THE METROPOLITAN GOVERNMENT OF NASHVILLE AND DAVIDSON COUNTY

BILL PURCELL, MAYOR

EXECUTIVE ORDER NO. 013

SUBJECT: COMPREHENSIVE INTERNET AND ELECTRONIC MAIL USE POLICY

I, Bill Purcell, Mayor of The Metropolitan Government of Nashville and Davidson County, by virtue of the power and authority vested in me, do hereby direct and order that:

I. The Metropolitan Government of Nashville and Davidson County has had a long-standing need for a comprehensive internet and electronic mail (e-mail) policy to provide direction to the employees who use the internet and e-mail system while at work:

II. The Metropolitan Government also is required by Tennessee Code Annotated, Section 10-7-512 to adopt a written policy on monitoring of electronic mail communications.

III. The attached Internet and Electronic Mail Use Policy fulfills both of the objectives stated above. Therefore, it is hereby adopted as the Internet and Electronic Mail Use Policy (hereinafter "the Policy") for The Metropolitan Government of Nashville and Davidson County.

IV. The attached Policy shall be distributed to all employees of the Metropolitan Government whose job includes any use of computers owned by or linked to the computer network of The Metropolitan Government of Nashville and Davidson County. All such employees shall execute the acknowledgement that is attached to the Policy to certify that they have received and are familiar with the Policy.

V. The heads of all departments, agencies, and commissions of The Metropolitan Government of Nashville and Davidson County shall be responsible for distributing the Policy to their current and future employees. The heads of all departments, agencies, and commissions of The Metropolitan Government of Nashville and Davidson County shall also be responsible for assuring that their employees execute the acknowledgement and for retention of the acknowledgements.

Bill Purcell
Mayor

Date:  April 5, 2002

The Metropolitan Government of Nashville and Davidson County

Internet and Electronic Mail Use Policy

I. Purpose

The Metropolitan Government of Nashville and Davidson County ("Metro") provides Internet connections and electronic mail ("e-mail") to its employees to be used in the performance of their duties for Metro.

The purpose of this Policy is:

1. To establish guidelines and minimum requirements governing the acceptable use of Metro-provided Internet and e-mail services.
2. To educate employees regarding these guidelines and requirements.
3. To define enforcement mechanisms to ensure successful implementation of these guidelines and requirements.

II. Scope

This policy applies to all Metro employees ("users"), including permanent, temporary and part-time employees, as well as interns and contractor personnel, whose access to, or use of, Internet and e-mail services is funded by Metro, or is available through equipment owned or leased by Metro.

This policy is intended to be illustrative of the range of acceptable and unacceptable uses of Metro's Internet and e-mail facilities and is not necessarily exhaustive. Questions about specific activities not enumerated in this policy should be directed to the user's supervisor.

III. Objectives

This Policy is intended to achieve the following objectives:

· Facilitate Internet and e-mail usage for the benefit of Metro.
· Avoid disruptions to Metro's activities from unacceptable use of Metro-provided Internet and e-mail services.
· Minimize the risks and unnecessary costs from Internet and e-mail usage.
· Increase productivity.
· Educate employees that Internet and e-mail communications are subject to the same laws, rules and regulations as offline office communications.
· Comply with Nashville Metro Code, State and Federal laws.
· Define personal responsibilities regarding acceptable and unacceptable usage of the Internet and e-mail, including but not limited to:
· Confidentiality
· Harassment
· Privacy
· Pornography
· Vandalism
· Network security
· Copyright infringement
· Unauthorized not-for-profit activities
· Personal for-profit activities
· Private activities
· Political campaign activities
· To comply with T.C.A. § 10-7-512 that Metro shall adopt a written policy on monitoring of electronic mail communication.

IV. Background

The Internet and e-mail are efficient communication tools that can be used to accomplish Metro's functions and to conduct Metro's internal business, its activities with business partners, and with the public.

E-mail and Internet-generated electronic records that are created in the normal course of official business and retained as evidence of official policies, actions, decisions, or transactions may be public records subject to public inspection. These records are subject to records management requirements under Nashville Metro Code 2.140.

In the course of their work, system administrators or other authorized individuals may monitor users Internet and e- mail activities at any time without the user's permission or notification. Additionally, the content of these activities may be monitored during investigations of inappropriate use or non-compliance with this Policy (see Section IX. Enforcement, for detail).

