Chapter 5 Managing IT Resources.pdf

Last revised (Transmittal 15-036) September 17, 2025

Guide to Judiciary Policy Vol. 15: Information Technology

Ch. 5: Managing IT Resources

(Note: No unauthorized disclosure of this policy guidance outside the judiciary is permitted.)

§ 510 Appropriate Use of the Internet § 510.10 Establishment of Policies and Responsibilities § 510.20 Minimum Policy Requirements § 510.30 Other Policy Considerations

§ 515 Access to Employee Files and Data § 515.10 Background § 515.20 Keystroke Monitoring § 515.30 Banner Notice § 515.40 Email Access

§ 520 Links to Sites Outside the Data Communications Network

§ 525 Personal Use of Government-Owned Office Equipment and Resources § 525.20 General § 525.30 Definitions § 525.35 Limitations § 525.40 Appropriate Personal Use § 525.50 Inappropriate Personal Use § 525.60 Management and Sanctions

§ 530 Use of Government-Owned IT Equipment Outside of Duty Station § 530.10 Allowable Use § 530.20 Software § 530.30 Liability § 530.40 Operating Costs § 530.50 Guidelines and Operational Procedures

§ 535 Copyrighted Software § 535.10 Federal Copyright Law § 535.20 Scope § 535.30 Compliance

§ 540 “Music on Hold” Copyrights § 540.20 Definition of “Music on Hold” § 540.30 Allowed Services § 540.40 Compliance § 540.50 Infringement and Penalties § 540.60 Funding https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-1-governance-and-authorities/ch-1-guide-introduction-and-public-disclosure#120

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 2

§ 545 Email and Voicemail Records Management

§ 546 IT Asset Management

§ 550 Disposal of IT Equipment § 550.20 Equipment Replacement Funding § 550.30 Media Sanitization § 550.40 Environmental Regulations § 550.50 Records Management § 550.60 Software Licenses

§ 555 Taxes and Fees for Communication Services and Computers § 555.20 State and Local Taxes and Other Charges § 555.30 Federal Tax § 555.40 Collect Calls § 555.60 Cable Television

§ 560 Use of Personally Owned Equipment § 560.10 Voice and/or Data Service Usage Plan Reimbursement § 560.20 Internet Service Plan Reimbursement

§ 570 Smart Phones, Tablet Devices, and Related Applications § 570.10 Wearable Mobile Devices

§ 580 Income from IT Equipment Sales and Miscellaneous Transactions § 580.20 Income from Sales and Employee Reimbursement § 580.30 Income from Manufacturer Exchange § 580.40 Income from Class Action Settlements

§ 510 Appropriate Use of the Internet

§ 510.10 Establishment of Policies and Responsibilities

(a) All court units and federal public defender organizations (FPDOs) are responsible for adopting their own local policies for managing employee internet access and providing guidance on responsible use of the internet.

(b) Since no two employees will use the internet in the same way, each employee and the employee’s manager will need to exercise individual responsibility and judgment as to acceptable and appropriate use of internet services. A local policy will help employees and managers in making this judgment.

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 3

§ 510.20 Minimum Policy Requirements

Each court unit’s or FPDO’s policy must contain, at a minimum:

(a) a definition of what constitutes “acceptable or responsible” use;

(b) an explanation of the potential for institutional embarrassment, such as disclosure or damage to sensitive organization information;

(c) the consequences of violation of the local use policy; and

(d) notice to employees that use is monitored and may be reported to the employee’s court unit or FPDO upon request.

(Note: For the message that must be displayed to each user upon login to the local network, see: § 515.30.)

§ 510.30 Other Policy Considerations

In addition to what is required by § 510.20, the following additional concerns should be considered for inclusion in local policies on the appropriate use of the internet:

(a) Principal areas of concern associated with uncontrolled access to the internet for employees are:

• institutional embarrassment,

• disclosure of sensitive organization information,

• misperception of authority, and

• the introduction of malicious software (also known as malware) to the local or wide area networks.

(b) When accessing the internet from a judiciary gateway, employees should keep the following information in mind:

(1) Employees should use discretion and avoid accessing internet sites that may be inappropriate or reflect badly on the judiciary.

(2) Employees not authorized to speak on behalf of their units, organization, or the judiciary should avoid the appearance of doing so.

(c) The responsibility for preventing personal information about judges and staff, and sensitive court unit and FPDO data from appearing on public sites lies with every judiciary employee.

(1) Court units and FPDOs are encouraged to develop local policies on the release of judiciary information in addition to developing their

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 4 own local policies on use of social media to further safeguard sensitive judiciary information. For information about threats to the security of sensitive judiciary data, see: Guide, Vol. 15, § 310.10.30.

(2) For information on best practices in use of social media, see:

Social Media Guidance and Policies on JNet’s Ethics and Financial Disclosure page.

