17�Թ���

Appropriate Use Policy for Information Technology

Table of Contents

1. Introduction
   1. Identity of Information Technology Resources at 17�Թ��� (“IT Resources”)
   2. Appropriate Use of IT Resources
   3. Scope
   4. Key definitions (for purposes of this Policy)
2. Expectations for Appropriate 17�Թ��� IT Use
3. Use of AI Tools
4. Access to IT Resources
   1. Central IT Resources
   2. Other IT Resources
   3. Departmental IT Resources
5. Data Security and Integrity
   1. ITS-Maintained Equipment
   2. Departmental Facilities
6. Privacy
   1. Access by IT Staff on Behalf of the University
   2. Access by Administrators of Departmental IT Systems
   3. Electronic Communications
7. Ownership of Copyright for Materials Developed with 17�Թ���'s Resources
8. Responsibility for Errors in Software, Hardware, and Consulting
9. Changes in the 17�Թ��� IT Environment
10. Non-Compliance
11. Comments, Suggestions, Corrections, etc.
12. Revision History
13. Disclaimer Statement

01. Introduction

Identity of Information Technology Resources at 17�Թ��� (“IT Resources”)

Information Technology (IT) at 17�Թ��� includes all campus computing, telecommunications, document services, educational media, and management information systems technologies. These IT Resources support the University's teaching, research, and administrative activities. Examples of IT Resources include, but are not limited to, the central administrative, academic, and library computing facilities, systems, and services—whether on-site or cloud-based; AI-powered tools, the campus-wide data, video, and voice network; electronic mail; conferencing systems; Internet access; voice mail; the University switchboard; fax machines; photocopiers; classroom audio-visual equipment; departmental and general-use computing facilities; computer and other related devices assigned to faculty, staff, and students; and related services. 17�Թ���’s central information technology organization is “Information Technology Services” (ITS), led by the University’s Chief Information Officer (CIO) and Vice President of Information Technology.

Appropriate Use of IT Resources

Users of IT Resources have access to valuable University resources, sensitive data, and external networks. Consequently, all users must act responsibly, ethically, and legally. Generally, “Appropriate Use” means understanding how to properly use 17�Թ��� IT Resources, ensuring your use complies with it, respecting the rights of other 17�Թ��� information technology users, preserving the integrity of the Resource, and following all relevant license and contractual agreements.

Scope

This Policy applies to any and all users of 17�Թ��� IT Resources, whether access occurs on-campus or remotely, and whether access occurs using University-owned devices or personally owned devices that connect to or access 17�Թ��� IT Resources. Furthermore, this policy applies to all information technology owned or managed by 17�Թ��� and represents the minimum appropriate use standards for IT.

Key definitions (for purposes of this Policy)

• “University Data” means information created, received, maintained, stored, transmitted, or processed in connection with University business, including University records.
• “Restricted” and “Confidential” data mean University Data classified by the University as requiring heightened safeguards (including, as applicable, student education records subject to FERPA, health information, financial account information, authentication credentials, and other sensitive personal information). Please see the University Data Classification Policy in the University Policy Library for more details.
• “Public” data means information approved for public release.
• “Cloud Service” means any externally hosted service used to store, process, or transmit data (including SaaS).

02. Expectations for Appropriate 17�Թ��� IT Use

The following list, while not exhaustive, sets forth expectations for appropriate and compliant use of 17�Թ���’s IT Resources:

Respect for intellectual labor and creativity is vital to academic discourse and enterprise. This principle applies to the work of all authors and publishers in all media. It encompasses respect for the right to acknowledgment, right to privacy, and right to determine the form, manner, and terms of publication and distribution.

Because electronic information is volatile and easily reproduced, respect for the work and personal expression of others is especially critical in computer environments. Violations of authorial integrity, including plagiarism, invasion of privacy, unauthorized access and trade secret and copyright violations, may be grounds for sanctions against members of the academic community.

Rulings by courts under the Digital Millennium Copyright Act have determined that Internet Service Providers, or ISPs (for example, 17�Թ���, which acts as an ISP for its students, faculty, and staff), must disclose the identity of users associated with specific Internet Protocol addresses or “user IDs” listed above when presented with a properly issued subpoena. Individual students, faculty, and staff can be held personally liable for copyright law violations.

Visit the Illegal File Sharing website for more information.

03. Use of AI Tools

When using tools that include Artificial Intelligence (AI) technology (“AI Tools”), including, but not limited to, generative AI tools (such as ChatGPT, Microsoft Copilot, Google Gemini, Claude, etc.) for University business, users must comply with this Policy and applicable University guidance.

• Where required by University, course, program, or departmental rules, users must disclose material use of AI Tools and comply with applicable academic integrity requirements, including the University’s AI Academic Policy, and/or Honor Code for Law School Students. Please see the University’s AI Resources page for more information.
• Users must not input, upload, or otherwise provide Restricted, Confidential, or any other sensitive University Data into public or unapproved AI Tools. Restricted or Confidential University Data includes, without limitation: student education records subject to FERPA; health information; Social Security Numbers; payment card data; bank account information; authentication credentials (including passwords, tokens, MFA codes/prompts); export-controlled or sponsor-restricted research data; donor/alumni data; applicant/admissions data; and employee personnel/HR data. Please see the University Data Classification Policy in the University Policy Library for more details.
• Where the University provides or approves an AI Tool for University use, users must use the University-approved tool for University business involving University Data and must follow any applicable configuration requirements.
• Users must not use an AI Tool for University business if the tool’s terms or configuration permit the provider to train on, claim rights to, or retain user inputs/outputs in a manner inconsistent with University requirements, unless the tool has been reviewed and approved by the University through ITS and appropriate contractual processes.
• AI outputs must not be used without human review to make or support decisions with significant impact on individuals (e.g., grading/academic standing, student advising decisions, disciplinary matters, employment actions, financial decisions, or official University communications).
• Users remain responsible for reviewing and verifying AI outputs for accuracy, appropriateness, bias, and compliance before use; AI outputs used for University purposes must be handled, stored, and shared as University Data and only in approved systems.
• Users must not use AI Tools to circumvent security controls, violate law or policy, generate or distribute malicious code, conduct unauthorized scanning/testing, or automate bulk actions (e.g., mass emailing/messaging, scraping, or account creation) that interfere with University systems or other users.
• Users may not install, configure, or run agentic AI systems on University-owned devices or within the 17�Թ��� network that are capable of accessing local files, folders, system credentials, password stores, email, or other protected institutional data without explicit authorization from ITS. Such tools may autonomously read, modify, transmit, or store University information and therefore present significant security and privacy risks. Installation or use of these systems on 17�Թ���-managed computers or accounts is strictly prohibited unless formally approved through ITS security and governance review.

04. Access to IT Resources

Central IT Resources

Students, faculty, administrators, staff, recognized student organizations, and approved external users may obtain IDs for use in central IT activities related to instruction, research, or University administration. Students employed by the University will receive a separate user account to be used for University business.

If any member of the University or an approved external user leaves, resigns, or ends their relationship with 17�Թ��� for any reason, access to all IT Resources, including but not limited to voicemail, email services, and files stored on university computers (such as desktops and file shares), will be terminated promptly in accordance with University processes and system controls. Accounts are automatically created and deactivated based on information in the University’s system of record (currently, Banner) and are in accordance with applicable university and departmental policies and procedures.

Qualified retirees (as defined by Human Resources) may request a retiree email account, which will be separate and distinct from the account previously assigned as a faculty or staff member.

To enable students to communicate with faculty, complete assignments, and receive required notifications, student e-mail accounts will be deactivated 12 months after the last class taken.

Other IT Resources

Most of 17�Թ���'s IT facilities and services—such as the computer labs, classrooms equipped with computers, Video Conferencing rooms, consulting services, voicemail, and training—are available to members of the University community. ITS plans and budgets for central IT services. However, these services are not free. Users or departments may be required to cover the additional costs for excess usage (based on typical, normal utilization) or for abuses of 17�Թ��� IT resources (expenses beyond the baseline budget). For more detailed information about access to any facility or service, visit the ITS homepage at .

Departmental IT Resources

For information concerning access to departmental IT resources, contact your department’s IT staff or Department Chair.

05. Data Security and Integrity

ITS-Maintained Equipment

ITS offers reasonable security against intrusion and damage to files stored in the central IT facilities. ITS also provides some tools for archiving and retrieving files specified by users and for recovering files after accidental data loss. However, other users cannot hold the University or any IT staff accountable for unauthorized access, nor can they guarantee protection against media failure, fire, floods, etc. Users should employ all available methods to protect their files, including frequently changing passwords and using University-approved backup tools to back up data. If data becomes corrupted due to intrusion, ITS should be notified immediately. Every reasonable effort will be made to restore files to their pre-intrusion state; however, ITS cannot guarantee recovery.

Upon request, the IT staff will assist in implementing procedures to enhance security. Although ITS backs up some departmental servers and makes reasonable efforts to protect them from intrusion, it does not provide the same level of protection or offer file restoration for files stored on departmental servers. Therefore, it is especially important for users to back up their files and utilize all available methods to safeguard their data on departmental systems.

The central 17�Թ��� information technology organization (Information Technology Services, ITS), led by the University’s Chief Information Officer/VP, Information Technology, reserves the right to manage the University’s voice, data, and video bandwidth. Criteria for bandwidth management involve the integrity and robustness of University-owned equipment, data, and services as well as the appropriateness of bandwidth use in relation to the University’s academic goals, administrative missions, and this Acceptable Use Policy for Information Technology.

Departmental Facilities

Data security and integrity in departmental IT facilities vary depending on the department. Users should contact their department’s IT staff for more information on their security and data integrity procedures.

06. Privacy

To ensure compliance with 17�Թ���’s internal policies, applicable laws and regulations, and to maintain the security and integrity of University systems, as well as to ensure the safety of employees and the community, 17�Թ��� reserves the right to monitor, inspect, access, or search its information systems (including the contents of University-provided email accounts, systems, and storage) at any time, in accordance with applicable law and University procedures. Access to user content for investigative or administrative purposes will be limited to authorized personnel with a legitimate University purpose and may require approval, documentation, and logging as required by the University.

