Feedback prompts NSCS to re-examine tech policies

By: Aubrie Lawrence

Responding to what it called, “constructive suggestions,” the Nebraska State College System will re-examine its proposed technology policies, sent in mid-August to all employees at the three colleges for feedback.

The NSCS is revising Board Policy 5008 and its Standard 5: Acceptable Use and User Privacy Statement, and is introducing Board Policy 7003.

 In its revisions, it added new conduct rules for private devices using NSCS servers and resources, and a level of protection for both faculty and students.  

The Policy 5008 draft defines the technological resources on campus as “all NSCS owned, operated, leased, outsourced, or contracted computing, networking, telephone, and informational resources: all electronic information maintained within the NSCS computing environments, in any format, stored on any medium or location including privately owned devices used for NSCS purposes; all data, voice and video networks; all applications systems used to conduct NSCS business; and all NSCS assets connected to the networks.”  

The policy also states that, “the College or System Office, as appropriate, reserves the right to inspect all electronic files, e-mail or voice mail of any employee, without advance notice or specific permission, for legitimate business purpose.” 

This led to questions concerning whether this would be a violation of privacy. However, after an email discussion with Chancellor of NSCS Paul Turman, the policy was further explained. 

“A private device is any device that is not owned by the NSCS.  Assuming the device is compatible with College security systems, only the NSCS information on that private device is subject to the granting of access, or inspection. There is a misconception that we are pursuing a right to any private information on a private device, and that is simply not true.” 

The policy goes on to say that “users must comply with the NSCS Acceptable Use Policy (AUP) prior to gaining access to NSCS technology resources. The NSCS AUP is stated in Standard 5: Acceptable Use and User Privacy, from the NSCS Information Security Program in Board Policy 7003. The requirements found therein apply to all persons accessing or using NSCS information assets, including NSCS students, employees, and authorized guests. Individuals that violate the NSCS AUP may be subject to denial of access and disciplinary action.” 

The NSCS AUP referred to is a policy that all students and staff agree to before being able access the NSCS server. The policy allows for the server to be monitored for suspicious activity and protect technology on campus.  

The function of Board Policy 7003, a new policy implementing a Informational Security Program (ISP), is like the NSCS AUP in the regard that protects all systems and data within the technical resources of the NSCS as well as protecting the integrity of NSCS systems and data.  

Along with the policy, the Vice Chancellor for Facilities and Information Technology  will be responsible for the System Office ISP and also serve as the System as the System Office Information Security Officer (SOISO).

  At the beginning of the semester, the Board sent the policy revisions to all employees for input. They were met with constructive feedback that would only help improve the policy revisions.  

“The vast majority of the feedback that was provided through the appropriate channels and has been positive with several constructive suggestions for improving the verbiage and readability of the documents,” said Turman.  

Since Board Policy 5008 also applies to students, a question formed on whether students would also be subject to private device checks. This question was also answered after further questioning. 

“There will be no private device checks for students,” said Turman. “If an IT department notices a server anomaly, and if the issue can be traced to a certain student, then the IT department would have a private conversation with the student in an effort to resolve the issue.” 

These policies are still in development and are continuing to be revised. 

The board is not voting on this policy in the Fall meeting on campus in September. The fact of whether the policy was supposed to be voted on at the upcoming meeting remains unknown. 

“The NSCS values the input of its students, faculty, and staff. The NSCS received and granted a request to extend the comment period. The System office is currently reviewing employee comments and feedback provided on the policy drafts, as well as the concerns raised, and then will make final revisions as necessary before providing to the Board to take action,” Turman concluded.