Approved by ACG BoCC on 04105/2011 Purpose: This policy defines Arapahoe County's computing policy regarding the usage of County computer-related hardware, software, network, Internet, e-mail, telephones, remote access and other computing services. Scope: This policy applies to anyone using ACG computing services or equipment, such as all full-time, part-time and temporary employees, volunteers, vendors and contractors. Definitions: Emplovee - Any person that works for Arapahoe County, either on a part time, full-time or temporary basis, whether as a County employee, a State or other employee, vendor, contractor or volunteer using ACG computing services or equipment. Contractor - Any person that contracts services or goods with Arapahoe County County Arapahoe County Government County Computing Equipment - All Electronic Media, Hardware, Mobile Devices and other equipment and systems provided by or on behalf of Arapahoe County to its elected and apPointed officials, employees, contractors and agents, whether owned or leased directly by Arapahoe County or otherwise, for the purpose of Electronic Communications and/or for data storage or manipulation. Electronic Communications - Use of electronic mail ("e-mail"), Internet, text or instant messaging, electronic FAX, bulletin boards, television access channels, voice services, electronic subscription services, or any other electronic communications forums. 4/6/2011 1 Electronic Media - Electronic storage devices including, but not limited to, hard drives, CD-ROMs, servers, memory sticks or other external drive devices, Mobile Devices - Laptops, tablet computers, Smart phones, and Personal Digital Assistants, such as (but not limited to) a "Blackberry" device or any other of a class of handheld electronic devices that can provide County computing functionality and/or can be used wirelessly on or off premise, Hardware - Devices, including, but not limited to, computers, laptops, printers, scanners, telephones, handheld or other mobile or wireless devices, network equipment, modems, storage or input devices, General Policy: All information or data contained or stored in any County Computing Equipment (as defined above) is the property of the County, Any information or data contained or stored in any County Computing Equipment is available at all times to the County and its authorized elected and appointed officials, employees, agents or other representatives. The County's records are subject to the Colorado Open Records Act ("CORA"). 1 Any party requesting records under CORA may be responsible for any and all costs incurred in the retrieval and review of electronic media, Availability of information is subject to County policies and procedures for retention of data, The County Attomey or his/her designee must be notified of all open records requests and shall review all records before they are released, including documents produced pursuant to subpoenas, to ensure personal or privileged information is not published. Should questions arise concerning what mayor may not be exempt from disclosure under CORA, employees should contact the County Attorney's office for clarification, All employees should be aware that their correspondence in the form of e-mail may be a public record under the public records law and may be subject to public inspection under Section 24-72 203 of CORA 2 1 Colorado Open Records Act begins at Section 24-72-201, et seq., of the Colorado Revised Statutes. Pursuant to section at seq.. C.R.S., certain records k.ept by Arapahoe County, Colorado in the normal course of business are open to inspection by the public at reasonable times. However, the County makes no representation as to the accuracy or content of the information contained in these records. Some of the information contained in the Arapahoe County records is derived from other sources. and that information should be verified by consulting said sources, (Source: Colorado Attorney General's Office at http://www.ago.state.co.us) 2 REQUESTS FOR MESSAGES: The Arapahoe County Information Technology Director is the official custodian of the County's e-mail messages, All requests for copies of whether for elected officials' or employees' e-mail, will be handled by the Information TeCtlnology Director, in conjunction with the County Attomey's Office. 41612011 2 Employees are expected and have the obligation to use good judgment at all times when using the Internet and other electronic communications tools. Employees should be professional and courteous when sending electronic messages. Electronic media is made available to employees for the purpose of providing an effective method to communicate, increase productivity, perform research and obtain information that will assist in performing job-related tasks. County Computing Equipment may be used for incidental personal communications or transactions provided that such use does not interfere with the conduct of Arapahoe County Business, incur additional system costs, interfere with the employee's duties, or violate any other County policy or procedure. However, all personal and business use of County Computing Equipment is subject to access, monitoring, review and disclosure at all times by the County, and its authorized elected and appOinted officials, employees, agents and other representatives. Therefore, County elected and appOinted officials, employees and agents have no expectation of privacy with respect to use of County Computing Equipment. Further, the County may choose to block or ban certain hardware, software, computing functions, applications or services at any time due to security risks or for other reasons. If an employee desires the use of a remote connection to access the County network, they must abide by the provisions of the County Teleworking Policy, including following of established inventory control and licensing procedures. Information Technology provides telephone support during normal business support hours and will perform maintenance and repair of