As with any Metro-provided resource, the use of the Internet and e-mail should be limited to legitimate Metro business and is governed by rules of conduct similar to those applicable to the use of other resources. As with any Metro-provided resource, the use of the Internet and e-mail should be limited to legitimate Metro business and is governed by rules of conduct similar to those applicable to the use of other information technology resources.

A. Internet-specific background

The Internet is a network of computer networks that unifies educational institutions, government agencies, and various commercial and non-profit organizations. Once an exclusive domain of research and education groups, the Internet is now a shared information resource for individuals, businesses and governments.

The Internet can help Metro by facilitating communication, service provision and resource sharing, disseminate information, encourage collaborative projects, and build a broader infrastructure to support the performance of professional, work-related activities. The Internet can also be used to publish information required by law or executive order, as well as information of general interest to the public.

Users of the Internet should be aware of certain characteristics that distinguish the Internet from other means of communication, such as paper records, telephones, and information stored on electronic media such as diskettes.

· Downloading and storage. Information downloaded or stored by users on Metro's Internet system can be accessed by Metro even if password protected or encrypted. Use of passwords or encryption does not confer a special status on the Internet-generated files with respect to applicability of laws, policies, and practices.
· Internet browsing and establishing links are not private activities. Metro may employ screen-capture software or other technological means to monitor and record users Internet activities.
· Metro may block access to sites that are inappropriate for use on Metro's equipment such as sites that contain sexually harassing material.
· Content downloaded from the Internet, if allowed to accumulate on a server, can quickly consume the server's disk space and may cause system problems. Although deletion of unnecessary content downloaded from the Internet is encouraged, users should consult Metro's record retention guidelines for proper instruction regarding disposal or archival of Internet downloads.

Cookies. Cookies are small files that are downloaded to your computer when you browse certain web pages. Cookies hold information that can be retrieved by other web pages on the site. Some cookies are programmed with an expiration date so that they are automatically deleted after a period of time. Cookies may be turned off and deleted.

B. E-Mail-specific background

E-mail refers to the electronic transfer of information, typically in the form of electronic messages, memoranda, and attached documents from a sending party to one or more receiving parties, via an intermediate telecommunications system.

E-mail can help Metro improve the way it conducts business by providing a quick and cost-effective means to create, transmit, and respond to messages and documents electronically. Well-designed and properly managed e-mail systems expedite business communications, reduce paperwork, and automate routine office tasks, thereby increasing productivity and reducing costs.

As with the Internet, users of e-mail should be aware of certain characteristics that distinguish e-mail from other means of communication such as physical letters.

· The systems involved in the transmission and storage of e-mail messages may be "backed up" by systems administration on a routine basis. This process results in copying data, such as the content of an e-mail message, onto storage media that may be retained for periods of time and in locations unknown to the sender or recipient of a message.
· User's e-mail account password or encrypting code does not confer a special status on e-mail records with respect to applicability of laws, policies, and practices.
· All information transmitted via or stored on Metro's e-mail system can be reviewed by Metro.
· Inadvertent disclosure may occur when e-mail messages are forwarded to unauthorized users, directed to the wrong recipient, or printed in a common area where others can read them.
· Transmission of e-mail to locations outside of the Metro's local area network may require the use of the Internet for transport. Since the Internet and its tools adhere to open and documented standards and specifications, it is inherently an unsecured network that has no built-in security controls.
· E-mail communications, if allowed to accumulate on a server, can quickly consume the server's disk space and may cause system problems. Although deletion of unnecessary e-mail communications is encouraged, users should consult their supervisor for proper instruction regarding disposal or archival of e-mail correspondence.

V. Potential Risks

Although Internet and e-mail access can provide significant business benefit, it is important to point out that use of the Internet and e-mail exposes Metro and users to various risks. Even with the extensive effort that has been made by Metro to minimize those risks, there is no known way to ensure complete protection. The most significant potential problems associated with the Internet and e-mail use are:

Legal liability:

Expose Metro to legal liability due to harassment, vandalism, intellectual property rights violations and other unauthorized internet and e-mail activities.
Expose Metro to production of potentially damaging documents on record in the event of litigation.

Network insecurity:

Expose Metro network to computer viruses from the downloading and use of programs or files from Internet and e-mail sources. E-mail is the most frequently used method for transmitting computer viruses.

Expose Metro network to outside unauthorized surveillance, forgery, downloading or vandalism.

