Attachment 2 - ODOT Policy ADM 05-08-01.pdf

Oregon Department of Transportation NUMBER

ADM 05-08-01

SUPERSEDES

01-10-2019

POLICY EFFECTIVE DATE

01-05-2023

PAGE NUMBER

VALIDATION DATE

01-05-2026

REFERENCE

ORS 811.507; DAS Statewide Policy: 107-004-110, 107-001-015, 107-004-051, 107-004-052, 107-004-050, ADM 05-08-02, SAF-04, PER-18, PER 01-02, PER 01-03, PER 01-02-03, ADM 04-20, SUP 09-01, SUP 09-03.

SUBJECT

ACCEPTABLE USE OF STATE

INFORMATION SYSTEMS AND

INFORMATION ASSETS

APPROVED SIGNATURE

Signature on File

PURPOSE

The purpose of this policy is for the Oregon Department of Transportation, (Department) to adopt the Department of Administrative Services (DAS) Statewide policies: Acceptable Use of State Information Assets, (107-004-110), and Internal Controls for the Management of Mobile Communications Devices (107-001-015), and be consistent with ODOT Policy Distracted Driving (SAF-04).

This policy identifies Department specific policy where state policy allows Department discretion, exceptions, or more restrictive policies based on business needs. Department users of state information systems and information assets are responsible for complying with the provisions of both the DAS statewide and Department policies including the use of mobile or electronic devices that require the purchase of cellular services by the Department.

BACKGROUND

To have all related policy language in a single document, this policy incorporates, verbatim, the language of DAS Statewide Policy Acceptable Use of State Information Assets (107-004-110)

Department policy statements are shown in plain text.

ATTACHMENTS

Attachment A: Computer Crime

Attachment B: Acceptable Use Agreement

Passages from the DAS Acceptable Use policy are shown in the grey boxes.

ATTACHMENT 3

http://www.oregon.gov/das/Policies/107-004-110.pdf http://www.oregon.gov/das/Policies/107-004-110.pdf http://www.oregon.gov/das/Policies/107-001-015.pdf http://www.oregon.gov/das/Policies/107-001-015.pdf http://transnet.odot.state.or.us/cs/BSS/Policies%20and%20Procedures/PER%2005-13.pdf http://transnet.odot.state.or.us/cs/BSS/Policies%20and%20Procedures/PER%2005-13.pdf https://www.oregon.gov/das/Policies/107-004-110.pdf

ODOT Policy No: ADM 05-08-01

DEFINITIONS

Limited Incidental Personal Use - Use is restricted so it does not affect productivity or lead to misuse of state paid time or resources, and results in no cost or insignificant cost to the state.

The following scenarios are examples of policy violations:

• Frequent or lengthy personal internet use resulting in misuse of state paid time.

• Use of state e-mail services to send personal correspondence regularly or routinely, because of the use of state paid time, and resource cost of e-mail storage.

• Use of state networks to download personal sound media songs or personal streaming audio or video because of the network and storage resource costs

Mobile and Electronic Devices – include but are not limited to; portable, wireless, or other devices used for email, messaging, voice, audio, video or other data communication such as smartphones, laptops, tablets, iPads or mobile devices that may use: Cellular, Wi-Fi, Bluetooth, or other communication protocols.

Peer-to-Peer (P2P) File Sharing - Exchanging music and video or other files through using communication protocols that do not differentiate between servers and PCs. Peer to Peer (P2P) file exchanges allow any PC to work as a file server to any member of the P2P network.

Privately Owned Devices - In this policy, privately-owned devices are any non-Department owned device including but not limited to; smartphones, mobile phones, tablets, laptops, computers, wireless adaptors, access points, web-cameras, voice or video recorders, or Internet of Things (IoT) smart devices.

Portable Storage Devices - Privately owned portable data storage devices include but are not limited to: Flash or USB drives, DVD’s external drives, portable audio and video players that can connect to the Department computing environment and storing information.

Control – Means of managing risk, including policies, procedures, guidelines, practices or organizational structures, which can be of administrative, technical, management, or legal nature.

Encryption – Use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without the use of a confidential process or key.

Information Asset – Any knowledge that can be communicated or documentary material, regardless of its physical form or characteristics that has value to the organization.