§ 515 Access to Employee Files and Data

§ 515.10 Background

(a) Employer access to employees’ computer files and data is necessary from time to time for a number of purposes, such as maintenance, support, detection of intruders through the use of tools such as keystroke monitoring and the analysis of security logs, and for business needs in the employee’s absence.

(b) The Supreme Court has held (O’Connor v. Ortega, 480 U.S.709 (1987)) that searches of public employees’ workspace are governed by Fourth Amendment standards that require balancing “employees’ legitimate expectations of privacy against the government’s need for supervision, control, and efficient operation of the workplace.”

(1) The Court confirmed that public employees can have a reasonable expectation of privacy in their place of work, but that such expectations “may be reduced by . . . actual office practices and procedures, or by legitimate regulation.”

(2) The reasonableness of a search of an employees’ computer files and data will be determined based on a factual analysis of the circumstances in each case.

(c) The law is not without ambiguities and variations from one jurisdiction to another and the reasons for monitoring and requiring access are not foreseeable or uniform. Thus, it is recommended that court units and FPDOs establish policy describing the authorized use of and access to employees’ computer files and data to establish clear expectations of privacy by all users.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_10_30 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_10_30 https://jnet.ao.dcn/policy-guidance/ethics-and-financial-disclosure/social-media-guidance-and-policies https://jnet.ao.dcn/policy-guidance/ethics-and-financial-disclosure https://jnet.ao.dcn/policy-guidance/ethics-and-financial-disclosure

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 5

§ 515.20 Keystroke Monitoring

(a) Keystroke monitoring is a process by which system managers view or record both the keystrokes entered by a computer user and the computer’s response.

(1) Examples of keystroke monitoring would include viewing characters as they are typed by users, reading users’ email, and viewing other recorded information typed by users.

(2) Some forms of routine system maintenance record user keystrokes, which could constitute keystroke monitoring if the keystrokes are preserved along with the user identification.

(3) Keystroke monitoring is typically conducted in an effort to protect systems from intruders who access the systems without authority or in excess of their assigned authority.

(b) Ambiguity in the current law makes it unclear whether keystroke monitoring is viewed as equivalent to a telephone wiretap.

(1) No legal precedent has been set to determine whether keystroke monitoring is legal without consent or authorization.

(2) Since there has not been a ruling in this area, if a court unit or FPDO were to determine that keystroke monitoring is improper without consent or authorization, system managers could potentially be subject to criminal and civil liabilities.

(c) If system managers are conducting keystroke monitoring or anticipate the need for such monitoring, even if only for the purpose of detecting intruders, they should ensure that all system users, authorized and unauthorized, are notified that such monitoring may be undertaken.

§ 515.30 Banner Notice

(a) All IT systems must display the following warning banner before the login screen except as provided below in paragraph (b).

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 6

NOTICE TO USERS

This is a restricted government system for official judiciary business only. All activities on this system for any purpose, and all access attempts, may be recorded and monitored or reviewed by persons authorized by the federal judiciary for improper use, protection of system security, performance of maintenance, and appropriate management by the judiciary of its systems. By using this system or any connected system, users expressly consent to system monitoring and to official access to data reviewed and created by them on the system. Any evidence of unlawful activity, including unauthorized access attempts, may be reported to law enforcement officials.

(b) If the warning banner cannot be used due to a limit on the number of characters, contact the Administrative Office of the U.S. Courts’ (AO) Information Technology Security Office (ITSO) at AO_ITSO@ao.uscourts.gov for a shorter version. (Note: FPDO employees should contact the Defender Services Office’s National Information Technology Operations and Applications Development (NITOAD) Branch.)

(c) For public websites that do not require any specific login, the warning banner will be included as part of the privacy notice.

§ 515.40 Email Access

(a) The judiciary’s enterprise email software configuration provides administrators in each court unit and the AO with the level of access rights necessary to maintain their unit’s email files. For reasons related to email security and for privacy considerations, local administrators generally do not have the level of access rights that enable them to view any individual’s email file.

(b) Because circumstances may require management to have access to an employee’s email files and data, managers from court units or the AO can request to have “full access” temporarily granted to a specific employee for the purpose of accessing a specific email file.

(1) Managers may request temporary “full access” access only for official business purposes.

(2) Requests for temporary “full access” access require the concurrence of the chief judge, court unit executive (CUE), or the Executive Management Group (EMG) member of the requesting manager at the AO.

(3) All requests are reviewed by the AO’s Office of the General Counsel, which may contact the requesting manager for additional information or justification.

mailto:AO_ITSO@ao.uscourts.gov

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 7

(c) Temporary “full access” may be requested by completing the Request for Temporary Data Access Rights (For Courts and AO Use) form.

§ 520 Links to Sites Outside the Data Communications Network The ability to link from judiciary websites to sources external to the judiciary can add significant value to the judiciary’s information services. Each court unit and FPDO is responsible for ensuring that the following requirements are met when selecting and maintaining links to external websites.

