Acceptable Use Policy

Nederlandse versie: Gebruiksvoorwaarden

Acceptable Use

This Acceptable Use Policy governs the use of the Nikhef networking and computer services; all users of these services are expected to understand and comply to these rules.

1. Use for intended purpose

   Nikhef offers the services to enable the users (employees, students and collaborators) to do their work. The services may not be used for commercial or political purposes. A limited amount of private use is allowed as long as it does not interfere with normal duties and does not incur significant cost. When in doubt about any form of personal use, ask first!
   Of course, there are lots of actions that are most certainly not intended: sending spam, trolling on forums or newsgroups, forwarding chain letters or phishing attempts, cracking passwords, attacking other systems on the Internet, random calling or tele-marketing, stalking, etc.
2. Obey the law

   Seems logical, doesn't it?
3. Respect the authorization restrictions set by Nikhef system administrators and users

   Trying to circumvent effective or intended restrictions is not allowed (and unlawful as well). This includes, but is not limited to, accessing data not intended for the User, logging into a service or using an account you are not expressly authorized to access, probing the security of other networks, interfering with another users access to services, or trying to disrupt services or the network. You shall also refrain from trying to intercept or sniff network traffic that is not intended for you. If you find you have access to data or services you should not have access to, inform the Computer Security Incident Response Team (CSIRT) through the helpdesk (helpdesk@nikhef.nl)
4. Respect intellectual property and confidentiality agreements

   So do not publish, post, transmit or re-transmit, or put up on the web, items that violate the rights of any person, including rights protected by copyright, trade secret, patent or other intellectual property or similar laws or regulations including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for your use. Except of course as permitted by applicable Dutch law -- keeping in mind the rest of this AUP.
5. Protect your access keys (passwords, private keys, security tokens)

   You are responsible for anything that is done under your account, so by sharing credentials you become responsible for the other persons behaviour. You can and should not be. Access keys are yours and yours only: so do not share your credentials with others. These include your single-sign-on (SSO) password, the pass phrase for your certificate's key, the password that protects your SSH key pair. If you feel the need to share, there is always a proper solution. Be careful with your passwords: do not write them down on note paper or in your agenda, but use a storage system intended for such purpose. Also, any credential that grants to access to other services (at Nikhef or elsewhere) must be protected with at least a password or better.
   If you think your credentials have been stolen of sniffed, inform the help desk immediately (phone 2200) and - if possible - change them from a trusted computer and location. If Nikhef suspects abuse of your login credentials, access to your account will typically be suspended as an immediate security measure (see: Enforcement).
   If you have been given credentials for special services (such as a VoIP telephony roaming password, or access to a generic account) you must protect these according to the specific instructions given to you.
6. Report suspected security breaches and misuse

   When you discover vulnerabilities, witness abuse, or see other forms of non-acceptable use, you should report these incidents to the Nikhef Computer Security Incident Response Team (CSIRT) through the helpdesk (helpdesk@nikhef.nl). Do not take any action, but await further instructions. Of course, you should not attempt to exploit such vulnerabilities to circumvent security controls or harm Nikhef, it's services, staff or reputation in any way - such attempts in itself are a violation of this Acceptable Use Policy.
7. Do no harm to Nikhef, it's services, staff or reputation

   Harm is more easily done than repaired! Data is easily deleted or modified but hard or impossible to recover. A rash document (as well as of course offensive material) put up on your home page is quickly indexed by search engines and will never disappear from the web. Confidential data accidentally disclosed will never be secret again. A defamatory remark will live forever in cyberspace. An infected home laptop or smart phone will quickly poison other systems at Nikhef and many person months will be wasted to recover from the incident. So be mindful as well as careful.
8. Comply with the policies of Nikhef's service providers

   Nikhef provides access to and brokers services of third parties for its users, such as connectivity to the public Internet through SURFnet, access to Federated Services, or other hosted services like backup and calendering. You should at all times comply with the policies, terms and conditions of use of these service providers.
9. You share resources with others - be nice