County-owned equipment that is in use at an employee's home. The employee, however, is responsible for transporting the device(s) to the Information Technology Department, or other approved County facility. Employees are not allowed to access the Arapahoe County network via remote communications devices (modems, DSL, ISDN, etc.) without the express consent of their supervisor or manager. No one may connect to the County wired or wireless network with non County printers, routers, switches or any electronic device not approved in the published Technology Standards without the expressed permission of their sponsoring Office or Department and the Information Technology Department Director. See the published Technology Standards for a list of currently approved electronic devices. It is permissible for employees to used personally owned WiFi enabled mobile devices that are approved in the Technology Standards with the County wireless network for Internet only access. Such usage must be reasonable, approved and managed by the employee's supervisor, manager or Department Director/Elected Official or designee. 41812011 3 To secure County data, employees shall always make a reasonable attempt to logoff of their computer when finished with a session. Employees shall only use e-mail and Internet security software provided or approved by Arapahoe County's IT Department. Employees shall not use their own security software, including but not limited to encryption and virus scanning, without express prior written authorization from the Information Technology Department, nor shall they de-activate or bypass County security in any way, except where specifically authorized by the Director of the Information Technology Department. County employees shall not use County Computing Equipment to publish material (e-mail or web publishing, wikis, blogs or the like) about sensitive County issues (this does not apply to the publication of material that is protected by the First Amendment). All media releases shall go through the appropriate County representatives. Department Directors and Elected Officials are responsible for enforcement of all County policies and for taking prudent steps to ensure the safety of County assets. Passwords and Password Management It is the responsibility of each employee to select, protect and manage their own network passwords (and application passwords, if appropriate) according to current County security requirements. In the event that an employee needs to have their password reset through the IT Service Desk, (due to error, expiration or inability to remember it), the IT Service Desk will use approved County procedures to verify the requestor's identity in order to ensure that the password reset is valid and appropriate. E-mail Standards Employees shall adhere to the standards set forth by the Arapahoe County Information Technology Department. Electronic Communications should be monitored by each employee and proper etiquette used at all times. Please see the sections titled "Examples of Permissible Uses of the Arapahoe County Computing Resources" and "Examples of Prohibited Uses of the Arapahoe County Computing Resources" for specific standards. Electronic Communications and Internet content shall not be used in any way that violates any federal, and/or state law, Arapahoe County standard, policy, procedure, or ordinance or resolution. 4/612011 4 Employees are responsible for business related subscription services and should unsubscribe to lists or newsgroups when they are no longer needed. Opinions contained in e-mail messages, whether expressed or implied, are the opinions of the author and are not necessarily the official pOSitions of Arapahoe County The County may filter or block certain file attachments or organization's addresses to protect the County from computer viruses or other threats. Any type of text or instant messaging through County Computing Equipment should also adhere to appropriate email standards. In addition, since text and instant messaging content is generally non-permanent in nature, these communication means should not be used for anything that requires documentation or recoverability. Email Retention and Archiving In order to meet all legislative, judicial and County business requirements, and to provide for the effective and efficient use of County resources, all email is now subject to retention and archiving periods established by the County. All email items (sent and received) are archived for 18 months to preserve their authenticity, reliability and integrity, and are recoverable in their original form. This archiving process will supersede any end user deletion activity within an employee's own email account. After the 18 month archive period has expired, email items will be purged from the archive system and will not be recoverable from that system. Calendar items are archived for 1 year and then purged. To better manage County resources and expenses, all email items (sent and received) older than 45 days will be purged from the email servers. Any items older than 45 days which need to be accessed will be available during the 18 month archive period on the archive system. E-mail items may be moved to other externally managed storage (Including but not limited to CD, desktop, networked or other electronic personal storage media) in order to be retained outside of the archive system only when necessary for legitimate business reasons and only with the permission of a Director or Elected Official. Any deliberate activity to circumvent the County email retention and archiving pOlicies may be cause for disciplinary action up to and including termination. An exception to this retention and archive policy is for any email subject to a litigation hold. If the County Attorney's office determines that a litigation hold is applicable, affected employees will be notified and provided with any needed instructions pertaining to the litigation hold, as determined by the County 4/6/2011 5 Attorney's office and in