(a) Links to non-judiciary web resources should be in support of the judiciary’s mission. Each external link should be reviewed periodically to ensure its continued suitability. The content of a linked external site should be removed if it becomes:

• questionable,

• insecure,

• objectionable, or

• obsolete.

(b) No product endorsements may be stated or implied nor preferential treatment given through judiciary web information services.

(c) Links may include those vendor pages offering free viewers for different file formats offered at the court unit and FPDO website. Examples of links include:

• Adobe PDF;

• Microsoft Word, Excel, and PowerPoint; and

• Corel WordPerfect and Presentations.

(d) Payments or benefits of any kind may not be accepted in exchange for a link placed on publicly accessible websites.

(e) Judiciary websites should not require or encourage users to choose any specific browser software. Only text or linked text may be used to direct visitors to software download sites. Graphics or logos depicting companies or products should not appear on judiciary web information services.

(f) The local policy for linking to other sites needs to be carefully developed so as not to discriminate on an arbitrary basis. Once a link to a non-judiciary site is established at a court unit and FPDO, requests to link to similar sites may be received and should be considered on the same basis as previously established links.

https://fedcourts.sharepoint.com/sites/zNSD/Pages/SupportDocuments.aspx?RootFolder=%2Fsites%2FzNSD%2FSupport%20Documents%2FNational%20Systems%2FOffice%20Productivity%20Services%2FEmail%2FData%20Access%20Rights&FolderCTID=0x0120007A3CD82CCEE8424DA2B0D5552A8AA2ED005C466668B0467F47B3C069AF606D48EF&View=%7BA4B493A5%2D95EE%2D40CB%2D8532%2D55260A4042D9%7D https://fedcourts.sharepoint.com/sites/zNSD/Pages/SupportDocuments.aspx?RootFolder=%2Fsites%2FzNSD%2FSupport%20Documents%2FNational%20Systems%2FOffice%20Productivity%20Services%2FEmail%2FData%20Access%20Rights&FolderCTID=0x0120007A3CD82CCEE8424DA2B0D5552A8AA2ED005C466668B0467F47B3C069AF606D48EF&View=%7BA4B493A5%2D95EE%2D40CB%2D8532%2D55260A4042D9%7D

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 8

(g) When external links are included, the CUE or FPD is responsible for ensuring that a disclaimer appears indicating that the judiciary neither endorses the product or organization at the destination, nor exercises any responsibility over the content at the destination.

(1) A disclaimer similar to the one below should be displayed when linking to external sites. This disclaimer may appear on the page(s) listing external links, or through an intermediate “exit notice” page generated by the server whenever a request is made for any site outside of the judiciary web information service.

(2) Sample disclaimer:

The links below [or “The site you are about to visit”] contain[s] information created and maintained by other public and private organizations. These links are provided for the user’s convenience. The [court unit or FPDO name here] does not control or guarantee the accuracy, relevance, timeliness, or completeness of this outside information; nor does it control or guarantee the on-going availability, maintenance, or security of these internet sites. Further, the inclusion of links is not intended to reflect their importance or to endorse any views expressed, or products or services offered, on these outside sites, or the organizations sponsoring the sites.

§ 525 Personal Use of Government-Owned Office Equipment and Resources This section sets forth judiciary model policy for judges and judiciary employees on the appropriate use of government-owned equipment (including IT equipment). See:

JCUS-SEP 2002, pp. 47-48.

§ 525.20 General

(a) Government-owned equipment is for the use of judges and judiciary employees in their performance of official government business.

(1) The judiciary recognizes, as do other branches of the federal government, that equipment supplied to perform government business offers many conveniences that may be used by judges and judiciary employees for personal needs at minimal or no additional cost to the taxpayer.

(2) This personal use may enable judges and judiciary employees to be more efficient and productive in their professional and their personal lives. Thus, on balance, the limited, personal use of such equipment, as further described below, is in the best interest of the judiciary.

https://www.uscourts.gov/file/2136/download

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 9

(b) Judges and judiciary employees are permitted limited use of government-owned equipment for personal needs if such use does not interfere with official business and involves minimal additional expense to the government.

(c) The limited, personal use of government-owned equipment should only occur during non-work time.

(d) This privilege to use government-owned equipment for non-government purposes may be revoked or limited at any time by appropriate judiciary officials.

§ 525.20.10 Applicability

(a) Judiciary officials may apply this policy to contractor personnel, interns, and other non-government employees through incorporation by reference in contracts or memoranda of agreement as conditions for use of government-owned equipment.

(b) Court unit and FPDO officials may impose or maintain a more restrictive policy for personal use of government-owned equipment by judges, judiciary employees, and other on-site personnel.

§ 525.30 Definitions

Government- Owned Equipment and Resources

Includes but is not limited to:

• personal computers, printers, and related peripheral equipment and software,

• tablet devices and related applications,

• library resources,

• telephones,

• facsimile machines,

• photocopiers,

• office supplies,

• cellular phones, smart phones, and hands-free devices,

• internet connectivity, and

• email.