   Even when staying within the intended use, it is quite possible to strain resources to such an extent that other users can no longer make use of them. Running CPU intensive applications on the general login server, or using this service for bulk data transport are some examples. Making an outbound telephone call for a phone conference and then put it on hold, but subsequently forget about it - exhausting our telephone lines as well as incurring a high bill. When such incidents are detected, the program or call in question will be terminated by Nikhef CT staff to preserve operational integrity. Users should subsequently refrain for such actions (so do not just try it again) and may work together with system administrators to see if a less disruptive alternative exists.

Other terms

Monitoring and logging of network traffic and e-mail

Systems and network are monitored in order to detect trouble in an early stage and rapidly mitigate potential damage, for administrative, operational, accounting, monitoring and security purposes only. In order to trace problems on the network to the source, logs of all network traffic flows (but not their content) may be kept for a period of up to 14 days. E-mail transactions (its source and destinations, but again not its content) are also logged, in a secured system, and retained for a maximum of 90 days. Access, authentication and authorization (collectively "security") logs are kept for a period of up to 400 days.

Because most systems are periodically backed up, the above log data is effectively kept for for an additional period of 100 days.

This data is only accessible by Nikhef system administrators and CSIRT members, as authenticated per the usual Nikhef login/password access control.

Obviously, user data, including stored e-mail, will only be inspected if there is a strong and substantiated suspicion of misuse of services or illegal activities. If you want to know what kind of logs are kept about your use of ICT services, you can always contact the CT department. We follow CBP guidance on working in networks.

Enforcement

Access to services may at any times be suspended or terminated discretionarily for administrative, operational or security purposes. It is common for access to be suspended as part of an incident investigation, even when a violation is merely suspected. As a general matter prior to terminating service, Nikhef will attempt to work with the User to cure violations and to ensure that there is no re-occurrence of the violation.

Liability

In no event will Nikhef be liable to any user or third party for any direct, indirect, special or other consequential damages for actions taken pursuant to this AUP, including, but not limited to, any lost profits, business interruption, loss of programs or other data, or otherwise, even if Nikhef was advised of the possibility of such damages.

Reporting abuse

Complaints regarding violations of this AUP, as well as concerns regarding objectionable material sent from or distributed via Nikhef, will be accepted via e-mail at [1], so long as a valid return address is included. Nikhef must be able to independently verify each instance of abuse: for objectionable email each complaint must include the COMPLETE TEXT OF THE OBJECTIONAL MESSAGE, INCLUDING ALL HEADERS. Please do NOT send excerpted parts of a message; sending a copy of the entire message, including headers, helps to prevent misunderstandings based on incomplete information, or information used out of context. Full headers demonstrate which path the message has taken, and enable us to determine whether any part of the message has been forged. This information is vital to our investigation. If you consider material located on Nikhef resources (e.g. published via its web site) to infringe on your rights, provide the complete URL, the time you visited this URL, and complete and sufficient evidence as to why you consider such a publication to infringe on your rights under Dutch Law.

Responsibility

Nikhef is not responsible for the content of email communications sent by its users, not for information published on user personal home pages. This responsibility rests with the user. At its sole discretion, Nikhef reserves the right to remove materials from its servers and to terminate access to services for the user that Nikhef determines has violated this AUP.

Modifications

Nikhef retains the right to modify the AUP at any time. Such modifications shall become effective at the moment they are adopted by Nikhef and will apply to all users, current and future.

CSIRT

The above text mentions several times the Computer Security Incident Response Team (CSIRT). For more information about the role of this team, see the contact page at http://www.nikhef.nl/security/.

Complaints

Employees who disagree with the application of this policy, should at first contact the head of the CT department, and otherwise consult the FOM algemeen klachtrecht (UR-17) (in dutch).