Educause Security Discussion mailing list archives

Re: How do you handle students who attempt to exploit internal resources?


From: Russell Fulton <r.fulton () AUCKLAND AC NZ>
Date: Tue, 14 Nov 2006 08:37:52 +1300

First off you need clear policies in place so:

   1. you don't have to reinvent the wheel for each incident and
   2. everyone knows what the rules actually are and the consequences of
      breaking them

We have a bunch of policies which cover these situations:

   1. IT systems regulations, a short legal style document which derives
      its authority direct from a clause in our founding act of parliament.
   2. AUP which is much more 'user' orientated with examples and commentary.
   3. University Disciplinary Regulations, like 1/ formal and legal
      deriving authority direct from legislation.
   4. Misdemeanor Policy (I forget its proper name) which spells out how
      to deal with minor offenses.

So in circumstances like you describe the following would happen:

   1. We (security) would collect evidence and present it to the
      student's Dean or HOD if it were a grad student.
   2. for a first offense of this nature the student would be told that
      he has broken regulations and and given a general dressing down.
      He would also be told that any further breaches would lead to
      formal disciplinary proceedings.
   3. When he was found to have breached the AUP again the evidence
      would then be handed to the Dean with a recommendation that the
      case be referred to Disciplinary Committee.  At this point stuff
      is added to Academic record and lawyers probably get involved.
      There will be a formal hearing and we would give evidence and if
      the charges are found to be proven then  the committee can decide
      on penalty as listed in the AUP.
   4. Likely outcome would be withdrawal of all computer usage
      privileges for the rest of the semester.
   5. Third offense could result in permanent withdrawal of computer
      privileges or expulsion (again at committee's discretion).
   6. For members of staff, the process is similar but HR take the place
      of disciplinary committee.

Current thread: