders within Outlook is prohibited and use of the automatic archive feature in Outlook is prohibited. The Information Services Division will conduct scans of Outlook records and will notify respective Department Heads of violations. Exceptions to this prohibition may be granted on a case by case basis by the respective Department head where there is a strong business reason to retain certain records in Outlook [see Section 6(c)].
6. Maintenance and Retention of Electronic Records, including E-Mail and Social Media content:
a. Electronic records, email and social media content (including attachments), are considered public records and the retention and disposition of public records are governed by the California Public Records Act and the City’s Municipal Code and are managed according to the Department’s Record Retention Schedule.
Users shall be aware that messages sent or received via email and content posted on Social Media Websites may be public records and must meet the same standards as if they were paper documents. Users shall manage their email and social media content in accordance with their department’s record retention schedule and the City’s Code.
b. Electronic mail and content posted on Social Media websites are methods of communication. The City is not implementing any retention policy on E-mail and due to the public nature of Social Media cannot implement any retention policy on Social Media content. E-mail messages, Social Media content, and any attachments, intended to be retained for long-term storage shall be placed in the appropriate subject file, either in a specifically labeled electronic file folder or in hard copy, prior to system backup [see Section 7(a) for purging schedule]. Except for certain exceptions discussed in Section 6(c) below, the City’s E-mail system is NOT an acceptable method for saving electronic records of any type. Social Media websites are not controlled by City IT resources and thus are not an acceptable method for saving electronic records of any type.
City of Anaheim Administrative Regulation 155
Page (5) of (9)
c. In the event that it is in the best interest of the City to retain public records in the Outlook software format, an exception will be made and use of an archive folder maintained on the City’s shared drive will be authorized. Requestors must establish the business reason for maintaining records in Outlook. Requestors must obtain Department Head approval for such an exception. The Exception Form can be located on the on the City Intranet under Information Services Forms http://Insider
(See attachment A)
i. All approved records that are stored in Outlook archives must be listed in the City’s Record Retention Schedule [see section 7(c) for purging schedule].
ii. The City reserves the right to audit any archive file to ensure those files are correctly listed in the City’s Record Retention Schedule. d. The normal operation and maintenance of the City’s resources require the backup and caching of data and communications, the logging of activity, the monitoring of general usage patterns and other such activities that are necessary for the rendition of service. The Information Services Division maintains a backup of all files located on City servers. Backups are not performed on individual computers unless specified by the Information Services Division, in rare cases when a user runs applications locally.
e. Backups of the City’s network and e-mail system are for the purpose of system recovery only and not for the purpose of preserving the informational content of e-mail messages and records for future business use.
7. Data storage and retention:
a. Data backups are taken at varying intervals depending on the defined server data type and are for purposes of system restoration only, in the event of server failure.
Data backups are not itemized for individual file recovery. b. Data types include the City’s Email system and File Systems (1. City’s databases; and 2. Operating systems). All data backups are stored to tape in a non-categorical order as follows:
i. All electronic mail communication, whether read or not, is electronically deleted from the users outlook system on the 30 th day
after they are received or sent and maintained on the server for an additional 7 days, at which time said data is purged/erased, without any notice to users. Thus all e-mail communications older than 37 days are purged from the backup system, and no longer recoverable. ii. All e-mail communications received or sent and then deleted (from the user’s deleted folder) on the same date, by or around 6:00 p.m., are not recoverable as they are permanently deleted from the system, thus not backed-up.
iii. File system records stored on the City’s network are backed up nightly in an uncategorized order and are retained for 2 years, from the date the file is permanently deleted from the network.
City of Anaheim Administrative Regulation 155
Page (6) of (9)
iv. All file system records created and deleted, on the same date, from the City’s network system prior to the nightly back-up, by or around 6:00 p.m., are not recoverable as they are permanently deleted from the system, thus not backed-up.
c. All archived electronic email must be listed on the City’s Retention Schedule and manually purged at the appropriate time pursuant to said Schedule.