compliance with the County's Litigation Hold Policy and Procedures. Records Management is currently decentralized at the County. Appropriate retention and archiving of official records is the responsibility of each Office and Department. Therefore, it is the responsibility of the end user to make necessary arrangements and receive appropriate approval from a Department Director or Elected Official for long term storage of email whose content may constitute an official record. Internet Standards Employees shall adhere to the County approved computing standards set forth by the Information Technology Department. Please see the sections entitled "Examples of Permissible Uses of the Arapahoe County Computing Resources" and "Examples of Prohibited Uses of the Arapahoe County Computing Resources" for specific guidelines. The County may block certain web sites to protect County data, to protect from infrastructure damage or other threats and to prevent inappropriate Internet use. Hardware Standards All Hardware shall be used for Arapahoe County Government business purposes, except that minimal personal use is allowed as long as it does not interfere with the conduct of Arapahoe County Business, incur additional system costs (such as affecting the performance of the hardware), interfere with the employee's duties, or violate any other County policy or procedure. However, all personal use of Hardware is subject to access, monitoring, review and disclosure by the County and its representatives. Employees shall adhere to the standards as stated in the ACG Financial Policy, and set forth by the Arapahoe County Information Technology Department regarding Hardware acquisitions and the Information Technology Department approval process. Information Technology Department approval shall be obtained prior to purchases of any non-standard hardware. Please see the sections entitled "Examples of Permissible Uses of the Arapahoe County Computing Resources" and "Examples of Prohibited Uses of the Arapahoe County Computing Resources" for specific standards. All employees who use handheld wireless mobile devices, whether owned by the County or by the employee, shall follow the hardware guidelines herewith and published Technology Standards when used to interact with County computing 4/6/2011 6 equipment or systems. Employees shall take prudent steps to ensure the safety of County assets and protect them from damage or loss. Any handheld wireless Mobile Devices shall adhere to County standards and shall not be configured for use on nonACG computers. Handheld wireless mobile devices and laptop computers shall have password protection on the device to protect from data loss or theft. All handheld wireless Mobile Devices that access the County network or data may be subjected to remote wiping by the County in the event of loss or theft. Further, the County may determine that these devices also require approved encryption software. Computers shall have a screen saver set with password protection that initiates after a set period of inactivity, generally about 15 minutes. Employees shall not make Hardware changes to County devices. All maintenance and repairs will be performed by the Information Technology Department or designated representative. All Hardware remains the property of the County and shall be returned upon termination of employment. The employee is responsible for protecting both data and hardware from loss, theft, and damage. Software Standards Employees shall not copy software, nor should software be given to any outside third party. Employees shall use software only in accordance with applicable license agreements. This includes "Freeware" or "Shareware". "Shareware" shall be registered to the Arapahoe County Information Technology Department and license fees shall be paid in accordance with the software vendor's policy. All software acquired through Department Director or Elected Official approval shall also first be approved by the Information Technology Department, in accordance with the County Financial Policy. The Finance Department shall be included in the selection, development, modification, upgrade and implementation of all financial software, including all software that interfaces with the County's financial system or that is routinely used to record, collect, summarize or report financial data, including but not limited to inventory tracking, grants and project accounting, payroll and benefits, revenue collections, accounts receivable and disbursements, for the purpose of ensuring the integrity of the financial data and financial reporting and the adequacy of the internal controls imbedded in the financial business processes accompanying the software. Employees shall not install, modify or remove any software, without approval by the Information Technology Department. 3 An exception can be made for employee supplied license compliant desktop wallpaper or license :) The custOdlan, and the immediate decision maker for computer related Issues at Arapahoe County, is the Information Technology Director. 4/612011 7 compliant screen savers. However, these are subject to removal by the Information Technology Department should they interfere with County business operations, operation of the hardware or problem trouble-shooting. All software licenses acquired by Arapahoe County will be stored and monitored by the Information Technology Department. Storage/Media Devices: The County provides network based storage (file servers) for employees to manage County data to do their jobs. The Information Technology Department will provide data backup and restore services for all ACG County file servers. Information Technology does not backup data on County desktops, laptops or personal home PC's. Backing up any data on desktop PC's is the responsibility of the employee. The Arapahoe County IT Service Desk can provide recommended procedures to use for backing up desktop PC's. However, it is strongly encouraged to store critical information in server based files for