POLICY 26
TECHNOLOGY POLICY

SECTION INDEX: Technology Policy

1 Purpose

2 Reference

3 Application

4 Guidance

4.1 Approval

4.2 Ownership

4.3 No Expectation of Privacy

4.4 Definitions

4.5 Use of City Systems

4.6 Compliance

4.7 Procurement Procedures

4.8 Security, Viruses and Downloading

4.9 Telecommunication Device Usage

4.10 Electronic Communications

4.11 Collective Bargaining/Civil Service Rules

4.12 Penalties and Enforcement

5 Forms

Technology Use Authorization Form

1. PURPOSE

This guideline establishes policies and procedures for the use of computer hardware and software, telecommunications devices, procurement of technology assets, and security relating to technology.

2. REFERENCE

City of Olympia, Policy 20 - Standards of Conduct, Chapter 434-662 WAC, Preservation of Electronic Records, Chapter 42.56 RCW, Public Records Act

3. APPLICATION

This policy applies to all technology and electronic communications resources owned by the City, all authorized users of City resources, all contents of electronic communications and attachments and transactional information associated with such communications.

4. GUIDANCE

It is the policy of the City to maximize the cost-effective use of computer systems as a means of improving productivity. The City of Olympia provides a communications network capable of offering computing resources, electronic mail (email) and internet access to employees to assist in and facilitate City business and communications. The primary purpose of the City’s network and systems is to provide service to the public as part of City business in a manner that is congruent with the City’s vision and values. Some limited, incidental personal use of the computer system by City employees is permitted if accomplished in compliance with the provisions of this policy as set forth below.

This policy does not articulate all required or prohibited behaviors by technology users or identify all exceptions to the rules, but merely covers likely examples. In general, the City relies on the good judgment of its employees to ensure that City technology resources are used in the public’s best interest and in accordance with Policy 20 - Standards of Conduct. Misuse of the City’s technological resources includes excess use for personal reasons and accessing sites or sending email with inappropriate content. Employees who misuse the City’s technology resources for personal reasons are subject to disciplinary action up to and including termination.

The management of electronic records in electronic form and in printed format is subject to federal and state laws including the provisions regarding retention and disclosure.

This policy specifies usage as it relates to all information processing and communications facilities employed by the City, including computers, fax machines, telephones, smart phones, pagers, wireless email devices, copiers, software, on-line accounts, hosted applications, facilities for Internet/ Intranet/ Extranet access, storage media, network accounts, computer files, email electronic messages and related equipment and documentation employed or stored in its offices and facilities.

4.1. APPROVAL

Employees must obtain approval for computer, email and internet use from the appropriate department director or authorized supervisor or manager.

4.2. OWNERSHIP

The City owns, leases, and has the right to specify the use of all electronic communications resources. No employee has any property interest in the electronic communications resources of the City.

4.3. NO EXPECTATION OF PRIVACY

By using the City’s computer system (including e-mail, internet and hosted applications), employees acknowledge and agree that they have no expectation of privacy or confidentiality in their use of the system or in any data that they create, store, or transmit on or over the system, including any data created, stored or transmitted during the employees’ incidental personal use of the computer system as permitted under this policy. Employees who use the computer system further agree that they are aware of, understand and will comply with the provisions of this policy, and that their use of the computer system may be monitored and any data that they create, store, or transmit on or over the system including incidental personal use of the computer system as permitted under this policy, may be inspected by the City at any time. In addition, email messages and other documents created on the computer system are public records and may be subject to public disclosure.

4.4. DEFINITIONS

a. Authorized User: Any person who uses the electronic communication resources with proper authority. The term includes employees of the City who have completed the required prerequisites for use and persons who are not employees but have been properly authorized to use the electronic resources.

b. Computer System: Includes individual desktop computers (PCs), portable computers, handhelds, software, email system, the internet and intranet, hosted applications, portable storage devices, magnetic tapes, cd’s, dvds, file servers, peripherals, network equipment and all other components of the City’s computer network.

c. Electronic Communications: Any communication transmitted electronically via the use of the electronic communications resources. Examples include but are not limited to email, instant messages, social media postings, and speech to text.

d. Employee: For the purpose of this guideline, this term refers to any individual who works with the City and will use the computer and/or telecommunication systems. This includes but is not limited to regular or temporary personnel, volunteers, emergency hires, instructors, contracted personnel, and interns, etc.