Information System – Computers, hardware, software, storage media, networks, operational procedures and processes used in the collection, processing, storage, sharing or distribution of information within, or with any access beyond ordinary public access to, the state’s shared computing and network infrastructure.

User – All state employees, volunteers, their agents, vendors and contractors, including those users affiliated with third parties who access state information assets, and all others authorized to use state information technology for the purpose of accomplishing the state’s business objectives and processes.

Screensaver - An executable computer program first designed to prevent damage to computer monitors when the computer is not in use, by blanking the screen or display of images. Screensavers are executable programs that are different than static wallpaper or desktop pictures not associated with an executable program

Sensitive Information - Any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the interest or the conduct of programs, or the privacy to which individuals are entitled. Sensitive Information includes all Level 3 – Restricted and Level – 4 Critical information assets.

Wallpaper - The term “wallpaper” or desktop picture refers to a static image used as a background on a computer screen.

ODOT Wireless Networks

• ODOT Guest wireless network is an open unsecured network that is provided primarily for business purposes and uses the group logon “Guest”. This wireless network is managed at the infrastructure level by the State Data Center (SDC). The ODOT Guest wireless network is NOT supported at the user level by helpdesk, other than to provide the guest password on request.

• ODOT Secure wireless network is a secure network provided for ODOT owned devices to connect through wireless access points to the ODOT domain. The ODOT Secure wireless network is supported by the ODOT Computer Support Desk (helpdesk) and is monitored. Privately owned devices may NOT connect to the ODOT Secure wireless network.

POLICY

State Business

The Department shall follow DAS statewide policy Acceptable Use of State Information Assets 107-004-110 with clarifications, exceptions, and definitions for the Department as described in this document.

This policy is in no way intended to interfere with or prohibit Department employees from doing their official duties or responsibilities.

Information, computer systems and devices are made available to users to optimize the business processes of the State of Oregon. Any use of information, computer systems and devices shall comply with this policy. Agencies will put in place policies, procedures and practices that enable compliance, deter misuse, and detect policy violations. Notwithstanding specific prohibitions in this policy, public officials carrying out agency missions or functions permitted by law are not prohibited by any part of this policy from performing their official duties or responsibilities. State agencies shall approve and document any exceptions to this policy. Agencies may adopt more restrictive policies based on business requirements. Users of state information assets are responsible for complying with the provisions of this policy and agency-promulgated supporting policies, procedures and practices.

Systems and Information are State Property

Department public records and retention policies are available at ODOT Records Management.

This policy does not prohibit Department employees from knowingly destroying or overwriting data in compliance with Department records retentions policies.

Access and Control

Lawful, Ethical and Inoffensive Use

Professional Conduct

Legal Compliance

Data Integrity

Use of state information assets shall not be false, unlawful, offensive, or disruptive. State networks and systems shall not be used to intentionally view, download, store, transmit, retrieve any information, communication or material which: is harassing or threatening; is obscene, pornographic or sexually explicit; is defamatory; makes discriminatory reference to race, age, gender, sexual orientation, religious or political beliefs, national origin, health, or disability; is untrue or fraudulent; is illegal or promotes illegal activities; is intended for personal profit; condones to foster hate, bigotry, discrimination or prejudice; facilitates Internet gaming or gambling; or contains offensive humor.

State information, computer systems and devices are provided for business purposes only and information on those systems are the sole property of the State of Oregon, subject to its sole control unless an overriding agreement or contract exists to the contrary. No part of state agency systems or information is, or may become, the private property of any system user. The state owns all legal rights to control, transfer, or use all or any part or product of its systems. All uses shall comply with this policy and any other applicable state policies and rules that apply. State agencies are responsible for controlling and monitoring their systems and protecting their information assets. All information stored within applications, systems, and networks are the property of the State of Oregon. Users shall comply with public records retention laws and rules.

The State of Oregon reserves, and intends to exercise, all rights relating to all information assets. State agencies are responsible for granting and monitoring users’ access only to systems and information required to do their work, and for revoking user access in a timely manner. A state agency may withdraw permission for any or all use of its systems at any time without cause or explanation.

Use of state information systems shall be in compliance with copyrights, licenses, contracts, intellectual property rights and laws associated with data, software programs, and other materials made available through those systems.