maximum security and file management. While it may be appropriate for business reasons to copy or move data to removable media (such as external drive, CD or memory stiCk), it is the obligation of the employee to ensure that this is approved by their Office or Department. In all cases, it is recommended that files on any removable media be password protected for READ so that it is not accessible by anyone else in the event that the mini-media is lost or stolen. In some cases, it may be appropriate to only use an external storage device which enforces the use of encryption and password, such as for sensitive or personal information. Again, this may be a requirement in your own Office or Department. Conference Calls: No employee shall listen to a conference call unless the employee was invited to participate or was the organizer/originator of the conference call. All employees are required to identify themselves to the other participants when first joining in on a conference call. Privacy/Monitoring: The County, through its Authorized Employees, has the right to access, review and monitor all telephone calls sent or received by any person on or through the County telephone lines and/or County telephones. Such telephone lines may be monitored periodically at any time by the County's Authorized Employees without 4/612011 8 notice or cause for the purposes of ensuring the quality of customer service provided to callers and/or for training purposes, Employees have no expectation of privacy for their usage of County telephone lines and/or County telephones, Employees who use County telephone lines, and/or use any County telephone, have no expectation of privacy for any such usage, including any personal usage, The County, through its authorized elected and appointed officials, employees, agents and other representatives, reserves the right to access, review, monitor, delete and disclose all infonmation and data sent, received or stored using County Computing Equipment, including, but not limited to, all e-mails, on a random basis or otherwise, with or without prior notice, and with or without cause,4 Therefore, County elected and appointed officials, employees and agents do not have any expectation of privacy with respect to use of County Computing Equipment or any communications or other data or information sent, received or stored using County Computing Equipment In addition, and not in limitation of the foregoing, County Internet usage is traceable, and persons using the County-provided Internet access should not expect that they have any degree of anonymity and/or privacy, Access to Web sites and message authorship can be easily traced to a specific user and may be done with or without cause or notice, Remote or Wireless Access: Some job responsibilities, special circumstances or desire for convenience may result in employees accessing County IT services from locations outside of a County facility, Such usage will fall into 3 categories: wireless, nominal remote access use and teleworking, Wireless usage is defined as performing your normal job duties or reasonable personal usage using County owned or approved personal equipment through a wireless network connection, For this type of access all computing policies apply the same as for a hard wired connection, regardless of work location, Nominal remote access use is defined as occasional usage of County IT services, generally for convenience, Examples would be someone who utilizes Outlook Web Access (OWA) from a home PC to catch up on email, or someone who may have authorization for a more robust County provided remote access service such as Citrix or VPN, but again uses it only occasionally and generally for convenience or productivity, This type of usage may be performed from an approved County device that the employee is authorized to remove from County premises (such as a PDA, smart phone, laptop computer, tablet computer or , This section is not intended to violate, or confer authority to any County to violate, state or federal law with respect to eavesdropping and wiretapping, 4/6/2Q11 9 other wireless mobile device) or may be from a non-County device such as a kiosk PC at a conference or a personally owned approved PDA, smart phone, laptop computer, tablet computer or other wireless mobile device on or off County premises, In these cases, the individual should be authorized by management for this type of access and should continue to adhere to all County computing policies for County related activity. In addition, the nominal remote access user is responsible for ensuring the security of County information regardless of the environment from which he or she is remotely accessing any County information or service. In addition, the nominal remote access user should understand that at no time should any County data be stored on a non County device, including a home PC, regardless of how short a period of time. Any non-County device that has had County data stored on it can become subject to CORA Teleworking is defined as participating in a County sponsored program that permits an employee to work a regularly scheduled portion of their job from a remote access site, generally home. A separate Teleworking agreement must be signed and on file for each employee who is Teleworking, This agreement can be obtained through Human Resources. In all Teleworking situations, Arapahoe County computing policies will apply. All remote access is subject to the privacy and monitoring policies contained herein, Violations: Violations of this policy may result in disciplinary or legal action up to, and including termination of employment, criminal/civil penalties, or other legal action against the employee. Complaint Procedures: To report a violation, employees should contact their supervisor and/or manager who should report it to the appropriate official. The responsible department director/Elected Official shall then take appropriate action. Alternative avenues for reporting include Human Resources and the "Ethics Hotline", Examples of Permissible Uses of Arapahoe County Computing Resources: Day-to-day functions as outlined by the employee's written job descriptions, his/her supervisor/manager, or by the governing body that oversees the employee's department. 