IT Employment

Ask something
Discussion Locked

Information Policy Dilemma

0 helpful
4 replies

by oldefar

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My corporation has decided that they own all content found on their systems. They have directed IT to establish policy to control this content, insuring that it does not leave the company. The CIO asked my team to review his initial policy attempt.

Here is my dilemma. The policy seems unenforceable as written - a blanket statement that treats all data equal and makes its removal grounds for termination.

Example - included in this policy are the whitepapers downloaded off the Web from various sites. Copyright is held by these external sites, not our company. Distribution is allowed provided the papers include the source. Individuals can obtain this information external to our systems. Several engineers have organized this information into folders, and would like to make CD's for distribution to other engineers. The key advantage is the ease of retrieval because of the folders. The engineers brought their original set with them, and have simply added more current papers.
Similar issues exist with other public domain information that we use at our company.

How have others addressed this issue within their companies?

4 replies

by thechas

Well, if your management wishes to be Draconian about this, why not suggest a draconian response?

Remove all user FDDs and CD-RW drives.
Set up your e-mail server to strip attachments from outgoing mails.

I suspect that somewhere along the line, an aquatance of an upper manager got into trouble for improper use and distribution of material that his staff had downloaded.
So, the gut-level response is to make irrational blanket policy statements.

Hopefully, you can assist management increating a reasonable fair use policy.

Chas

by oldefar

The scenario is not real, but is in response to many postings where the default stand is that everything on corporate systems belongs to the corporation and cannot leave with employees.

My recommendation is always that business Objectives drive business Requirements drive Solutions (O-R-S). I believe this applies to policy as well as to technology.

Your response illustrates the issues around blanket security policies. I guess that laptops are out also unless their various networking capabilities are disabled or secured.

by lordinfidel

Technically they are correct to a certain point.

Any information placed on corporate systems becomes the property of the company.

Wait a minute, what about copyright laws? Isn't the company infringing on copyright laws by preventing the spread of documents that they did not create.

Since your company has mandated that all extrenal papers must include the source, they are not infringing on copyright laws. Once it is on their systems, they can control it's distribution. Regardless of whether the creators intent was to be freely distributable.

If your company decided to make those directories that were once freely accesible to everyone locked down so no one can access them They can.

The short and simple is "If it's on theirsystems, it's theirs"

But they can not say, "Hey x person downloaded this off of the web and we are going to put our name on it and claim it as our own". That is violating the law.

Since the information was freely downloaded from the net, it can be accessed via other means for personal use.

Is it a Draconian method. For a public, non-governmental company, yes. For a non-public, top-secret/governmental type of company. This is acceptable policy and pretty standard.

Their is a reasonable use guidline that would probably need to be addressed by your company.

I would probably create different storage areas for the different types of docs.

Like \whitepapers
\Corporate
\Public

by oldefar

This was posted based on the discussions in Tech Wanna-be and Soon-to-be-Terminated.

I would think that first step would be a classification of information to handle the key types. Perhaps a unclassified for data that is or may be public (eitherexternal, or internal like market sheets, company names and addresses). From there, it moves up based on impact to company business.

Along with this is a need for policy regarding what data may be introduced. For example, an email policy that restricts use to company business and user email contacts to those being emailed. This would eliminate the issue regarding exporting a personal list - no list would be personal.

Next is a guideline of how data is identified.

Next is a guidelineon access of data. In the service, there were two criteria. First was a level of clearance. Second was a need to know. Having the clearance only meant you could be authorized if you had the need. This also has to include who has authority to authorize others.

Finally the mechanics can get addressed. This is where IT plays a crucial role.

An effective approach will be mapped from business objectives down to how users and systems behave.

This discussion is closed to new replies.