Authorised and unauthorised use of ICT services, facilities and devices guideline

Final | December 2015 | v2.0.2 | PUBLIC | QGCIO

Introduction

Purpose

A Queensland Government Enterprise Architecture (QGEA) guideline provides information for Queensland Government departments on the recommended practices for a given topic area. Guidelines are for information only and departments are not required to comply. They are intended to help departments understand the appropriate approach to addressing a particular issue or doing a particular task.

The Use of ICT services, facilities and devices policy (IS38) provides the authority to a departments chief executive officer to authorise limited personal use of government-owned ICT services, facilities and devices by departmental employees. If limited personal use is allowed, departments must clearly define what use is considered authorised (official, professional and personal) and unauthorised and include comprehensive examples and the permitted levels of such use.

This guideline has been designed to:

• define the concepts of limited personal use and authorised and unauthorised use
• provide a range of examples for departmental consideration when they are determining and defining authorised and unauthorised use of ICT services, facilities and devices.

Audience

This document is primarily intended for:

• chief executive officers (CEOs)/other senior officers who authorise how departmental ICT services, facilities and devices may be used
• human resource professionals
• information management/ICT policy staff.

Scope

Out of scope

The following are out of scope:

• Examples of employee use of personal ICT services, facilities and devices for official purposes should be captured within departmental bring-your-own-device policies.
• Conducting government business on private email accounts or systems and messaging applications is covered by the Public Sector  Commissions Private Email Use Policy.
• Detailed implementation advice on official use of social media. This should be distinguished from limited personal use (including professional use) of social media via government-owned ICT services, facilities and devices. For detailed implementation advice on the official use of social media please refer to the QGEA Principles for the official use of social media networks and emerging social media.

Authorised and unauthorised use

When defining what use is authorised and unauthorised, departments need to carefully consider the core business of their departments and the roles and responsibilities of their employees. It is recommended that departments use the headings authorised use and unauthorised use in their policies and guidelines in order to decrease both ambiguity and legal risks. Departments need to ensure that use of government-owned ICT services, facilities and devices is closely linked to business but strikes a balance between official and limited personal use.

Departments should implement practices to ensure that employees are competent in the use of ICT services, facilities and devices. In addition, access to ICT services, facilities and devices should be consistent with departmental security requirements and practices.

The examples in the following section are indicative only and departments should consider their own business requirements and risks when providing examples of authorised and unauthorised use.

Authorised use

The following examples of authorised use of ICT services, facilities and devices have been broken down into the following primary categories:

• official
• professional
• personal
• other

Departments should convey to employees that government-owned ICT services, facilities and devices should be primarily used according to a business need to help carry out the work of the department and for employees to be well informed.

Official use

Examples of official use may include, but are not limited to:

• using ICT services, facilities and devices for work-related purposes
• using the internet to access work-related information
• sending emails to colleagues on work-related matters
• sending emails outside of the work environment on work-related matters
• any use of a departments or Queensland Governments social media account by an authorised employee to engage with the community for approved purposes (for more information see the QGEA Principles for the official use of social media networks and emerging social media.

Professional use

Departments may wish to make government-owned ICT services, facilities and devices available to staff for professional development provided that such use is approved by appropriate senior officers. Professional use may occur during work hours or in an officers own time. Approval is at the discretion of senior officers, provided such use does not interfere with the activities of the department or affects the productivity of other employees and complies at all times with relevant department policy regarding acceptable behaviour.

Examples of professional use may include, but are not limited to:

• using the internet (including social media) for professional development such as the Study and Research Assistance Scheme or other approved study, research or professional forums
• using computers, email and other ICT services, facilities and devices to support study
• supporting employees to engage with professional associations or discuss professional issues via forums
• networking with colleagues and peers provided that this does not breach confidentiality or privacy obligations (e.g. maintaining an up-to-date profile on LinkedIn).

Personal use

Limited personal use of government-owned ICT services, facilities and devices should be seen as a privilege and not as a right and is generally expected to:

• take place during the employee's non-work time (e.g. during an employees lunch break or after hours) and not be counted when accruing banked time or TOIL
• incur minimal additional expense to the Queensland Government
• be infrequent and brief, not delay official business and should be for non-commercial purposes
• not interfere with the operation of government and does not violate any state/ departmental policy or related state/federal legislation and regulation
• be able to survive public scrutiny and disclosure.

Departments should also ensure that employees and regulatory bodies would perceive any restrictions to be sufficiently justifiable.

Departments should ensure that employees understand that they are expected to continue to follow department principles, guidelines and codes of conduct.

Where limited personal use is permitted (for example internet banking) departments must ensure that employees are aware that the Queensland Government accepts no liability for any loss or damage suffered by the employee as a result of this personal use.

Examples of personal use may include, but are not limited to:

• completing job applications
• accessing Sensis White and Yellow Pages
• limited personal emails and internet searches that are not unauthorised, unlawful or criminal
• limited personal use of social media (e.g. Facebook) to contact family and friends
• limited personal use of telecommunications applications (e.g. Skype for Business) to chat with colleagues
• limited updating of personal blogs or micro-blogs (e.g. Twitter)
• keeping up-to-date with news and current events
• using a printer or photocopier to print a few pages of personal information
• making occasional brief local telephone calls (landline, mobile or internet (e.g. Skype))
• sending emails collecting for charities, school raffles and similar activities (this may be subject to approval on a case by case basis depending on departmental policy)
• making financial transactions including bill paying or home banking
• using a work supplied personal identifier (such as an email address or mobile number) to support personal account recovery or two factor authentication provided the use of the related service (e.g. web mail) would be within limited personal use policies and is not associated with or could lead to unauthorised use.

For further advice on the personal use of social media, refer to the Personal use of social media guideline.

Emerging issue: Use of work identifiers (e.g. email addresses)

The limited personal use of work supplied personal identifiers (e.g. email addresses) is no different to other government provided ICT services, facilities and devices. The same general principles apply. Where limited personal use of work identifiers is allowed, this use must be within limited personal use policies. That is, it should not be associated with services that are unauthorised or could lead to unauthorised use.

The section below includes specific examples of unauthorised use of work identifiers.

Because a wide variety of materials may be considered offensive by colleagues, clients or suppliers, individual departments should define what constitutes unauthorised use for their particular department and ensure policies reflect both the departments and employees legislative, ethical and policy obligations.

The examples within the table below should be considered unauthorised by all departments.