BRIEF

Policy Summary

To further the secure and acceptable use of Laboratory Information Technology (IT) at Berkeley Lab, this policy:

• Defines no expectation of privacy in use
• Establishes authority to monitor and consent to monitoring
• Establishes policies for Access without Consent

Who Should Read This Policy

• Employees and affiliates
• Other users of Laboratory IT, including collaborators and visitors

To Read the Full Policy, Go To:

The POLICY tab on this wiki page

Contact Information

Information Technology Policy Manager
Information Technology Division
[email protected]

POLICY

A. Purpose

To further the secure and acceptable use of Laboratory IT at Lawrence Berkeley National Laboratory (Berkeley Lab), this policy:

• Defines no expectation of privacy in use
• Establishes authority to monitor and consent to monitoring
• Establishes policies for Access without Consent

B. Persons Affected

This policy applies to employees and affiliates as well as casual users of Laboratory IT, including collaborators and visitors.

C. Exceptions

Not applicable

D. Policy Statement

1. Expectation of Privacy
   1. No Expectation of Privacy: Users have no expectation of privacy when they use Laboratory IT, subject to applicable state, federal, Department of Energy (DOE), and University laws and regulations.
2. Authority to Monitor
   1. Authority: System administrators have limited authority to monitor systems for availability and security; however, only the Chief Information Officer, Laboratory Director, or Deputy Chief Operating Officer may grant broad authority to monitor content and transactions on Laboratory IT for security purposes and acceptable use.
   2. Minimal Access: Employees engaged in monitoring must access the minimum amount of information necessary to accomplish any monitoring task and must treat information in a confidential manner as appropriate.
   3. Notice of Monitoring: This policy serves as Notice of Monitoring. Systems with external users must provide notice to these users. Acceptable ways of providing notice include but are not limited to requiring users to sign an agreement or linking to the LBNL Privacy and Security Notice.
   4. Exceptions: The monitoring or recording of telephone conversations is illegal without the consent of all parties.
3. Consent to Monitoring
   1. Consent: Use of Laboratory IT constitutes consent to monitoring. Any or all uses of Laboratory IT may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to authorized University, DOE, and law-enforcement personnel.
   2. Written Consent: Use of Laboratory IT serves as written consent to the requirements and policies of the LBNL Privacy and Security Notice for that system and all other DOE systems.
4. Access without Consent
   1. Background: Access without Consent is access to Laboratory IT that is normally available to a single user without that user's permission. This access occurs for either investigations or operational necessity and exceeds monitoring activities.
   2. Authorizations for Access without Consent
      1. Investigation of Wrongdoing: The Laboratory Chief Operating Officer or Laboratory Counsel must authorize access for purposes of investigation of wrongdoing.
      2. Legal Requests: Laboratory Counsel must authorize access for legal requests, including requests from law enforcement.
      3. Operational Access: Any Laboratory employee who needs operational access must first request consent from the individual; if the individual is unavailable, the division director or designee must authorize requests for operational access.
      4. Operational Changes: Any Laboratory employee who needs access for operational changes must first request consent from the individual; if the individual is unavailable, no authorization is required.
   3. Fair and Reasonable Access: Employees responsible for authorizing Access without Consent must ensure that requests for access are fair and reasonable, given the potential for abuse inherent in Access without Consent and despite no expectation of privacy in the use of Laboratory IT.
   4. Least Intrusive Means Possible: Methods of access for operational purposes must be limited to the least-intrusive means possible. For example, it is less intrusive to set a vacation message (an operational change) than to give access to e-mail (operational access).
   5. Minimal Involvement: To maximize confidentiality, the number of persons involved must be limited to only those required to initiate and conduct access.
   6. IT Authorized Access Lead (ITAAL): The IT Division must provide a point of contact to provide and/or coordinate the provision of access.

E. Roles and Responsibilities

Employees engaged in monitoring or Access without Consent must adhere to the provisions of this policy. This policy also emphasizes the following roles and responsibilities:

F. Definitions/Acronyms

G. Recordkeeping Requirements

None

H. Implementing Documents

I. Contact Information

Information Technology Policy Manager
Information Technology Division
[email protected]

J. Revision History

DOCUMENT INFORMATION

Source Requirements Documents

• DOE Office of Science Program Cyber Security Plan, June 2010
• DOE O 205.1B, Department of Energy Cyber Security Program, CRD Section 6
• DOE O 1450.4, Consensual Listening-In to or Recording Telephone/Radio Conversations
• Clause I.124 – DEAR 952.204–77 Computer Security (AUG 2006), as modified by Contract No. DE-AC02-05CH11231, Appendix P, Section 2

Implementing Documents