POLICY CSIL-1

Eric Kolotyluk / Nov 1994
(revision 1996-3, 1997-3, 2002-3)

Simon Fraser University offers its students some of the most advanced and comprehensive computing facilities in the world. Like the rest of the campus facilities (class rooms, lecture halls, study areas, etc.) SFU's computing facilities are a shared resource. As such, it helps if there is a code of etiquette and honour that is observed so that the resources may be shared fairly by all.

The purpose of this report is to present the important issues in sharing computing resources to the people who use them. In particular, this report is aimed at undergraduate students who are typically new to computing, especially in a university environment, and are generally unaware of the established etiquette of computer use.

SFU's Computing Facilities

Simon Fraser University provides an extensive and well integrated network of Unix (and other) computing systems for use by the students, faculty, and staff. Additionally, departments, such as the School of Computing Science, provide and support computing facilities for their students, faculty, and staff. Additional technical information on the campus computing facilities can be found in Academic Computing Services' `how to' handouts.

Access to these facilities can be obtained on campus through the various computing laboratories and terminal areas. Access from off campus can be obtained through both dial-up modems and other computer networks.

In addition to SFU's computing facilities, people at SFU have access to a world-wide and world-class network of computing systems and services.

Issues and Problems

If there were no problems in sharing important resources like computing facilities, there would be little need for conventions, standards, and rules of use. At the turn of the century, while there were roads, there were fewer rules about how to share the road: horses and wagons pass to the right. As automobiles became plentiful, new problems arose: speeding vehicles, traffic congestion, running over pedestrians, etc. Consequently, additional rules and conventions were required so that all people could have fair access to the growing systems of roads.

Our computing systems and computer networks are similar in many ways to the roads system. We need our computing systems to help us accomplish our work and study. The software that runs on those computing systems are like the cars we drive or the buses we ride, and the computer networks are like the roads we drive on. Just as one or more people can have a serious impact (pun intended) on the road, so computer users can have a serious impact on other computer users.

Computer Security

The most basic problem with sharing computing facilities is computing systems security. Just as we lock our cars and homes to protect them from criminals, we also restrict access to computer files and programs to protect them from criminals.

Unfortunately, there is a glamour or mystique attached to computing that makes it seem like harmless fun to explore and defeat computer security mechanisms. While in most cases no destruction occurs of computer files or programs, a great deal of harm is done in other areas.

1. The computing systems support staff spend large amounts of time responding to computer system security situations. For every hour or day the support staff spend tracking down a `hacker,' reissuing passwords for `cracked' IDs, or repairing abused e-mail systems, that is less time the support staff can spend installing new software, designing new systems, or responding to your requests for new and improved service.
2. When people attempt to break into other people's computer accounts (or engage in other mischief), invariably word gets around that it was done. This promotes the misconception that it's OK to `hack' computer systems. Consequently, this attracts more people to engage in this pastime, some of whom are more malicious than playful.
3. Attempting to break computing systems security consumes computing resources. For example, password cracking programs require vast amounts of computer time, denying others use of computing cycles for more important work.
4. Often perpetrators of computer security abuse are students. This gives students, in general, a bad reputation and denies good honest students of the respect they deserve.

It is important to realize that while computer security intrusions may not always affect you directly, they can have a very great impact on you indirectly. Aside from following computer security rules and guidelines yourself, the most important thing you can do to help is to be vigilant. If you have information on such abuses or suspect something, bring it to the attention of the computing support staff immediately.

For the most part the people who persist in challenging computer security systems tend to be sociopaths who typically justify their actions as being either harmless ("I only read stuff under other peoples IDs"), or actually helpful ("what I do teaches people to take better care of their password").

The majority of people who cause computer security problems are, however, typically naive computer users, most often students new to large scale computing systems and computer networks. Practices in this category include sharing passwords with friends, putting friends' names in .rhosts files, inappropriate use of pseudonyms, and playing pranks on friends and other people. The only way to reduce such naive practices is through information, such as this report.

Password Cracking

The act of trying to guess other peoples' computer passwords through the use of sophisticated software or otherwise is referred to as `password cracking'. This has become a favorite pastime for many people who often exchange lists of cracked passwords with their partners in crime. While this often a game to the perpetrators, the real danger is that eventually your password may fall into the hands of someone malicious.

Remember: change your password frequently, pick a secure password, and if you suspect anything, or anyone of password mischief, report them.

