An Acceptable Use Policy, acceptable usage policy or fair use policy, is a set of rules
applied by the owner or manager of a network, website, service, or large computer system
that restrict the ways in which the network, website or system may be used.
AUP documents are written for corporations, businesses, universities, schools, internet
service providers, and website owners, often to reduce the potential for legal action that
may be taken by a user, and often with little prospect of enforcement.
Acceptable use policies are an integral part of the framework of information security policies;
it is often common practice to ask new members of an organization to sign an AUP before they
are given access to its information systems.
For this reason, an AUP must be concise and clear, while at the same time covering the
most important points about what users are, and are not, allowed to do with the IT systems
of an organization.
It should refer users to the more comprehensive security policy where relevant.
It should also, and very notably, define what sanctions will be applied if a user breaks
the AUP.
Compliance with this policy should, as usual, be measured by regular audits.
In some cases a fair usage policy applied to a service allowing nominally unlimited
use for a fixed fee simply sets a cap on what may be used, intended to allow normal usage
but prevent what is considered excessive.
For example, users of an "unlimited" broadband Internet service may be subject to suspension,
termination, or bandwidth limiting for usage which is "continually excessive, unfair, affects
other users' enjoyment of the broadband service, or is not consistent with the usage typically
expected on a particular access package".
The policy is enforced directly, without legal proceedings.
Terminology AUP documents are similar to and often serve
the same function as the Terms of Service document, although not always.
In the case of IBM.com for instance, the Terms of Use are about the way in which IBM presents
the site, how they interact with visitors of the site and little to no instruction as
to how to use the site.
In some cases, AUP documents are named Internet and E-mail Policy, Internet AUP, Network AUP,
or Acceptable IT Use Policy.
These documents, even though named differently, largely provide policy statements as to what
behavior is acceptable from users of the local network/Internet connected via the local network.
Common elements of AUP statements In general, AUP statements/documents often
begin with a statement of the philosophy of the sponsoring organization and intended reason
as to why Internet use is offered to the users of that organization's network.
For example, the sponsoring organization adopts a philosophy of self-regulation and offers
the user connection to the local network and also connection to the Internet providing
that the user accepts the fact she/he is going to be personally responsible for actions taken
when connected to the network or Internet.
This may mean that the organization is not going to provide any warning system should
the user contravene policy, maintaining that it is up to the user to know when his/her
actions are in violation of policy.
Often Acceptable Use Policy documents provide a statement about the use of the network and/or
Internet and its uses and advantages to the business, school or other organisation sponsoring
connection to the Internet.
Such a statement may outline the benefit of email systems, ability to gain information
from websites, connection with other people through the use of instant messaging, and
other similar benefits of various protocols including the relatively new VoIP services.
The most important part of an AUP document is the code of conduct governing the behaviour
of a user whilst connected to the network/Internet.
The code of conduct may include some description of what may be called netiquette which includes
such items of conduct as using appropriate/polite language while online, avoiding illegal activities,
ensuring that activities the user may embark on should not disturb or disrupt any other
user on the system, and caution not to reveal personal information that could be the cause
of identity theft.
Most AUP statements outline consequences of violating the policy.
Such violations are met with consequences depending on the relationship of the user
with the organisation.
Common actions that schools and universities take is to withdraw the service to the violator
and sometimes if the activities are illegal the organization may involve appropriate authorities,
such as the local police.
Employers will at times withdraw the service from employees, although a more common action
is to terminate employment when violations may be hurting the employer in some way, or
may compromise security.
Earthlink, an American Internet service provider has a very clear policy relating to violations
of its policy.
The company identifies six levels of response to violations:
issue warnings: written or verbal suspend the Member's newsgroup posting privileges
suspend the Member's account terminate the Member's account
bill the Member for administrative costs and/or reactivation charges
bring legal action to enjoin violations and/or to collect damages, if any, caused by violations.
Central to most AUP documents is the section detailing unacceptable uses of the network,
as displayed in the University of Chicago AUP.
Unacceptable behaviours may include creation and transmission of offensive, obscene, or
indecent document or images, creation and transmission of material which is designed
to cause annoyance, inconvenience or anxiety, creation of defamatory material, creation
and transmission that infringes copyright of another person, transmission of unsolicited
commercial or advertising material and deliberate unauthorised access to other services accessible
using the connection to the network/Internet.
Then there is the type of activity that uses the network to waste time, as indicated in
SurfControl's advice on writing AUPs, of technical staff to troubleshoot a problem for which
the user is the cause, corrupting or destroying other user's data, violating the privacy of
others online, using the network in such a way that it denies the service to others,
continuing to use software or other system for which the user has already been warned
about using, and any other misuse of the network such as introduction of viruses.
Disclaimers are often added in order to absolve an organisation from responsibility under
specific circumstances.
For example, in the case of Anglia Ruskin University a disclaimer is added absolving
the University for errors or omissions or for any consequences arising from the use
of information contained on the University website.
While disclaimers may be added to any AUP, disclaimers are most often found on AUP documents
relating to the use of a website while those offering a service fail to add such clauses.
Particularly when an AUP is written for a college or school setting, AUPs remind students
that connection to the Internet, or use of a website, is a privilege, as demonstrated
in the Loughborough University's Janet Service AUP and not a right.
Through emphasising this "privilege" aspect, Northern Illinois University then make the
connection that any abuse of that privilege can result in legal action from the University.
In a handbook for writing AUP documents, the Virginia Department of Education indicate
that there are three other areas needing to be addressed in an AUP:
a statement that the AUP is in compliance with state and national telecommunication
rules and regulations a statement regarding the need to maintain
personal safety and privacy while accessing the Internet
a statement regarding the need to comply with Fair Use Laws and other copyright regulations
while accessing the Internet Through a cursory reading of AUP statements
found by a Google Search the variation of the inclusion of these items in AUP documents
is highly variable.
However, those statements in a school or university setting are more likely to include a statement
to address at least the "personal safety" issue.
Enforceability Example:
6.3 This Policy shall be governed by the laws of England and the parties submit to the exclusive
jurisdiction of the Courts of England and Wales.
Due to the many jurisdictions covered by the Internet, the AUP document needs to specify
the jurisdiction, which determines the laws that are applicable and govern the use of
an AUP.
Even if a company is only located in one jurisdiction and the AUP applies only to its employees,
naming the jurisdiction saves difficulties of interpretation should legal action be required
to enforce its statements.
AUP can be effectively enforced with Content an URL filters.
See also Terms of service
Lee v. PMSI, Inc., a U.S. District Court Case that found violating an acceptable use policy
did not violate the Computer Fraud and Abuse Act.
References
External links Critiquing Acceptable Use Policies by Dave
Kinnaman