8. On-Line Services Policy:
a. Web resources are made available to Technology Users to improve communication and information exchange, as well as a tool to assist in gathering research needed to conduct official City business. The Internet is a global electronic infrastructure of networks and therefore it is necessary to place certain restrictions to avoid improprieties and ensure established standards are met.
b. The City reserves the right to restrict access to any data source if the City determines such a source to be problematic. Technology Users can be granted temporary override of certain privileges to blocked sites with Department Head approval, provided such is necessary for official city business. c. The City censors access to the Internet. The City has the right and ability to view, access and disclose all such internet activity by a Technology User for any purpose. City Supervisors are responsible for monitoring use of the Internet by Technology Users.
d. Knowingly generating, sending, requesting, receiving, or archiving any material which contains any comment or image that is discriminatory, offensive, defamatory, or harassing in nature is prohibited. e. Users shall not use on-line radios or music and news sources that have a constant feed. This may cause congestion and disrupt network traffic. f. Use of chat rooms is prohibited.
g. When accessing the Internet, users shall only stay connected to such service for the time necessary to perform City business, and then immediately log off. h. The occasional personal use of the Internet on the employee’s own time (i.e. lunch break) is permitted as long as it does not interfere with regular City business, is not excessive, does not cause an adverse impact (i.e. congestion) on the City’s network, and does not violate any established City or Department policies or procedures, including this Regulation.
i. The City Manager’s office shall determine appropriateness of materials posted to the City’s Internet and Intranet web site. Links from the City Internet website is permitted, but shall be in conformance with this regulation. All links must be approved by the City Manager’s office.
j. The City of Anaheim logo is a trademark of the City. Any use of the materials stored on the City’s website is prohibited without the written permission of the City of Anaheim. The City of Anaheim retains all intellectual property rights including copyrights on all text, graphic images, and other content.
Unauthorized modification, distribution, mirroring, or use of images or other web content is prohibited.
City of Anaheim Administrative Regulation 155
Page (7) of (9)
k. The materials and information contained on, or obtained from, the City website are distributed and transmitted “as is” without warranties of any kind, either express or implied, including without limitation, warranties of title or implied warranties of merchantability or fitness for a particular purpose. Information contained on the City website, including information from external links thereon, is provided without any representation of any kind as to accuracy or content and should be verified by the user. The City of Anaheim is not responsible for any special, indirect, incidental or consequential damages that may arise from the use of, or the inability to use, the website and/or material contained on the site whether the material contained on the website is provided by the City or a third party.
9. Remote Access:
a. The City offers employees the ability to access their Outlook Mailbox from remote locations using non-City computers and Internet access accounts.
Access is limited to Outlook Mailbox functions and does not include access to files or applications stored on the network. Employees who use this service must adhere to the guidelines of this Regulation, as well as the following:
i. The City offers this service as a convenience to employees and does not require employees to use this service. As such, employees shall not be compensated for time spent accessing their City Outlook Mailbox through this service. As with all overtime, authorization for overtime compensation must be approved in advanced in accordance with the appropriate section in the various bargaining groups’ MOU and Human Resources policies and procedures.
ii. Employees who use this optional service do so at their own risk and the City will not be held liable for damage to employees’ personal computers.
iii. Use of this service shall be for work-related purposes only. iv. Employees using this optional service should take reasonable precautions to prevent computer viruses from infecting the City’s network.
b. Remote access to the City’s network is available. Exempt employees shall receive authorization from their Department Head and submit the applicable service form to the Information Services Division. Permission will be granted on a case-by-case basis. Any remote access to the City’s network is strictly for business related purposes and is not to be shared with any individuals who are not employed by the City or employees who have not received such authorization.
i. Unless authorized by the Department Head, no employee shall use this ability to take the place of their attending work.
City of Anaheim Administrative Regulation 155
Page (8) of (9)
ii. The City reserves the right to audit any personal computer of any employee accessing City files from their personal computers. Users who do not wish to be subject to possible audit of their personal computer may request a City laptop to be provided to access City resources from remote sites.