Electronic Mail Fraud

With the increase of Unix and personal computer based electronic mail systems, it has become popular for some to take advantage of the ability to `sign' names other than their own to mail messages. While many cases of this are innocent in intent (it's no crime to use a pseudonym), there are too many cases of people using someone else's name (fraud is a crime), often with malicious intent and harmful results. This is a very serious issue!

Remember: most electronic mail systems do not support authenticated mail. Do not always assume electronic mail is from the user the message says it is from. If you know or suspect anyone of partaking in electronic mail fraud, report them! Someday they may send damaging mail and fraudulently sign it in your name.

Appropriate Computer Use

The primary purpose of the University's computing facilities to do university business, and that business is teaching, research, and the administration of teaching and research. For the most part, other harmless uses of the University resources are tolerated under certain conditions, for example: writing resumes, sending personal or casual e-mail, recreational computer conferencing, etc.

For the most part the University's computing resources are finite. This becomes most obvious during semester end when most students who need to use computers to complete their assignments, do so all at the same time.

When people play games on computers or lock the computer screen and then go to lunch or to class, it generates a great deal of frustration and resentment among those who need to use a computer to get their work done. Before you use a computer for purposes other than strict university business, take the time to consider others who may be waiting to use the computer for something really important.

A particular problem with game playing (and other gratuitous computer use) is that people often get software from unknown or questionable sources. This is most serious when personal computers (e.g. Windows) are involved since these systems are most susceptible to computer viruses. Other computer systems are not immune however. Users may use only computer software that is provided by the School of Computing Science.

Food and Drink Policy

No Eating or Drinking is allowed in the labs.

While it is understandably very relaxing to work on a computer with a cup of coffee or a can of pop near by, or expedient to eat lunch while you finish those last few lines of code before class, all computing laboratories have a no food/drink policy.

Food and beverages get into computer hardware and cause unnecessary damage. Food residue and spills create a messy and unhealthy environment. The carpets on the floor, cable ducts in the floor and the cable trays on tables accumulate spills and crumbs and thus can harbor mold, bacteria and pests.

There are many pleasant places to take a break and eat nearby. Any food or drink carried into the lab must be in sealed containers. Violations may be prosecuted under University Policy.

Personal Belongings

Because the computing laboratories of often secure and private places, some students like to use study or computer carrels as their own personal lockers. This not only encourages others to leave the labs in an untidy state, but it also deprives other of a study or work area.

Vandalism

One common problem in the Computing Science Instructional Laboratories is that some students insist on writing on the table tops. While this may seem harmless, it is particularly annoying to the support staff who have to take care of the facilities.

Damage

If you accidently damage a piece of equipment, report it as soon as possible. People often damage equipment by accident, but are too embarrassed to report the problem. Not only does this typically deprive other use of the equipment until the technical support staff learn about it, but it can cause further damage when someone else tries to use equipment that is not in good working order.

Liaison with Computing Support Staff

The two most important things to remember regarding the computing systems support staff are:

1. The staff are there to serve your computing needs (you need them),
2. The staff are human and typically overworked.

For the most part the support staff do their best to keep the computing facilities running, often under adverse conditions. Comments and suggestions from computer users, even students, are most welcome and appreciated. For the most part, requests are acted upon as quickly as possible.

Invariably in the very challenging and demanding environment of the university, (exams, projects, homework, etc.) the first skills to suffer are interpersonal skills. Often the support staff receive abusive and/or demeaning remarks from frustrated and angry computer users, especially students.

When liaising with the computer systems support staff, whether by e-mail, by phone, or in person, remember the following points:

• Be courteous. You will get better action from someone you don't offend.
• Be patient. Support staff are typically very busy. Always follow up and don't be afraid to remind someone of something (politely).
• Be clear. If you have a problem or concern, the more clearly and informatively you explain yourself, the better your problem or concern will be addressed.

Summary of Etiquette

There are two main points to follow:

1. Be aware of the issues of good computing facilities etiquette and follow them best you can.
2. Be vigilant. Don't tolerate or ignore other people who abuse their computing privileges; either confront them or report them.

Computer Security

• Don't share computing accounts
• Use unusual passwords and change them frequently.

Appropriate Computer Use

• Don't lock computer screens for extended periods of time.
• Don't make casual use of computers when other people are waiting to do real work.
• Don't bring in software from outside sources without checking with computer support staff.

Physical Facilities

• Do not bring food or drink into computing laboratories.
• Do not leave papers such as computer output on tables or floors, either take them with you or use the recycling bins.
• Do not leave personal belongings lying around.