Note: This list is provided to show examples of equipment intended to be covered by this policy, and it is not meant to be comprehensive.

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 10

§ 525.30 Definitions

Minimal Additional Expense

Personal use that will result in no more than normal wear and tear or the use of small amounts of electricity, ink, toner, or paper. Examples of such minimal additional expenses include:

• making a limited number of photocopies,

• using a computer printer to print a limited number of pages,

• making occasional phone calls,

• infrequently sending email messages, and

• limited use of the internet.

Non-Work Time

Time when judges and judiciary employees are not otherwise expected to be addressing official business, such as:

• off-duty hours before or after a workday,

• lunch periods or other authorized breaks, and

• weekends or holidays.

Personal Use Activity conducted by judges and judiciary employees for purposes other than official government business and that is not deemed inappropriate personal use per § 525.50.

Push Technology

Technology through which information is sent automatically to a user’s computer from the internet or other on-line services without the user initiating a request for the information each time.

Streaming Recreational Video

Streaming videos, movies, sports, talk shows, and other programming unrelated to official government business that is available from a variety of sources.

§ 525.35 Limitations

(a) For the purpose of this policy, the judiciary is extending the opportunity to judges and judiciary employees for limited, appropriate, personal use of government-owned equipment in an effort to establish a work environment more conducive to efficiency and productivity.

(b) This policy does not create any right to use government-owned equipment solely for other than official government business, nor for inappropriate personal use. Nor does the privilege extend to modifying such equipment, including loading personal software or making configuration changes.

§ 525.40 Appropriate Personal Use

(a) Judges and judiciary employees are specifically prohibited from using government-owned equipment in furtherance of a private business.

However, users may, for example, use government-owned equipment to:

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 11

• review Thrift Savings Plan accounts,

• monitor medical and dependent care, or commuter benefit reimbursement accounts,

• seek employment, or

• communicate with volunteer charity organizations.

(b) In using government-owned equipment for limited, personal purposes, judges and judiciary employees must, at all times, avoid giving the impression that they are acting in an official capacity. If there is a potential that such limited, appropriate, personal use could be interpreted to represent official business of the judiciary, an adequate disclaimer must be used, such as, “The contents of this message are personal and do not reflect any position of the judiciary or the [court unit or FPDO].”

(c) The Code of Conduct for Judiciary Employees applies to this privilege, including the stricture that judiciary employees may not lend the prestige of their offices to advance or appear to advance the private interests of others. See: Guide, Vol. 2A, Ch. 3 (Code of Conduct for Judicial Employees).

§ 525.50 Inappropriate Personal Use

Inappropriate personal use of government-owned equipment includes:

(a) Any personal use that could cause congestion, delay, or disruption of service to any government system. Examples include but are not limited to, use of electronic greeting cards, video, sound or other large file attachments, push technology on the internet, streaming recreational video and other continuous data stream uses. See: Report of the Judicial Conference Committee on Information Technology, Sept. 2018, pp. 7-8.

(b) Attempting to gain unauthorized access to other systems or data.

(c) Creating, copying, transmitting, or retransmitting chain letters or other unauthorized mass mailings, regardless of subject matter.

(d) Using equipment for activities that are illegal, inappropriate, or offensive to fellow staff or the public, such as hate speech, or material that ridicules others on the basis of race, creed, religion, color, gender, disability, national origin, or sexual orientation.

(e) Creating, downloading, viewing, storing, copying, transmitting, or retransmitting sexually explicit or sexually oriented material.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-2-ethics-and-judicial-conduct/part-codes-conduct/ch-3-code-conduct-judicial-employees https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-2-ethics-and-judicial-conduct/part-codes-conduct/ch-3-code-conduct-judicial-employees

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 12

(f) Creating, downloading, viewing, storing, copying, transmitting, or retransmitting material related to illegal gambling, illegal weapons, terrorist activities, and any other illegal or prohibited activities.

(g) Using equipment for commercial activities or in support of commercial activities or in support of outside employment or business activity, such as:

• consulting for pay,

• administering business transactions, or

• selling goods or services.

(h) Using equipment for fund-raising activity, endorsing any product or service, participating in any lobbying activity, or engaging in any partisan political activity.

(i) Posting or providing judiciary information to external news groups, bulletin boards, or other public sites without authority, including any use that could create the perception that the communication was made in an official capacity as a judiciary employee.

(j) Using equipment in a manner that results in loss of productivity, interference with official duties, or greater than minimal additional expense to the government.

(k) Acquiring, using, reproducing, transmitting, or distributing without authorization any controlled information. Controlled information includes judiciary sensitive data (see: Guide, Vol. 15, § 310.10.10(e)), proprietary data subject to the intellectual property rights of others, such as copyright, trademark or other rights (beyond fair use), as well as computer software and data (e.g., export controlled software or data).

