University Financial Policies

Computer Ethics Policy
The following statement of policy was issued in January, 1990 and is effective from that date; for additional information contact Technology Services.

Virginia Commonwealth University provides computing facilities to faculty, students and staff for activities supporting the mission of the University. The following policies indicate what is expected as responsible behavior by those given access to the facilities. Practical guidelines for the application of these policies will be provided by the appropriate computing support division.

State Law (Article 7.1 of Title 18.2 of the Code of Virginia) classifies damage to computer hardware or software (18.2-152.4), unauthorized examination (18.2-152.5) or unauthorized use (18.2-152.6) of computer systems as (misdemeanor) crimes. Computer fraud (18.2-152.3) and use of a computer as an instrument of forgery (18.2-152.14) can be felonies. The University's internal procedures for enforcement of its policy are independent of possible prosecution under the law.

DEFINITION: Computing Resources include mainframe computers, minicomputers, networks, software, data, computer rooms and computer related supplies. Access to some University computing resources is controlled through the use of assigned accounts with an access ID. Details of obtaining an index can be obtained from the user's department or from the department supplying the computing resources.

Policy Statements
The following shall govern the use of all VCU computing resources:
a. The use of computing resources is restricted to those appropriately authorized individuals. On computing resources where access is controlled through the use of an access ID, eligible users are authorized to use only the access ID assigned to them.
b. Use of the computing resources must be University related. The authorized ID holder is responsible for both the use and contents of the index.
c. Persons authorized to use University computing resources should insure that any safeguards available to them are in place to guard against inappropriate use.
d. Intentional abuse of computer resources, intentional interference with the operation of computer resources, intentional interference with the work of other users, violation of confidentiality, copyrights or license agreements and intentional wasting of computer resources are prohibited.
e. Actions which attempt to circumvent prescribed channels to obtain computer privileges and resources are prohibited.

Enforcement Procedures
Classified Employees: Alleged violations shall be referred to the Director of the employee's department and be dealt with in accordance with the Employee Standards of Conduct and Performance.

All Other Users: Alleged violations of this policy shall first be reported, reviewed and disposed of through STEP ONE of the procedure outlined below. However, at any point during STEP ONE any of the parties may invoke STEP TWO. Reasons for invoking STEP TWO may include, but are not limited to, the following: the judgment that the matter is of a nature that it should be handled by the judicial system; the view of the individual reporting the violation that the matter is not being handled effectively; the desire of the alleged violator that the matter be considered by the Office of Information Technology; or a judgment that state law has been violated.

STEP ONE
1. Violations of the policy should be reported by faculty, staff or students to the head of the appropriate computing support division. Charges of violations should be presented immediately upon discovery thereof.
2. The division head will collect the facts of the case and attempt to identify the offender as quickly as possible. If the division head believes disciplinary action is necessary, the charge and any information related to the charge will be presented to the head of the alleged violator's department.
3. The head of the alleged violator's department will identify the appropriate response and action to be taken, subject to the agreement of all parties, including the accused. If any of the parties do not agree, STEP TWO is invoked. The actions may include, but are not limited to, the following:
a. Temporary restriction of the alleged violator's computing resources access for a fixed period of time, generally not more than six months.
b. Requiring restitution for the damages caused, material consumed, machine time and the like on an actual cost basis. Such restoration may include the costs associated with determining the facts of the case.

STEP TWO
1. Written charges which describe the violation must be provided to the Office of Information Technology within 30 days of the date on which STEP TWO is invoked.
2. The Office of Information Technology will refer the statement of written charges to the appropriate administrator in compliance with the provisions of the RULES AND PROCEDURES OF VIRGINIA COMMONWEALTH UNIVERSITY. The usual procedures and provisions of the RULES AND PROCEDURES shall be observed from this point forward.
3. Violations of state law will be reported to the Director of Campus Police or his designee.