Expose confidential Metro records (including passwords, sensitive data or correspondence) to breaches of data security from unauthorized intrusion.

Work productivity reduction:

When users are induced by the vast social and informational forums of the Internet into spending significant work time on activities unrelated to Metro business.

When users engage in unauthorized non-profit or private for-profit activities.

When users engage in political campaign activities.

Network inefficiency:

When users consume limited disk storage on Metro's servers and on user PCs with unnecessary information that has been downloaded from the Internet or received via e-mail.

Thus, each authorized user must exercise prudence and caution in using these powerful information resources. The sections that follow define responsibilities for ensuring that Internet services and e-mail are used appropriately.

VI. Principles of Acceptable Use and User Responsibilities

This Policy is intended to be illustrative of the range of acceptable and unacceptable uses of the Metro's Internet and e-mail facilities and is not necessarily exhaustive. Supervisors or department heads may authorize the use of the Internet or e-mail relating to the official functions of Metro. All authorized employees are encouraged to use the Internet and e-mail as they would any other communication tool provided by Metro subject to the following conditions.

The use of the Internet and e-mail services should be dedicated to legitimate Metro business and is governed by internal policies as well as local, State, and Federal laws. Acceptable use must be responsible, legal and ethical. Users should demonstrate cost-effective consumption of shared resources and respect for intellectual property, ownership of information, system security mechanisms, and the individual's rights to privacy and freedom from intimidation, harassment, and unwarranted annoyance.

Each user has the following responsibilities:

· Each user will certify that he or she has read and fully understands the contents of this Policy by signing the attached agreement.
· Each user must comply with this "Internet and Electronic Mail Use Policy".
· Users must be aware of the classification of any information contained in data files or correspondence which they are transporting using the Internet and e-mail.
· Under no circumstances should data ever be transported that would place Metro in violation of any law.
· The content of anything exchanged (sent or received) via Internet or e-mail (regardless of its state of encryption) must be appropriate and consistent with Metro Policy, subject to the same restrictions as any other exchange.
· Users should use appropriate precautions when confidential information is contained in e-mail communications. These precautions should protect confidential and sensitive information where intentional, inappropriate, or accidental disclosure of the information might expose Metro or an individual to loss or harm.
· Users must take all reasonable precautions, including safeguarding and changing passwords, to prevent the use of their e-mail account by unauthorized individuals.
· Users must use Internet and e-mail in a manner that is consistent with their job function, even when the access is off-hours.
· Each user must be courteous and follow accepted standards of etiquette;

· Each user must respect system security mechanisms.

VII. Acceptable Usage

Acceptable Internet and e-mail activities are those that conform to the purpose, goals, and mission of Metro and to each user's job responsibilities. The following list, although not all-inclusive, provides some examples of acceptable usage:

· Communications, including information exchange and storage, directly relating to the mission, charter and work tasks of Metro.
· Communications, including information exchange and storage, for professional development or to maintain job knowledge or skills.
· Use in applying for or administering grants or contracts for Metro.
· Research for the benefit of Metro.
· Communications with Metro's business partners providing document delivery or transferring working documents or drafts for comment.
· Use for advisory standards, research, analysis, and professional society or development activities related to the user's responsibilities at Metro.
· Announcements of Metro procedures, policies, services, meetings, or activities.
· Incidental personal use of the Internet and e-mail to exchange or store personal information. This information will not be treated any differently than other information on the Metro network system.

VIII. Unacceptable Usage

Unacceptable use can be defined generally as activities that do not conform either to the purpose, goals, and mission of Metro, or to each user's job responsibilities. Any Internet and e-mail usage in which acceptable use is questionable should be avoided. When in doubt, seek Policy clarification from your supervisor prior to pursuing the activity.
The following list, although not all-inclusive, provides some examples of unacceptable usage:

· Private or personal for-profit activities. This includes use of Internet and e-mail services for private purposes, such as marketing or business transactions, private advertising of products or services, and any activity meant to foster personal gain.
· Unauthorized not-for-profit business activities. This includes the conduct of any non-Metro-related fund raising or public relations activities such as solicitation for religious and political causes.
· Use for, or in support of, prohibited activities as defined by Federal, State, and local laws or regulations. Illegal activities relating to Internet and e-mail access include, but are not limited to:
· Transmission of threatening, offensive or harassing information (messages or images) which contains defamatory, abusive, obscene, pornographic, profane, sexually oriented, threatening, racially offensive, or otherwise biased, discriminatory, or illegal material. Violating Federal and State laws dealing with copyrighted materials (including articles and software) or materials protected by a trade secret. Users may access copyrighted material, but its use must be strictly within the agreement as posted by the author or current copyright law. The Federal Copyright Act at 17 U.S.C. 101 et. seq. (1988), protects and prohibits misuse of all original works of authorship in any tangible medium of expression. This includes a prohibition on plagiarism.
· Transmission of incendiary statements that might incite violence or describe or promote the use of weapons or devices associated with terrorist activities.
· Intentionally seeking information about, obtaining copies of, or modifying contents of files, other data, or passwords belonging to other users, unless explicitly authorized to do so by those users.
· Violating the privacy of individual users by reading their e-mail communications unless specifically authorized to do so.
· Attempting to subvert network security, to impair functionality of the network, or to bypass restrictions set by the network administrators. Assisting others in violating these rules by sharing information or passwords is also unacceptable behavior.
· Deliberately interfering or disrupting another user's work or system. The users must not perform any activity that will cause the loss or corruption of data, the abnormal use of computing resources (degradation of network performance), or the introduction of computer worms or viruses by any means.
· Distributing "junk" mail or "spam", such as chain letters, advertisements, or unauthorized solicitations.
· Distributing Metro's data and information without authorization.

IX. Enforcement

Each department head or director is responsible for implementation and enforcement of this Policy, including but not limited to monitoring of Internet and e-mail use and application of appropriate corrective actions. The Information Systems Department retains e-mail communications for the sole purpose of back up for a specified period of time. The archival and retention of public records contained in e-mail communications is the responsibility of the individual departments and must be in accordance with State law and policy adopted by the Public Records Commission.

A. Monitoring

System administrators will not routinely monitor user Internet and e-mail activities, and will take reasonable precautions to protect user privacy. However, Metro may monitor user's Internet and e-mail activity for the reasons including but not limited to:

· Legitimate business purpose (e.g., the need to access information when a user is absent for an extended period of time or unavailable).
· Diagnosing and resolving technical problems involving system hardware, software, or communications.
· Conducting network maintenance.
· Investigating possible misuse of Internet and e-mail when a reasonable suspicion of abuse exists or in conjunction with an approved investigation.
· Gathering necessary information in the event of litigation.
· Investigating a possible crime or violation of this Policy.
· Disclosing any e-mail or Internet activity to law enforcement officials whenever legally required to do so.
· Testing performed by internal audit or Metro Information Systems as considered necessary to perform their duties.
· Users should be on notice that the maintenance and operations of Metro network may result in observation of random user activities.

X. Corrective Actions

Metro will review alleged violations of this Policy on a case-by-case basis. Clear and willful violations or abuse of acceptable usage will be subject to appropriate disciplinary actions, depending upon the severity of the transgression and policy abuse, up to and including termination. Criminal or civil action may be initiated in appropriate instances.

User's access to Internet and e-mail may be suspended, with or without notice, when deemed necessary for the operation or integrity of the Metro communications infrastructure, connected networks, or data.

XI. Written Agreement Required

Users having access to Metro-provided Internet or e-mail services are advised that all such network activity is the property of Metro. All users of Internet and e-mail services are required to acknowledge acceptance of, and intention to comply with, "Internet and Electronic Mail Use Policy" by signing a "Internet and Electronic Mail Use Agreement". The attached "Sample Internet and Electronic Mail Use Agreement" is provided as a model. Signed agreements will be maintained by each department.

XII. Waiver of Privilege Not Intended

Nothing contained within this policy is intended to waive any privileges provided by law.

The Metropolitan Government of Nashville and Davidson County

Internet and Electronic Mail Use Agreement

I hereby agree that I have read the attached document entitled " The Metropolitan Government of Nashville and Davidson County Internet and Electronic Mail Use Agreement", and certify that I am familiar with the contents of the document and agree to comply with its terms.
I also acknowledge my understanding that any infractions on my part may result in disciplinary action including, but not limited to, removal of e-mail services, removal of Internet services, suspension of access to computers and networks, suspension of employment, termination of employment, recommendation for prosecution.

User Name (Print): _____________________________________

User Signature: _____________________________________

Date: __________________

Internet and Electronic Mail Use Policy