Re: Role of Campus Police. Was: number of IT security staff

[John Lupton <lupton () ISC UPENN EDU>]

One of the things we stress most when talking to the campus community
about what we (Penn Info Security) do is the concept that "we are *not*
cops" - we view our function as much more along the lines of being
consultants and liasions than disciplinarians and wrist-slappers. And,
in most cases where it turns out some wrist-slapping is warranted,
there is usually an appropriate body (e.g., Office of Student Conduct)
to do the slapping. And, if it truly is criminal in nature, then it
ends up with the campus police. (Penn's force, BTW, is fairly large and
fully accredited, including a detective division).

Another thing we try to stress to the campus community when a troubling
incident or circumstance pops up and they ask us for advice and/or help
(email harassment is probably the most common example) is that if they
believe a crime has been committed or is about to be committed, or if
they feel the personal safety of themselves or any other person is in
jeopardy, they should contact the University police directly and
immediately. We are more than willing to assist the campus police in
any investigation they undertake, but we cannot, and should not,
undertake a criminal investigation independently. There are times when
the University's general counsel advises us to be careful about what
records we supply, and under what circumstances, whether or not a court
order is required for some things, etc., but for the most part, we have
a pretty good working relationship with the campus police. Up until a
year or so ago, one of the detectives was pretty well trained in IT
security issues, and liked working with us, but he left the force when
his wife got a good job somewhere else. On the whole, though, the
campus police don't hesitate to call us in if there is some sort of IT
skulduggery they have their hands in, and they seem to appreciate the
help.

Anyway, that's my story, and I'm sticking to it.

==============================================
John T. Lupton           Sr. Information Security Specialist
Information Systems & Computing/Information Security
University of Pennsylvania, Philadelphia PA USA
lupton () isc upenn edu       (215) 573-3811


On Jan 31, 2005, at 2:08 PM, Piscitello, Frank wrote:

> Well, I have a different view of Police Vs. IT staff.  I treat it
> similar to corporate security.  If the incident is "civil" in nature,
> then I handle it as an IT incident. If it seems that it is more
> criminal
> or the case turns into criminal, I contact law enforcement.  The campus
> police can handle some incidents (I usually help with suggestions).
> However, I also have contact with the State Police.  For example, if I
> am going over a hard-drive for campus policy violations, and I find a
> file full of credit card number, names, and birthdates.  This would
> lean
> me to a criminal issue, and I would forward all my information to Law
> Enforcement.  I use the same hardware/software to aquire hard drive
> evidence, so it makes it real easy to transfer the information.
> Remember, there are things that we can do as "civilians" for policy
> enforcement that police can't do without warrants and support from the
> local DA's office.  However, once the case is turned over to Law
> Enforcement, you become an agent for them so, you have to follow the
> same rules as law enforcement for the remainder of the case.
>
> So, word of advise:  Get to know your law enforcement.  Get names and
> contact information.  Talk to them on how they handle evidence, and
> where to draw the line at transferring the case to them.
>
> -Frank
>
> ------------------------------------------------------------------
> Frank J. Piscitello, Jr.
> Information Security Manager
> Office of Information Security
> West Chester University of PA
> http://www.wcupa.edu/infoservices/security/
>
> Security is everyone's responsibility.
>
> **********
> Participation and subscription information for this EDUCAUSE
> Discussion Group discussion list can be found at
> http://www.educause.edu/groups/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.