e. Internet: A global system of interconnected computer networks that use a standard communication protocol to serve billions of users worldwide.

f. Intranet: Web site containing content and applications for City internal use only.

g. Hosted Applications: Application software that resides on a third party vendor’s system and is accessed by users through a web browser using HTML or by special purpose client software provided by the vendor.

h. Litigation Hold: A process by which an organization must preserve all records, including all forms of electronic communications, related to the subject of a dispute being addressed by current or reasonably anticipated litigation for possible production in the litigation. During a litigation hold, normal record disposition policies are suspended.

i. Metadata: Electronic file attributes such as file owner, creation date, last modified date, routing details, sender, receiver, and subject line.

j. Occasional Use: Irregular and infrequent usage.

k. Public Record: Any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by the agency regardless of physical form or characteristics, or as defined in 42.56 RCW.

l. Streaming Audio/Video: Technology used to “play” audio/video on a PC over a network; can be used for music, voice, lectures and other audio/video material. It generally consists of a continuous stream of data coming from a network.

m. Web Browsing: Use of a browser tool to access web sites on the internet.

4.5. USE OF CITY SYSTEMS

The City’s computer systems are provided to assist employees to perform their jobs, share files, and communicate with each other and with outside individuals and organizations on City business. The City’s computer systems are to be used for City business purposes, except for occasional, incidental personal use as permitted consistent with the guidelines below.

a. Appropriate Use: The City’s computer systems are to be used by employees or volunteers for City business.

The computer systems may also be utilized for occasional, incidental personal use that, in the judgment of the employee’s supervisor or department director, does not interfere with employee or department productivity. Personal use does not include uses requiring substantial expenditures of time, uses for profit, or uses that would otherwise violate City policy with regard to employee time commitments or City equipment.

Examples of acceptable occasional, incidental personal use of the City computer system include:

1. Advising others about an employee’s vacation, marriage, birth of a child, etc.

2. Brief and infrequent communication.

3. Important and time-sensitive personal needs such as making medical appointments or arranging parent-teacher conferences.

4. Personal use of impact similar to that of a brief phone call.

5. Browsing the on-line edition of newspaper during lunch or break time.

b. Prohibited Use: Use of the City’s computer system to engage in any communication that violates federal, state, or local laws, codes, and regulations, City policies and procedures is strictly prohibited at all times.

In addition, the following uses of the City’s systems are inappropriate and are prohibited at all times, unless expressly accepted below. Inappropriate uses of the City’s system include, but are not limited to:

1. Commercial use for an employee’s personal business (e.g. - Ebay or other auction sites, other jobs or businesses in which the employee is involved);

2. accessing of pornographic, sexually explicit or indecent materials including materials of a bawdy or risque nature, or that are otherwise unreasonably offensive, except for limited usage for City business as permitted below under section 4.5.c;

3. usage for any type of harassment or discrimination including transmission of obscene or harassing messages to any individual or group because of their sex, race, creed, religion, national origin, sexual orientation or other protected class status;

4. gambling;

5. usage for any activity that could adversely affect the City of Olympia’s image or reputation;

6. usage for recreational purposes including the loading of computer games or playing online games;

7. usage which precludes or hampers City network performance such as viewing or listening to streaming audio and/or video, except for limited usage for City business as permitted below under section 4.5.c;

8. unauthorized copying of copyrighted material;

9. usage which violates software license agreements;

10. downloading of software except for limited usage for City business as permitted below under section 4.5.c;

11. transmission of information to unauthorized persons or organizations;

12. unauthorized entry or attempt of entry to other City systems or to any other networks;

13. unauthorized entry or attempt of entry into other City Departments sub-directories, files, resources; or

14. malicious use of the system in an excessive manner so as to unreasonably deprive others of system use or resources.

15. Use of computing resources that violates standards outlined in Policy 20 - Standards of Conduct.

c. Limited Usage: The following uses of the City’s systems are permitted for City business only. The City business need must be conveyed to and the use authorized by the employee’s department director:

1. Accessing streaming audio/video is permitted for City business such as online training.

2. Accessing of pornographic, sexually explicit or indecent materials including materials of a bawdy or risque nature, or that are otherwise unreasonably offensive is permitted as part of any investigation conducted by Police Detectives or other authorized personnel.