Users shall not knowingly destroy, misrepresent, or otherwise change the data stored in state information systems.

https://ordot.sharepoint.com/sites/BusinessServices/SitePages/Records.aspx

Security

The Department provides public folders and shared directories to store files, e-mail, and calendars. These are made available expressly for collaboration and information sharing.

This policy is not intended to restrict storing, viewing, and using the information stored in these folders or directories. Storage of sensitive information in these folders and directories is not allowed.

Operational Efficiency

All employees shall be sensitive to the cumulative effect that the size and number of e-mail communications have on network congestion and storage costs including unnecessary images, icons or backgrounds in e-mail messages and unnecessary reply all broadcast messages.

Accounts and Account Passwords

Department employees shall follow the ODOT Information Security Guidelines. The guidelines reinforce the importance of password practices, such as using difficult to guess passwords, not sharing passwords, and not writing down or leaving passwords where others could discover them.

Approved Software Installation, Downloads

Employees shall only use screen savers installed or approved by the Department, however personal wallpaper and desktop pictures are allowed.

The Department maintains a list of “Approved Software” and “Approved Desktop Builds” managed by the Information Systems Branch (ISB). Only software that is approved may be downloaded for install on Department systems. Employees shall follow procedures to add software to the approved list, and only after testing and approval, may the software be installed by authorized personnel.

Any use of state information systems shall respect the confidentiality of other users’ information and shall not attempt to: (i) access third party systems without prior authorization by the system owners.

(ii) obtain other users’ login names or passwords; (iii) attempt to defeat or breach computer or network security measures; (iv) intercept, access, or monitor electronic files or communications of other users or third parties without approval from the author or responsible business owners; (v) peruse the files or information of another user without specific business need to do so and prior approval from the author or responsible business owner.

Operation or use of information assets shall be conducted in a manner that will not impair the availability, reliability or performance of state business processes and systems, or unduly contribute to system or network congestion.

All users shall be properly authorized and authenticated to use state information assets.

Non-approved software, including screensavers, shall not be downloaded or installed from the Internet or other external sources (including portable computing and storage devices) without prior consent from the state agency. Any software that would result in copyright violations shall not be downloaded onto state systems.

https://ordot.sharepoint.com/sites/security/Resources/Information_Security_Guidelines/ODOT_Information_Security_Guidelines.pdf

Remote Login

Remote access to Department systems or software shall be approved by the employee’s manager. Remote users shall follow ODOT policy for Working Remotely (PER-18), DAS CHRO policy on Working Remotely ( 50-050-01) and the ODOT Information Security Guidelines when working away from Department facilities.

Use of E-Mail and Messaging

Except as noted below under potential Division Restrictions, the Department allows employees limited, incidental personal use of Department e-mail and messaging services within the constraints of the preceding paragraph.

Employees shall have no expectation of privacy for personal e-mail or messaging. The Department has no responsibility to protect the information contained in personal e-mail or messaging sent or received using Department communication services. Personal e-mail or messages sent or received using Department e-mail services are considered public records and are subject to the same monitoring, public disclosure, and oversight as business e-mail.

Department employees shall not use Department e-mail or message services for communication of sensitive or confidential information, such as passwords and social security numbers, whether work-related or personal.

Use of Employee Pictures

Employee pictures may be used in applications in which this is supported, such as Office

365. Pictures may be uploaded and maintained by employees for their own accounts but are not required. See the guidance posted on the Information Systems Branch Site for Use of Employee Pictures, for additional information and current requirements.

Division Restrictions

Because of the sensitive nature of the work and information handled, Department divisions may apply added restrictions to personal e-mail or messaging use. Division restrictions shall be documented, approved by the appointing authority, and communicated to affected employees. Any Division restriction that prohibits all personal e-mail use must be approved by the appointing authority.

Access to state agency networks from remote locations is not allowed except through the use of agency-approved and agency-provided remote access systems or software. Agencies may allow remote access from non-state devices to access e-mail via a Web page.

