Acceptable Use Policy - Common Elements of AUP Statements

Common Elements of AUP Statements

In general, AUP statements/documents often begin with a statement of the philosophy of the sponsoring organisation and intended reason as to why Internet use is offered to the users of that organisation's network. For example, the sponsoring organisation adopts a philosophy of self-regulation and offers the user connection to the local network and also connection to the Internet providing that the user accepts the fact she/he is going to be personally responsible for actions taken when connected to the network or Internet. This may mean that the organisation is not going to provide any warning system should the user contravene policy, maintaining that it is up to the user to know when his/her actions are in violation of policy. Often Acceptable Use Policy documents provide a statement about the use of the network and/or Internet and its uses and advantages to the business, school or other organisation sponsoring connection to the Internet. Such a statement may outline the benefit of email systems, ability to gain information from websites, connection with other people through the use of instant messaging, and other similar benefits of various protocols including the relatively new VoIP services.

The most important part of an AUP document is the code of conduct governing the behaviour of a user whilst connected to the network/Internet. The code of conduct may include some description of what may be called netiquette which includes such items of conduct as using appropriate/polite language while online, avoiding illegal activities, ensuring that activities the user may embark on should not disturb or disrupt any other user on the system, and caution not to reveal personal information that could be the cause of identity theft.

Most AUP statements outline consequences of violating the policy. Such violations are met with consequences depending on the relationship of the user with the organisation. Common actions that schools and universities take is to withdraw the service to the violator and sometimes if the activities are illegal the organization may involve appropriate authorities, such as the local police. Employers will at times withdraw the service from employees, although a more common action is to terminate employment when violations may be hurting the employer in some way, or may compromise security. Earthlink, an American Internet service provider has a very clear policy relating to violations of its policy. The company identifies six levels of response to violations:

• issue warnings: written or verbal
• suspend the Member's newsgroup posting privileges
• suspend the Member's account
• terminate the Member's account
• bill the Member for administrative costs and/or reactivation charges
• bring legal action to enjoin violations and/or to collect damages, if any, caused by violations.

Central to most AUP documents is the section detailing unacceptable uses of the network, as displayed in the University of Chicago AUP. Unacceptable behaviours may include creation and transmission of offensive, obscene, or indecent document or images, creation and transmission of material which is designed to cause annoyance, inconvenience or anxiety, creation of defamatory material, creation and transmission that infringes copyright of another person, transmission of unsolicited commercial or advertising material and deliberate unauthorised access to other services accessible using the connection to the network/Internet. Then there is the type of activity that uses the network to waste time, as indicated in SurfControl's advice on writing AUPs, of technical staff to troubleshoot a problem for which the user is the cause, corrupting or destroying other user's data, violating the privacy of others online, using the network in such a way that it denies the service to others, continuing to use software or other system for which the user has already been warned about using, and any other misuse of the network such as introduction of viruses.

Disclaimers are often added in order to absolve an organisation from responsibility under specific circumstances. For example, in the case of Anglia Ruskin University a disclaimer is added absolving the University for errors or omissions or for any consequences arising from the use of information contained on the University website. While disclaimers may be added to any AUP, disclaimers are most often found on AUP documents relating to the use of a website while those offering a service fail to add such clauses. PsychologyUK, a magazine forum site, includes the type of disclaimer that can be used in an AUP for a website or online service of some type.

Particularly when an AUP is written for a college or school setting, AUPs remind students (or when in the case of a company, employees) that connection to the Internet, or use of a website, is a privilege, as demonstrated in the Loughborough University's Janet Service AUP and not a right. Through emphasising this "privilege" aspect, Northern Illinois University then make the connection that any abuse of that privilege can result in legal action from the University.

In a handbook for writing AUP documents, the Virginia Department of Education indicate that there are three other areas needing to be addressed in an AUP:

• a statement that the AUP is in compliance with state and national telecommunication rules and regulations
• a statement regarding the need to maintain personal safety and privacy while accessing the Internet
• a statement regarding the need to comply with Fair Use Laws and other copyright regulations while accessing the Internet

Through a cursory reading of AUP statements found by a Google Search the variation of the inclusion of these items in AUP documents is highly variable. However, those statements in a school or university setting are more likely to include a statement to address at least the "personal safety" issue.