3. Downloading software as approved by IT Services.

d. Time of Use: While the employee is working, the use of the City’s computer system shall be for City business only. Use of the computer system for occasional, incidental use as permitted in section 4.5.a above shall be limited to the employees’ break and lunch hours unless otherwise allowed by the department director and as limited by this section, 4.5 -Use of City Systems. Employees who work within the public’s visual sight should be cognizant of public perception and should use care and discretion in providing an appropriate image of the City while using the computer system and particularly the internet.

4.6. COMPLIANCE

a. Inappropriate use or violations of this policy may result in disciplinary action, up to and including termination.

b. If managers or employees have reason to believe that an employee is misusing the City’s computer systems, they shall report the inappropriate use to any supervisor, manager, or department director.

c. It is the responsibility of the department director to administer any disciplinary action necessary.

d. Each user is responsible for their image on the internet/intranet as well as the image of the City of Olympia. It is recommended that employees not put personal information on or access email or internet services for personal use unless they would feel comfortable accessing or putting the same information in a widely distributed office memo. In addition, use of City computer systems must be consistent with Policy 20-Standards of Conduct.

4.7. PROCUREMENT PROCEDURES

A user wishing to purchase, lease, or contract for hosted computer hardware or software for City use should consult IT Services early in the planning process. IT Services will assist in assessing hardware/software requirements, contract terms, support services and costs. Unless an exception can be justified by user requirements, hardware, software and hosted applications will comply with the City’s standard configuration. The user will assure that funds are budgeted and available for purchase of items required.

Acting on behalf of the user, IT Services will initiate requisitions for computer systems, hardware, software or hosted applications. Such requisitions, which originated from the user, will be forwarded to IT Services to be evaluated and approved before any purchasing, leasing or contracting for services action is taken.

All computer hardware and software will be shipped in care of IT Services. IT Services staff will perform necessary tests, install software, set-up the system and provide user instruction.

a. Computer Replacement: When a new computer is purchased, setup and installed in a section, the existing computer will be removed by IT Services staff. If the computer is at the end of its life cycle it will either be used for parts or deemed surplus for auction.

b. Standardized Software and Hardware: To ensure compatibility between computer systems and provision of adequate user support, the City has established standard software and hardware for commonly used applications. The use of unauthorized, non-standard software or hardware, including personally owned software or hardware, on City computer systems without IT Services and Department Director approval is prohibited. If non-standard software is approved by the IT Services Manager and the Department Director for installation, the City shall not be responsible for its operation and/or maintenance. If it is found that this non-standard software affects the operation of the user computer or the network, it will be removed. If non-standard hardware or software, which has not been approved, is discovered during routine maintenance operations, it will be reported to the immediate supervisor of the user to ensure its removal.

c. Installation of Software and Hardware: Improper installation of software or hardware can damage a computer system or cause it to malfunction. Consequently, all software and hardware is to be installed by the IT Services staff. Any moving, relocating, or rearranging of computer hardware will also be coordinated with the IT Services staff.

d. Ownership and Confidentiality: All software, programs, applications, templates, data, data files and web pages residing on municipal computer systems or storage media, or developed on municipal computer systems is the property of the City of Olympia. The City retains the right to access, copy, and change, alter, modify, destroy, delete or erase this property in accordance with applicable laws. Computer data files containing confidential or sensitive data should be treated accordingly and should not be removed from the workplace without proper authorization.

e. Copying Software, Programs, Applications, and Templates etc: Users will notify IT Services and receive proper authorization before attempting to copy software. In many cases, copyright laws and/or licenses for commercial software, programs, applications, and templates used by the City prohibit making multiple copies. The City and its employees are required to abide by the federal copyright laws and to abide by any licensing agreements.

4.8. SECURITY, VIRUSES AND DOWNLOADING

No one may use loopholes in computer security systems or knowledge of a special password to damage computer systems, to obtain extra resources, to take resources from another user, to gain access to systems or to use systems for which proper authorization has not been given. System accounts are assigned to individuals or groups. Passwords must be kept secret and not shared with any other individual. No one is allowed to attempt to use another person’s user-id or password to gain access to another individual’s account.