E-mail is to be used only for state related business; however, agency directors may allow employees limited, incidental personal use. Sending e-mail or other electronic communications that attempts to hide the identity of the user or represent the user as someone else is prohibited. No use of scramblers, re-mailer services, drop-boxes or identity-stripping methods is permitted. E-mail may be used for union business per the contract. E-mails are public record and state agencies, and all users are responsible for ensuring compliance with archiving and public records laws. Confidential information transmitted externally shall be appropriately protected.

https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/PER%2018.pdf https://www.oregon.gov/das/Policies/50-050-01.pdf https://ordot.sharepoint.com/sites/isb

Hardware Installation and Privately Owned Devices

Privately owned devices may generally not be used for ODOT business purposes. This policy prohibits both physical and wireless connections of privately owned devices to state networks, computers, or other equipment with the following two exceptions.

1. Privately-owned portable data storage devices (for example USB or flash drives, external drives) may be used to move non-sensitive information to and from Department equipment.

Device users shall minimize this practice and exercise utmost care to make sure the devices do not carry malicious files.

Portable storage devices, both privately-owned or Department owned shall not store sensitive information without suitable physical and technical protective measures in place.

All use of portable and removable devices shall follow Controlling Portable and Removable Storage Devices, per DAS Statewide Policy 107-004-051.

2. Privately owned devices may be connected to the ODOT Guest wireless network, under the “limited incidental personal use” provisions of this policy. Personal devices may NOT be connected to the ODOT Secure wireless or wired networks.

Mobile or Electronic Devices

Department owned mobile or electronic devices that are connected to the ODOT network must be used for acceptable business purposes. Employee use of mobile or electronic devices may be monitored to ensure compliance with the Departments Cyber and Information Security Policy (ADM 04-20), and Distracted Driving (SAF-04). Department network security is vitally important and shall be considered as new technologies are deployed.

Department owned mobile or electronic devices capable of accessing the Department computing environment, systems or networks, such as smartphones, tablets, laptops, or other approved wireless devices, shall be selected from devices supported by Information Systems Branch (ISB).

Installation of Department owned mobile or electronic device related hardware and software on Department owned systems including desktop PCs will be performed only by authorized personnel. ISB will coordinate the installation of all ODOT provided hardware and software including laptops, smartphones, and Mobile Device Management (MDM) software, in accordance with the Department policy- Information Technology Asset Management, (SUP 03-02). Only Department approved applications may be installed on Department owned devices and except for incidental personal information all data contained on such devices shall be strictly work-related.

Hardware devices shall not be attached to a state provided computer that the user does not employ in the user’s assigned work. Privately owned devices shall not be connected to state networks, computers (including remotely used computers) or other equipment without approval of the agency prior to connection. All hardware attached to state systems shall be appropriately configured, protected, and monitored so it will not compromise state information assets.

https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/ADM%2004-20.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/ADM%2004-20.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/SAF%2004.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/SUP%2003-02.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/SUP%2003-02.pdf

Department resources will only be used to support Department approved hardware, software, applications, and connections.

Business Unit Responsibilities for Mobile or Electronic Devices

Business units are responsible for tracking Department owned laptops, smartphones, or other mobile electronic devices as expendable property and for reclaiming it from the employee when employment with the Department ends. Laptops, smartphones, or other electronic devices purchased by the Department shall be selected from the approved hardware list. Business units are responsible for the tracking and management of Department owned laptops, smartphone or other devices and associated plans, in accordance with statewide DAS policy, Internal Controls for the Management of Mobile Computing Devices, (107-001-015).

Efficient utilization of Department resources must be adhered to. Department managers shall have sufficient justification to warrant approval of multiple devices per employee such as: laptops, smartphones, tablets, or other electronic device purchases by gains in efficiency and productivity which cannot otherwise be achieved by existing, supported computer equipment. Any excess equipment should be turned in to Surplus Property. See ODOT Policy Disposal of State Owned Property, (SUP 09-1).

Personal Use

Personal Use of Internet, Networks and Services

Except as noted in the Division Restrictions described in this section, the Department allows employees “limited, incidental personal” use of the internet, and the ODOT Guest wireless network. The Department has sole discretion to decide if an employee’s use is personal or business.

Personal use shall follow all state and Department policies including the Ethical Conduct section of this policy and Ethics (PER 01-02), Employee Behavioral Standards (PER 01-02-

03) and Solicitation, Distribution, Events & Fundraising Activities (PER 01-03).