17�Թ��� management reserves the right to remove any material from its information systems that it considers offensive, potentially illegal, or otherwise against University policies.

Access by IT Staff on Behalf of the University

Although not legally required, the University respects the privacy of all users. However, it should be understood that all data created or stored on University systems and IT Resources is the property of 17�Թ���. Members of the ITS organization are forbidden to log into another user’s account or access a user's files, software, or other contents unless the user grants explicit permission (for example, by setting file access privileges). Exceptions to this privacy policy are made under specific conditions. These include investigating programs suspected of causing network disruptions or other shared services, other internal investigations, examining suspected violations of state or federal law or University policies, and conducting investigations to prevent liability or in connection with internal hearings or litigation.

Before accessing a user’s account, files, software, or other content, reasonable efforts will be made to notify the user, except when such prior notice would violate legal requirements, directives, or jeopardize an internal investigation. In those cases, before examining a user’s account, files, software, or other content, the Vice President of Information Technology or their designee, after consulting with University Counsel, must determine that there is a legal obligation or other sufficient cause to do so without prior notice or permission from the user. Information obtained this way is admissible in legal proceedings or in a University internal investigation or hearing. All parties involved will keep information regarding security incidents and investigations confidential. Only authorized personnel may disclose such information. By accepting a user account, the user agrees to this policy.

Access by Administrators of Departmental IT Systems

Departmental IT staff should not access a user's files without that user's explicit permission or monitor file traffic in a way that allows intrusion into the file contents. However, some exceptions may be necessary, such as when a file is suspected of disrupting the local network or other shared services and the user cannot be reached. Additionally, information about system users and data stored by them should be kept confidential. Individual departments may have guidelines aligned with University policy that address access to their IT resources.

Electronic Communications

Users should not expect privacy for any electronic communications. IT systems administrators may view the contents of electronic messages due to serious addressing mistakes or when maintaining the communications system. In cases where administrators do see the contents of private electronic messages, they are required to keep the contents confidential. Users should also understand that the current design of the networks means that the privacy of electronic communications leaving 17�Թ��� cannot be guaranteed. Additionally, when a user's association with 17�Թ��� ends, any emails received at 17�Թ��� addressed to the former user will either be returned to the sender or, if appropriate, forwarded for a limited time to an address specified by the former user or their supervisor.

07. Ownership of Copyright for Materials Developed with 17�Թ���'s Resources

17�Թ��� has established guidelines related to ownership of copyright property. The exact policies and procedures relating to copyrights are in the 17�Թ��� Faculty Handbook at pp. 61-71 and the 17�Թ��� Copyright Policy and Procedures. Finance and Administration | Copyright Policy and Procedures | 17�Թ��� New York

08. Responsibility for Errors in Software, Hardware, and Consulting

ITS strives to maintain an error-free IT environment for users and to ensure that the IT staff is properly trained. However, it is impossible to guarantee that IT system errors will not occur or that IT staff will always provide correct advice. 17�Թ��� offers no warranty, either expressly stated or implied, for the services provided. Damages resulting directly or indirectly from the use of these resources are the user's responsibility. However, upon the user's request, when errors are identified on IT facilities, members of the IT staff will make a reasonable effort to restore lost University information to its state prior to the failure. As part of maintaining the IT environment, the IT staff applies vendor-supplied or locally developed fixes as appropriate when problems are identified. Since vendors may be involved and staff resources are limited, no guarantee can be made about how long it may take to resolve an error once identified.

When software errors are considered major problems or could produce inaccurate results, users will be notified as soon as possible using appropriate electronic and/or other media.

09. Changes in the 17�Թ��� IT Environment

When significant changes in hardware, software, or procedures are planned, notifications will be sent via email and other channels to ensure all users have enough time to prepare and voice any concerns they may have.

10. Non-Compliance

All users of 17�Թ���'s IT Resources must adhere to this Appropriate Use Policy for Information Technology, all other IT policies, and the University’s Guiding Principles of Conduct related to the use of the University’s IT resources. Failure to comply with any of these policies may lead to temporary or permanent revocation of system or network access, notification to the user’s supervisor, and/or disciplinary actions, up to and including termination of employment or dismissal from the University, in accordance with applicable University policies and procedures (such as Student Conduct policies, faculty handbook processes, and Human Resources policies). When relevant, a violation may also result in civil and/or criminal liability and could be referred to law enforcement.

11. Comments, Suggestions, Corrections, etc.

Questions concerning this or any other Information Technology Policy can be directed to the ITS Customer Support Center via .

12. Revision History

13. Disclaimer Statement

17�Թ��� reserves the right to amend or otherwise revise this document as may be necessary to reflect future changes made to the IT environment. You are responsible for reviewing this Policy periodically to ensure your continued compliance with all 17�Թ��� IT guidelines.