(l) Using judiciary-provided access to online investigative tools and databases containing personal information to gather information for non-work-related purposes is prohibited, including attempting to research friends, neighbors, acquaintances, celebrities, other public figures, etc.

Online investigative tools include LexisNexis and Westlaw public records or other databases that contain personal information (e.g., telephone, driver’s license, auto registration and VIN numbers, home addresses, property ownership records, voting records).

§ 525.60 Management and Sanctions

(a) Each court unit and FPDO will establish local controls to ensure that the use of government-owned equipment is consistent with this policy.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_10_10

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 13

Unauthorized or improper personal use of government-owned equipment may result in:

(1) loss of the privilege;

(2) limitation of the privilege;

(3) disciplinary or adverse actions;

(4) criminal penalties; and/or

(5) civil penalties, including financial responsibility for the costs of improper use.

(b) The AO will centrally block recreational video sites that have no business purpose. See: Report of the Judicial Conference Committee on Information Technology, Sept. 2018, pp. 7-8; Currently Blocked Streaming Recreational Video Sites.

§ 530 Use of Government-Owned IT Equipment Outside of Duty Station

§ 530.10 Allowable Use

(a) Court units and FPDOs may make cyclically replaced IT equipment available for use by employees outside of the duty station when it is determined to be in the best interest of the government. The equipment remains the property of the judiciary and should be used primarily for official business.

(b) Limited personal use of such equipment is permissible as established in the personal use guidelines. See: § 525.

§ 530.20 Software

§ 530.20.10 Approval for Use

Personally owned software and computer equipment must not be loaded or connected to court-provided equipment without the approval of the court unit or FPDO.

§ 530.20.20 Licensing

Software may only be used consistent with the applicable license, and terms should be reviewed before loading software on PCs designated for home use.

https://jnet.ao.dcn/information-technology/networks/currently-blocked-streaming-recreational-video-sites https://jnet.ao.dcn/information-technology/networks/currently-blocked-streaming-recreational-video-sites

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 14

§ 530.30 Liability

(a) The Government Accountability Office (GAO) has determined that employees may be held responsible for loss or damage to government-owned equipment only when covered by a written agency policy.

(b) A board of survey, appointed by a chief judge, CUE, or FPD, must be convened at the court unit or FPDO to determine the circumstances of a specific instance involving loss, damage, or destruction of government-owned equipment. See: Guide, Vol. 11, § 435(b) and Vol. 16, § 555.

(c) Written policies and procedures must be in place at the court unit or FPDO to impose liability on employees for loss or damage of property issued to them for telework or other official purposes due to negligence. See:

Guide, Vol. 11, § 550.40(c) and Vol. 12, § 1020.60.40.

(d) The policy must inform employees of potential liability and establish a means of determining and enforcing liability.

(e) The board of survey must make a recommendation, in writing, to its convening authority whether to pursue remedies under applicable court unit or FPDO policies, to include financial liability if deemed appropriate.

(f) Reimbursement by employees for damaged or lost IT equipment must be deposited back into the Judiciary Information Technology Fund (JITF) and redistributed back to the court unit or FPDO. See: § 580.

§ 530.40 Operating Costs

The judiciary is not responsible for operating or other costs (e.g., utilities) incurred when an employee uses government- or personally owned IT equipment in a private residence for official purposes.

§ 530.50 Guidelines and Operational Procedures

To improve management control and oversight of government-owned PCs in residences, court units or FPDOs must develop written guidelines and operational procedures. For policy on teleworking for judiciary employees, see: Guide, Vol. 12, § 1020.

§ 530.50.10 Factors to Consider

The following are some of the issues to consider when developing guidelines and operational procedures:

(a) Who is responsible for authorizing residential use of judiciary-owned equipment;

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-11-internal-control/ch-4-property-management#435 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-16-space-and-facilities/ch-5-personal-property#555 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-11-internal-control/ch-5-human-resources#550_40 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-10-telework#1020_60_40 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-10-telework#1020 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-10-telework#1020

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 15

(b) Who will ensure appropriate property records (including property passes or caretaker forms) and check-in and check-out procedures are in place and operational;

(c) How often should authorization for non-duty station use of judiciary-owned equipment be renewed;

(d) What software will be loaded on equipment and who is authorized to load software;

(e) What hardware, if any, may be added to equipment outside of the duty station;

(f) What virus prevention software will be installed and how instructions on its use will be provided;

(g) Who is responsible for preparing, setting up, and maintaining equipment;

(h) How will damaged equipment be handled;

(i) How will sensitive information be secured;

(j) What precautions will be taken to prevent loss, theft, or damage to the equipment; and

(k) What precautions will be taken to prevent the transmission of confidential information on unsecured communications lines?

See: Guide, Vol. 12, Ch. 10 (Telework).

§ 535 Copyrighted Software

§ 535.10 Federal Copyright Law

(a) Software is protected by federal copyright law. This means that the creator of the software is entitled to establish allowable use of the software through licensing terms and be compensated for the licensed use.