Using the Internet increases the risk of exposing state information assets to security breaches. The state can only accept this risk for business use; however, agency directors may allow employees limited, incidental personal use as long as there is no or insignificant cost to the state and such use does not violate these guidelines. State agencies have sole discretion to determine if an employee’s use is personal or business. Business use includes accessing information related to employment with the state, including all rights per the union contract. Approved sites for this purpose are PEBB, PERS, EAP, the Oregon JOBS page, Oregon Savings Growth Plan, and union contractual information. Use in cases of emergency or to check weather conditions may be deemed acceptable based on agency policy.

Use shall not include playing computer games, whether Internet, personal, or those included with approved software applications. State systems may not be used for: hosting or operating personal Web pages; non-business-related postings to Internet groups, chat rooms, Web pages, or list serves; or creating, sending, or forwarding chain e-mails.

https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/SUP%2009-01.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/PER%2001-02.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/PER%2001-02-03.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/PER%2001-02-03.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/PER%2001-03.pdf

The following activities are “explicitly prohibited” personal internet uses on ODOT secure networks:

• Buying, selling, or transacting business of any sort

• Personal financial transactions or bill paying

• Gaming or gambling

• Personal blogging and contributing to collaborative websites

• Promoting or soliciting personal opinions

This policy does not limit or infringe upon those rights to use state information systems and information assets granted under the collective bargaining agreements.

Division Restrictions

Because of the sensitive nature of the work or information handled, and bandwidth or other considerations, Department divisions may apply added restrictions to personal internet use and/or ODOT Guest wireless network use. Division restrictions shall be documented, approved by the appointing authority, and communicated to affected employees. Any Division restriction that prohibits all personal internet use must be approved by the appointing authority.

Messaging solutions must be approved by the Department.

The Department allows streaming video/audio for business purposes. This includes internet broadcasts of government and educational events, such as hearings, legislative sessions, classes, and webinars. Use of entertainment-related streaming video/audio is prohibited unless the use is required as part of the employee’s official duties or responsibilities.

Use of state information systems and information assets for blogging and contributing to collaborative web-sites is only allowed for business purposes, in accordance with ODOT Social Media Policy ADM (05-08-02). All Department blogs, messaging activity and social media presence, for example Facebook posting representing ODOT, must be approved by the Communications Division. Use of state information systems and information assets for promoting an employee’s opinion is prohibited.

Personal Use of Audio CDs, DVDs

State agencies may allow the use of Instant Messaging (IM) and other communications/messaging alternatives for business purposes.

Agencies may allow the use of streaming video/audio for business purposes. However, these uses shall be approved, documented, adequately secured, and comply with public records and archiving laws.

State agencies may allow users to play audio CDs or DVDs using state equipment (per state agency policy) provided it does not interfere with their or other’s work. Users are not allowed to transfer music from the CD to the workstation or notebook hard drive. Audio CDs that require the user to install software on the workstation or notebook computer may not be played. State agency workstations and notebook computers may not be used to make “compilation” CDs or to “burn” audio or video disks for personal use. State workstation and notebook computers may not be used to transfer music to portable music players. Peer-to-Peer (P2P) file sharing is prohibited on the state network. State agencies shall approve and document any exceptions.

https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/ADM%2005-08-02.pdf https://ordot.sharepoint.com/:b:/r/sites/BusinessServices/Shared%20Documents/ADM%2005-08-02.pdf

The Department allows users to play media files, such as music DVD’s using state equipment if it does not interfere with their work or the work of others. Users are not allowed to store non-business media files on state-owned equipment, except for personal wallpaper and desktop pictures, as described under the Downloads Section of this policy.

Personal Use of Encryption

Personal Solicitation

General information postings for the Department employee population such as those related to Department-sponsored training opportunities, Governor’s food drive, Jackson Scholarship, retirement education sessions, retiree receptions, blood drives, recycling, public transit or ridesharing, and diversity do not need advanced approval. See ODOT Policy Solicitation Distribution, Events and Fundraising Activity, (PER 01-03).

Public Use of State Systems

Connection of privately owned devices to the ODOT Guest wireless network for public access is authorized only through approved Department provided wireless access points. Visitors, vendors, contractors, guests, or employees logging on under the account “Guest” may connect privately owned devices only to the open ODOT Guest wireless network. A password for the “Guest Account” is required and available from the ODOT Computer Support Desk.

The open ODOT Guest wireless network is primarily provided for business purposes.