Liaison with Computing Support Staff

• Treat the staff with respect, and you will be treated with respect.
• Don't hesitate to contact the staff if you have a problem or a good idea.

Penalties

Failing to practice good etiquette when using the university's computing facilities will generally result in an overall degradation in service. This is the most obvious penalty because it affects all who use the computing facilities. When abuses of these facilities become unmanageable, however, often the only recourse is to restrict access to the facilities, or in some case remove services altogether.

The university's computing support staff regularly detect computer abuse and instigate punitive actions against people who are caught. Individual penalties range from being denied access to the computing facilities or failing a course, to expulsion from university. In extremely serious cases, criminal charges may be filed against individuals.

CSIL access

To access the main CSIL facilities, you must have a Traffic & Security access card. You may not lend your card to or open a secure door for any other person. All CSIL facilities are open 24 hours.

CSIL Policies & Procedures

Computing Ethics

(Revision date: September 3, 2002)

The Computing Science Instructional Lab (CSIL) are composed of ASB 9804, ASB 9840, ASB 9700, and K9505. CSIL is operated by the School of Computing Science with the assistance of software and technical staff.

The following Policies on Computing Ethics apply to the use of the facilities within the CSIL. The CSIL enforces these policies on behalf of the School of Computing Science and Simon Fraser University.

Preamble

The School of Computing Science of Simon Fraser University makes available computing facilities (CSIL) to its faculty, staff, students and authorized external users for instructional, research and administrative use. The School accepts no responsibility for any damage to or loss of data arising directly or indirectly from the use of these facilities or for any consequential loss or damage. The School makes no warranty, express or implied regarding the computing services offered, or their fitness for any particular purpose.

To protect the integrity of the computing facilities against unauthorized or improper use, and to protect authorized users from the effects of unauthorized or improper usage of the facilities, the School of Computing Science and Simon Fraser University reserves the rights to: limit or restrict any account holder's usage, inspect, copy, remove or otherwise alter any data, file, or system resources which may undermine the authorized use of these facilities with or without notice to the user. The School also reserves the right to periodically check the facilities and any other rights necessary to protect the facilities. Under no circumstance is the School responsible for any loss of data or interference to services resulting from these activities.

Users of the CSIL's computing facilities are required to comply with the following University Policies on Computing Ethics, and by using the computing facilities, the user agrees to comply with and be subject to the Policies on Computing Ethics. Failure to comply with the Policies will subject the violators to disciplinary action by the School of Computing Science and Simon Fraser University including restitution for services consumed and expulsion from the School and University, or to prosecution under the laws and regulations as specified in the Canadian Criminal Code.

The School of Computing Science and Simon Fraser University (SFU) reserve the right to amend this statement at any time with or without prior notice.

Policies on Computing Ethics

These Policies govern the use of all of SFU's computing facilities which include but are not limited to any terminal, microcomputer, workstation, mini-computer, mainframe on the SFU networks.

As with all matters of law and ethics, ignorance of these Policies does not excuse violations.

1. Use only authorized accounts. Users are not allowed to share their accounts by giving out passwords or programs which effectively allow sharing of accounts.
2. Users are responsible for all use of their computer accounts and are required to take reasonable measures in protecting their accounts such as using a good, hard to guess, password. Users should take appropriate use of system provided protection features and take precautions against others from obtaining access to their computer resources.
3. Users are to use their accounts ONLY for the purposes for which they are intended. For example, running a password cracking program is not an authorized activity.
4. Users must not access, copy, alter or remove another user's files without prior authorization from the user. Files belonging to individuals are to be considered as private property whether or not they are accessible by other users. The fact that you can read or alter a file does not mean that you may read or alter the file.
5. In general, users may use and view operating system files if their access permissions so allow. Users must never make copies of any system file, in whole or in part.
6. Copyrighted computer software must not be copied from, into, or by using the University's computing facilities unless proper licensing has been obtained and demonstrated to the University. Users must not use the University's equipment or software to violate the terms of any license agreement.
7. Users must not interfere with or deprive other authorized users of access to the University's computing facilities.
8. Using electronic mail (email) or other messaging systems to send or store harassing or obscene messages and material is prohibited.
9. Users must not encroach on others' use of computer resources with activities such as, but not limited to, tying up computer resources for excessive game playing, sending frivolous or excessive messages or mail either locally or over the networks, using excessive amount of storage, printing excessive copies of files, or deliberately attempting to degrade system performance or causing system crashes.
10. Users must not exploit, or attempt to exploit loopholes in computer system software to obtain unauthorized privileges or systems resources, or to interfere with the intended purpose of the system.
11. Tampering with the University's computing facilities is vandalism and violators will be prosecuted as such. Unauthorized alteration and/or destruction of data and services includes, but is not limited to, changing the configuration of equipment, software or network configuration, forging data or services, and deliberately misleading other users into using unauthorized data and services. In particular, any tampering with the email system such as forging email, interfering with the delivery of email, intercepting email and otherwise preventing legitimate users from accessing their email is prohibited.
12. Any commercial use of the University computing facilities without prior authorization is a violation of the University policies. Commercial activities include: consulting, developing software for sale, and in general any activity for which you get paid from non-University funds.
13. The networks to which SFU is connected have their own regulations for legal and ethical use. Users are expected to abide by them. Abuse of the networks or of computers at other sites connected to the networks will be treated as abuse of computing privileges at SFU.
14. Users must report any knowledge of violations of these policies by another individual. Users are also encouraged to report any information relating to a flaw in, or bypass of, computer facilities security.