10. City Technology Equipment:
a. Laptops and cellular phones (PDAs etc.) are assigned on a permanent basis to certain staff by their respective Department Head and are the property of the City. All technology-use rules set forth herein apply to laptop and cellular users.
b. Laptops and cellular phones should be used for City related business only. The City recognizes that there may be incidental occasional personal use of laptops and cellular phones, but all data and messages will be treated as a record and the City reserves the right to access, review, audit and disclose, as necessary, all information from a City-owned laptop and cellular phone, without regard to content.
c. Laptops issued to staff for use while at the City must be stored in a locked or secured area when not in use.
d. The user shall immediately report any lost or stolen equipment to their supervisor so that the equipment can be reported appropriately. e. The user is responsible for properly caring and maintaining the equipment while in their possession. All liquids and food must be kept away from the equipment at all times.
f. Reports of any problems with the equipment, software, or other computer related problems are to be made to the Information Services Help Desk staff immediately. Users should not try to resolve any unfamiliar problems without the assistance of the Information Services Help Desk staff. Error messages appearing on the user’s computer screen when a problem occurs are not to be answered. When a problem does occur, document the action that was occurring at the time the problem started. This will facilitate Information Services Help Desk staff’s efforts to correct or repair the problem. Always provide as much detailed information as possible.
11. Security Policy:
a. All City network users are required to use personalized user IDs and passwords. The user ID will be assigned by the Information Services Division staff and follows the syntax of first name initial and full last name unless otherwise specified. The passwords are chosen by the user and are not known to the Information Services Division staff. Passwords are considered confidential and should not be disclosed to anyone and should not be saved on any computer.
City of Anaheim Administrative Regulation 155
Page (9) of (9)
b. It is the responsibility of each user to create a strong password and change their password when prompted by the system. Users should avoid using passwords that are easy to guess. The system will reject passwords that have been previously used by the user over the last 12 selections. c. All use of the login accounts to various systems is assumed to be performed by the person assigned to that account. Account owners are held responsible for all activities associated with their accounts.
d. If it is required that another City employee access a user’s account, access can only be granted by the Department Head or supervisor, in writing, to the Director of the Information Systems Division, or designee. Information that a user obtains through this special privilege is to be treated as confidential. e. Virus protection software is resident on each computer. Users shall not disable this software. Users shall notify Information Services Division Staff of any virus detected on their system.
f. Users of the City network must report any known security weaknesses or breaches immediately to the Information Services Division Help Desk.
12. Training:
a. The City provides computer-training classes for employees. The courses taken must meet the job description duties of the employee. Information on training registration is available on the City Intranet at http://Insider.
Responsibility:
This regulation applies to all users authorized to use the City’s Technology and the City of Anaheim’s network system.
Attachment:
Email Archiving Exception Request
ATTACHMENT A
City of Anaheim
Information Technology Services and Support
EMAIL ARCHIVING EXCEPTION REQUEST
FOR SECURITY ADMINISTRATOR USE
ONLY
REQUEST NO.
TO BE COMPLETED BY REQUESTOR
REQUESTED BY PHONE EXTENSION DATE REQUESTED
SIGNATURE REQUESTING DEPARTMENT DESIRED COMPLETION DATE
EMAIL ACCOUNT USER
FIRST NAME LAST NAME I MI WORK PHONE NUMBER
EMAIL ADDRESS / ACCOUNT NETWORK LOGIN ID SUPERVISOR
DEPARTMENT DIVISION/GROUP UNIT
EMAIL ARCHIVING REQUIREMENTS
• Please ensure that your department's record retention schedule includes the type of records listed on this exception form.
• On the space below, please specify the requested information and justification for archiving your emails PURPOSE OF EMAIL ARCHIVING and TYPES OF EMAIL TO BE ARCHIVED ARCHIVE DATE or DATE RANGE ARCHIVE DURATION (In Years)
Please obtain the required signatures for approval by your department. Approval must be obtained from an Administrative Manager and/or a Department Head, as established by your department.
APPROVER PRINTED NAME SIGNATURE DATE
DEPARTMENT HEAD
FOR EMAIL ADMINISTRATOR USE ONLY
ARCHIVED EMAIL ACCOUNT I SIZE OF ARCHIVED EMAILS I COMPLETED BY AND DATE
ARCHIVE PATH OR NETWORK FOLDER LOCATION