Limited incidental personal use of the guest network is allowed only if the use of this state asset does NOT affect productivity or result in misuse of state paid time or resources.

The ODOT Guest wireless network shares the same network bandwidth as the ODOT Secure wireless network access points and uses the larger statewide Wide Area Network (WAN).

Employees shall be sensitive to network congestion that can be caused by using the ODOT Guest wireless network. Employee limited incidental personal use of the ODOT Guest wireless network, with privately owned devices, must not include high bandwidth activity including, but not limited to: Sound or video files, images or large e-mail attachments that are high bandwidth downloads.

Personal hardware or software may not be used to encrypt any state or agency owned information so as to deny or restrict access to a public official who has a valid, job-related interest or purpose in the information, except in accordance with express prior permission and direction from the agency director.

State information systems shall not be used for personal solicitation. For example, systems shall not be used to lobby, solicit, recruit, sell, or persuade for or against commercial ventures, products, religious or political causes or outside organizations.

Agency-provided e-mail systems and Internet access for the public shall be appropriately secured in order to properly protect state information assets.

If ODOT Guest wireless network bandwidth usage significantly impacts operational Statewide Area network (WAN) bandwidth, managers may prohibit guest network access, in affected areas, with appointing authority approval. Managers may prohibit ODOT Guest wireless network usage, or add other restrictions, that are consistent with their division’s restrictions, with appointing authority approval. Managers may revoke individual usage privileges, per the Acceptable Use Agreement, based on loss of productivity, misuse of state paid time or resources, and because of bandwidth or other considerations.

Employees, contractors, visitors, guests, or others shall not connect privately owned devices to the ODOT secure wireless or wired networks.

The Information Systems branch (ISB) will provide technical support only for Department owned devices and connections to ODOT Secure Networks. The Department is not responsible for loss of, or damage to, privately owned devices, accessories, data, or personal information, resulting from connection to any state network or system.

Monitoring, Control and Compliance

The Department monitors use of information systems and information assets, including the Internet, messaging services, and e-mail use on a random basis and in response to evidence of misuse.

Department management does not need to have cause to conduct reviews of employee use.

Violation

When violations of this policy are discovered, they shall be properly remedied and proper parties notified.

Violation of terms of this policy can result in limitation, suspension or revocation of access to state information assets and can lead to other disciplinary action up to and including dismissal from state service. Knowingly violating portions of this policy may also constitute “computer crime” under ORS 164.377.

GUIDELINES

RESPONSIBILITY ACTION

Managers and Supervisors

Review/Training Cycle

Understand and follow this policy. Give each employee, contractor, volunteer, intern and temporary or student worker, under your supervision who has access to the ODOT computing environment, a copy of this policy, or provide electronic access, for the required yearly review. Make sure all personnel under your supervision take the “ODOT

- IS - Acceptable Use and You” training, upon hire and yearly thereafter.

Promptly start investigation and take proper action if violations of this policy are reported or suspected.

This policy and “ODOT-IS-Acceptable Use and You” Training is reviewed annually by employees, contractors, volunteers, interns, and temporary or student workers, who have access to the ODOT computing environment.

All Employees, Contractors, Interns Volunteers, Temporary and Student Workers

Understand and follow this policy. Complete the “ODOT – IS - Acceptable Use and You” training annually. Make sure all information systems and information assets, including Internet, e-mail, messaging services, and sensitive data, are used in a professional and proper manner. Consult your supervisor or Human Resources for clarification if you have any doubt about proper use of internet access or other information systems and information assets.

Attachment A

Computer Crime

ORS 164.377 Computer crime

(1) As used in this section:

(a) To “access” means to instruct, communicate with, store data in, retrieve data from or otherwise make use of any resources of a computer, computer system or computer network.

(b) “Computer” means, but is not limited to, an electronic, magnetic, optical electrochemical or other high-speed data processing device that performs logical, arithmetic or memory functions by the manipulations of electronic, magnetic or optical signals or impulses, and includes the components of a computer and all input, output, processing, storage, software or communication facilities that are connected or related to such a device in a system or network.

(c) “Computer network” means, but is not limited to, the interconnection of communication lines, including microwave or other means of electronic communication, with a computer through remote terminals or a complex consisting of two or more interconnected computers.

