Permitted Activities
The duties of Administrators can be divided into two areas.
The first duty of an Administrator is to ensure that networks, systems and services are available to users and that information is processed and transferred correctly, preserving its integrity. Here the Administrator is acting to protect the operation of the systems for which they are responsible. For example investigating a denial of service attack or a defaced web server is an operational activity.
Administrators may also play a part in monitoring compliance with policies which apply to the systems. For example the University may prohibit the sending or viewing of particular types of material; or may restrict access to certain external sites, or ban certain services from local systems or networks. The JANET Acceptable Use Policy prohibits certain uses of the network. In all of these cases the Administrator is acting in support of policies, rather than protecting the operation of the system.
The law differentiates between operational and policy actions, for example in section 3(3) of the Regulation of Investigatory Powers Act, so the Administrator should be clear, before undertaking any action, whether it is required as part of their operational or policy role. The two types of activity are dealt with separately in the following sections.
Operational activities
Where necessary to ensure the proper operation of networks or computer systems for which they are responsible, Administrators may:
- monitor and record traffic on those networks or display it in an appropriate form;
- examine any relevant files on those computers;
- rename any relevant files on those computers or change their access permissions (see Modification of Data)
- create relevant new files on those computers.
Where the content of a file or communication appears to have been deliberately protected by the owner, for example by encrypting it, the Administrator must not attempt to make the content readable without specific authorisation from Management or the owner of the file.
The Administrator must ensure that these activities do not result in the loss or destruction of information. If a change is made to user filestore then the affected user(s) must be informed of the change and the reason for it as soon as possible after the event.
Policy activities
Administrators must not act to monitor or enforce policy unless they are sure that all reasonable efforts have been made to inform users both that such monitoring will be carried out and the policies to which it will apply. If this has not been done through a general notice to all users then before a file is examined, or a network communication monitored, individual permission must be obtained from all the owner(s) of files or all the parties involved in a network communication.
Provided Administrators are satisfied that either a general notice has been given or specific permission granted, they may act as follows to support or enforce policy on computers and networks for which they are responsible:
- monitor and record traffic on those networks or display it in an appropriate form;
- examine any relevant files on those computers;
- rename any relevant files on those computers or change their access permissions or ownership (see Modification of Data);
- create relevant new files on those computers.
Where the content of a file or communication appears to have been deliberately protected by the owner, for example by encrypting it, the Administrator must not attempt to make the content readable without specific authorisation from Management or the owner of the file.
The Administrator must ensure that these activities do not result in the loss or destruction of information. If a change is made to user filestore then the affected user(s) must be informed of the change and the reason for it as soon as possible after the event.