The Rights of System Administration Staff

The staff in general have the right to do whatever is necessary to carry out their responsibility to keep the University's computing facilities operating and available.

It is acknowledged that there is a trade-off between the absolute right of privacy of a user, and the need of the staff to gather necessary information to insure the continued functioning of facilities.

In the normal course of system administration, the staff is given the right to examine files, mail, and printer listings to gather sufficient information to diagnose and correct problems with system software, or to determine if a user is acting in violation of the policies set forth in this document. In doing so, the staff has an obligation to maintain the privacy of a user's files, mail, and printer listings.

The Canadian Criminal Codes

The following sections in the Canadian Criminal Code applies to the usage of computers (cf. Pocket Criminal Code, 1992, Published by Carswell):

342.1 (1) Every one who fraudulently and without color of right (a) obtains, directly or indirectly, any computer service, (b) by means of an electromagnetic, acoustic, mechanical or other device, intercepts or causes to be intercepted, directly or indirectly, any function of a computer system, or (c) uses or causes to be used, directly or indirectly, a computer system with intent to commit an offence under paragraph (a) or (b) or an offence under section 430 in relation to data or a computer system is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years, or is guilty of an offence punishable on summary conviction. (2) In this section, "computer program" means data representing instructions or statements that, when executed in a computer system, causes the computer system to perform a function; "computer service" includes data processing and the storage or retrieval of data; "computer system" means a device that, or a group of interconnected or related devices one or more of which, (a) contains computer programs or other data, and (b) pursuant to computer programs, (i) performs logic and control, and (ii) may perform any other function; "data" means representations of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer system; "electromagnetic, acoustic, mechanical or other device" means any device or apparatus that is used or is capable of being used to intercept any function of a computer system, but does not include a hearing aid used to correct subnormal hearing of the user to not better than normal hearing; "function" includes logic, control, arithmetic, deletion, storage and retrieval and communication or telecommunication to, from or within a computer system; "intercept" includes listen to or record a function of a computer system, or acquire the substance, meaning or purport thereof. 430. (1.1) Every one commits mischief who wilfully (a) destroys or alters data; (b) renders data meaningless, useless or ineffective; (c) obstructs, interrupts or interferes with the lawful use of data; or (d) obstructs, interrupts or interferes with any person in the lawful use of data or denies access to data to any person who is entitled to access thereto. (8) In this section, "data" has the same meaning as in section 342.1.

Procedures

The following procedures govern the enforcement of the Policies on Computing Ethics by the School of Computing Science and CSIL :

1. The School of Computing Science will monitor the CSIL for violations to the Policies. Any violation will be documented.
2. A user who is suspected of violating the Policies will have her/his network privileges suspended immediately. The user and the user's department will be notified of the reason for the suspension.
3. The School of Computing Science and CSIL will determine whether the violation is minor or major. For a minor violation, the user will be served either a verbal or written warning. The user's network privileges will only be restored after the user signs a form re-confirming her/his compliance of the Policies. Further violation of any of the Policies by the same user will be treated as a major offence.
4. For a major offence, a tribunal consisting of technical representatives from CSIL will convene to hear evidence of the offence presented by CSIL and defence by the user. If the tribunal finds the user to be in breach of the Policies, the user will be barred from the network for a stated period of time. Furthermore, the tribunal may make recommendations to the School of Computing Science or University for academic disciplines.
5. In determining between major or minor offence, the School of Computing Science and CSIL must maintain consistency from case to case. Any deviation must be approved by the School of Computing Science.

Click here for CSIL Policy Digest.