Approved: CALEA Effective Date: October 28, 2013 CHAPTER 3 – GENERAL OPERATIONS Information Technology Use 342.1 PURPOSE AND SCOPE The purpose of this policy is to provide guidelines for the proper use of Deparrtment information technology resources, including computers, electronic devices, hardware, software and systems.. In addition to this policy, all employees shall be familiar with and adhere to the City’s Technology Use Policy. 342.1.1 DEFINITIONS Definitions related to this policy include: Computer System – All computers (on-site and portable), electronic devices, hardware, software, and resources owned, leased, rented, or licensed by the Burbank Police Department, which are provided for official use by Department employees. This shall include all access to, and use of, Internet Service Providers (ISP) or other service providers made available or funded by the Department or the City. Hardware – Includes, but is not limited to, computers, computer terminals, network equipment, electronic devices, telephones, including cellular and satellite, modems, or any other tangible computer device generally understood to comprise hardware. Software –Includes, but is not limited to, all computer programs and applications including "shareware." This does not include files created by the individual user. File (Temporary or Permanent) – Any electronic document, information, or data residing or located, in whole or in part, whether temporarily or permanently, on the system, including but not limited to spreadsheets, calendar entries, tasks, notes, letters, reports, messages, photographs or videos. 342.2 policy It is the policy of the Burbank Police Department that members shall use information technology resources, including computers, software and systems, that are issued or maintained by the Department in a professional manner and in accordance with this policy. 342.3 PRIVACY expectation Members forfeit any expectation of privacy with regard to emails, texts, or anything published, shared, transmitted, or maintained through file-sharing software or any internet site that is accessed, transmitted, received, or reviewed on any Department computer system. The Department reserves the right to access, audit, and disclose, for whatever reason, any message, including attachments, and any information accessed, transmitted, received, or reviewed over any technology that is issued or maintained by the Department including the Department email system, computer network, and/or any information placed into storage on any Department system or device. This includes records of all keystrokes or Web-browsing history made at any Department computer or over any Department network. The fact that access to a database, service, or website requires a username or password will not create an expectation of privacy if it is accessed through Department computers, electronic devices, or networks. The Department shall not require a member to disclose a personal username or password for accessing personal social media or to open a personal social website; however, the Department may request access when it is reasonably believed to be relevant to the investigation of allegations of work-related misconduct provided that the social media is used solely for purposes of that investigation or a related proceeding (Labor Code § 980). 342.4 restricted use Members shall not access computers, devices, software or systems for which they have not received prior authorization or the required training. Members shall immediately report unauthorized access or use of computers, devices, software or systems by another member to their supervisors or Watch Commander’s. Members shall not use another person’s access passwords, logon information and other individual security data, protocols and procedures unless directed to do so by a supervisor. 342.4.1 software Members shall not copy or duplicate any copyrighted or licensed software except for a single copy for backup purposes in accordance with the software company’s copyright and license agreement. To reduce the risk of a computer virus or malicious software, members shall not install any unlicensed or unauthorized software on any Department computer. Members shall not install personal copies of any software onto any Department computer. When related to criminal investigations, software program files may be downloaded only with the approval of the information systems technology (IT) staff and with the authorization of the Chief of Police or the authorized designee. No member shall knowingly make, acquire or use unauthorized copies of computer software that is not licensed to the Department while on Department premises, computer systems or electronic devices. Such unauthorized use of software exposes the Department and involved members to severe civil and criminal penalties. Introduction of software by members should only occur as part of the automated maintenance or update process of Department or City-approved or installed programs by the original manufacturer, producer or developer of the software. Any other introduction of software requires prior authorization from IT staff and a full scan for malicious attachments. 342,4,2 hardware Access to technology resources provided by or through the Department shall be strictly limited to Department-related activities. Data stored on or available through Department computer systems shall only be accessed by authorized members who are engaged in an active investigation or assisting in an active investigation, or who otherwise have a legitimate law enforcement or Department-related purpose to access such data. Any exceptions to this policy must be approved by a supervisor. 342.4.3 internet use Internet access provided by or through the Department shall be strictly limited to Department-related activities. Internet sites containing information that is not appropriate or applicable to Department use and which shall not be intentionally accessed include but are not limited to adult forums, pornography, gambling, chat rooms, and similar or related internet sites. Certain exceptions may be permitted with the express approval of a supervisor as a function of a member’s assignment. Downloaded information from the internet shall be limited to messages, mail, and data files. 342.4.4 off-duty use Members should only use technology resources provided by the Department while on-duty or in conjunction with specific on-call assignments unless specifically authorized by a supervisor. This includes the use of telephones, cell phones, texting, email or any other "off the clock" work-related activities. This also applies to personally owned devices that are used to access Department resources. Refer to the Personal Communication Devices Policy for guidelines regarding off-duty use of personally owned technology. 3425 PROTECTION OF DEPARTMENT SYSTEMS AND FILES All employees have a duty to protect Department computer systems and devices from physical and environmental damage and are responsible for the correct use, operation, care, and when applicable, maintenance of the system. Computers and terminals should be secured, users logged off and password protections enabled whenever the user is not present. Access passwords, logon information, and other individual security data, protocols, and procedures are confidential information and are not to be shared. Password length, format, structure, and content shall meet the prescribed standards required by the computer system or as directed by a supervisor and shall be changed at intervals as directed by IT staff or a supervisor. Passwords for accounts that access CJI are governed by the CJIS Access, Maintenance, and Security Policy. It is prohibited for a member to allow an unauthorized user to access the computer system at any time or for any reason. Members shall promptly report any unauthorized access to the computer system or suspected intrusion from outside sources (including the internet) to a supervisor. 342.6 SYSTEM INSPECTION OR REVIEW An employee's supervisor or authorized designee has the express authority to inspect or review the system, any and all temporary or permanent files and related electronic systems or devices, and any contents thereof when such inspection or review is in the ordinary course of supervisory duties, based on cause, or when conducting an audit. Reasons for inspection or review may include, but are not limited to system malfunctions, problems or general system failure, a lawsuit against the Department involving the employee or related to the employee's duties, an alleged or suspected violation of a Department policy, or a need to perform or provide a service when the employee is unavailable. When requested by an employee's supervisor, or during the course of regular duties requiring such information, authorized personnel may extract, download, or otherwise obtain any and all temporary or permanent files residing or located in or on the system. 342.7 AGENCY PROPERTY All information, data, documents, communications, and other electronic entries initiated on, sent to or from, or accessed on any Department computer, or through the Department computer system on any other computer, whether downloaded or transferred from the original Department computer, shall remain the exclusive property of the Department and shall not be available for personal or non-Departmental use without the expressed authorization of an employee's supervisor. 342.8 PASSWORDS All members shall maintain password configuration and security in compliance with Administrative Procedure III. Passwords to Department systems shall not be written on or stored in non-secure locations (for example, under the keyboard). Employees should periodically change their passwords. The Department may conduct password audits to verify access security. 342.9 EXTERNAL QUERIES Employees may make queries or entries into the external systems (JDIC, CLETS, NCIC, CWS) only for authorized law enforcement purposes and only in compliance with applicable policies and regulations governing their use.