4/6/2011 10 Disseminating appropriate County documents to other individuals or organizations. Communicating with other County employees. Obtaining information from job-related vendors on products and services. Use in applying for or administering grants or contracts for County Govemment research or programs. Communication with members of professional organizations, collaborating on articles and other writing, reviewing information on career and educational opportunities, and participating in reading electronic discussion groups on professional or career development topics. Training to enhance business and/or technical skills, pertaining to the employee's job function or as assigned by the employer. Broadcast messages (messages sent to large distribution lists such as department lists or building lists) are allowed, but should be restricted to those instances where there is a clear business need to inform all e-mail users. Subscriptions to job-related Internet mailing lists and newsgroups. Reasonable incidental personal communications or transactions, so long as it does not interfere with the conduct of Arapahoe County Business, incur additional system costs, interfere with the employee's duties, or violate any other County policy, procedure or departmental standard. Examples of Prohibited Uses of Arapahoe County Computing Resources; Sending broadcast messages or mass file attachments for personal use. This includes the sale of any personally owned item or school fundraisers, etc, It is suggested that the employee instead use the Classified Ads on the Intranet or in the County Line Newsletter. Sending email to 'all employees' either with or without using one or more distribution lists unless approved by Communication Services. Most employee information is more appropriately distributed through another fonm, such as the AC Weekly. Subscriptions to non-business related Internet mailing lists. Use of the County's e-mail system for any illegal activity including, but not limited to, gambling, child or other pornography, soliCitation to distribute or purchase controlled substances, etc, Messages or Internet content containing sexual implications, racial slurs, gender-specific comments, or any comment that offensively addresses someone's age, religious or political beliefs, national origin, or disability. Use of electronic communications to be used to send or receive copyrighted materials, trade secrets, proprietary financial information, chain letters or Similar materials. Use of non-approved electronic communications such as third party "chat" software. These or other messaging services may be used only within the County network and with approved County standard software. 416/2011 11 Use of electronic communications to solicit, communicate, or recruit for outside commercial ventures, religious or political causes, matters or organizations not connected to the County business, or other non-job related solicitations. Knowingly distributing any e-mail message that includes a virus or other destructive program, or intentionally developing or distributing programs that are designed to infiltrate computer systems internally or externally. Distribution or saving of any non-business related file attachments or software, such as games, pictures, video or audio clips is prohibited. Unauthorized distribution or saving of copyrighted materials, applications or programs, confidential business materials, non-business related or confidential financial information or similar materials. Playing computer games, either on the local machine or through the network. Accessing non-County networks that could allow access into the County network. Downloading of or unauthorized linking to copyrighted information or software. Accessing or downloading any resource for which there is a fee without prior appropriate approval. Attempting to access any computer system or resource that an employee is not authorized to access (hacking). Representing oneself as another user or employee. Disclosing your userid and password to anyone for any purpose. Installing any unauthorized software on any computer for any reason, without prior appropriate consent. Copying software, or giving software to any outside third party. Altering, in any manner, including but not limited to: decompiling, disassembling, cross-compiling, reverse engineering, or creating derivative works without prior written consent of the vendor and as directed by the County. Removing computer equipment, software or documentation without the prior permission of the department director/Elected Official. Careless use of County-owned hardware, including but not limited to, leaving equipment in unattended vehicles or public areas. Altering hardware configurations. Use of electronic communications for sensitive personnel or legal matters may be restricted in certain situations at the direction of ACG management or legal. 4/6/2011 12 Hardware/Software Standards and Support: Information Technology shall provide support for all approved computing platforms including the following: Standard software installation on all hardware: the standard desktop consists of one of several different Microsoft Operating Systems, the Microsoft Office Suite, and any departmental application that has been approved by Information Technology. Network, server and storage infrastructure and voice communications Hardware connections for approved synchronization Replacement of County-owned hardware under warranty due to hardware failure Basic training on standard hardware Isoftware for users Answers to frequently asked questions about standard hardware and software Reconfiguration of hardware when it is transferred to another employee or if the current employee's user identification changes. 416/2011 13