(b) Infringers of software copyrights may be liable whether or not they know their conduct violated federal law.

§ 535.20 Scope

Most software used by judges and judiciary employees is made available through judiciary enterprise licenses. If the terms of the license permit, software may also be installed directly on a judge or judiciary employee’s personally owned PC or on a court https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-12-human-resources/ch-10-telework

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 16 unit’s or FPDO’s local area network (LAN). This section applies to software installed on PCs or the court unit’s or FPDO’s LAN, excluding open source software, software with creative commons licensing, or other software deemed in the public domain.

§ 535.30 Compliance

Court unit executives and federal public defenders should ensure that compliance with these requirements is periodically reviewed.

(a) All provisions of the license agreements issued with the software must be followed and organizational ownership must be registered.

(b) A license or other proof of ownership must be on file for each piece of copyrighted software installed on PCs.

(c) Some government-owned software licenses allow home-use rights, so that an employee may install government-owned software on a computer at home for official use. The home-use rights expire if the employee is separated from court or FPDO employment.

(d) In general, employees are discouraged from installing their personally owned software on government-owned equipment. If it is in the best interest of the organization to allow personally owned software to be installed on government-owned equipment:

(1) Authorization should be granted in writing by the immediate supervisor, providing the justification.

(2) Before authorization, the employee should provide the software license to the IT manager and give proper assurance, per local policy, that copyright infringement will not occur from installation on government equipment and that the software will be kept up to date.

(3) Employees not following these procedures may be held personally liable for violations of the copyright laws and may be subject to the applicable penalties.

(e) LAN administrators and users must assure strict compliance with the software license for the use of the software on a LAN. Single-copy licensed software should not be used on a LAN unless the license explicitly permits simultaneous multiple users or the number of users can be controlled.

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 17

(f) Employees should ensure that they are in full compliance with shareware/open source terms of use. Shareware/open source software is software that the author allows users to obtain at little or no cost.

(1) Use of shareware is generally restricted to evaluation purposes only, and continued use may obligate the user to pay the price set by the copyright owner.

(2) Often the author of shareware/open source software permits users to distribute copies of the software, but requires that all associated files — including terms of use and licensing — be distributed along with the executable files.

§ 540 “Music on Hold” Copyrights The copyright owners of a musical work or performance own the exclusive right to public performance of the work. This includes transmission of recorded music or re-transmission of radio station broadcasts.

§ 540.20 Definition of “Music on Hold”

(a) “Music on Hold” describes any system (e.g., radio receiver, tape recorder, or other playback devices or telecommunications) that provides musical entertainment for telephone callers who are placed on hold.

(b) Transmitting radio programs over the telephone to provide “music on hold” is considered “re-broadcasting” and requires a separate license for the copyrighted material (music and/or program).

§ 540.30 Allowed Services

Court units and FPDOs may use:

(a) Commercial services, such as Muzak, that provide copyrighted music for a fee.

(b) Bulk licenses that allow the use of copyrighted music from a performing rights clearinghouse, such as the American Society of Composers, Authors, and Publishers (ASCAP). Clearinghouses provide a license for public performance rights for music within their library but generally do not provide the music itself.

(c) Substitute services, such as messages on hold that allow the called organization to provide information to callers and may include descriptions of the organization’s mission or function, a schedule of upcoming events, or plans for future services.

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 18

§ 540.40 Compliance

Each court unit and FPDO is responsible for ensuring that, if it is using “music on hold,” it is consistent with copyright laws and all provisions of the license agreements.

§ 540.50 Infringement and Penalties

Individual infringers of copyrights may be liable whether or not they know their conduct violated federal law. Enforcement penalties may include an injunction prohibiting further infringements, damages of not less than $750 nor more than $30,000 for each song infringed, plus court costs and attorney’s fees. Judiciary funds may not be used to pay penalties or fines for infringement of the law. See: 17 U.S.C. § 504. (For alleged copyright infringement by or on behalf of the judiciary, see: 28 U.S.C. § 1498; Guide, Vol. 14, § 660.10(a)).

§ 540.60 Funding

The AO will not provide appropriated funds for equipment or services in support of “music on hold,” such as:

• radio receivers,

• tape recorders,

• music playback devices,

• telecommunications equipment, or

• bulk licenses.

§ 545 Email and Voicemail Records Management

(a) Email applications do not provide record keeping functionality that complies with National Archives and Records Administration (NARA) requirements for a system for the retention of federal records.

(b) In the absence of a compliant electronic record keeping system in which to retain these records until their disposition is authorized, a complete paper copy of records that must be maintained must be printed and filed in the appropriate local record keeping system. The electronic copy may then be deleted when no longer needed.

(c) Users should be educated as to what type of email or voicemail message would constitute an official record. See: Guide, Vol. 10, § 610.50.