(d) “Computer program” means, but is not limited to, a series of instructions or statements, in a form acceptable to a computer, which permits the functioning of a computer system in a manner designed to provide appropriate products from or usage of such computer system.

(e) “Computer software” means, but is not limited to, computer programs, procedures and associated documentation concerned with the operation of a computer system.

(f) “Computer system” means, but is not limited to, a set of related, connected or unconnected, computer equipment, devices and software. “Computer system” also includes any computer, device or software owned or operated by the Oregon State Lottery or rented, owned or operated by another person or entity under contract to or at the direction of the Oregon State Lottery.

(g) “Data” means a representation of information, knowledge, facts, concepts, computer software, computer programs or instructions. “Data” may be in any form, in storage media, or as stored in the memory of the computer, or in transit, or presented on a display device. “Data” includes, but is not limited to, computer or human readable forms of numbers, text, stored voice, graphics and images.

(h) “Intimate image,” means a photograph, film, video, recording, digital picture or other visual reproduction of a person whose intimate parts are visible or who is engaged in sexual conduct.

(i) “Intimate parts” means uncovered human genitals, pubic areas or female nipples.

(j) “Property” includes, but is not limited to, financial instruments, information, including electronically produced data, and computer software and programs in either computer or human readable form, intellectual property and any other tangible or intangible item of value.

(k) “Proprietary information” includes any scientific, technical or commercial information including any design, process, procedure, list of customers, list of suppliers, customers’ records or business code or improvement thereof that is known only to limited individuals within an organization and is used in a business that the organization conducts. The information must have actual or potential commercial value and give the user of the information an opportunity to obtain a business advantage over competitors who do not know or use the information.

(l) “Services” includes, but is not limited to, computer time, data processing and storage functions.

(m) “Sexual conduct” means sexual intercourse or oral or anal sexual intercourse, as those terms are defined in ORS 163.305, or masturbation.

(2) Any person commits computer crime who knowingly accesses, attempts to access or uses, or attempts to use, any computer, computer system, computer network or any part thereof for the purpose of:

(a) Devising or executing any scheme or artifice to defraud;

(b) Obtaining money, property or services by means of false or fraudulent pretenses, representations or promises; or

(c) Committing theft, including, but not limited to, theft of proprietary information or theft of an intimate image.

(3) Any person who knowingly and without authorization alters, damages or destroys any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime.

(4) Any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime.

(5) (a) A violation of the provisions of subsection (2) or (3) of this section shall be a Class C felony. Except as provided in paragraph (b) of this subsection, a violation of the provisions of subsection (4) of this section shall be a Class A misdemeanor.

(b) Any violation of this section relating to a computer, computer network, computer program, computer software, computer system or data owned or operated by the Oregon State Lottery or rented, owned or operated by another person or entity under contract to or at the direction of the Oregon State Lottery Commission shall be a Class C felony. [1985 c.537 §8;

1989 c.737 §1; 1991 c.962 §17; 2001 c.870 §18; 2015 c.350 §1; 2017 c.318 §13]

Attachment B

Acceptable Use Agreement

I, acknowledge I am being granted use of state information assets in order to carry out my work and agree that my use of such assets will be conducted in a manner that ensures compliance with this Policy, and Statewide Policies: Acceptable Use of State Information Assets, (107-004-1100), Internal Controls for the Management of Mobile Computing Devices (MCDs), (107-001-015) and ODOT Distracted Driving, (SAF-04).

I acknowledge my usage will be monitored, without further warning, and that inappropriate usage may be cause for disciplinary action, including but not limited to reprimand, suspension, and termination of employment or civil or criminal prosecution under federal and state law.

I acknowledge that Department owned Mobile or Electronic Devices shall only be used for acceptable business purposes.

I acknowledge that I must use any Mobile or Electronic Device, when traveling for Department business, or driving an ODOT owned vehicle, in compliance with ODOT Distracted Driving Policy (SAF-04). Any traffic violations or payment of fines imposed for violation of any applicable laws are my personal responsibility.

I acknowledge that the use of state information assets may be revoked at any time without further warning.

I acknowledge I have read this document by signing below. I understand it is my responsibility to seek advice regarding any questions I might have regarding this document or policy prior to my signing.

Employee Name Employee Signature Date

Manager/Supervisor Name Manager/Supervisor Signature Date