Employees who accept files via the Internet (e.g., via FTP, E-mail, attachments or newsgroups) are individually and directly responsible for using a current and reliable virus-checking program prior to opening the file. Downloading or uploading a file is restricted to City-related business. Users must not download any software packages and/or upgrades from the Internet, and must comply with the 4.5 -Use of City Systems section of this policy. File Sharing - Public Folders are available to employees for sharing access to files with other employees. Employees are not allowed to share drives on a user’s computer as a modified local server.

4.9. TELECOMMUNICATIONS DEVICE USAGE

a. City Owned/Operated Devices: The director of the department shall approve all phone and data services purchased for City business use. Such devices are limited to business use only. Personal use of City-owned devices is not allowed. Calls home or to family, etc, by City staff when required to work extended hours shall be considered business calls.

1. City-operated devices should utilize State of Washington contract pricing.

2. Billing of City-owned devices will be reviewed by department directors for authorization. Department billing summaries are available to management upon request.

3. Electronic devices should be limited to use where two-way radio service or regular telephone is not available or no other less expensive method is available.

4. The City reserves the right to monitor and audit all calls made on City-owned Communication Devices.

b. Other Communication Policies:

1. Proper Use: Access to communication devices is a privilege. All users of City provided or used devices are responsible for using this resource in an effective, ethical, safe, and lawful manner. All usage should be congruent with the City’s Vision and Values, and used only for City business, except as provided by this policy.

2. Communication devices are only for City-related activities. Fraudulent, harassing, or obscene messages must not be transmitted. Inappropriate messages include but are not limited to:

a. Messages sent under an assumed name or with intent to obscure the origin of the message.

b. Messages that harass an individual or group because of the sex, race, creed, religion, national origin, sexual orientation, or other protected class status.

c. Messages that contain erotic material as defined by City Ordinance, indecent or inflammatory remarks directed toward an individual or group.

d. No one may use these devices for personal gain or promoting private products, services or interests.

3. Employees are expected to use communication devices in a manner that does not create a distracting or unsafe situation while driving or operating machinery or equipment.

4.10. ELECTRONIC COMMUNICATIONS

a. Use and access of electronic communications systems and resources:

Authorized users have access to City electronic communications resources such as email accounts. Electronic communications systems and resources are intended for use in matters directly related to the business activities as a means to further the agency mission by providing services that are efficient and timely.

1. Privately owned mobile devices (PDAs, cell phones, etc) may be used to send and receive work email so long as the messages are sent through the City’s email system. Use of personal email accounts (such as hotmail or gmail) for conducting City business is prohibited. In the event email related to the conduct of City business is received at a personal email address, it should be immediately forwarded as an attachment through the City email system.

2. The City may make use of technologies or programs to aid in the management, retention, and disposition of electronic messages, including deletion after a specific retention period based on record series. However, all employees have records management responsibilities for electronic communications and/or messages, and may be asked to identify records responsive to public disclosure or discovery requests. Printing and saving hard copies is not sufficient for records management purposes because metadata, which is part of the electronic record, is lost when a file is in hard copy format.

b. Public Disclosure: Electronic communications falling within the definition of a public record on any City equipment is the property of the City of Olympia and not the individual employee. Electronic communications are generally subject to public disclosure. Electronic communications systems may not be secure, and care should be taken before information of a confidential or sensitive nature is sent via email, instant message, or other electronic means. Attorney-client privileged or other messages that are exempt from public disclosure should be noted as such in the subject line.

Flagging, tagging, or noting a message as confidential, privileged, or exempt does not automatically prevent disclosure, but does highlight the message for review prior to release. The Public Records Act clearly articulates that exemptions are narrowly construed and disclosure is liberally construed. If no specific exemption can be identified as applicable to a record, the record will be released.

4.11. COLLECTIVE BARGAINING/CIVIL SERVICE RULES

Employees covered by collective bargaining agreements and/or civil service rules will be subject to the specific terms of those agreements or rules with respect to network, e-mail and internet use. In the event the collective bargaining agreement and/or civil service rules do not address the specific issues addressed in this policy, then employees covered by the same shall be governed by this policy.

4.12. PENALTIES AND ENFORCEMENT

Any user violating these policies or applicable local, state and/or federal laws may be subject to immediate loss of all computer, e-mail, communication devices and Internet privileges. In addition, disciplinary action may be taken for violations.

It is every employee’s responsibility to report any suspected abuse to a supervisor, manager or director. IT Services shall be notified in all cases.

5. FORMS