(1) For email messages and attachments that meet the definition of federal records, the printed copy must include attachments, and capture the names of the sender, all recipients, the transmission https://www.law.cornell.edu/uscode/text/17/504 https://www.law.cornell.edu/uscode/text/28/1498 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-14-procurement/ch-6-bonds-insurance-taxes-and-intellectual-property#660_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-14-procurement/ch-6-bonds-insurance-taxes-and-intellectual-property#660_10 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management#610_50

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 19 date and time, and any receipt record required or received. See:

Guide, Vol. 10, Ch. 6.

(2) Voice mail messages that meet the definition of federal records must be memorialized in writing and capture the names of the sender and recipient as well as the date and time of the message.

Users should be encouraged to use means other than voicemail for such matters.

(d) Transitory records (short-term interest,180 days or less) that have minimal or no documentary or evidential value may be destroyed when no longer needed. For applicable record retention policy, see: Guide Vol. 10, Ch. 6.

§ 546 IT Asset Management

(a) The AO’s Chief Information Officer must implement and maintain an IT

Asset Management program for the judiciary that:

(1) tracks all IT assets and their use;

(2) ensures that IT assets comply with relevant laws and policies;

(3) strengthens the judiciary’s IT infrastructure and data protection capabilities against both physical and cyber threats; and

(4) ensures that IT assets are accounted for, maintained, upgraded, and disposed of properly throughout their lifecycles.

(b) All court units must, at a minimum, satisfy the judiciary’s national Standard for IT Asset Management, but this standard may be supplemented by more rigorous local standards.

(c) In coordination with the AO’s Chief Information Officer, the Defender Services Office, through NITOAD, must implement and maintain an IT Asset Management program for FPDOs consistent with the judiciary's national Standard for IT Asset Management.

§ 550 Disposal of IT Equipment

(a) The procedures for the disposal of personal property, including IT equipment, are prescribed in Guide, Vol. 16, § 580. The purpose of this section is to further ensure that the disposal of IT equipment:

(1) adheres to judiciary IT disposal policies;

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management https://fedcourts.sharepoint.com/:b:/r/sites/zUSC-IT-Stds/Active_Standards/IT_Asset_Management_Standard.pdf https://fedcourts.sharepoint.com/:b:/r/sites/zUSC-IT-Stds/Active_Standards/IT_Asset_Management_Standard.pdf https://fedcourts.sharepoint.com/:b:/r/sites/zUSC-IT-Stds/Active_Standards/IT_Asset_Management_Standard.pdf https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-16-space-and-facilities/ch-5-personal-property#580

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 20

(2) is compliant with federal, state, and local environmental regulatory requirements; and

(3) protects the confidentiality of the judiciary’s information.

(b) For a list of IT equipment to which this guidance applies, see: Guide, Vol.

15, § 210.20.

§ 550.20 Equipment Replacement Funding

The judiciary’s PC desktop and laptop configurations, servers, software, communications equipment, printers, copiers, and maintenance are presently funded for replacement through the IT Infrastructure Formula, which is calculated on a requirements-based approach. See: IT Infrastructure Allotment Formula.

§ 550.30 Media Sanitization

(a) The inadvertent or deliberate disclosure of sensitive information is possible without the proper application of data removal procedures for electronic media. (For examples of sensitive information, see: Guide, Vol. 15, § 310.10.20(a).) To mitigate the risks of such disclosures, staff responsible for IT security should follow data security practices throughout the system life-cycle. Media should be sanitized of all sensitive information under each of the following conditions:

(1) Before a device is transferred internally within the judiciary to another court unit or FPDO or externally to another individual or organization.

(2) After receiving an internal or external transfer of a device and it cannot be confirmed that it was already sanitized by the originating organization.

(3) Before the device and/or its components are remanufactured, reused, and/or recycled.

(4) Before the device and media are provided to a service provider or maintenance organization for the purposes of repair, diagnostics, or replacement.

(5) Before leased equipment is returned to its vendor.

(6) Before the device and media are disposed of.

(b) The process of deleting files from media or simply removing pointers to a file generally will not render the previous information unrecoverable.

Similarly, reformatting media does not necessarily overwrite all data or https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-2-funding#210_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-2-funding#210_20 https://jnet.ao.dcn/information-technology/it-infrastructure-formula https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_10_20 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#310_10_20

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 21 adequately prevent later recovery. For effective media sanitization methods, see NIST SP-800-88 (Revision 1) Media Sanitization, Appendix A.

(c) Court units and FPDOs are responsible for sanitizing information systems media, such as hard drives and memory devices (e.g., SD Cards) located in office printers, copiers, fax machines, computers, mobile devices, telephones, and any other equipment that may have data storage capabilities, before disposal, release from judiciary control, or release for reuse within the judiciary. See: JNet’s Media Sanitization and Information Disposal Best Practices page.

(1) When returning leased equipment, court units and FPDOs should contact vendors and/or the equipment manufacturers for the information needed to remove data from hard drives or memory devices of the equipment before returning it to the vendor or designating it as surplus property.

(2) When possible, data should be erased from machines using native (built-in) capabilities that have been carefully evaluated by a trusted service or another government agency such as the National Security Agency (NSA).

(3) If the vendor or manufacturer does not have options for erasing data, a carefully evaluated third-party software or service may be used.

(4) The National Institute of Standards and Technology (NIST) has developed information security guidelines for federal agencies and assets. Only those products that meet (minimum requirements) or exceed the methods specified in the NIST SP-800-88 Guidelines for Media Sanitization should be considered for use in the judiciary.

(5) When disposing of media containing Department of Defense (DoD) classified information, ensure that the methods of destruction in 32 CFR part 117 are followed.

(6) The sanitization method for any media containing witness security (WITSEC) data must be destruction. Contact the AO Probation and Pretrial Services Office for detailed information on destruction methods. See: Guide, Vol. 15, § 350(b).

(7) Courts are expected to monitor and evaluate continually the effectiveness of the selected sanitization tools as they are used.

For a list of evaluated products, see: NSA’s Media Destruction Guidance.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf https://jnet.ao.dcn/media-sanitization-and-information-disposal-best-practices https://jnet.ao.dcn/media-sanitization-and-information-disposal-best-practices https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-15-information-technology/ch-3-security#350 https://www.nsa.gov/Resources/Media-Destruction-Guidance/ https://www.nsa.gov/Resources/Media-Destruction-Guidance/

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 22

§ 550.40 Environmental Regulations

(a) Computer equipment can be disposed through approved disposal methods when a determination is made that the equipment cannot be sold or transferred to another organization because of the age and/or condition of the equipment, and the media has been purged of sensitive information.

(1) Court units and FPDOs must be aware of the special handling requirements associated with computer equipment disposal because computer equipment can contain small amounts of toxic compounds, including lead, mercury, cadmium, and arsenic.

(2) The handling and disposal of computer equipment are subject to multiple federal regulatory requirements, including but not limited to:

• Clean Air Act,

• Clean Water Act,

• Resource Conservation and Recovery Act (RCRA), and

• Toxic Substances Control Act.

(b) The implementation of many federal regulatory requirements is delegated to the states with programs that are as (or more) stringent than the federal level.

(1) Even where federal regulations apply, state laws may impose additional requirements not addressed in the federal program. For example, the Commonwealth of Massachusetts has banned the disposal of cathode ray tubes (CRTs) in municipal waste landfills.

(2) Depending on the state, fees could apply for the disposal of the computer equipment and/or transportation of the equipment to the state approved disposal site.

(c) All court units and FPDOs planning on disposing, recycling, or abandoning computer equipment must check state and local regulatory requirements before taking these actions.

(1) Depending on location, GSA may already have procedures in place for the transportation and disposal of computer equipment and related components.

(2) Court units and FPDOs should contact the GSA building manager or regional manager for information. See: Guide, Vol. 16, § 580.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-16-space-and-facilities/ch-5-personal-property#580

Guide to Judiciary Policy, Vol. 15, Ch. 5 Page 23

§ 550.50 Records Management

(a) All information that meets the definition of a federal record must be preserved, removed, or managed according to judiciary policies (see:

Guide, Vol. 10, Ch. 6) before disposition of the computer equipment.

(b) Court units and FPDOs must undertake a coordinated program to ensure that, before computer equipment disposition, all records contained in the system and its media elements are managed under the judiciary’s record disposition schedules. For applicable schedule, see: Guide, Vol. 10, Appx. 6A, Appx. 6B, and Appx. 6C.

§ 550.60 Software Licenses

(a) Court units and FPDOs must be cognizant of any licensed software residing on IT equipment when planning to transfer the equipment to another organization.

(b) Because of the varied licensing provisions and restrictions that accompany individual software products, a generalized set of recommendations is not possible.

(1) The software manufacturer and/or licensing agreement should be consulted for individual product licensing rights and restrictions.

(2) These licensing rights and restrictions must be followed for any computer software that is protected under federal copyright law.

(c) The process detailed in § 550.30 for permanently clearing or purging storage media can also be applied to ensure permanent removal of licensed software from computer equipment before transfer.

§ 555 Taxes and Fees for Communication Services and Computers This section presents factors that determine the government’s liability to pay various telecommunications taxes and fees.

(a) Generally, the federal government is immune from paying taxes imposed by state and local governments when the burden of the tax is imposed on the government as a consumer or purchaser.

(b) If the tax is imposed on the consumer, not the vendor, and the vendor simply collects the tax for the taxing authority, then the federal government is immune from the tax.

https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management/appx-6a-records-disposition-schedule-1 https://jnet.ao.dcn/policy-guidance/guide-judiciary-policy/volume-10-public-access-and-records/ch-6-records-management/appx-6a-records-disposition-schedule-1…